@aikdna/kdna-core 0.15.12 → 0.17.0

package/src/runtime-api.js

@@ -0,0 +1,91 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const v1 = require('./v1');
+
+function invalidDirectoryPlan(inputPath) {
+  const resolved = path.resolve(inputPath);
+  return {
+    kdna_version: null,
+    asset: { asset_id: null, asset_uid: null, title: null, version: null, judgment_version: null },
+    access: null,
+    access_alias: null,
+    entitlement_profile: null,
+    state: 'invalid',
+    required_action: 'block',
+    can_load_now: false,
+    projection_policy: 'none',
+    input_fingerprint: null,
+    checks: {
+      format_valid: false,
+      schema_valid: false,
+      payload_valid: false,
+      checksums_valid: false,
+      load_contract_valid: false,
+      overall_valid: false,
+    },
+    issues: [{
+      code: 'KDNA_ASSET_FILE_REQUIRED',
+      severity: 'blocking',
+      message: 'Runtime loading requires a packaged .kdna asset file. Source directories are authoring inputs only.',
+    }],
+    source: { kind: 'dir', path: resolved },
+  };
+}
+
+function isDirectory(inputPath) {
+  if (typeof inputPath !== 'string') return false;
+  try {
+    return fs.statSync(path.resolve(inputPath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function guardResolver(options = {}) {
+  if (typeof options.resolveAsset !== 'function') return options;
+  const resolveAsset = options.resolveAsset;
+  return {
+    ...options,
+    resolveAsset(name) {
+      const resolved = resolveAsset(name);
+      if (resolved?.path && isDirectory(resolved.path)) {
+        const error = new Error(
+          `Resolved asset "${name}" is a source directory. Runtime dependencies must be packaged .kdna files.`,
+        );
+        error.code = 'KDNA_ASSET_FILE_REQUIRED';
+        throw error;
+      }
+      return resolved;
+    },
+  };
+}
+
+function planLoad(inputPath, options = {}) {
+  if (isDirectory(inputPath)) return invalidDirectoryPlan(inputPath);
+  return v1.planLoad(inputPath, guardResolver(options));
+}
+
+function loadAuthorized(inputPath, options = {}) {
+  const plan = planLoad(inputPath, options);
+  if (plan.can_load_now !== true) {
+    const issueCodes = Array.isArray(plan.issues)
+      ? plan.issues.map((issue) => issue.code).filter(Boolean)
+      : [];
+    const error = new Error(
+      `LoadPlan denied loading: state=${plan.state || 'invalid'} required_action=${plan.required_action || 'block'}`,
+    );
+    error.code = issueCodes[0] || 'KDNA_LOAD_NOT_AUTHORIZED';
+    error.plan = plan;
+    throw error;
+  }
+  return v1.loadAuthorized(inputPath, guardResolver(options));
+}
+
+module.exports = {
+  planLoad,
+  loadAuthorized,
+  load: loadAuthorized,
+  loadAsset: loadAuthorized,
+};

package/src/types.d.ts

@@ -414,6 +414,165 @@ export function createLicensedDecryptEntry(options: {
   machineFingerprint: string;
 }): NonNullable<KdnaDecryptOptions['decryptEntry']>;
 
+export const EXTERNAL_ENVELOPE_PROFILE: 'kdna-envelope-external-grant-v1';
+export const EXTERNAL_GRANT_PROFILE: 'kdna-key-grant-v1';
+
+export class KDNAExternalGrantError extends Error {
+  code: string;
+}
+
+export interface KDNAExternalGrantEnvelope {
+  profile: 'kdna-envelope-external-grant-v1';
+  alg: 'A256GCM';
+  cek_derivation: 'HKDF-SHA256';
+  key_ref: string;
+  issuer_key_id: string;
+  entry_path: string;
+  plaintext_digest: string;
+  iv: string;
+  tag: string;
+  ciphertext: string;
+}
+
+export interface KDNAExternalKeyGrant {
+  profile: 'kdna-key-grant-v1';
+  grant_id: string;
+  issuer: string;
+  signing_key_id: string;
+  entitlement_id: string;
+  account_id: string;
+  device_id: string;
+  device_public_key: string;
+  device_signing_public_key: string;
+  asset: {
+    asset_id: string;
+    asset_uid: string;
+    version: string;
+    digest: string;
+    entry_path: string;
+    ciphertext_digest: string;
+    key_ref: string;
+    issuer_key_id: string;
+  };
+  issued_at: string;
+  refresh_after: string;
+  offline_grace_until: string;
+  expires_at: string;
+  status: 'active' | 'revoked' | 'expired';
+  status_version: number;
+  wrap: {
+    alg: 'X25519-HKDF-SHA256+A256KW';
+    ephemeral_public_key: string;
+    salt: string;
+    wrapped_cek: string;
+  };
+  signature: string;
+}
+
+export interface KDNADeviceKeyPairs {
+  agreement: { public_key: string; private_key: string };
+  signing: { public_key: string; private_key: string };
+}
+
+/** Runtime-branded by authorizeExternalKeyGrant; a structurally similar object is not accepted. */
+export interface KDNAVerifiedExternalEntitlement {
+  readonly status: 'active' | 'offline_grace';
+  readonly profile: 'kdna-key-grant-v1';
+  readonly grant_id: string;
+  readonly entitlement_id: string;
+  readonly account_id: string;
+  readonly device_id: string;
+  readonly refresh_after: string;
+  readonly offline_grace_until: string;
+  readonly expires_at: string;
+  readonly asset: {
+    readonly asset_id: string;
+    readonly asset_uid: string;
+    readonly version: string;
+    readonly digest: string;
+    readonly entry_path: string;
+    readonly ciphertext_digest: string;
+    readonly key_ref: string;
+    readonly issuer_key_id: string;
+  };
+}
+
+export interface KDNAExternalAuthorization {
+  entitlement: KDNAVerifiedExternalEntitlement;
+  decryptEntry: NonNullable<KdnaDecryptOptions['decryptEntry']>;
+  dispose(): void;
+}
+
+export function canonicalJson(value: unknown): string;
+export function grantSigningPayload(grant: Omit<KDNAExternalKeyGrant, 'signature'> | KDNAExternalKeyGrant): Uint8Array;
+export function validateExternalEnvelope(value: unknown): KDNAExternalGrantEnvelope;
+export function validateExternalKeyGrant(value: unknown): KDNAExternalKeyGrant;
+export function externalEnvelopeAad(options: {
+  manifest: KDNAManifest;
+  entryName: string;
+  plaintextDigest: string;
+  keyRef: string;
+  issuerKeyId: string;
+}): Uint8Array;
+export function deriveExternalAssetCek(options: {
+  issuerRootKey: string | Uint8Array;
+  manifest: KDNAManifest;
+  entryName: string;
+  plaintextDigest: string;
+  keyRef: string;
+  issuerKeyId: string;
+}): Uint8Array;
+export function encodeExternalEnvelope(value: KDNAExternalGrantEnvelope): Uint8Array;
+export function decodeExternalEnvelope(value: KDNAExternalGrantEnvelope | Uint8Array): KDNAExternalGrantEnvelope;
+export function encryptExternalGrantEntry(plaintext: string | Uint8Array, options: {
+  manifest: KDNAManifest;
+  entryName?: string;
+  issuerRootKey: string | Uint8Array;
+  keyRef: string;
+  issuerKeyId: string;
+  iv?: Uint8Array;
+}): KDNAExternalGrantEnvelope;
+export function generateDeviceKeyPairs(): KDNADeviceKeyPairs;
+export function createExternalKeyGrant(options: {
+  issuerRootKey: string | Uint8Array;
+  issuerSigningPrivateKey: unknown;
+  signingKeyId: string;
+  issuer: string;
+  entitlementId: string;
+  accountId: string;
+  deviceId: string;
+  devicePublicKey: string;
+  deviceSigningPublicKey: string;
+  manifest: KDNAManifest;
+  envelope: KDNAExternalGrantEnvelope | Uint8Array;
+  assetDigest: string;
+  status?: 'active' | 'revoked' | 'expired';
+  statusVersion?: number;
+  issuedAt?: Date | string;
+  refreshAfter?: Date | string;
+  offlineGraceUntil?: Date | string;
+  expiresAt?: Date | string;
+  grantId?: string;
+  ephemeralKeyPair?: unknown;
+  wrapSalt?: Uint8Array;
+}): KDNAExternalKeyGrant;
+export function authorizeExternalKeyGrant(options: {
+  grant: KDNAExternalKeyGrant;
+  issuerPublicKeys: Map<string, unknown> | Record<string, unknown>;
+  manifest: KDNAManifest;
+  checksums: KDNAChecksums;
+  envelope: KDNAExternalGrantEnvelope | Uint8Array;
+  deviceAgreementKey: KDNADeviceKeyPairs['agreement'] | unknown;
+  expectedAccountId: string;
+  expectedDeviceId: string;
+  expectedDeviceSigningPublicKey: string;
+  minimumStatusVersion?: number;
+  now?: Date | string;
+  networkAvailable?: boolean;
+  allowOffline?: boolean;
+}): KDNAExternalAuthorization;
+export function isVerifiedExternalEntitlement(value: unknown): value is KDNAVerifiedExternalEntitlement;
+
 // Stable public API — preferred entry points for third-party integrations.
 export type KDNAAssetInput = string | Uint8Array | KdnaAsset;
 
@@ -482,7 +641,7 @@ export function matchDomain(input: string, candidates: Array<KDNAAssetInput | KD
 export function matchDomainSync(input: string, candidates: Array<KDNAAssetInput | KDNAInspectResult>, options?: KdnaDecryptOptions): KDNAMatchResult[];
 export function composeKDNA(inputs: KDNAAssetInput[], options?: { input?: string; profile?: 'compact' | 'scenario' | 'full' | string; separator?: string } & KdnaDecryptOptions): Promise<KDNAComposeResult>;
 
-// KDNA Core — source directory / container API
+// KDNA Core — authoring source and packaged runtime API
 export const MIMETYPE: string;
 export const REQUIRED_DIR_ENTRIES: string[];
 
@@ -553,7 +712,7 @@ export interface KDNALoadPlan {
     path: string;
   };
 }
-export function planLoad(inputPath: string, options?: { password?: string; hasPassword?: boolean; entitlement?: Record<string, any> }): KDNALoadPlan;
+export function planLoad(inputPath: string, options?: { password?: string; hasPassword?: boolean; entitlement?: KDNAVerifiedExternalEntitlement | Record<string, any> }): KDNALoadPlan;
 export function buildChecksums(sourceDir: string): KDNAChecksums;
 export function pack(sourceDir: string, outputPath: string): void;
 export function unpack(inputPath: string, outputDir: string): void;

package/src/v1/index.js

@@ -1,17 +1,15 @@
 /**
- * v1-cli.js — KDNA Core v1 inspect / validate / pack / unpack for the
- * kdna monorepo CLI shim.
+ * KDNA Asset Container inspect / validate / pack / unpack implementation.
  *
  * KDNA Core is the official KDNA judgment-asset format and runtime
  * loading contract. .kdna assets are created, inspected, packed,
  * unpacked, and validated through the official KDNA toolchain. This
- * module is the v1 component of that toolchain.
  *
- * The KDNA Core v1 file format is documented in docs/core/file-format.md.
+ * The KDNA Asset Container is documented in docs/core/file-format.md.
  * This module is the shared implementation that:
  *
- *   - packages/kdna/bin/kdna.js uses as a v1-aware router
- *   - scripts/v1-*.mjs delegate to (via child_process) so the legacy
+ *   - packages/kdna/bin/kdna.js uses as its container router
+ *   - compatibility scripts delegate to it so historical tooling
  *     scripts and the official CLI cannot drift
  *
  * Hard rules from the format spec:
@@ -39,6 +37,11 @@ const path = require('node:path');
 const zlib = require('node:zlib');
 const crypto = require('node:crypto');
 const cbor = require('cbor-x');
+const {
+  EXTERNAL_ENVELOPE_PROFILE,
+  validateExternalEnvelope,
+  isVerifiedExternalEntitlement,
+} = require('../external-key-grant');
 
 const { readAsset } = (() => {
   try {
@@ -178,7 +181,7 @@ function loadSchemas() {
 // ─── Format detection ──────────────────────────────────────────────────
 
 /**
- * Detect whether a directory is a v1 source layout.
+ * Detect whether a directory is a KDNA authoring source layout.
  * Required entries: mimetype, kdna.json, payload.kdnab.
  * mimetype content must equal "application/vnd.kdna.asset".
  */
@@ -536,10 +539,10 @@ function readV1Layout(absPath) {
     for (const f of V1_REQUIRED_DIR_ENTRIES) {
       const full = path.join(absPath, f);
       if (!fs.existsSync(full)) {
-        throw new Error(`not a KDNA v1 source dir: missing ${f}`);
+        throw new Error(`not a KDNA authoring source directory: missing ${f}`);
       }
       if (fs.lstatSync(full).isSymbolicLink()) {
-        throw new Error(`not a KDNA v1 source dir: ${f} must not be a symlink`);
+        throw new Error(`not a KDNA authoring source directory: ${f} must not be a symlink`);
       }
     }
     for (const f of [...V1_REQUIRED_DIR_ENTRIES, ...V1_OPTIONAL_DIR_ENTRIES]) {
@@ -557,10 +560,10 @@ function readV1Layout(absPath) {
     kind = 'file';
     entries = listZipEntries(absPath);
     if (entries.length === 0 || entries[0].name !== 'mimetype') {
-      throw new Error('not a KDNA v1 container: first entry is not mimetype');
+      throw new Error('not a KDNA Asset Container: first entry is not mimetype');
     }
     if (entries[0].method !== 0) {
-      throw new Error('not a KDNA v1 container: mimetype must be uncompressed');
+      throw new Error('not a KDNA Asset Container: mimetype must be uncompressed');
     }
     for (const e of entries) {
       // We only need the well-known entries; signatures/ attachments/ etc.
@@ -576,7 +579,7 @@ function readV1Layout(absPath) {
     }
     for (const f of V1_REQUIRED_DIR_ENTRIES) {
       if (!map[f]) {
-        throw new Error(`not a KDNA v1 container: missing ${f}`);
+        throw new Error(`not a KDNA Asset Container: missing ${f}`);
       }
     }
   } else {
@@ -725,7 +728,7 @@ function runValidate(v1) {
   if (!validators) {
     result.schema_valid = false;
     problems.push(
-      'schema: ajv not available. KDNA Core v1 requires ajv and ajv-formats for JSON-Schema validation. Run: npm install ajv ajv-formats (or: npm install -g ajv ajv-formats for global CLI users)',
+      'schema: KDNA Core requires ajv and ajv-formats for JSON-Schema validation. Run: npm install ajv ajv-formats (or: npm install -g ajv ajv-formats for global CLI users)',
     );
     return finalizeValidate(result, problems);
   }
@@ -758,7 +761,16 @@ function runValidate(v1) {
       result.payload_valid = false;
       problems.push(`payload: encrypted envelope profile ${payload.profile || 'unknown'} does not match manifest encryption profile ${encProfile}`);
     }
-    const hasKeyMaterial = !!payload.wrapped_key || (Array.isArray(payload.key_slots) && payload.key_slots.length > 0);
+    let hasKeyMaterial = !!payload.wrapped_key || (Array.isArray(payload.key_slots) && payload.key_slots.length > 0);
+    if (payload.profile === EXTERNAL_ENVELOPE_PROFILE) {
+      try {
+        validateExternalEnvelope(payload);
+        hasKeyMaterial = true;
+      } catch (error) {
+        result.payload_valid = false;
+        problems.push(`payload: ${error.message}`);
+      }
+    }
     if (!payload.profile || !payload.ciphertext || !hasKeyMaterial) {
       result.payload_valid = false;
       problems.push('payload: encrypted envelope missing required fields (profile/ciphertext/key material)');
@@ -919,7 +931,7 @@ function buildChecksumsV1(sourceDir) {
 // ─── pack ──────────────────────────────────────────────────────────────
 
 /**
- * Pack a v1 source directory into a .kdna container. Output is
+ * Pack an authoring source directory into a .kdna asset. Output is
  * deterministic: the same source directory packed twice produces
  * byte-identical output (fixed DOS timestamps, fixed entry order,
  * mimetype first).
@@ -1017,7 +1029,7 @@ function unpack(inputPath, outputDir) {
     throw new Error(`not a file: ${absIn}`);
   }
   const entries = listZipEntries(absIn);
-  // Sanity: v1 container must have mimetype as first entry with the v1 media type.
+  // Sanity: the asset must have mimetype as its first, uncompressed entry.
   if (entries.length === 0 || entries[0].name !== 'mimetype') {
     throw new Error('not a KDNA container: first entry is not mimetype');
   }
@@ -1101,12 +1113,11 @@ function finalizeLoadPlan(plan) {
   return plan;
 }
 
-function computeSourceFingerprint(inputPath, v1) {
-  const absPath = path.resolve(inputPath);
-  if (v1.kind === 'file') {
-    return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(absPath)).digest('hex')}`;
-  }
-
+function computeSourceFingerprint(_inputPath, v1) {
+  // Fingerprint the logical entries, not the transport ZIP bytes. DEFLATE
+  // output can differ between zlib versions and operating systems even when
+  // every uncompressed KDNA entry is identical. LoadPlan conformance must be
+  // stable across JS, Swift, CI runners, and repackaging transports.
   const hash = crypto.createHash('sha256');
   for (const name of Object.keys(v1.map).sort()) {
     const bytes = v1.map[name];
@@ -1211,14 +1222,15 @@ function canonicalToV1Layout(asset) {
 }
 
 /**
- * Plan a KDNA v1 runtime load without decrypting or emitting judgment content.
+ * Plan a KDNA runtime load without decrypting or emitting judgment content.
  * Product consumers such as Chat should render authorization UI from this
  * result instead of parsing manifest fields directly.
  */
 function planLoad(inputPath, opts = {}) {
   let v1;
 
-  // Try the unified container dispatcher first (handles v1 dirs, v1 containers, v2 containers)
+  // Try the unified container dispatcher first; the internal compatibility
+  // reader below remains available only for authoring and migration tooling.
   if (readAsset !== null) {
     try {
       const asset = readAsset(path.resolve(inputPath));
@@ -1278,6 +1290,36 @@ function planLoad(inputPath, opts = {}) {
 
   const manifest = v1.manifest;
 
+  function externalEntitlementMatchesCurrentAsset(entitlement) {
+    if (!isVerifiedExternalEntitlement(entitlement) || !entitlement.asset) return false;
+    let checksums;
+    try {
+      checksums = v1.map['checksums.json']
+        ? parseJsonEntry('checksums.json', v1.map['checksums.json'])
+        : null;
+    } catch {
+      return false;
+    }
+    return entitlement.asset.asset_id === (manifest.asset_id || manifest.name)
+      && entitlement.asset.asset_uid === manifest.asset_uid
+      && entitlement.asset.version === manifest.version
+      && entitlement.asset.digest === checksums?.asset_digest
+      && entitlement.asset.entry_path === manifest.payload?.path;
+  }
+
+  function rejectExternalEntitlementMismatch() {
+    plan.state = 'invalid';
+    plan.required_action = 'block';
+    plan.can_load_now = false;
+    plan.projection_policy = 'none';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_GRANT_ASSET_MISMATCH',
+      'blocking',
+      'The verified account/device grant is bound to a different asset, version, digest, or encrypted entry.',
+    ));
+    return finalizeLoadPlan(plan);
+  }
+
   // Resolve dependencies if declared (Story 6)
   const resolvedDeps = [];
   if (manifest.dependencies && typeof manifest.dependencies === 'object' && Object.keys(manifest.dependencies).length > 0) {
@@ -1449,6 +1491,23 @@ function planLoad(inputPath, opts = {}) {
     }
 
     if (plan.entitlement_profile === 'account') {
+      if (isVerifiedExternalEntitlement(opts.entitlement)) {
+        if (!externalEntitlementMatchesCurrentAsset(opts.entitlement)) {
+          return rejectExternalEntitlementMismatch();
+        }
+        plan.state = opts.entitlement.status === 'offline_grace' ? 'offline_grace' : 'ready';
+        plan.required_action = opts.entitlement.status === 'offline_grace' ? 'sync' : 'load';
+        plan.can_load_now = true;
+        plan.projection_policy = 'minimal';
+        if (opts.entitlement.status === 'offline_grace') {
+          plan.issues.push(buildLoadPlanIssue(
+            'KDNA_AUTH_OFFLINE_GRACE_ACTIVE',
+            'warning',
+            'The verified device grant can load offline but must sync before grace expires.',
+          ));
+        }
+        return finalizeLoadPlan(plan);
+      }
       plan.state = 'needs_account';
       plan.required_action = 'sign_in_or_activate';
       plan.can_load_now = false;
@@ -1462,6 +1521,16 @@ function planLoad(inputPath, opts = {}) {
     }
 
     if (plan.entitlement_profile === 'org') {
+      if (isVerifiedExternalEntitlement(opts.entitlement)) {
+        if (!externalEntitlementMatchesCurrentAsset(opts.entitlement)) {
+          return rejectExternalEntitlementMismatch();
+        }
+        plan.state = opts.entitlement.status === 'offline_grace' ? 'offline_grace' : 'ready';
+        plan.required_action = opts.entitlement.status === 'offline_grace' ? 'sync' : 'load';
+        plan.can_load_now = true;
+        plan.projection_policy = 'minimal';
+        return finalizeLoadPlan(plan);
+      }
       plan.state = 'needs_org_auth';
       plan.required_action = 'sign_in_or_activate';
       plan.can_load_now = false;
@@ -1797,6 +1866,34 @@ function normalizeCompactAxiom(axiom) {
   };
 }
 
+function judgmentRoleExclusions(role) {
+  if (!role || typeof role !== 'object' || Array.isArray(role)) return [];
+  if (Array.isArray(role.does_not_act_as)) return role.does_not_act_as;
+  return role.does_not_act_as ? [role.does_not_act_as] : [];
+}
+
+function hasStandardJudgmentRoleContent(role) {
+  if (!role || typeof role !== 'object' || Array.isArray(role)) return false;
+  return Boolean(
+    role.acts_as || judgmentRoleExclusions(role).length || role.responsibility,
+  );
+}
+
+function hasCompactPromptContent(content) {
+  if (!content) return false;
+  return Boolean(
+    content.highest_question ||
+      (Array.isArray(content.worldview) && content.worldview.length > 0) ||
+      (Array.isArray(content.value_order) && content.value_order.length > 0) ||
+      hasStandardJudgmentRoleContent(content.judgment_role) ||
+      (Array.isArray(content.axioms) && content.axioms.length > 0) ||
+      (Array.isArray(content.boundaries) && content.boundaries.length > 0) ||
+      (Array.isArray(content.self_checks) && content.self_checks.length > 0) ||
+      (Array.isArray(content.failure_modes) && content.failure_modes.length > 0) ||
+      (Array.isArray(content.patterns) && content.patterns.length > 0)
+  );
+}
+
 function loadV1Unsafe(inputPath, opts = {}) {
   const v1 = readV1Layout(path.resolve(inputPath));
   const m = v1.manifest;
@@ -1828,7 +1925,7 @@ function loadV1Unsafe(inputPath, opts = {}) {
         payload = parsePayloadEntry('payload.kdnab', decryptedBuf);
       } catch (e) {
         const err = new Error(`Decryption failed: ${e.message}`);
-        err.code = 'KDNA_DECRYPT_FAILED';
+        err.code = e.code || 'KDNA_DECRYPT_FAILED';
         throw err;
       }
     } else if (opts.password) {
@@ -1859,8 +1956,13 @@ function loadV1Unsafe(inputPath, opts = {}) {
         throw err;
       }
     } else {
-      const err = new Error('payload is encrypted and cannot be decrypted without a password or license key');
-      err.code = 'KDNA_AUTH_PASSWORD_REQUIRED';
+      const isExternal = payload.profile === EXTERNAL_ENVELOPE_PROFILE;
+      const err = new Error(
+        isExternal
+          ? 'payload requires a verified account/device external key grant'
+          : 'payload is encrypted and cannot be decrypted without an authorized credential',
+      );
+      err.code = isExternal ? 'KDNA_AUTH_ACCOUNT_REQUIRED' : 'KDNA_AUTH_PASSWORD_REQUIRED';
       throw err;
     }
   }
@@ -1890,8 +1992,12 @@ function loadV1Unsafe(inputPath, opts = {}) {
     const core = payload.core || {};
     const hasJudgment = (core.axioms && core.axioms.length > 0)
       || (core.boundaries && core.boundaries.length > 0)
+      || Boolean(core.highest_question)
+      || (Array.isArray(core.worldview) && core.worldview.length > 0)
+      || (Array.isArray(core.value_order) && core.value_order.length > 0)
+      || hasStandardJudgmentRoleContent(core.judgment_role)
       || (payload.patterns && payload.patterns.length > 0)
-      || (payload.reasoning && ((payload.reasoning.self_checks && payload.reasoning.self_checks.length > 0) || (payload.reasoning.failure_modes && payload.reasoning.failure_modes.length > 0)));
+      || (payload.reasoning && ((payload.reasoning.self_check && payload.reasoning.self_check.length > 0) || (payload.reasoning.failure_modes && payload.reasoning.failure_modes.length > 0)));
     profiles.push('index');
     if (hasJudgment) profiles.push('compact');
     if (payload.scenarios && payload.scenarios.length > 0) profiles.push('scenario');
@@ -1924,9 +2030,24 @@ function loadV1Unsafe(inputPath, opts = {}) {
     }).filter(Boolean);
     result.content = {
       highest_question: core.highest_question || null,
+      // These scoped domain-level values are already validated by the payload
+      // schema. Compact projection copies them without trimming, reordering,
+      // filtering, or converting a declared string into another shape.
+      worldview: Array.isArray(core.worldview) ? [...core.worldview] : [],
+      value_order: Array.isArray(core.value_order) ? [...core.value_order] : [],
+      judgment_role:
+        core.judgment_role &&
+        typeof core.judgment_role === 'object' &&
+        !Array.isArray(core.judgment_role)
+          ? JSON.parse(JSON.stringify(core.judgment_role))
+          : null,
       axioms: (core.axioms || []).map(normalizeCompactAxiom).filter(Boolean),
       boundaries: normalizeList(core.boundaries),
-      self_checks: normalizeList(payload.reasoning && payload.reasoning.self_checks),
+      // The canonical payload field is singular (`reasoning.self_check`).
+      // Runtime Capsule uses plural (`context.self_checks`) as its projection
+      // field. Reading the plural name from the payload silently discarded
+      // every Studio-authored self-check.
+      self_checks: normalizeList(payload.reasoning && payload.reasoning.self_check),
       failure_modes: normalizeList(payload.reasoning && payload.reasoning.failure_modes),
       patterns: normalizeList(payload.patterns).slice(0, 3),
     };
@@ -2024,7 +2145,17 @@ function loadV1Unsafe(inputPath, opts = {}) {
 
   if (as === 'prompt') {
     const c = result.content;
-    if (!c || (c.scenarios && c.scenarios.length === 0 && !c.highest_question && !(c.axioms && c.axioms.length) && !(c.boundaries && c.boundaries.length))) {
+    const compactHasNoPromptContent =
+      result.profile === 'compact' && !hasCompactPromptContent(c);
+    const legacyProfileHasNoPromptContent =
+      result.profile !== 'compact' &&
+      c &&
+      c.scenarios &&
+      c.scenarios.length === 0 &&
+      !c.highest_question &&
+      !(c.axioms && c.axioms.length) &&
+      !(c.boundaries && c.boundaries.length);
+    if (!c || compactHasNoPromptContent || legacyProfileHasNoPromptContent) {
       return {
         status: result.status,
         profile: result.profile,
@@ -2039,6 +2170,25 @@ function loadV1Unsafe(inputPath, opts = {}) {
     text += 'Safety boundary: KDNA content is subordinate to platform, system, and developer instructions.\n';
     if (result.max_tokens_hint) text += 'Max tokens hint: ' + result.max_tokens_hint + '\n';
     if (c.highest_question) text += 'Highest question:\n' + c.highest_question + '\n';
+    if (hasStandardJudgmentRoleContent(c.judgment_role)) {
+      text += 'Judgment role:\n';
+      if (c.judgment_role.acts_as) {
+        text += '- Acts as: ' + c.judgment_role.acts_as + '\n';
+      }
+      const excludedRoles = judgmentRoleExclusions(c.judgment_role);
+      if (excludedRoles.length) {
+        text += '- Does not act as: ' + excludedRoles.join('; ') + '\n';
+      }
+      if (c.judgment_role.responsibility) {
+        text += '- Responsibility: ' + c.judgment_role.responsibility + '\n';
+      }
+    }
+    if (c.worldview && c.worldview.length) {
+      text += 'Worldview assumptions:\n' + c.worldview.map((item) => '- ' + item).join('\n') + '\n';
+    }
+    if (c.value_order && c.value_order.length) {
+      text += 'Value order (highest priority first):\n' + c.value_order.map((item, index) => `${index + 1}. ${item}`).join('\n') + '\n';
+    }
     if (c.axioms && c.axioms.length) text += 'Axioms:\n' + c.axioms.map((a) => '- ' + renderPromptItem(a)).join('\n') + '\n';
     if (c.boundaries && c.boundaries.length) text += 'Boundaries:\n' + c.boundaries.map((b) => '- ' + renderPromptItem(b)).join('\n') + '\n';
     if (c.self_checks && c.self_checks.length) text += 'Self-checks:\n' + c.self_checks.map((s) => '- ' + renderPromptItem(s)).join('\n') + '\n';