@aikdna/kdna-core 0.17.0 → 0.19.0

package/src/{v1 → container}/index.js

@@ -20,7 +20,10 @@
  *   - the source directory must contain mimetype, kdna.json, payload.kdnab
  *   - checksums.json and signatures/ are optional
  *   - lineage must be a single object (not an array)
- *   - pack output must be deterministic: same input → same SHA-256
+ *   - pack output is reproducible within one pinned toolchain/compressor;
+ *     DEFLATE bytes may differ across compressors, zlib versions, or systems
+ *   - entry_set_digest/source_fingerprint identify logical entries; A binds
+ *     the exact immutable package bytes
  *
  * Output language must stay content-neutral. We never say "trusted",
  * "recommended", "high_quality", or "officially_approved". We say
@@ -37,6 +40,11 @@ const path = require('node:path');
 const zlib = require('node:zlib');
 const crypto = require('node:crypto');
 const cbor = require('cbor-x');
+const {
+  KDNA_LOADER_VERSION,
+  assessLoaderCompatibility,
+  loaderVersionUnsupportedMessage,
+} = require('../loader-compatibility');
 const {
   EXTERNAL_ENVELOPE_PROFILE,
   validateExternalEnvelope,
@@ -67,12 +75,6 @@ const FORBIDDEN_LEGACY_TOP_LEVEL = new Set([
   'KDNA_Evolution.json',
 ]);
 
-// Legacy aliases — prefer the unversioned names above
-const V1_REQUIRED_DIR_ENTRIES = REQUIRED_DIR_ENTRIES;
-const V1_OPTIONAL_DIR_ENTRIES = OPTIONAL_DIR_ENTRIES;
-const V1_ALLOWED_TOP_LEVEL_ENTRIES = ALLOWED_TOP_LEVEL_ENTRIES;
-const V1_FORBIDDEN_LEGACY_TOP_LEVEL = FORBIDDEN_LEGACY_TOP_LEVEL;
-
 const DEFAULT_CONTAINER_LIMITS = Object.freeze({
   maxContainerBytes: 25 * 1024 * 1024,
   maxEntries: 128,
@@ -84,7 +86,7 @@ const DEFAULT_CONTAINER_LIMITS = Object.freeze({
   maxJsonStringLength: 1024 * 1024,
 });
 
-// Words that must never appear in v1 CLI output as positive claims.
+// Words that must never appear in layout CLI output as positive claims.
 // Schema-valid, signature-valid, compatible — those are fine.
 // "trusted", "recommended", "high_quality", "officially_approved" — never.
 const FORBIDDEN_OUTPUT_TERMS = Object.freeze([
@@ -103,8 +105,8 @@ let _validators = null;
 function loadPackagedSchemas() {
   return {
     manifestSchema: require('../../schema/manifest.schema.json'),
-    payloadSchema: require('../../schema/payload-profile-v1.schema.json'),
-    bundlePayloadSchema: require('../../schema/bundle-profile-v1.schema.json'),
+    payloadSchema: require('../../schema/payload-profile.schema.json'),
+    bundlePayloadSchema: require('../../schema/bundle-profile.schema.json'),
     checksumsSchema: require('../../schema/checksums.schema.json'),
     loadContractSchema: require('../../schema/load-contract.schema.json'),
   };
@@ -131,10 +133,10 @@ function loadSchemasFromDisk() {
   return {
     manifestSchema: JSON.parse(fs.readFileSync(path.join(schemaDir, 'manifest.schema.json'), 'utf8')),
     payloadSchema: JSON.parse(
-      fs.readFileSync(path.join(schemaDir, 'payload-profile-v1.schema.json'), 'utf8'),
+      fs.readFileSync(path.join(schemaDir, 'payload-profile.schema.json'), 'utf8'),
     ),
     bundlePayloadSchema: JSON.parse(
-      fs.readFileSync(path.join(schemaDir, 'bundle-profile-v1.schema.json'), 'utf8'),
+      fs.readFileSync(path.join(schemaDir, 'bundle-profile.schema.json'), 'utf8'),
     ),
     checksumsSchema: JSON.parse(
       fs.readFileSync(path.join(schemaDir, 'checksums.schema.json'), 'utf8'),
@@ -187,7 +189,7 @@ function loadSchemas() {
  */
 function isKdnaSourceDir(absPath) {
   if (!fs.existsSync(absPath) || !fs.statSync(absPath).isDirectory()) return false;
-  for (const f of V1_REQUIRED_DIR_ENTRIES) {
+  for (const f of REQUIRED_DIR_ENTRIES) {
     if (!fs.existsSync(path.join(absPath, f))) return false;
   }
   const mime = fs.readFileSync(path.join(absPath, 'mimetype'), 'utf8');
@@ -228,9 +230,13 @@ function detectContainerFormat(absPath) {
  * truncated input.
  */
 function listZipEntries(absPath, opts = {}) {
+  return listZipEntriesFromBuffer(fs.readFileSync(absPath), opts);
+}
+
+function listZipEntriesFromBuffer(input, opts = {}) {
   const secure = opts.secure !== false;
   const limits = { ...DEFAULT_CONTAINER_LIMITS, ...(opts.limits || {}) };
-  const buf = fs.readFileSync(absPath);
+  const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
   if (secure && buf.length > limits.maxContainerBytes) {
     throw new Error(`container exceeds maximum size (${limits.maxContainerBytes} bytes)`);
   }
@@ -393,8 +399,8 @@ function validateContainerEntryMetadata(entry) {
     throw new Error(`container has duplicate entry: ${normalizedName}`);
   }
   const topLevel = normalizedName.split('/')[0];
-  if (!V1_ALLOWED_TOP_LEVEL_ENTRIES.has(topLevel)) {
-    if (V1_FORBIDDEN_LEGACY_TOP_LEVEL.has(topLevel)) {
+  if (!ALLOWED_TOP_LEVEL_ENTRIES.has(topLevel)) {
+    if (FORBIDDEN_LEGACY_TOP_LEVEL.has(topLevel)) {
       throw new Error(`container includes forbidden top-level source entry: ${topLevel}`);
     }
     throw new Error(`container includes unsupported top-level entry: ${topLevel}`);
@@ -512,17 +518,17 @@ function listSourceDir(dir, opts = {}) {
   return out;
 }
 
-// ─── Read v1 from either source dir or container ───────────────────────
+// ─── Read layout from either source dir or container ───────────────────────
 
 /**
- * Read a v1 layout (source dir or .kdna container) and return a single
+ * Read a layout layout (source dir or .kdna container) and return a single
  * normalized map of { mimetype, kdna.json, payload.kdnab, checksums.json? }.
  * `where` describes the origin for error messages.
  *
  * Throws an Error with a clear, content-neutral message if the layout
  * is malformed (missing entry, wrong mimetype, etc.).
  */
-function readV1Layout(absPath) {
+function readLayout(absPath) {
   let stat;
   try {
     stat = fs.statSync(absPath);
@@ -533,10 +539,11 @@ function readV1Layout(absPath) {
   const map = {};
   let entries = null; // ZIP entries if container
   let kind; // 'dir' | 'file'
+  let containerBytes = null;
 
   if (stat.isDirectory()) {
     kind = 'dir';
-    for (const f of V1_REQUIRED_DIR_ENTRIES) {
+    for (const f of REQUIRED_DIR_ENTRIES) {
       const full = path.join(absPath, f);
       if (!fs.existsSync(full)) {
         throw new Error(`not a KDNA authoring source directory: missing ${f}`);
@@ -545,7 +552,7 @@ function readV1Layout(absPath) {
         throw new Error(`not a KDNA authoring source directory: ${f} must not be a symlink`);
       }
     }
-    for (const f of [...V1_REQUIRED_DIR_ENTRIES, ...V1_OPTIONAL_DIR_ENTRIES]) {
+    for (const f of [...REQUIRED_DIR_ENTRIES, ...OPTIONAL_DIR_ENTRIES]) {
       const full = path.join(absPath, f);
       if (fs.existsSync(full)) {
         if (fs.statSync(full).isFile()) {
@@ -558,13 +565,10 @@ function readV1Layout(absPath) {
     }
   } else if (stat.isFile()) {
     kind = 'file';
-    entries = listZipEntries(absPath);
-    if (entries.length === 0 || entries[0].name !== 'mimetype') {
-      throw new Error('not a KDNA Asset Container: first entry is not mimetype');
-    }
-    if (entries[0].method !== 0) {
-      throw new Error('not a KDNA Asset Container: mimetype must be uncompressed');
-    }
+    // Open once so parsing and the whole-file digest come from the same
+    // immutable snapshot, without a path-level TOCTOU window.
+    containerBytes = fs.readFileSync(absPath);
+    entries = listZipEntriesFromBuffer(containerBytes);
     for (const e of entries) {
       // We only need the well-known entries; signatures/ attachments/ etc.
       // are passed through unchanged by the loader but not parsed here.
@@ -577,25 +581,36 @@ function readV1Layout(absPath) {
         map[e.name] = e.data;
       }
     }
-    for (const f of V1_REQUIRED_DIR_ENTRIES) {
-      if (!map[f]) {
-        throw new Error(`not a KDNA Asset Container: missing ${f}`);
-      }
-    }
   } else {
     throw new Error(`not a file or directory: ${absPath}`);
   }
 
-  // mimetype content must equal the literal v1 media type.
+  const containerDigest = kind === 'file'
+    ? `sha256:${crypto.createHash('sha256').update(containerBytes).digest('hex')}`
+    : null;
+
+  return finalizeContainerLayout({ kind, map, entries, containerDigest });
+}
+
+function finalizeContainerLayout({ kind, map, entries, containerDigest }) {
+  if (kind !== 'dir' && (!entries || entries.length === 0 || entries[0].name !== 'mimetype')) {
+    throw new Error('not a KDNA Asset Container: first entry is not mimetype');
+  }
+  if (kind !== 'dir' && entries[0].method !== 0) {
+    throw new Error('not a KDNA Asset Container: mimetype must be uncompressed');
+  }
+  for (const required of REQUIRED_DIR_ENTRIES) {
+    if (!map[required]) {
+      const source = kind === 'dir' ? 'KDNA authoring source directory' : 'KDNA Asset Container';
+      throw new Error(`not a ${source}: missing ${required}`);
+    }
+  }
+
   const mime = map.mimetype.toString('utf8');
   if (mime !== MIMETYPE) {
-    throw new Error(
-      `not a KDNA layout: mimetype is "${mime}", expected "${MIMETYPE}"`,
-    );
+    throw new Error(`not a KDNA layout: mimetype is "${mime}", expected "${MIMETYPE}"`);
   }
 
-  // Lineage must be a single object, not an array. (Format rule from
-  // docs/core/manifest.md / schema/manifest.schema.json.)
   let manifest;
   try {
     manifest = parseJsonEntry('kdna.json', map['kdna.json']);
@@ -606,7 +621,60 @@ function readV1Layout(absPath) {
     throw new Error('kdna.json.lineage must be an object, not an array');
   }
 
-  return { kind, map, manifest, entries };
+  return { kind, map, manifest, entries, containerDigest };
+}
+
+function readLayoutBytes(input) {
+  const bytes = Buffer.isBuffer(input) ? input : Buffer.from(input);
+  const entries = listZipEntriesFromBuffer(bytes);
+  const map = {};
+  for (const entry of entries) {
+    if (
+      entry.name === 'mimetype' ||
+      entry.name === 'kdna.json' ||
+      entry.name === 'payload.kdnab' ||
+      entry.name === 'checksums.json'
+    ) {
+      map[entry.name] = entry.data;
+    }
+  }
+  return finalizeContainerLayout({
+    kind: 'memory',
+    map,
+    entries,
+    containerDigest: `sha256:${crypto.createHash('sha256').update(bytes).digest('hex')}`,
+  });
+}
+
+function readInputLayout(input) {
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
+    return readLayoutBytes(input);
+  }
+  return readLayout(path.resolve(input));
+}
+
+function snapshotPackagedInput(input) {
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
+    return Buffer.from(input);
+  }
+  if (typeof input !== 'string') return input;
+  const resolved = path.resolve(input);
+  let stat;
+  try {
+    stat = fs.statSync(resolved);
+  } catch {
+    return input;
+  }
+  // Authoring directories remain available to inspect/validate. Runtime
+  // wrappers reject them; this helper only freezes packaged-file loads.
+  return stat.isFile() ? fs.readFileSync(resolved) : input;
+}
+
+function inputSource(input, kind) {
+  return {
+    kind,
+    path: typeof input === 'string' ? path.resolve(input) : null,
+  };
 }
 
 function parseJsonEntry(name, bytes, opts = {}) {
@@ -658,7 +726,7 @@ function parsePayloadEntry(name, bytes, opts = {}) {
   try {
     parsed = cbor.decode(bytes);
   } catch {
-    throw new Error(`${name}: not valid CBOR. payload.kdnab must be CBOR-encoded (kdna_version 1.0).`);
+    throw new Error(`${name}: not valid CBOR. payload.kdnab must be CBOR-encoded (format 0.1.0).`);
   }
   assertJsonWithinLimits(parsed, name, limits);
   return parsed;
@@ -670,10 +738,10 @@ function parsePayloadEntry(name, bytes, opts = {}) {
  * Print a content-neutral manifest summary. Always JSON. Never emits
  * the words trusted / recommended / high_quality / officially_approved.
  */
-function buildInspectOutput(v1) {
-  const m = v1.manifest;
+function buildInspectOutput(container) {
+  const m = container.manifest;
   const out = {
-    kdna_version: m.kdna_version ?? null,
+    format_version: m.format_version ?? null,
     asset_id: m.asset_id ?? null,
     asset_uid: m.asset_uid ?? null,
     asset_type: m.asset_type ?? null,
@@ -683,10 +751,11 @@ function buildInspectOutput(v1) {
     payload: m.payload ? m.payload.path : null,
     payload_encrypted: m.payload ? m.payload.encrypted : null,
     profile: m.compatibility ? m.compatibility.profile : null,
+    ...assessLoaderCompatibility(m),
     load_contract_default_profile: m.load_contract ? m.load_contract.default_profile : null,
   };
   if (m.signatures !== undefined) out.signature_count = Array.isArray(m.signatures) ? m.signatures.length : 0;
-  if (v1.map['checksums.json']) out.checksums_present = true;
+  if (container.map['checksums.json']) out.checksums_present = true;
   return out;
 }
 
@@ -697,26 +766,27 @@ function buildInspectOutput(v1) {
  * reports each gate independently. Never includes trust / recommended
  * / high_quality / officially_approved as a positive claim.
  */
-function runValidate(v1) {
+function runValidate(layout) {
   const result = {
     format_valid: true,
     schema_valid: true,
     payload_valid: true,
     checksums_valid: true,
     load_contract_valid: true,
+    ...assessLoaderCompatibility(layout.manifest),
   };
   const problems = [];
 
-  // format gate — already proven by readV1Layout, but we re-state the gates
+  // format gate — already proven by readLayout, but we re-state the gates
   // so the report matches the spec.
-  for (const f of V1_REQUIRED_DIR_ENTRIES) {
-    if (!v1.map[f]) {
+  for (const f of REQUIRED_DIR_ENTRIES) {
+    if (!layout.map[f]) {
       result.format_valid = false;
       problems.push(`format: missing required entry ${f}`);
     }
   }
-  if (v1.map.mimetype) {
-    const mimeStr = v1.map.mimetype.toString('utf8');
+  if (layout.map.mimetype) {
+    const mimeStr = layout.map.mimetype.toString('utf8');
     if (mimeStr !== MIMETYPE) {
       result.format_valid = false;
       problems.push(`format: mimetype is not ${MIMETYPE}`);
@@ -732,35 +802,82 @@ function runValidate(v1) {
     );
     return finalizeValidate(result, problems);
   }
-  if (!validators.manifest(v1.manifest)) {
+  if (!validators.manifest(layout.manifest)) {
     result.schema_valid = false;
     for (const err of validators.manifest.errors) {
       problems.push(`manifest: ${err.instancePath || '<root>'} ${err.message}`);
     }
   }
 
-  // payload gate — payload.kdnab against payload-profile-v1.schema.json
+  // Known pre-1.0 aliases are not extension fields. Rejecting them here keeps
+  // the current layout validator as the single manifest authority while allowing
+  // genuinely namespaced/forward-compatible manifest extensions.
+  const removedAliases = {
+    kdna_spec: 'format_version',
+    kdna_version: 'format_version',
+    spec_version: 'format_version',
+  };
+  for (const [field, replacement] of Object.entries(removedAliases)) {
+    if (Object.prototype.hasOwnProperty.call(layout.manifest, field)) {
+      result.schema_valid = false;
+      problems.push(`kdna.json: ${field} is not allowed. Use ${replacement}.`);
+    }
+  }
+
+  // payload gate — payload.kdnab against payload-profile.schema.json
   // For actually encrypted payloads (envelopes), skip schema validation.
   let payload;
   try {
-    payload = parsePayloadEntry("payload.kdnab", v1.map['payload.kdnab']);
+    payload = parsePayloadEntry("payload.kdnab", layout.map['payload.kdnab']);
   } catch (e) {
     result.payload_valid = false;
     problems.push(`payload: not valid KDNA payload (${e.message})`);
     return finalizeValidate(result, problems);
   }
 
-  const isEncryptedPayload = payload.profile
-    && payload.ciphertext
-    && (v1.manifest.payload?.encrypted || v1.manifest.encryption?.encrypted_entries?.includes('payload.kdnab'));
+  const payloadIsEncryptedEnvelope = Boolean(payload.profile && payload.ciphertext);
+  const encryptedEntries = layout.manifest.encryption?.encrypted_entries;
+  const manifestDeclaresEncryptedPayload = Boolean(
+    layout.manifest.payload?.encrypted
+    || (Array.isArray(encryptedEntries) && encryptedEntries.includes('payload.kdnab')),
+  );
+  if (manifestDeclaresEncryptedPayload && !payloadIsEncryptedEnvelope) {
+    result.payload_valid = false;
+    problems.push('payload: manifest declares encryption but payload.kdnab is not an encrypted envelope');
+  }
+  if (payloadIsEncryptedEnvelope && !manifestDeclaresEncryptedPayload) {
+    result.payload_valid = false;
+    problems.push('payload: encrypted envelope is missing its manifest encryption declaration');
+  }
+  const isEncryptedPayload = payloadIsEncryptedEnvelope && manifestDeclaresEncryptedPayload;
 
   if (isEncryptedPayload) {
     // Encrypted payload — verify it's a proper encryption envelope, not plaintext.
-    const encProfile = v1.manifest.encryption?.profile;
+    const encProfile = layout.manifest.encryption?.profile;
+    const encProfileVersion = layout.manifest.encryption?.profile_version;
+    if (!layout.manifest.encryption) {
+      result.payload_valid = false;
+      problems.push('payload: encrypted payload requires a manifest encryption declaration');
+    }
+    if (
+      !Array.isArray(encryptedEntries)
+      || encryptedEntries.length !== 1
+      || encryptedEntries[0] !== 'payload.kdnab'
+    ) {
+      result.payload_valid = false;
+      problems.push('payload: manifest encrypted_entries must declare only payload.kdnab');
+    }
     if (encProfile && payload.profile !== encProfile) {
       result.payload_valid = false;
       problems.push(`payload: encrypted envelope profile ${payload.profile || 'unknown'} does not match manifest encryption profile ${encProfile}`);
     }
+    const payloadProfileVersion = payload.profile === EXTERNAL_ENVELOPE_PROFILE
+      ? payload.contract_version
+      : payload.profile_version;
+    if (encProfileVersion && payloadProfileVersion !== encProfileVersion) {
+      result.payload_valid = false;
+      problems.push(`payload: encrypted envelope compatibility coordinate ${payloadProfileVersion || 'unknown'} does not match manifest encryption profile_version ${encProfileVersion}`);
+    }
     let hasKeyMaterial = !!payload.wrapped_key || (Array.isArray(payload.key_slots) && payload.key_slots.length > 0);
     if (payload.profile === EXTERNAL_ENVELOPE_PROFILE) {
       try {
@@ -778,7 +895,7 @@ function runValidate(v1) {
     // Encrypted payload passes payload gate if envelope is structurally valid.
   } else {
     // Plaintext payload — full schema validation.
-    const isBundleProfile = v1.manifest.compatibility?.profile === 'bundle-profile-v1' || v1.manifest.asset_type === 'bundle';
+    const isBundleProfile = layout.manifest.compatibility?.profile === 'kdna.payload.bundle' || layout.manifest.asset_type === 'bundle';
     const payloadValidator = isBundleProfile ? validators.bundlePayload : validators.payload;
     if (!payloadValidator(payload)) {
       result.payload_valid = false;
@@ -789,10 +906,10 @@ function runValidate(v1) {
   }
 
   // checksums gate — checksums.json against checksums.schema.json
-  if (v1.map['checksums.json']) {
+  if (layout.map['checksums.json']) {
     let checks;
     try {
-      checks = parseJsonEntry('checksums.json', v1.map['checksums.json']);
+      checks = parseJsonEntry('checksums.json', layout.map['checksums.json']);
     } catch (e) {
       result.checksums_valid = false;
       problems.push(`checksums: not valid JSON (${e.message})`);
@@ -805,13 +922,13 @@ function runValidate(v1) {
     }
     // Digest matching verification — compute actual hashes and compare.
     if (checks) {
-      result.checksums_valid = verifyDigests(checks, v1.map, problems, result);
+      result.checksums_valid = verifyDigests(checks, layout.map, problems, result);
     }
   }
 
   // load_contract gate — only if manifest references a load_contract block
-  if (v1.manifest.load_contract) {
-    const lc = v1.manifest.load_contract;
+  if (layout.manifest.load_contract) {
+    const lc = layout.manifest.load_contract;
     const validLc = _ajv.getSchema('load-contract.schema.json');
     if (validLc && !validLc(lc)) {
       result.load_contract_valid = false;
@@ -828,6 +945,51 @@ function runValidate(v1) {
 }
 
 function verifyDigests(checksums, map, problems, result) {
+  const digestMetadataPresent =
+    checksums.digest_profile !== undefined ||
+    checksums.digest_profile_version !== undefined ||
+    checksums.covered_entries !== undefined;
+  if (digestMetadataPresent) {
+    const requiredDigestFields = [
+      'digest_profile',
+      'digest_profile_version',
+      'covered_entries',
+      'manifest_digest',
+      'payload_digest',
+      'entry_set_digest',
+    ];
+    const missingDigestFields = requiredDigestFields.filter(
+      (field) => checksums[field] === undefined,
+    );
+    if (missingDigestFields.length) {
+      problems.push(
+        `checksums: kdna.digest-basis.runtime-entry-set metadata requires ${missingDigestFields.join(', ')}`,
+      );
+      result.checksums_valid = false;
+      return false;
+    }
+    if (checksums.digest_profile !== 'kdna.digest-basis.runtime-entry-set') {
+      problems.push('checksums: unsupported digest_profile (expected kdna.digest-basis.runtime-entry-set)');
+      result.checksums_valid = false;
+      return false;
+    }
+    if (checksums.digest_profile_version !== '0.1.0') {
+      problems.push('checksums: unsupported digest_profile_version (expected 0.1.0)');
+      result.checksums_valid = false;
+      return false;
+    }
+    const coveredEntries = checksums.covered_entries;
+    if (
+      !Array.isArray(coveredEntries)
+      || coveredEntries.length !== 2
+      || coveredEntries[0] !== 'kdna.json'
+      || coveredEntries[1] !== 'payload.kdnab'
+    ) {
+      problems.push('checksums: covered_entries does not match kdna.digest-basis.runtime-entry-set');
+      result.checksums_valid = false;
+      return false;
+    }
+  }
   const algo = checksums.algorithm || 'sha256';
   if (algo !== 'sha256') {
     problems.push(`checksums: unsupported digest algorithm ${algo} (supported: sha256)`);
@@ -857,21 +1019,21 @@ function verifyDigests(checksums, map, problems, result) {
       stillValid = false;
     }
   }
-  if (checksums.asset_digest) {
-    const expectedAssetDigest = checksums.asset_digest.replace(/^sha256:/, '');
+  const declaredEntrySetDigest = checksums.entry_set_digest;
+  if (declaredEntrySetDigest) {
+    const expectedEntrySetDigest = declaredEntrySetDigest.replace(/^sha256:/, '');
     const missingAssetInputs = ['kdna.json', 'payload.kdnab'].filter((entryName) => !entryDigests[entryName]);
     if (missingAssetInputs.length) {
-      problems.push(`checksums: asset_digest cannot be verified without ${missingAssetInputs.join(', ')}`);
+      problems.push(`checksums: entry_set_digest cannot be verified without ${missingAssetInputs.join(', ')}`);
       stillValid = false;
     } else {
-      const combined = Object.keys(entryDigests)
-        .sort()
-        .map((name) => `${name}:${entryDigests[name]}`)
-        .join('\n');
-      const actualAssetDigest = crypto.createHash('sha256').update(combined).digest('hex');
-      if (actualAssetDigest !== expectedAssetDigest) {
+      const actualEntrySetDigest = computeRuntimeEntrySetDigest(
+        map['kdna.json'],
+        map['payload.kdnab'],
+      ).slice('sha256:'.length);
+      if (actualEntrySetDigest !== expectedEntrySetDigest) {
         problems.push(
-          `checksums: asset_digest mismatch (declared ${expectedAssetDigest.slice(0, 8)}..., actual ${actualAssetDigest.slice(0, 8)}...)`,
+          `checksums: entry_set_digest mismatch (declared ${expectedEntrySetDigest.slice(0, 8)}..., actual ${actualEntrySetDigest.slice(0, 8)}...)`,
         );
         stillValid = false;
       }
@@ -904,7 +1066,29 @@ function digestEntry(sourceDir, entry) {
   };
 }
 
-function buildChecksumsV1(sourceDir) {
+function computeRuntimeEntrySetDigest(manifestBytes, payloadBytes) {
+  if (
+    (!Buffer.isBuffer(manifestBytes) && !(manifestBytes instanceof Uint8Array))
+    || (!Buffer.isBuffer(payloadBytes) && !(payloadBytes instanceof Uint8Array))
+  ) {
+    const error = new Error(
+      'E requires raw uncompressed kdna.json and payload.kdnab bytes.',
+    );
+    error.code = 'KDNA_DIGEST_INPUT_INVALID';
+    throw error;
+  }
+  const entries = {
+    'kdna.json': crypto.createHash('sha256').update(manifestBytes).digest('hex'),
+    'payload.kdnab': crypto.createHash('sha256').update(payloadBytes).digest('hex'),
+  };
+  const combined = Object.keys(entries)
+    .sort()
+    .map((name) => `${name}:${entries[name]}`)
+    .join('\n');
+  return `sha256:${crypto.createHash('sha256').update(combined).digest('hex')}`;
+}
+
+function buildChecksums(sourceDir) {
   const absSrc = path.resolve(sourceDir);
   if (!fs.existsSync(absSrc) || !fs.statSync(absSrc).isDirectory()) {
     throw new Error(`not a directory: ${absSrc}`);
@@ -914,16 +1098,18 @@ function buildChecksumsV1(sourceDir) {
     'kdna.json': digestEntry(absSrc, 'kdna.json'),
     'payload.kdnab': digestEntry(absSrc, 'payload.kdnab'),
   };
-  const combined = Object.keys(entries)
-    .sort()
-    .map((name) => `${name}:${entries[name].value}`)
-    .join('\n');
-
+  const entrySetDigest = computeRuntimeEntrySetDigest(
+    fs.readFileSync(path.join(absSrc, 'kdna.json')),
+    fs.readFileSync(path.join(absSrc, 'payload.kdnab')),
+  );
   return {
+    digest_profile: 'kdna.digest-basis.runtime-entry-set',
+    digest_profile_version: '0.1.0',
+    covered_entries: ['kdna.json', 'payload.kdnab'],
     algorithm: 'sha256',
     manifest_digest: `sha256:${entries['kdna.json'].value}`,
     payload_digest: `sha256:${entries['payload.kdnab'].value}`,
-    asset_digest: `sha256:${crypto.createHash('sha256').update(combined).digest('hex')}`,
+    entry_set_digest: entrySetDigest,
     entries,
   };
 }
@@ -931,17 +1117,19 @@ function buildChecksumsV1(sourceDir) {
 // ─── pack ──────────────────────────────────────────────────────────────
 
 /**
- * Pack an authoring source directory into a .kdna asset. Output is
- * deterministic: the same source directory packed twice produces
- * byte-identical output (fixed DOS timestamps, fixed entry order,
- * mimetype first).
+ * Pack an authoring source directory into a .kdna asset. With one pinned
+ * packer toolchain and compressor, output is byte-reproducible (fixed DOS
+ * timestamps, fixed entry order, mimetype first). DEFLATE output may differ
+ * across compressors, zlib versions, or systems. entry_set_digest and
+ * source_fingerprint identify the logical entries; A binds the exact immutable
+ * package bytes.
  */
 function pack(sourceDir, outputPath) {
   const absSrc = path.resolve(sourceDir);
   if (!fs.existsSync(absSrc) || !fs.statSync(absSrc).isDirectory()) {
     throw new Error(`not a directory: ${absSrc}`);
   }
-  for (const f of V1_REQUIRED_DIR_ENTRIES) {
+  for (const f of REQUIRED_DIR_ENTRIES) {
     if (!fs.existsSync(path.join(absSrc, f))) {
       throw new Error(`cannot pack: missing required entry ${f}`);
     }
@@ -1020,7 +1208,7 @@ function pack(sourceDir, outputPath) {
 // ─── unpack ────────────────────────────────────────────────────────────
 
 /**
- * Unpack a v1 .kdna container to a directory. Refuses path traversal.
+ * Unpack a layout .kdna container to a directory. Refuses path traversal.
  * Does not auto-execute any entry.
  */
 function unpack(inputPath, outputDir) {
@@ -1061,23 +1249,20 @@ function unpack(inputPath, outputDir) {
 // ─── Public router entry points ────────────────────────────────────────
 
 function inspect(inputPath, _opts = {}) {
-  const v1 = readV1Layout(path.resolve(inputPath));
-  const out = buildInspectOutput(v1);
+  const layout = readInputLayout(inputPath);
+  const out = buildInspectOutput(layout);
   // Guard against accidental forbidden wording in any future field additions.
   assertNoForbiddenTerms(out);
   return out;
 }
 
 function validate(inputPath, _opts = {}) {
-  const v1 = readV1Layout(path.resolve(inputPath));
-  return runValidate(v1);
+  const layout = readInputLayout(inputPath);
+  return runValidate(layout);
 }
 
 function normalizeAccess(access) {
   const value = access || 'public';
-  if (value === 'open') return { access: 'public', alias: value };
-  if (value === 'protected') return { access: 'licensed', alias: value };
-  if (value === 'runtime') return { access: 'remote', alias: value };
   return { access: value, alias: null };
 }
 
@@ -1085,13 +1270,12 @@ function inferEntitlementProfile(manifest) {
   if (manifest.entitlement && typeof manifest.entitlement.profile === 'string') {
     return manifest.entitlement.profile;
   }
-  if (manifest.encryption && manifest.encryption.profile === 'kdna-password-protected-v1') {
+  if (manifest.encryption && manifest.encryption.profile === 'kdna.encryption.password') {
     return 'password';
   }
-  if (manifest.encryption && manifest.encryption.profile === 'kdna-password-protected-v1-scrypt') {
+  if (manifest.encryption && manifest.encryption.profile === 'kdna.encryption.password.scrypt') {
     return 'password';
   }
-  if (manifest.access === 'protected') return 'password';
   return null;
 }
 
@@ -1113,14 +1297,14 @@ function finalizeLoadPlan(plan) {
   return plan;
 }
 
-function computeSourceFingerprint(_inputPath, v1) {
+function computeSourceFingerprint(_inputPath, layout) {
   // Fingerprint the logical entries, not the transport ZIP bytes. DEFLATE
   // output can differ between zlib versions and operating systems even when
   // every uncompressed KDNA entry is identical. LoadPlan conformance must be
   // stable across JS, Swift, CI runners, and repackaging transports.
   const hash = crypto.createHash('sha256');
-  for (const name of Object.keys(v1.map).sort()) {
-    const bytes = v1.map[name];
+  for (const name of Object.keys(layout.map).sort()) {
+    const bytes = layout.map[name];
     hash.update(name);
     hash.update('\0');
     hash.update(String(bytes.length));
@@ -1131,7 +1315,7 @@ function computeSourceFingerprint(_inputPath, v1) {
   return `sha256:${hash.digest('hex')}`;
 }
 
-function inputFingerprint(inputPath, v1, opts = {}) {
+function inputFingerprint(inputPath, layout, opts = {}) {
   const allowedEntitlement = new Set(['active', 'expired', 'revoked', 'offline_grace']);
   const entitlementInput = (
     opts.entitlement && allowedEntitlement.has(opts.entitlement.status)
@@ -1140,12 +1324,12 @@ function inputFingerprint(inputPath, v1, opts = {}) {
   return {
     has_password_input: opts.hasPassword === true,
     entitlement_input: entitlementInput,
-    source_fingerprint: computeSourceFingerprint(inputPath, v1),
+    source_fingerprint: computeSourceFingerprint(inputPath, layout),
   };
 }
 
-function baseLoadPlan(inputPath, v1, validation, opts = {}) {
-  const manifest = v1.manifest;
+function baseLoadPlan(inputPath, layout, validation, opts = {}) {
+  const manifest = layout.manifest;
   const accessInfo = normalizeAccess(manifest.access);
   const entitlementProfile = inferEntitlementProfile(manifest);
   const asset = {
@@ -1157,7 +1341,7 @@ function baseLoadPlan(inputPath, v1, validation, opts = {}) {
   };
 
   const plan = {
-    kdna_version: manifest.kdna_version || null,
+    format_version: manifest.format_version || null,
     asset,
     access: accessInfo.access,
     access_alias: accessInfo.alias,
@@ -1166,7 +1350,7 @@ function baseLoadPlan(inputPath, v1, validation, opts = {}) {
     required_action: 'block',
     can_load_now: false,
     projection_policy: 'none',
-    input_fingerprint: inputFingerprint(inputPath, v1, opts),
+    input_fingerprint: inputFingerprint(inputPath, layout, opts),
     checks: {
       format_valid: validation.format_valid,
       schema_valid: validation.schema_valid,
@@ -1177,8 +1361,8 @@ function baseLoadPlan(inputPath, v1, validation, opts = {}) {
     },
     issues: [],
     source: {
-      kind: v1.kind,
-      path: path.resolve(inputPath),
+      kind: layout.kind,
+      path: typeof inputPath === 'string' ? path.resolve(inputPath) : null,
     },
   };
 
@@ -1193,9 +1377,9 @@ function baseLoadPlan(inputPath, v1, validation, opts = {}) {
   return plan;
 }
 
-// ─── B1: Unified container model → legacy v1 layout ─────────────────────
+// ─── B1: Unified container model → legacy layout layout ─────────────────────
 
-function canonicalToV1Layout(asset) {
+function canonicalToContainerLayout(asset) {
   const map = {};
   if (asset.entries) {
     for (const [name, buf] of asset.entries) {
@@ -1218,6 +1402,7 @@ function canonicalToV1Layout(asset) {
     map,
     manifest: asset.manifest,
     entries: Object.keys(map),
+    containerDigest: asset.containerDigest || null,
   };
 }
 
@@ -1227,21 +1412,38 @@ function canonicalToV1Layout(asset) {
  * result instead of parsing manifest fields directly.
  */
 function planLoad(inputPath, opts = {}) {
-  let v1;
+  let layout;
+
+  if (Buffer.isBuffer(inputPath) || inputPath instanceof Uint8Array) {
+    try {
+      layout = readInputLayout(inputPath);
+    } catch (e) {
+      return finalizeLoadPlan({
+        format_version: null,
+        asset: { asset_id: null, asset_uid: null, title: null, version: null, judgment_version: null },
+        access: null, access_alias: null, entitlement_profile: null,
+        state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
+        input_fingerprint: null,
+        checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, load_contract_valid: false, overall_valid: false },
+        issues: [buildLoadPlanIssue('KDNA_FORMAT_INVALID', 'blocking', e.message)],
+        source: inputSource(inputPath, 'memory'),
+      });
+    }
+  }
 
   // Try the unified container dispatcher first; the internal compatibility
   // reader below remains available only for authoring and migration tooling.
-  if (readAsset !== null) {
+  if (!layout && readAsset !== null) {
     try {
       const asset = readAsset(path.resolve(inputPath));
-      v1 = canonicalToV1Layout(asset);
+      layout = canonicalToContainerLayout(asset);
     } catch (e) {
-      // If dispatcher fails, fall back to legacy readV1Layout for backward compat
+      // If dispatcher fails, fall back to legacy readLayout for backward compat
       if (e.code === 'KDNA_FORMAT_UNKNOWN' || e.code === 'KDNA_PATH_NOT_FOUND') {
         // let the legacy path handle it
       } else {
         return finalizeLoadPlan({
-          kdna_version: null,
+          format_version: null,
           asset: { asset_id: null, asset_uid: null, title: null, version: null, judgment_version: null },
           access: null, access_alias: null, entitlement_profile: null,
           state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
@@ -1251,33 +1453,37 @@ function planLoad(inputPath, opts = {}) {
             e.code === 'KDNA_FORMAT_UNKNOWN' ? 'KDNA_FORMAT_UNKNOWN' : 'KDNA_FORMAT_INVALID',
             'blocking', e.message,
           )],
-          source: { kind: null, path: path.resolve(inputPath) },
+          source: inputSource(inputPath, null),
         });
       }
     }
   }
 
-  if (!v1) {
+  if (!layout) {
     try {
-      v1 = readV1Layout(path.resolve(inputPath));
+      layout = readInputLayout(inputPath);
     } catch (e) {
       return finalizeLoadPlan({
-        kdna_version: null,
+        format_version: null,
         asset: { asset_id: null, asset_uid: null, title: null, version: null, judgment_version: null },
         access: null, access_alias: null, entitlement_profile: null,
         state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
         input_fingerprint: null,
         checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, load_contract_valid: false, overall_valid: false },
         issues: [buildLoadPlanIssue('KDNA_FORMAT_INVALID', 'blocking', e.message)],
-        source: { kind: null, path: path.resolve(inputPath) },
+        source: inputSource(inputPath, null),
       });
     }
   }
 
-  const validation = runValidate(v1);
-  const plan = baseLoadPlan(inputPath, v1, validation, opts);
+  const validation = runValidate(layout);
+  const plan = baseLoadPlan(inputPath, layout, validation, opts);
 
   if (!validation.overall_valid) {
+    if (!['public', 'licensed', 'remote'].includes(plan.access)) {
+      plan.access = null;
+      plan.access_alias = null;
+    }
     plan.state = 'invalid';
     plan.required_action = 'block';
     plan.can_load_now = false;
@@ -1288,22 +1494,27 @@ function planLoad(inputPath, opts = {}) {
     return finalizeLoadPlan(plan);
   }
 
-  const manifest = v1.manifest;
+  const manifest = layout.manifest;
+
+  if (validation.loader_compatible === false) {
+    plan.state = 'invalid';
+    plan.required_action = 'block';
+    plan.can_load_now = false;
+    plan.projection_policy = 'none';
+    plan.issues.push(buildLoadPlanIssue(
+      'KDNA_LOADER_VERSION_UNSUPPORTED',
+      'blocking',
+      loaderVersionUnsupportedMessage(validation.min_loader_version),
+    ));
+    return finalizeLoadPlan(plan);
+  }
 
   function externalEntitlementMatchesCurrentAsset(entitlement) {
     if (!isVerifiedExternalEntitlement(entitlement) || !entitlement.asset) return false;
-    let checksums;
-    try {
-      checksums = v1.map['checksums.json']
-        ? parseJsonEntry('checksums.json', v1.map['checksums.json'])
-        : null;
-    } catch {
-      return false;
-    }
-    return entitlement.asset.asset_id === (manifest.asset_id || manifest.name)
+    return entitlement.asset.asset_id === manifest.asset_id
       && entitlement.asset.asset_uid === manifest.asset_uid
       && entitlement.asset.version === manifest.version
-      && entitlement.asset.digest === checksums?.asset_digest
+      && entitlement.asset.digest === layout.containerDigest
       && entitlement.asset.entry_path === manifest.payload?.path;
   }
 
@@ -1698,34 +1909,46 @@ function assertNoForbiddenTerms(obj) {
   walk(obj);
   if (seen.size > 0) {
     throw new Error(
-      `internal: v1 inspect output contains forbidden terms: ${[...seen].join(', ')}`,
+      `internal: layout inspect output contains forbidden terms: ${[...seen].join(', ')}`,
     );
   }
 }
 
 module.exports = {
   MIMETYPE,
+  KDNA_LOADER_VERSION,
   REQUIRED_DIR_ENTRIES,
   isKdnaSourceDir,
   detectContainerFormat,
-  readLayout: readV1Layout,
+  readLayout: readLayout,
   inspect,
   validate,
   planLoad,
   loadAuthorized,
-  buildChecksums: buildChecksumsV1,
+  buildChecksums: buildChecksums,
+  computeRuntimeEntrySetDigest,
   pack,
   unpack,
-  load: loadV1,
-  loadAsset: loadV1,
-  buildCapsule,
+  load: loadAsset,
+  loadAsset: loadAsset,
   FORBIDDEN_OUTPUT_TERMS,
   parseSemver,
   compareSemver,
   satisfies,
 };
 
-// ─── loadV1 — v1 runtime loading / load contract ──────────────────────
+// The remote Runtime package subpath uses this non-enumerable bridge. Keeping
+// it non-enumerable prevents the package-root object spread from turning the
+// deployer-only contract into an ordinary consumer API. Package exports also
+// block direct access to this internal container module after installation.
+Object.defineProperty(module.exports, 'loadRemoteRuntimeAssetForServer', {
+  value: loadRemoteRuntimeAssetForServer,
+  enumerable: false,
+  configurable: false,
+  writable: false,
+});
+
+// ─── loadAsset — layout runtime loading / load contract ──────────────────────
 
 function renderPromptItem(item) {
   if (item === undefined || item === null) return '';
@@ -1746,7 +1969,7 @@ function renderPromptItem(item) {
   // Boundary card: kdna-studio writes { id, scope, out_of_scope,
   // acceptable_exceptions }. Render the scope/out-of-scope rule
   // instead of falling through to the UUID `id` (which was the
-  // v0.15.0 behavior and made boundaries unreadable in
+  // 0.15.0 behavior and made boundaries unreadable in
   // `kdna load --as=prompt`).
   if (
     item.type === 'boundary' ||
@@ -1806,7 +2029,12 @@ function sanitizePrompt(s) {
 }
 
 function loadAuthorized(inputPath, opts = {}) {
-  const plan = planLoad(inputPath, opts);
+  // A packaged path is read exactly once. Authorization and projection must
+  // operate on the same immutable byte snapshot even if the path changes
+  // while this synchronous call is in progress.
+  const inputKind = typeof inputPath === 'string' ? 'packaged_file' : 'packaged_bytes';
+  const inputSnapshot = snapshotPackagedInput(inputPath);
+  const plan = planLoad(inputSnapshot, opts);
   if (plan.can_load_now !== true) {
     const issueCodes = Array.isArray(plan.issues)
       ? plan.issues.map((issue) => issue.code).filter(Boolean)
@@ -1826,11 +2054,155 @@ function loadAuthorized(inputPath, opts = {}) {
       schema_valid: plan.checks && plan.checks.overall_valid === true,
       signature_valid: plan.signature_valid === true,
     },
+    _runtimeAssetBytes: inputSnapshot,
+    _runtimeInputKind: inputKind,
   };
-  return loadV1Unsafe(inputPath, mergedOpts);
+  return loadAssetUnsafe(inputSnapshot, mergedOpts);
+}
+
+function remoteRuntimeDeniedPlan(plan, code, message) {
+  return finalizeLoadPlan({
+    ...plan,
+    state: 'invalid',
+    required_action: 'block',
+    can_load_now: false,
+    projection_policy: 'none',
+    issues: [buildLoadPlanIssue(code, 'blocking', message)],
+  });
+}
+
+function packagedAssetRequiredPlan(inputPath) {
+  return finalizeLoadPlan({
+    format_version: null,
+    asset: {
+      asset_id: null,
+      asset_uid: null,
+      title: null,
+      version: null,
+      judgment_version: null,
+    },
+    access: null,
+    access_alias: null,
+    entitlement_profile: null,
+    state: 'invalid',
+    required_action: 'block',
+    can_load_now: false,
+    projection_policy: 'none',
+    input_fingerprint: null,
+    checks: {
+      format_valid: false,
+      schema_valid: false,
+      payload_valid: false,
+      checksums_valid: false,
+      load_contract_valid: false,
+      overall_valid: false,
+    },
+    issues: [buildLoadPlanIssue(
+      'KDNA_ASSET_FILE_REQUIRED',
+      'blocking',
+      'Remote Runtime loading requires a packaged .kdna asset file. Source directories are authoring inputs only.',
+    )],
+    source: {
+      kind: 'dir',
+      path: typeof inputPath === 'string' ? path.resolve(inputPath) : null,
+    },
+  });
 }
 
-function loadV1(inputPath, opts = {}) {
+function loadPlanDeniedError(plan, fallbackCode = 'KDNA_LOAD_NOT_AUTHORIZED') {
+  const issueCodes = Array.isArray(plan && plan.issues)
+    ? plan.issues.map((issue) => issue.code).filter(Boolean)
+    : [];
+  const error = new Error(
+    `LoadPlan denied loading: state=${plan?.state || 'invalid'} required_action=${plan?.required_action || 'block'}`,
+  );
+  error.code = issueCodes[0] || fallbackCode;
+  error.plan = plan;
+  return error;
+}
+
+/**
+ * Deployer-only remote Runtime loading contract.
+ *
+ * The caller must already control the packaged remote asset. This function
+ * snapshots a packaged path exactly once, validates and plans that immutable
+ * byte snapshot, accepts only the remote access mode and the frozen
+ * single-asset shape, then emits the full JSON Runtime Capsule required by a
+ * server-side projection engine.
+ */
+function loadRemoteRuntimeAssetForServer(inputPath) {
+  const inputKind = typeof inputPath === 'string' ? 'packaged_file' : 'packaged_bytes';
+  const inputSnapshot = snapshotPackagedInput(inputPath);
+
+  if (!Buffer.isBuffer(inputSnapshot)) {
+    if (typeof inputPath === 'string') {
+      try {
+        if (fs.statSync(path.resolve(inputPath)).isDirectory()) {
+          throw loadPlanDeniedError(packagedAssetRequiredPlan(inputPath));
+        }
+      } catch (error) {
+        if (error && error.code === 'KDNA_ASSET_FILE_REQUIRED') throw error;
+      }
+      throw loadPlanDeniedError(planLoad(inputPath));
+    }
+    const plan = remoteRuntimeDeniedPlan(
+      packagedAssetRequiredPlan(null),
+      'KDNA_FORMAT_INVALID',
+      'Remote Runtime input must be a packaged .kdna file path or packaged bytes.',
+    );
+    throw loadPlanDeniedError(plan);
+  }
+
+  const plan = planLoad(inputSnapshot);
+  if (!plan.checks || plan.checks.overall_valid !== true) {
+    throw loadPlanDeniedError(plan);
+  }
+
+  if (plan.access !== 'remote') {
+    throw loadPlanDeniedError(remoteRuntimeDeniedPlan(
+      plan,
+      'KDNA_REMOTE_RUNTIME_ACCESS_REQUIRED',
+      'The Remote Runtime loader accepts only packaged assets whose access mode is remote.',
+    ));
+  }
+
+  const layout = readInputLayout(inputSnapshot);
+  const manifest = layout.manifest;
+  const hasDependencies = manifest.dependencies
+    && typeof manifest.dependencies === 'object'
+    && Object.keys(manifest.dependencies).length > 0;
+  if (hasDependencies || manifest.extends !== undefined) {
+    throw loadPlanDeniedError(remoteRuntimeDeniedPlan(
+      plan,
+      'KDNA_REMOTE_RUNTIME_COMPOSITION_UNSUPPORTED',
+      'Remote Runtime loading currently accepts one asset only; dependencies and extends declarations are not authorized.',
+    ));
+  }
+
+  if (
+    plan.state !== 'needs_runtime'
+    || plan.required_action !== 'connect_runtime'
+    || plan.can_load_now !== false
+    || plan.projection_policy !== 'remote'
+  ) {
+    throw loadPlanDeniedError(plan);
+  }
+
+  return loadAssetUnsafe(inputSnapshot, {
+    profile: 'full',
+    as: 'json',
+    resolvedDependencies: [],
+    extendsChain: [],
+    _validation: {
+      schema_valid: plan.checks.overall_valid === true,
+      signature_valid: plan.signature_valid === true,
+    },
+    _runtimeAssetBytes: inputSnapshot,
+    _runtimeInputKind: inputKind,
+  });
+}
+
+function loadAsset(inputPath, opts = {}) {
   return loadAuthorized(inputPath, opts);
 }
 
@@ -1894,15 +2266,15 @@ function hasCompactPromptContent(content) {
   );
 }
 
-function loadV1Unsafe(inputPath, opts = {}) {
-  const v1 = readV1Layout(path.resolve(inputPath));
-  const m = v1.manifest;
+function loadAssetUnsafe(inputPath, opts = {}) {
+  const layout = readInputLayout(inputPath);
+  const m = layout.manifest;
   const profile = opts.profile || (m.load_contract ? m.load_contract.default_profile : 'compact') || 'compact';
   const as = opts.as || 'json';
 
   let payload;
   try {
-    const rawPayload = v1.map['payload.kdnab'];
+    const rawPayload = layout.map['payload.kdnab'];
     payload = parsePayloadEntry("payload.kdnab", rawPayload);
   } catch (e) {
     throw new Error(`payload.kdnab is not valid KDNA payload: ${e.message}`, { cause: e });
@@ -1914,10 +2286,10 @@ function loadV1Unsafe(inputPath, opts = {}) {
       // Consumer-provided decrypt hook (e.g., licensed entry key)
       try {
         const decrypted = opts.decryptEntry({
-          asset: { entries: v1.map, manifest: m },
+          asset: { entries: layout.map, manifest: m },
           manifest: m,
           entryName: 'payload.kdnab',
-          ciphertext: v1.map['payload.kdnab'],
+          ciphertext: layout.map['payload.kdnab'],
         });
         const decryptedBuf = typeof decrypted === 'string'
           ? Buffer.from(decrypted, 'utf8')
@@ -1929,7 +2301,7 @@ function loadV1Unsafe(inputPath, opts = {}) {
         throw err;
       }
     } else if (opts.password) {
-      // Password-based decryption via kdna-password-protected-v1*
+      // Password-based decryption via kdna.encryption.password*
       // profiles. Detects Argon2id vs scrypt from the envelope profile.
       try {
         const {
@@ -1937,10 +2309,10 @@ function loadV1Unsafe(inputPath, opts = {}) {
           decryptProtectedEntryScrypt,
           PASSWORD_PROTECTED_SCRYPT_PROFILE,
         } = require('../crypto-profile.js');
-        const encryptedEnvelope = v1.map['payload.kdnab'];
+        const encryptedEnvelope = layout.map['payload.kdnab'];
         let envelope;
         try { envelope = cbor.decode(Buffer.isBuffer(encryptedEnvelope) ? encryptedEnvelope : Buffer.from(encryptedEnvelope)); }
-        catch { throw new Error('Cannot decode encrypted envelope: payload.kdnab must be CBOR-encoded (kdna_version 1.0)'); }
+        catch { throw new Error('Cannot decode encrypted envelope: payload.kdnab must be CBOR-encoded (format 0.1.0)'); }
         const decryptFn = (envelope.profile === PASSWORD_PROTECTED_SCRYPT_PROFILE)
           ? decryptProtectedEntryScrypt
           : decryptProtectedEntry;
@@ -1968,11 +2340,11 @@ function loadV1Unsafe(inputPath, opts = {}) {
   }
 
   // Digest verification — refuse to load if checksums.json is present and digests mismatch.
-  if (v1.map['checksums.json']) {
+  if (layout.map['checksums.json']) {
     try {
-      const checks = parseJsonEntry('checksums.json', v1.map['checksums.json']);
+      const checks = parseJsonEntry('checksums.json', layout.map['checksums.json']);
       const problems = [];
-      const ok = verifyDigests(checks, v1.map, problems, {});
+      const ok = verifyDigests(checks, layout.map, problems, {});
       if (!ok) {
         const err = new Error(`checksum verification failed: ${problems.join('; ')}`);
         err.code = 'checksum_mismatch';
@@ -2020,7 +2392,8 @@ function loadV1Unsafe(inputPath, opts = {}) {
     if (m.load_contract && m.load_contract.profiles && m.load_contract.profiles.compact && m.load_contract.profiles.compact.max_tokens_hint) {
       maxTokensHint = m.load_contract.profiles.compact.max_tokens_hint;
     }
-    result.content = { asset_id: m.asset_id, asset_uid: m.asset_uid, title: m.title, version: m.version, judgment_version: m.judgment_version, asset_type: m.asset_type, summary: m.summary || null, language: m.language || null, keywords: m.keywords || [], profiles_available: m.load_contract ? Object.keys(m.load_contract.profiles || {}) : [], max_tokens_hint: maxTokensHint };
+    result.content = { asset_id: m.asset_id, asset_uid: m.asset_uid, title: m.title, version: m.version, judgment_version: m.judgment_version, asset_type: m.asset_type, summary: m.summary || null, language: m.language || null, keywords: m.keywords || [], profiles_available: m.load_contract ? Object.keys(m.load_contract.profiles || {}) : [] };
+    if (maxTokensHint !== undefined) result.content.max_tokens_hint = maxTokensHint;
   } else if (profile === 'compact') {
     const core = payload.core || {};
     const normalizeList = (items) => (items || []).map((item) => {
@@ -2028,6 +2401,13 @@ function loadV1Unsafe(inputPath, opts = {}) {
       if (item && typeof item === 'object') return item;
       return null;
     }).filter(Boolean);
+    const preserveDeclaredList = (items) => (
+      Array.isArray(items)
+        ? items.map((item) => (
+          typeof item === 'string' ? item : globalThis.structuredClone(item)
+        ))
+        : []
+    );
     result.content = {
       highest_question: core.highest_question || null,
       // These scoped domain-level values are already validated by the payload
@@ -2043,11 +2423,10 @@ function loadV1Unsafe(inputPath, opts = {}) {
           : null,
       axioms: (core.axioms || []).map(normalizeCompactAxiom).filter(Boolean),
       boundaries: normalizeList(core.boundaries),
-      // The canonical payload field is singular (`reasoning.self_check`).
-      // Runtime Capsule uses plural (`context.self_checks`) as its projection
-      // field. Reading the plural name from the payload silently discarded
-      // every Studio-authored self-check.
-      self_checks: normalizeList(payload.reasoning && payload.reasoning.self_check),
+      // Payload uses the singular field name while Runtime Capsule uses the
+      // plural collection name. Preserve every validated item and its shape;
+      // strings remain strings and structured questions remain objects.
+      self_checks: preserveDeclaredList(payload.reasoning && payload.reasoning.self_check),
       failure_modes: normalizeList(payload.reasoning && payload.reasoning.failure_modes),
       patterns: normalizeList(payload.patterns).slice(0, 3),
     };
@@ -2069,7 +2448,7 @@ function loadV1Unsafe(inputPath, opts = {}) {
   if (opts.extendsChain && opts.extendsChain.length > 0 && result.content) {
     try {
       const base = opts.extendsChain[0];
-      const baseLoaded = loadV1Unsafe(base.path, {
+      const baseLoaded = loadAssetUnsafe(base.path, {
         ...opts,
         resolvedDependencies: [],
         extendsChain: [],
@@ -2113,7 +2492,7 @@ function loadV1Unsafe(inputPath, opts = {}) {
 
    if (opts.resolvedDependencies && opts.resolvedDependencies.length > 0) {
     result.resolved_dependencies = opts.resolvedDependencies.map(dep => {
-      const depLoaded = loadV1Unsafe(dep.path, { ...opts, resolvedDependencies: [] });
+      const depLoaded = loadAssetUnsafe(dep.path, { ...opts, resolvedDependencies: [] });
       // RAG namespace (Story 11): scoped identifier for namespace isolation.
       // Format: name@version (or just name when version is absent).
       const ragNamespace = dep.name
@@ -2199,7 +2578,7 @@ function loadV1Unsafe(inputPath, opts = {}) {
     let textOut = text.trim();
    if (opts.resolvedDependencies && opts.resolvedDependencies.length > 0) {
       for (const dep of opts.resolvedDependencies) {
-        const depLoaded = loadV1Unsafe(dep.path, { ...opts, resolvedDependencies: [] });
+        const depLoaded = loadAssetUnsafe(dep.path, { ...opts, resolvedDependencies: [] });
         if (depLoaded.text) {
           // Namespace header (Story 11): each component section is prefixed
           // with [NAMESPACE: id] so consumers can isolate RAG content per source.
@@ -2218,59 +2597,37 @@ function loadV1Unsafe(inputPath, opts = {}) {
     return result;
   }
 
-  return wrapAsCapsule(result, v1, profile, opts);
+  return wrapAsCapsule(result, layout, profile, { ...opts, as });
 }
 
-function wrapAsCapsule(result, v1, profile, opts) {
+function wrapAsCapsule(result, layout, profile, opts) {
   if (opts.as === 'json') {
-    return buildCapsule(result, v1, profile, opts);
+    return buildRuntimeCapsuleProjection(result, layout, profile, opts);
   }
   return result;
 }
 
-function buildCapsule(loadResult, v1, profile, opts = {}) {
-  const m = v1.manifest;
+function buildRuntimeCapsuleProjection(loadResult, layout, profile, opts = {}) {
+  const m = layout.manifest;
   const val = opts._validation || {};
-  const assetDigest = v1.assetDigest || (v1.map && v1.map['checksums.json']
-    ? (() => {
-        try {
-          const checks = JSON.parse(v1.map['checksums.json'].toString('utf8'));
-          return checks.asset_digest || null;
-        } catch { return null; }
-      })()
-    : null);
-
-  const pubkey = (m.creator && m.creator.pubkey) || (m.author && m.author.pubkey) || null;
+  const pubkey = (m.creator && m.creator.pubkey) || null;
   const sigVerified = val.signature_valid === true;
-  const capsule = {
-    type: 'kdna.context.capsule',
-    version: '1.0',
-    domain: m.name || m.asset_id || null,
-    judgment_version: m.judgment_version || null,
-    asset_digest: assetDigest,
+  const runtimeCapsule = require('../runtime-capsule');
+  const digests = runtimeCapsule.computeDigestEvidence(opts._runtimeAssetBytes, {
+    expectedDigests: opts.expectedDigests,
+  });
+  return runtimeCapsule.buildRuntimeCapsule({
+    projection: loadResult,
+    manifest: m,
+    digests,
     signature: pubkey
       ? { state: sigVerified ? 'verified' : 'not_checked', issuer: pubkey }
       : { state: 'absent' },
-    access: m.access || 'public',
-    risk_level: m.risk_level || null,
-    profile: loadResult.profile,
-    context: loadResult.content || {},
-    trace: {
-      payload_encoding: (m.payload && m.payload.encoding) || 'cbor',
-      loaded_by: 'kdna-core',
-      loaded_at: new Date().toISOString(),
-      schema_valid: val.schema_valid === true,
-      signature_state: sigVerified ? 'verified' : (pubkey ? 'not_checked' : 'absent'),
-      profile: profile,
-    },
-  };
-
-  if (loadResult.extends_chain) capsule.extends_chain = loadResult.extends_chain;
-  if (loadResult.inheritance_applied !== undefined) capsule.inheritance_applied = loadResult.inheritance_applied;
-  if (loadResult.resolved_dependencies) capsule.resolved_dependencies = loadResult.resolved_dependencies;
-  if (loadResult.rag_isolation_policy) capsule.rag_isolation_policy = loadResult.rag_isolation_policy;
-
-  return capsule;
+    inputKind: opts._runtimeInputKind,
+    loadedAt: opts.loadedAt,
+    schemaValid: val.schema_valid === true,
+    profile,
+  });
 }
 
 // ─── Semver & Dependency Resolution (Story 6) ─────────────────────────
@@ -2286,9 +2643,9 @@ function parseSemver(v) {
   };
 }
 
-function compareSemver(v1, v2) {
-  const p1 = parseSemver(v1);
-  const p2 = parseSemver(v2);
+function compareSemver(leftVersion, rightVersion) {
+  const p1 = parseSemver(leftVersion);
+  const p2 = parseSemver(rightVersion);
   if (!p1 || !p2) return 0;
   if (p1.major !== p2.major) return p1.major - p2.major;
   if (p1.minor !== p2.minor) return p1.minor - p2.minor;