@aikdna/kdna-core 0.20.0 → 0.22.0

package/src/container/index.js

@@ -18,7 +18,9 @@
  *   - mimetype must be the first entry in a .kdna container
  *   - mimetype must be STORED (compression method 0) in a .kdna container
  *   - the source directory must contain mimetype, kdna.json, payload.kdnab
- *   - checksums.json and signatures/ are optional
+ *   - checksums.json, attachments/, and signature.kdsig are optional
+ *   - signature.kdsig is the RFC-0021 M1 `kdsig.ed25519` bundle; when present
+ *     it must verify fail-closed against the canonical content digest
  *   - lineage must be a single object (not an array)
  *   - pack output is reproducible within one pinned toolchain/compressor;
  *     DEFLATE bytes may differ across compressors, zlib versions, or systems
@@ -51,17 +53,46 @@ const {
   isVerifiedExternalEntitlement,
 } = require('../external-key-grant');
 
+function warnDispatcherDegraded(e) {
+  process.emitWarning(
+    `container-dispatcher failed to load; falling back to the legacy reader: ${e.message}`,
+    { code: 'KDNA_DISPATCHER_DEGRADED' },
+  );
+  return { readAsset: null };
+}
+
 const { readAsset } = (() => {
+  const dispatcherRequest = '../container-dispatcher.js';
+  // Absence check via require.resolve: resolution only inspects the module
+  // path and never executes the target, so it can only fail with
+  // MODULE_NOT_FOUND when the dispatcher file itself cannot be located.
+  // Message matching is intentionally not used: Node prints the require
+  // stack inside MODULE_NOT_FOUND messages, so a dispatcher whose own
+  // internal dependency is missing would mention "container-dispatcher"
+  // and be misclassified as absent.
   try {
-    return require('../container-dispatcher.js');
-  } catch {
-    return { readAsset: null };
+    require.resolve(dispatcherRequest);
+  } catch (e) {
+    if (e && e.code === 'MODULE_NOT_FOUND') {
+      // The dispatcher file is genuinely absent: expected in minimal
+      // installs. Fall back silently.
+      return { readAsset: null };
+    }
+    return warnDispatcherDegraded(e);
+  }
+  // The file resolved; any failure from here on (missing internal
+  // dependency, syntax error, initialization throw, permission error) is a
+  // real load failure and must be surfaced.
+  try {
+    return require(dispatcherRequest);
+  } catch (e) {
+    return warnDispatcherDegraded(e);
   }
 })();
 
 const MIMETYPE = 'application/vnd.kdna.asset';
 const REQUIRED_DIR_ENTRIES = ['mimetype', 'kdna.json', 'payload.kdnab'];
-const OPTIONAL_DIR_ENTRIES = ['checksums.json', 'signatures', 'attachments'];
+const OPTIONAL_DIR_ENTRIES = ['checksums.json', 'attachments', 'signature.kdsig'];
 const ALLOWED_TOP_LEVEL_ENTRIES = new Set([
   ...REQUIRED_DIR_ENTRIES,
   ...OPTIONAL_DIR_ENTRIES,
@@ -405,7 +436,7 @@ function validateContainerEntryMetadata(entry) {
     }
     throw new Error(`container includes unsupported top-level entry: ${topLevel}`);
   }
-  if ((topLevel === 'signatures' || topLevel === 'attachments') && normalizedName === topLevel) {
+  if (topLevel === 'attachments' && normalizedName === topLevel) {
     throw new Error(`container directory entry is not supported: ${name}`);
   }
   if (method !== 0 && method !== 8) {
@@ -557,8 +588,15 @@ function readLayout(absPath) {
       if (fs.existsSync(full)) {
         if (fs.statSync(full).isFile()) {
           map[f] = fs.readFileSync(full);
+        } else if (f === 'attachments') {
+          // Attachment files join the entry map under their relative names so
+          // digest and signature operations see the same entry set as the
+          // packaged container.
+          for (const entry of listSourceDir(full)) {
+            map[`attachments/${entry.rel}`] = fs.readFileSync(entry.full);
+          }
         } else {
-          // subdirectory like signatures/ — record its presence but not contents here
+          // Optional subdirectories are recorded without becoming payloads.
           map[f] = null;
         }
       }
@@ -570,13 +608,14 @@ function readLayout(absPath) {
     containerBytes = fs.readFileSync(absPath);
     entries = listZipEntriesFromBuffer(containerBytes);
     for (const e of entries) {
-      // We only need the well-known entries; signatures/ attachments/ etc.
+      // We only need the well-known entries and optional attachments.
       // are passed through unchanged by the loader but not parsed here.
       if (
         e.name === 'mimetype' ||
         e.name === 'kdna.json' ||
         e.name === 'payload.kdnab' ||
-        e.name === 'checksums.json'
+        e.name === 'checksums.json' ||
+        e.name === 'signature.kdsig'
       ) {
         map[e.name] = e.data;
       }
@@ -633,7 +672,8 @@ function readLayoutBytes(input) {
       entry.name === 'mimetype' ||
       entry.name === 'kdna.json' ||
       entry.name === 'payload.kdnab' ||
-      entry.name === 'checksums.json'
+      entry.name === 'checksums.json' ||
+      entry.name === 'signature.kdsig'
     ) {
       map[entry.name] = entry.data;
     }
@@ -732,6 +772,32 @@ function parsePayloadEntry(name, bytes, opts = {}) {
   return parsed;
 }
 
+function assertDecryptedPayloadValid(payload, manifest) {
+  const validators = loadSchemas();
+  if (!validators) {
+    const error = new Error(
+      'Decrypted payload schema validation is unavailable.',
+    );
+    error.code = 'KDNA_PAYLOAD_SCHEMA_UNAVAILABLE';
+    throw error;
+  }
+  const isBundleProfile =
+    manifest.compatibility?.profile === 'kdna.payload.bundle' ||
+    manifest.asset_type === 'bundle';
+  const validator = isBundleProfile
+    ? validators.bundlePayload
+    : validators.payload;
+  if (validator(payload)) return payload;
+  const details = (validator.errors || [])
+    .map((entry) => `${entry.instancePath || '<root>'} ${entry.message}`)
+    .join('; ');
+  const error = new Error(
+    `Decrypted payload failed its declared schema${details ? `: ${details}` : '.'}`,
+  );
+  error.code = 'KDNA_PAYLOAD_INVALID';
+  throw error;
+}
+
 // ─── inspect ───────────────────────────────────────────────────────────
 
 /**
@@ -754,8 +820,8 @@ function buildInspectOutput(container) {
     ...assessLoaderCompatibility(m),
     load_contract_default_profile: m.load_contract ? m.load_contract.default_profile : null,
   };
-  if (m.signatures !== undefined) out.signature_count = Array.isArray(m.signatures) ? m.signatures.length : 0;
   if (container.map['checksums.json']) out.checksums_present = true;
+  if (container.map['signature.kdsig']) out.signature_present = true;
   return out;
 }
 
@@ -772,6 +838,9 @@ function runValidate(layout) {
     schema_valid: true,
     payload_valid: true,
     checksums_valid: true,
+    signature_valid: true,
+    signature_state: 'absent',
+    signature_evidence: null,
     load_contract_valid: true,
     ...assessLoaderCompatibility(layout.manifest),
   };
@@ -926,6 +995,26 @@ function runValidate(layout) {
     }
   }
 
+  // signature gate — RFC-0021 M1 (`kdsig.ed25519`). An absent signature is
+  // not an error; a present signature must verify fail-closed.
+  if (layout.map['signature.kdsig'] !== undefined) {
+    try {
+      const signature = require('../signature');
+      const { contentDigestFromEntryBuffers } = require('../asset-reader');
+      const contentDigest = contentDigestFromEntryBuffers(fullEntryBufferMap(layout));
+      const evidence = signature.verifySignatureBundle(
+        layout.map['signature.kdsig'],
+        contentDigest,
+      );
+      result.signature_state = 'verified';
+      result.signature_evidence = evidence;
+    } catch (e) {
+      result.signature_valid = false;
+      result.signature_state = 'invalid';
+      problems.push(`signature: ${e.message}`);
+    }
+  }
+
   // load_contract gate — only if manifest references a load_contract block
   if (layout.manifest.load_contract) {
     const lc = layout.manifest.load_contract;
@@ -1043,12 +1132,39 @@ function verifyDigests(checksums, map, problems, result) {
   return stillValid;
 }
 
+/**
+ * Collect every file entry of a layout as name → Buffer, so digest and
+ * signature operations always cover the full entry set (including
+ * attachments), regardless of which entries layout.map parses.
+ */
+function fullEntryBufferMap(layout) {
+  const buffers = {};
+  if (Array.isArray(layout.entries)) {
+    for (const entry of layout.entries) {
+      // Entries are either parsed ZIP entry objects ({ name, data }) or plain
+      // entry names from the unified container model; both resolve through
+      // layout.map.
+      const name = typeof entry === 'string' ? entry : entry.name;
+      const data = typeof entry === 'string' ? layout.map[entry] : entry.data;
+      if (data === undefined || data === null) continue;
+      buffers[name] = data;
+    }
+    return buffers;
+  }
+  for (const [name, data] of Object.entries(layout.map)) {
+    if (data === null || data === undefined) continue;
+    buffers[name] = data;
+  }
+  return buffers;
+}
+
 function finalizeValidate(result, problems) {
   result.overall_valid =
     result.format_valid &&
     result.schema_valid &&
     result.payload_valid &&
     result.checksums_valid &&
+    result.signature_valid &&
     result.load_contract_valid;
   result.problems = problems;
   return result;
@@ -1205,6 +1321,108 @@ function pack(sourceDir, outputPath) {
   return { outputPath, entries: order };
 }
 
+/**
+ * Deterministically pack an in-memory entry map into .kdna container bytes.
+ * mimetype is forced first and STORED; remaining entries are ordered by UTF-8
+ * path bytes and DEFLATE-compressed; timestamps are pinned to the DOS epoch.
+ */
+function packEntryMap(map) {
+  for (const f of REQUIRED_DIR_ENTRIES) {
+    if (!map[f]) throw new Error(`cannot pack: missing required entry ${f}`);
+  }
+  const mime = Buffer.isBuffer(map.mimetype) ? map.mimetype.toString('utf8') : String(map.mimetype);
+  if (mime !== MIMETYPE) {
+    throw new Error(`cannot pack: mimetype is "${mime}", expected "${MIMETYPE}"`);
+  }
+  const names = Object.keys(map).filter((name) => name !== 'mimetype');
+  names.sort((a, b) => Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8')));
+  const order = ['mimetype', ...names];
+
+  const localChunks = [];
+  const centralChunks = [];
+  let offset = 0;
+  for (const rel of order) {
+    const data = rel === 'mimetype' ? Buffer.from(MIMETYPE, 'utf8') : Buffer.from(map[rel]);
+    const nameBytes = Buffer.from(rel, 'utf8');
+    const method = rel === 'mimetype' ? 0 : 8;
+    const built = buildLocalHeader(nameBytes, data, method);
+    localChunks.push(built.local, built.compressed);
+    centralChunks.push(
+      buildCentral(
+        {
+          method,
+          crc: built.crc,
+          time: built.time,
+          date: built.date,
+          compressed: built.compressed,
+          dataLength: built.dataLength,
+          offset,
+        },
+        nameBytes,
+      ),
+    );
+    offset += built.local.length + built.compressed.length;
+  }
+
+  const centralOffset = offset;
+  let centralSize = 0;
+  for (const c of centralChunks) centralSize += c.length;
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(0, 4);
+  eocd.writeUInt16LE(0, 6);
+  eocd.writeUInt16LE(order.length, 8);
+  eocd.writeUInt16LE(order.length, 10);
+  eocd.writeUInt32LE(centralSize, 12);
+  eocd.writeUInt32LE(centralOffset, 16);
+  eocd.writeUInt16LE(0, 20);
+
+  return Buffer.concat([...localChunks, ...centralChunks, eocd]);
+}
+
+/**
+ * Sign a packaged .kdna container per RFC-0021 M1 (`kdsig.ed25519`).
+ *
+ * The container must pass every validation gate after any pre-existing
+ * signature entry is removed; signing never certifies a broken asset. The
+ * returned bytes carry a fresh `signature.kdsig` bundle whose Ed25519
+ * signature covers the canonical content digest. Fail-closed throughout.
+ */
+function signContainerBytes(input, privateKeySeedHex, _opts = {}) {
+  const signature = require('../signature');
+  const { contentDigestFromEntryBuffers } = require('../asset-reader');
+
+  const bytes = Buffer.isBuffer(input) ? input : Buffer.from(input);
+  const layout = readLayoutBytes(bytes);
+
+  // Rebuild the full entry map (including attachments) from the parsed
+  // ZIP entries; layout.map only carries the well-known protocol entries.
+  const unsignedMap = {};
+  for (const entry of layout.entries) {
+    if (entry.name === 'signature.kdsig') continue;
+    unsignedMap[entry.name] = entry.data;
+  }
+  const validation = runValidate({ ...layout, map: unsignedMap });
+  if (!validation.overall_valid) {
+    const error = new Error(
+      `cannot sign: container does not pass validation (${validation.problems.join('; ')})`,
+    );
+    error.code = 'KDNA_SIGNATURE_INPUT_INVALID';
+    throw error;
+  }
+
+  const contentDigest = contentDigestFromEntryBuffers(unsignedMap);
+  const bundle = signature.signContentDigest(contentDigest, privateKeySeedHex);
+  const bundleBytes = signature.serializeSignatureBundle(bundle);
+  const signedMap = { ...unsignedMap, [signature.SIGNATURE_ENTRY_NAME]: bundleBytes };
+  return {
+    containerBytes: packEntryMap(signedMap),
+    bundle,
+    bundleBytes,
+    content_digest: contentDigest,
+  };
+}
+
 // ─── unpack ────────────────────────────────────────────────────────────
 
 /**
@@ -1285,6 +1503,12 @@ function buildLoadPlanIssue(code, severity, message) {
 
 function validationProblemCode(problem) {
   if (/checksums?:/i.test(problem)) return 'KDNA_INTEGRITY_DIGEST_FAILED';
+  if (/signature bundle profile_version .* is not supported/i.test(problem)) {
+    return 'KDNA_SIGNATURE_VERSION_UNSUPPORTED';
+  }
+  if (/signature bundle (profile|algorithm) .* is not supported/i.test(problem)) {
+    return 'KDNA_SIGNATURE_PROFILE_UNSUPPORTED';
+  }
   if (/signature/i.test(problem)) return 'KDNA_INTEGRITY_SIGNATURE_FAILED';
   if (/payload:/i.test(problem)) return 'KDNA_FORMAT_INVALID';
   if (/manifest:/i.test(problem)) return 'KDNA_FORMAT_INVALID';
@@ -1322,7 +1546,9 @@ function inputFingerprint(inputPath, layout, opts = {}) {
   ) ? opts.entitlement.status : null;
 
   return {
-    has_password_input: opts.hasPassword === true,
+    has_password_input:
+      opts.hasPassword === true ||
+      (typeof opts.password === 'string' && opts.password.length > 0),
     entitlement_input: entitlementInput,
     source_fingerprint: computeSourceFingerprint(inputPath, layout),
   };
@@ -1356,9 +1582,11 @@ function baseLoadPlan(inputPath, layout, validation, opts = {}) {
       schema_valid: validation.schema_valid,
       payload_valid: validation.payload_valid,
       checksums_valid: validation.checksums_valid,
+      signature_valid: validation.signature_valid,
       load_contract_valid: validation.load_contract_valid,
       overall_valid: validation.overall_valid,
     },
+    signature_state: validation.signature_state,
     issues: [],
     source: {
       kind: layout.kind,
@@ -1424,7 +1652,8 @@ function planLoad(inputPath, opts = {}) {
         access: null, access_alias: null, entitlement_profile: null,
         state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
         input_fingerprint: null,
-        checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, load_contract_valid: false, overall_valid: false },
+        checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, signature_valid: false, load_contract_valid: false, overall_valid: false },
+        signature_state: 'absent',
         issues: [buildLoadPlanIssue('KDNA_FORMAT_INVALID', 'blocking', e.message)],
         source: inputSource(inputPath, 'memory'),
       });
@@ -1448,7 +1677,8 @@ function planLoad(inputPath, opts = {}) {
           access: null, access_alias: null, entitlement_profile: null,
           state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
           input_fingerprint: null,
-          checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, load_contract_valid: false, overall_valid: false },
+          checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, signature_valid: false, load_contract_valid: false, overall_valid: false },
+          signature_state: 'absent',
           issues: [buildLoadPlanIssue(
             e.code === 'KDNA_FORMAT_UNKNOWN' ? 'KDNA_FORMAT_UNKNOWN' : 'KDNA_FORMAT_INVALID',
             'blocking', e.message,
@@ -1469,7 +1699,8 @@ function planLoad(inputPath, opts = {}) {
         access: null, access_alias: null, entitlement_profile: null,
         state: 'invalid', required_action: 'block', can_load_now: false, projection_policy: 'none',
         input_fingerprint: null,
-        checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, load_contract_valid: false, overall_valid: false },
+        checks: { format_valid: false, schema_valid: false, payload_valid: false, checksums_valid: false, signature_valid: false, load_contract_valid: false, overall_valid: false },
+        signature_state: 'absent',
         issues: [buildLoadPlanIssue('KDNA_FORMAT_INVALID', 'blocking', e.message)],
         source: inputSource(inputPath, null),
       });
@@ -1675,18 +1906,19 @@ function planLoad(inputPath, opts = {}) {
     }
 
     if (plan.entitlement_profile === 'password') {
-      if (opts.password || opts.hasPassword === true) {
-        if (opts.hasPassword === true && !opts.password) {
-          plan.issues.push(buildLoadPlanIssue(
-            'KDNA_AUTH_PASSWORD_DIAGNOSTIC',
-            'info',
-            'hasPassword is a diagnostic credential-presence signal only; it does not verify the password.',
-          ));
-        }
-        plan.state = 'ready';
-        plan.required_action = 'load';
-        plan.can_load_now = true;
-        plan.projection_policy = 'minimal';
+      if (
+        opts.hasPassword === true ||
+        (typeof opts.password === 'string' && opts.password.length > 0)
+      ) {
+        plan.state = 'needs_password';
+        plan.required_action = 'enter_password';
+        plan.can_load_now = false;
+        plan.projection_policy = 'none';
+        plan.issues.push(buildLoadPlanIssue(
+          'KDNA_AUTH_PASSWORD_UNVERIFIED',
+          'blocking',
+          'A password was provided but has not been verified. Only an authorized load may verify it by decrypting the protected payload.',
+        ));
       } else {
         plan.state = 'needs_password';
         plan.required_action = 'enter_password';
@@ -1921,6 +2153,8 @@ module.exports = {
   isKdnaSourceDir,
   detectContainerFormat,
   readLayout: readLayout,
+  readLayoutBytes,
+  fullEntryBufferMap,
   inspect,
   validate,
   planLoad,
@@ -1928,6 +2162,8 @@ module.exports = {
   buildChecksums: buildChecksums,
   computeRuntimeEntrySetDigest,
   pack,
+  packEntryMap,
+  signContainerBytes,
   unpack,
   load: loadAsset,
   loadAsset: loadAsset,
@@ -1958,10 +2194,10 @@ function renderPromptItem(item) {
   if (item.type === 'axiom_applicability' && item.one_sentence) {
     const parts = [item.one_sentence];
     if (Array.isArray(item.applies_when) && item.applies_when.length) {
-      parts.push(`applies when: ${item.applies_when.slice(0, 2).join('; ')}`);
+      parts.push(`applies when: ${item.applies_when.join('; ')}`);
     }
     if (Array.isArray(item.does_not_apply_when) && item.does_not_apply_when.length) {
-      parts.push(`does not apply when: ${item.does_not_apply_when.slice(0, 2).join('; ')}`);
+      parts.push(`does not apply when: ${item.does_not_apply_when.join('; ')}`);
     }
     if (item.failure_risk) parts.push(`failure risk: ${item.failure_risk}`);
     return parts.join(' — ');
@@ -2035,7 +2271,13 @@ function loadAuthorized(inputPath, opts = {}) {
   const inputKind = typeof inputPath === 'string' ? 'packaged_file' : 'packaged_bytes';
   const inputSnapshot = snapshotPackagedInput(inputPath);
   const plan = planLoad(inputSnapshot, opts);
-  if (plan.can_load_now !== true) {
+  const loadMayVerifyPassword =
+    typeof opts.password === 'string' &&
+    opts.password.length > 0 &&
+    plan.state === 'needs_password' &&
+    Array.isArray(plan.issues) &&
+    plan.issues.some((issue) => issue.code === 'KDNA_AUTH_PASSWORD_UNVERIFIED');
+  if (plan.can_load_now !== true && !loadMayVerifyPassword) {
     const issueCodes = Array.isArray(plan.issues)
       ? plan.issues.map((issue) => issue.code).filter(Boolean)
       : [];
@@ -2052,7 +2294,8 @@ function loadAuthorized(inputPath, opts = {}) {
     extendsChain: plan.extends_chain || [],
     _validation: {
       schema_valid: plan.checks && plan.checks.overall_valid === true,
-      signature_valid: plan.signature_valid === true,
+      signature_valid: plan.checks && plan.checks.signature_valid === true,
+      signature_state: plan.signature_state,
     },
     _runtimeAssetBytes: inputSnapshot,
     _runtimeInputKind: inputKind,
@@ -2094,9 +2337,11 @@ function packagedAssetRequiredPlan(inputPath) {
       schema_valid: false,
       payload_valid: false,
       checksums_valid: false,
+      signature_valid: false,
       load_contract_valid: false,
       overall_valid: false,
     },
+    signature_state: 'absent',
     issues: [buildLoadPlanIssue(
       'KDNA_ASSET_FILE_REQUIRED',
       'blocking',
@@ -2195,7 +2440,8 @@ function loadRemoteRuntimeAssetForServer(inputPath) {
     extendsChain: [],
     _validation: {
       schema_valid: plan.checks.overall_valid === true,
-      signature_valid: plan.signature_valid === true,
+      signature_valid: plan.checks.signature_valid === true,
+      signature_state: plan.signature_state,
     },
     _runtimeAssetBytes: inputSnapshot,
     _runtimeInputKind: inputKind,
@@ -2226,7 +2472,11 @@ function normalizeCompactAxiom(axiom) {
   if (!axiom || typeof axiom !== 'object') return null;
   const statement = axiom.statement || axiom.one_sentence || axiom.full_statement || axiom.id || null;
   if (!statement) return null;
-  const oneSentence = (axiom.one_sentence && !String(axiom.one_sentence).startsWith('<TBD')) ? axiom.one_sentence : (typeof axiom.full_statement === 'string' && axiom.full_statement.length > 0 ? axiom.full_statement.substring(0, 120) + (axiom.full_statement.length > 120 ? '…' : '') : statement);
+  const oneSentence = (axiom.one_sentence && !String(axiom.one_sentence).startsWith('<TBD'))
+    ? axiom.one_sentence
+    : (typeof axiom.full_statement === 'string' && axiom.full_statement.length > 0
+      ? axiom.full_statement
+      : statement);
   return {
     type: 'axiom_applicability',
     id: axiom.id || null,
@@ -2251,6 +2501,27 @@ function hasStandardJudgmentRoleContent(role) {
   );
 }
 
+function projectMinimalAxiom(axiom) {
+  const normalized = normalizeCompactAxiom(axiom);
+  if (!normalized) return null;
+  return {
+    type: 'axiom_applicability',
+    id: normalized.id || null,
+    one_sentence: normalized.one_sentence || null,
+    does_not_apply_when: normalized.does_not_apply_when || [],
+    failure_risk: normalized.failure_risk || null,
+  };
+}
+
+function hasMinimalPromptContent(content) {
+  if (!content) return false;
+  return Boolean(
+    content.highest_question ||
+      (Array.isArray(content.axioms) && content.axioms.length > 0) ||
+      (Array.isArray(content.boundaries) && content.boundaries.length > 0)
+  );
+}
+
 function hasCompactPromptContent(content) {
   if (!content) return false;
   return Boolean(
@@ -2260,12 +2531,120 @@ function hasCompactPromptContent(content) {
       hasStandardJudgmentRoleContent(content.judgment_role) ||
       (Array.isArray(content.axioms) && content.axioms.length > 0) ||
       (Array.isArray(content.boundaries) && content.boundaries.length > 0) ||
+      (Array.isArray(content.core_structure) && content.core_structure.length > 0) ||
       (Array.isArray(content.self_checks) && content.self_checks.length > 0) ||
       (Array.isArray(content.failure_modes) && content.failure_modes.length > 0) ||
       (Array.isArray(content.patterns) && content.patterns.length > 0)
   );
 }
 
+const COMPACT_PROJECTED_CORE_FIELDS = new Set([
+  'highest_question',
+  'worldview',
+  'value_order',
+  'judgment_role',
+  'axioms',
+  'boundaries',
+  'core_structure',
+]);
+const COMPACT_PROJECTED_REASONING_FIELDS = new Set(['self_check', 'failure_modes']);
+const COMPACT_PROJECTED_AXIOM_FIELDS = new Set([
+  'id',
+  'statement',
+  'one_sentence',
+  'applies_when',
+  'does_not_apply_when',
+  'failure_risk',
+]);
+const COMPACT_NON_CONTENT_FIELDS = new Set(['profile', 'profile_version']);
+
+function escapeJsonPointerToken(value) {
+  return String(value).replaceAll('~', '~0').replaceAll('/', '~1');
+}
+
+function omissionCount(value) {
+  if (value === undefined || value === null) return 0;
+  if (Array.isArray(value)) return value.length;
+  if (typeof value === 'string') return value.trim() ? 1 : 0;
+  if (typeof value === 'object') return Object.keys(value).length > 0 ? 1 : 0;
+  return 1;
+}
+
+function addOmittedValue(entries, pointer, value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    for (const key of Object.keys(value).sort()) {
+      addOmittedValue(
+        entries,
+        `${pointer}/${escapeJsonPointerToken(key)}`,
+        value[key],
+      );
+    }
+    return;
+  }
+  const count = omissionCount(value);
+  if (count > 0) entries.push({ path: pointer, count });
+}
+
+function addOmittedAxiomFields(entries, axioms) {
+  const counts = new Map();
+  for (const axiom of Array.isArray(axioms) ? axioms : []) {
+    if (!axiom || typeof axiom !== 'object' || Array.isArray(axiom)) continue;
+    for (const key of Object.keys(axiom).sort()) {
+      if (COMPACT_PROJECTED_AXIOM_FIELDS.has(key)) continue;
+      const count = omissionCount(axiom[key]);
+      if (count === 0) continue;
+      const path = `/core/axioms/*/${escapeJsonPointerToken(key)}`;
+      counts.set(path, (counts.get(path) || 0) + count);
+    }
+  }
+  for (const path of [...counts.keys()].sort()) {
+    entries.push({ path, count: counts.get(path) });
+  }
+}
+
+function buildCompactProjectionReport(payload) {
+  const entries = [];
+  const core = payload && typeof payload.core === 'object' && !Array.isArray(payload.core)
+    ? payload.core
+    : {};
+  const reasoning = payload && typeof payload.reasoning === 'object' && !Array.isArray(payload.reasoning)
+    ? payload.reasoning
+    : {};
+
+  for (const key of Object.keys(core).sort()) {
+    if (!COMPACT_PROJECTED_CORE_FIELDS.has(key)) {
+      addOmittedValue(entries, `/core/${escapeJsonPointerToken(key)}`, core[key]);
+    }
+  }
+  addOmittedAxiomFields(entries, core.axioms);
+
+  for (const key of Object.keys(reasoning).sort()) {
+    if (!COMPACT_PROJECTED_REASONING_FIELDS.has(key)) {
+      addOmittedValue(entries, `/reasoning/${escapeJsonPointerToken(key)}`, reasoning[key]);
+    }
+  }
+
+  for (const key of Object.keys(payload || {}).sort()) {
+    if (
+      COMPACT_NON_CONTENT_FIELDS.has(key) ||
+      key === 'core' ||
+      key === 'patterns' ||
+      key === 'reasoning'
+    ) {
+      continue;
+    }
+    addOmittedValue(entries, `/${escapeJsonPointerToken(key)}`, payload[key]);
+  }
+
+  entries.sort((left, right) => left.path.localeCompare(right.path));
+  const omittedTotal = entries.reduce((total, entry) => total + entry.count, 0);
+  return {
+    status: omittedTotal > 0 ? 'partial' : 'complete',
+    omitted: entries,
+    omitted_total: omittedTotal,
+  };
+}
+
 function loadAssetUnsafe(inputPath, opts = {}) {
   const layout = readInputLayout(inputPath);
   const m = layout.manifest;
@@ -2284,6 +2663,7 @@ function loadAssetUnsafe(inputPath, opts = {}) {
     // B4: Attempt decryption when password or decrypt hook is available.
     if (opts.decryptEntry) {
       // Consumer-provided decrypt hook (e.g., licensed entry key)
+      let decryptedBuf;
       try {
         const decrypted = opts.decryptEntry({
           asset: { entries: layout.map, manifest: m },
@@ -2291,18 +2671,27 @@ function loadAssetUnsafe(inputPath, opts = {}) {
           entryName: 'payload.kdnab',
           ciphertext: layout.map['payload.kdnab'],
         });
-        const decryptedBuf = typeof decrypted === 'string'
+        decryptedBuf = typeof decrypted === 'string'
           ? Buffer.from(decrypted, 'utf8')
           : Buffer.from(decrypted);
-        payload = parsePayloadEntry('payload.kdnab', decryptedBuf);
       } catch (e) {
         const err = new Error(`Decryption failed: ${e.message}`);
         err.code = e.code || 'KDNA_DECRYPT_FAILED';
         throw err;
       }
+      try {
+        payload = assertDecryptedPayloadValid(
+          parsePayloadEntry('payload.kdnab', decryptedBuf),
+          m,
+        );
+      } catch (error) {
+        if (!error.code) error.code = 'KDNA_PAYLOAD_INVALID';
+        throw error;
+      }
     } else if (opts.password) {
       // Password-based decryption via kdna.encryption.password*
       // profiles. Detects Argon2id vs scrypt from the envelope profile.
+      let decryptedBuf;
       try {
         const {
           decryptProtectedEntry,
@@ -2316,17 +2705,25 @@ function loadAssetUnsafe(inputPath, opts = {}) {
         const decryptFn = (envelope.profile === PASSWORD_PROTECTED_SCRYPT_PROFILE)
           ? decryptProtectedEntryScrypt
           : decryptProtectedEntry;
-        const decryptedBuf = decryptFn(encryptedEnvelope, {
+        decryptedBuf = decryptFn(encryptedEnvelope, {
           entryName: 'payload.kdnab',
           manifest: m,
           password: opts.password,
         });
-        payload = parsePayloadEntry('payload.kdnab', decryptedBuf);
       } catch (e) {
         const err = new Error(`Decryption failed with provided password: ${e.message}`);
         err.code = 'KDNA_DECRYPT_FAILED';
         throw err;
       }
+      try {
+        payload = assertDecryptedPayloadValid(
+          parsePayloadEntry('payload.kdnab', decryptedBuf),
+          m,
+        );
+      } catch (error) {
+        if (!error.code) error.code = 'KDNA_PAYLOAD_INVALID';
+        throw error;
+      }
     } else {
       const isExternal = payload.profile === EXTERNAL_ENVELOPE_PROFILE;
       const err = new Error(
@@ -2372,6 +2769,17 @@ function loadAssetUnsafe(inputPath, opts = {}) {
       || (payload.reasoning && ((payload.reasoning.self_check && payload.reasoning.self_check.length > 0) || (payload.reasoning.failure_modes && payload.reasoning.failure_modes.length > 0)));
     profiles.push('index');
     if (hasJudgment) profiles.push('compact');
+    // RFC-0020: minimal availability follows the manifest declaration, not
+    // payload inference. An asset that declares minimal in load_contract
+    // (and carries core judgment) may be projected minimally.
+    if (
+      hasJudgment &&
+      m.load_contract &&
+      m.load_contract.profiles &&
+      m.load_contract.profiles.minimal
+    ) {
+      profiles.push('minimal');
+    }
     if (payload.scenarios && payload.scenarios.length > 0) profiles.push('scenario');
     profiles.push('full');
     return profiles;
@@ -2408,6 +2816,32 @@ function loadAssetUnsafe(inputPath, opts = {}) {
         ))
         : []
     );
+    const projectCoreStructure = (items) => (
+      Array.isArray(items)
+        ? items.map((relation) => {
+            if (
+              !relation ||
+              typeof relation !== 'object' ||
+              Array.isArray(relation)
+            ) {
+              return null;
+            }
+            const projected = {};
+            for (const key of [
+              'from',
+              'to',
+              'via',
+              'applies_when',
+              'does_not_apply_when',
+            ]) {
+              if (relation[key] !== undefined) {
+                projected[key] = globalThis.structuredClone(relation[key]);
+              }
+            }
+            return projected;
+          }).filter(Boolean)
+        : []
+    );
     result.content = {
       highest_question: core.highest_question || null,
       // These scoped domain-level values are already validated by the payload
@@ -2423,16 +2857,48 @@ function loadAssetUnsafe(inputPath, opts = {}) {
           : null,
       axioms: (core.axioms || []).map(normalizeCompactAxiom).filter(Boolean),
       boundaries: normalizeList(core.boundaries),
+      // Relations are already part of the public Payload. Preserve order and
+      // the closed public relation fields, never arbitrary authoring state.
+      core_structure: projectCoreStructure(core.core_structure),
       // Payload uses the singular field name while Runtime Capsule uses the
       // plural collection name. Preserve every validated item and its shape;
       // strings remain strings and structured questions remain objects.
       self_checks: preserveDeclaredList(payload.reasoning && payload.reasoning.self_check),
       failure_modes: normalizeList(payload.reasoning && payload.reasoning.failure_modes),
-      patterns: normalizeList(payload.patterns).slice(0, 3),
+      patterns: normalizeList(payload.patterns),
     };
+    result.projection_report = buildCompactProjectionReport(payload);
     if (m.load_contract && m.load_contract.profiles && m.load_contract.profiles.compact && m.load_contract.profiles.compact.max_tokens_hint) {
       result.max_tokens_hint = m.load_contract.profiles.compact.max_tokens_hint;
     }
+  } else if (profile === 'minimal') {
+    const core = payload.core || {};
+    // RFC-0020: minimal availability follows the manifest declaration. If the
+    // asset does not declare minimal in load_contract, fail closed with an
+    // empty projection rather than silently serving a projection the asset
+    // did not opt into.
+    if (!result.profile_available) {
+      result.content = {};
+      result.projection_report = buildCompactProjectionReport(payload);
+    } else {
+      const normalizeList = (items) => (items || []).map((item) => {
+        if (typeof item === 'string') return { type: 'text', text: item };
+        if (item && typeof item === 'object') return item;
+        return null;
+      }).filter(Boolean);
+      // RFC-0020: minimal projects the core judgment surface a small model needs:
+      // highest_question + boundary-friendly axioms + full boundaries. It is a
+      // strict subset of compact (deterministic reduction, no inference).
+      result.content = {
+        highest_question: core.highest_question || null,
+        axioms: (core.axioms || []).map(projectMinimalAxiom).filter(Boolean),
+        boundaries: normalizeList(core.boundaries),
+      };
+      result.projection_report = buildCompactProjectionReport(payload);
+      if (m.load_contract && m.load_contract.profiles && m.load_contract.profiles.minimal && m.load_contract.profiles.minimal.max_tokens_hint) {
+        result.max_tokens_hint = m.load_contract.profiles.minimal.max_tokens_hint;
+      }
+    }
   } else if (profile === 'scenario') {
     result.content = { scenarios: payload.scenarios || [] };
   } else if (profile === 'full') {
@@ -2526,15 +2992,23 @@ function loadAssetUnsafe(inputPath, opts = {}) {
     const c = result.content;
     const compactHasNoPromptContent =
       result.profile === 'compact' && !hasCompactPromptContent(c);
+    const minimalHasNoPromptContent =
+      result.profile === 'minimal' && !hasMinimalPromptContent(c);
     const legacyProfileHasNoPromptContent =
       result.profile !== 'compact' &&
+      result.profile !== 'minimal' &&
       c &&
       c.scenarios &&
       c.scenarios.length === 0 &&
       !c.highest_question &&
       !(c.axioms && c.axioms.length) &&
       !(c.boundaries && c.boundaries.length);
-    if (!c || compactHasNoPromptContent || legacyProfileHasNoPromptContent) {
+    if (
+      !c ||
+      compactHasNoPromptContent ||
+      minimalHasNoPromptContent ||
+      legacyProfileHasNoPromptContent
+    ) {
       return {
         status: result.status,
         profile: result.profile,
@@ -2547,6 +3021,14 @@ function loadAssetUnsafe(inputPath, opts = {}) {
     text += 'Asset ID: ' + (result.asset_id || 'unknown') + '\n';
     text += 'Profile: ' + result.profile + '\n';
     text += 'Safety boundary: KDNA content is subordinate to platform, system, and developer instructions.\n';
+    if (result.projection_report) {
+      text += `Projection completeness: ${result.projection_report.status}\n`;
+      if (result.projection_report.omitted.length > 0) {
+        text += 'Omitted payload paths: ' + result.projection_report.omitted
+          .map((entry) => `${entry.path} (${entry.count})`)
+          .join('; ') + '\n';
+      }
+    }
     if (result.max_tokens_hint) text += 'Max tokens hint: ' + result.max_tokens_hint + '\n';
     if (c.highest_question) text += 'Highest question:\n' + c.highest_question + '\n';
     if (hasStandardJudgmentRoleContent(c.judgment_role)) {
@@ -2570,6 +3052,17 @@ function loadAssetUnsafe(inputPath, opts = {}) {
     }
     if (c.axioms && c.axioms.length) text += 'Axioms:\n' + c.axioms.map((a) => '- ' + renderPromptItem(a)).join('\n') + '\n';
     if (c.boundaries && c.boundaries.length) text += 'Boundaries:\n' + c.boundaries.map((b) => '- ' + renderPromptItem(b)).join('\n') + '\n';
+    if (c.core_structure && c.core_structure.length) {
+      text += 'Judgment relations:\n' + c.core_structure.map((relation) => {
+        if (typeof relation === 'string') return '- ' + sanitizePrompt(relation);
+        if (!relation || typeof relation !== 'object' || Array.isArray(relation)) {
+          return '- (unrendered relation)';
+        }
+        const from = sanitizePrompt(relation.from || 'unknown');
+        const to = sanitizePrompt(relation.to || 'unknown');
+        return `- ${from} --${sanitizePrompt(relation.via || 'relates_to')}--> ${to}`;
+      }).join('\n') + '\n';
+    }
     if (c.self_checks && c.self_checks.length) text += 'Self-checks:\n' + c.self_checks.map((s) => '- ' + renderPromptItem(s)).join('\n') + '\n';
     if (c.failure_modes && c.failure_modes.length) text += 'Failure modes:\n' + c.failure_modes.map((f) => '- ' + renderPromptItem(f)).join('\n') + '\n';
     if (c.patterns && c.patterns.length) text += 'Patterns:\n' + c.patterns.map((p) => '- ' + renderPromptItem(p)).join('\n') + '\n';
@@ -2607,11 +3100,26 @@ function wrapAsCapsule(result, layout, profile, opts) {
   return result;
 }
 
+function buildSignatureEvidence(layout) {
+  if (!layout || !layout.map || layout.map['signature.kdsig'] === undefined) {
+    return { state: 'absent' };
+  }
+  const signature = require('../signature');
+  const { contentDigestFromEntryBuffers } = require('../asset-reader');
+  const contentDigest = contentDigestFromEntryBuffers(fullEntryBufferMap(layout));
+  const evidence = signature.verifySignatureBundle(layout.map['signature.kdsig'], contentDigest);
+  return {
+    state: 'verified',
+    profile: evidence.profile,
+    profile_version: evidence.profile_version,
+    key_fingerprint: evidence.key_fingerprint,
+    content_digest: evidence.content_digest,
+  };
+}
+
 function buildRuntimeCapsuleProjection(loadResult, layout, profile, opts = {}) {
   const m = layout.manifest;
   const val = opts._validation || {};
-  const pubkey = (m.creator && m.creator.pubkey) || null;
-  const sigVerified = val.signature_valid === true;
   const runtimeCapsule = require('../runtime-capsule');
   const digests = runtimeCapsule.computeDigestEvidence(opts._runtimeAssetBytes, {
     expectedDigests: opts.expectedDigests,
@@ -2620,9 +3128,7 @@ function buildRuntimeCapsuleProjection(loadResult, layout, profile, opts = {}) {
     projection: loadResult,
     manifest: m,
     digests,
-    signature: pubkey
-      ? { state: sigVerified ? 'verified' : 'not_checked', issuer: pubkey }
-      : { state: 'absent' },
+    signature: buildSignatureEvidence(layout),
     inputKind: opts._runtimeInputKind,
     loadedAt: opts.loadedAt,
     schemaValid: val.schema_valid === true,