@aopslabs/aops 0.3.17 → 0.3.18

package/agent-assets-release/agent-assets/core/{e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1 → 387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447}/files/user-guides/aops-cli.md

@@ -61,6 +61,19 @@ aops update prepare --json
 aops update apply --plan <update-plan.json> --confirm <sha256-plan-id> --json
 ```
 
+For the one-time transition from a CLI released before candidate-owned update
+execution, prepare with the installed CLI and apply through the exact external
+target package instead:
+
+```text
+# macOS/Linux (`NUL` replaces `/dev/null` on Windows)
+npm exec --yes --registry=https://registry.npmjs.org --userconfig=/dev/null --package=@aopslabs/aops@<exact-target> -- aops update bridge --plan <update-plan.json> --confirm <sha256-plan-id> --json
+```
+
+`update bridge` refuses to run from the installed old CLI and requires its own
+package version to equal the immutable plan target. Future transitions use the
+normal candidate-owned `update apply` path.
+
 Prepare is non-mutating and retains exact candidate and rollback tarballs.
 Apply stops Cockpit before Server, installs the public closure as one global
 CLI with its exact nested Server, repeatedly checks loopback health, and

package/agent-assets-release/agent-assets/core/{e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1 → 387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447}/files/user-guides/aops-system.md

@@ -55,6 +55,21 @@ aops update prepare --json
 aops update apply --plan <update-plan.json> --confirm <sha256-plan-id> --json
 ```
 
+CLI versions released before candidate-owned execution cannot retroactively
+load the safer apply implementation. For that one transition, let the
+installed old CLI run `prepare`, then launch the exact target package outside
+the global installation and use its explicit bridge command. macOS/Linux:
+
+```text
+npm exec --yes --registry=https://registry.npmjs.org --userconfig=/dev/null --package=@aopslabs/aops@<exact-target> -- aops update bridge --plan <update-plan.json> --confirm <sha256-plan-id> --json
+```
+
+Windows uses the same command with `--userconfig=NUL`. The bridge rejects the
+installed old CLI entrypoint and a candidate version that differs from the
+plan target; that external candidate then stages and re-verifies the complete
+executor closure before any global mutation. Once this transition succeeds,
+ordinary TUI and headless Apply actions use candidate-owned execution.
+
 All metadata and tarball reads are pinned to the public npm registry. A legacy
 top-level Server dedupe is treated as a repairable package-layout issue. The
 updater does not publish packages, create tags/releases, or replace the normal

package/agent-assets-release/agent-assets/core/{e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1 → 387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447}/manifest.json

@@ -73,14 +73,14 @@
       "sha256": "18924d928b659eb80a7736a104b56b9693cffe91cc4499e739a2a67a0922c519"
     },
     {
-      "byteLength": 51366,
+      "byteLength": 52016,
       "path": "user-guides/aops-cli.md",
-      "sha256": "bcf09a9246da2854ef7d3a057688fccd8c5c06613f41044d3d8bc556e623bac8"
+      "sha256": "9984693a3bed26654e7beace62f61dc5227306e4c253ca63f8f3582bed6929a4"
     },
     {
-      "byteLength": 4675,
+      "byteLength": 5564,
       "path": "user-guides/aops-system.md",
-      "sha256": "3e001003b36c6cc392e8998b1399ac36558438b49a7cfe1a6b482edfdbf44bb7"
+      "sha256": "f22e10256fc70764b951a3fb3326abf7bcaf8c0821ec9c85182d51d18da4b52b"
     },
     {
       "byteLength": 5664,
@@ -109,7 +109,7 @@
     }
   ],
   "name": "aops",
-  "packageSha256": "e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1",
+  "packageSha256": "387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447",
   "provenance": {
     "expectedDigestSource": "signed-release-manifest",
     "reference": "aops-platform-agent-assets:core",
@@ -117,6 +117,6 @@
   },
   "schemaVersion": 1,
   "standard": "aops-community-core-v1",
-  "version": "0.3.17",
-  "versionId": "community-core-0.3.17"
+  "version": "0.3.18",
+  "versionId": "community-core-0.3.18"
 }

package/agent-assets-release/agent-assets/inventory.json

@@ -6,12 +6,12 @@
   },
   "core": {
     "entryFile": "SKILL.md",
-    "manifestRef": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/manifest.json",
+    "manifestRef": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/manifest.json",
     "name": "aops",
     "optional": false,
-    "packageSha256": "e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1",
-    "version": "0.3.17",
-    "versionId": "community-core-0.3.17"
+    "packageSha256": "387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447",
+    "version": "0.3.18",
+    "versionId": "community-core-0.3.18"
   },
   "gateway": {
     "byteLength": 621,
@@ -22,7 +22,7 @@
   "kind": "aops-community-agent-assets-inventory-v1",
   "schemaVersion": 1,
   "source": {
-    "commit": "8ec9dbd13f555253a1450fda1018707576832e24",
+    "commit": "9625e4bb91ced6a1f3883eaa8f1c1b61003dab49",
     "repository": "git+https://github.com/eeemzs/aops-platform",
     "root": "apps/aops-cli/assets/agent-assets"
   }

package/agent-assets-release/agent-assets/projection.json

@@ -1,6 +1,6 @@
 {
   "catalogPackageSha256": [],
-  "corePackageSha256": "e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1",
+  "corePackageSha256": "387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447",
   "gatewayRef": "agent-assets/gateway/aops/SKILL.md",
   "kind": "aops-community-agent-assets-projection-v1",
   "root": "agent-assets",

package/agent-assets-release/agent-assets-release.json

@@ -7,123 +7,123 @@
     },
     "core": {
       "entryFile": "SKILL.md",
-      "manifestRef": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/manifest.json",
+      "manifestRef": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/manifest.json",
       "name": "aops",
       "optional": false,
-      "packageSha256": "e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1",
-      "version": "0.3.17",
-      "versionId": "community-core-0.3.17"
+      "packageSha256": "387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447",
+      "version": "0.3.18",
+      "versionId": "community-core-0.3.18"
     },
     "files": [
       {
         "byteLength": 2738,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/SKILL.md",
         "sha256": "44f8e0ffe807195d6890719e1350a630d159ee74f219001d9393d1d9a8d4818b"
       },
       {
         "byteLength": 2681,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/agentspace/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/agentspace/SKILL.md",
         "sha256": "08e33ef035c41beead342202a1f07af4391b1e4ed62cea9a4d79b43e966c7c0f"
       },
       {
         "byteLength": 3804,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/aops-cli-core/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/aops-cli-core/SKILL.md",
         "sha256": "a645a2f50bc35b2033d05bad770b2f0a53e3f162b95f00dfd493ba718c062433"
       },
       {
         "byteLength": 2341,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/chatv3/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/chatv3/SKILL.md",
         "sha256": "0f45d8fe418f740456e7f448ce472a7f0784a7cd5b01fe4cbc81439ded3c7931"
       },
       {
         "byteLength": 2869,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/collaborative-work/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/collaborative-work/SKILL.md",
         "sha256": "f4d2af3c384368b1adb1308f2c3731b17e6b4074e4ebdfc8c8f061ba2bb01a67"
       },
       {
         "byteLength": 2386,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/discuss/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/discuss/SKILL.md",
         "sha256": "03cd2bde90b590b4ce6a370a6d17d1aaabbb6693fee47c29e0e45848b3d7f8d6"
       },
       {
         "byteLength": 2736,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/docman/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/docman/SKILL.md",
         "sha256": "cf48bfa4d94a97a0d2805d5d9dd7a7d0f7430adaf36b9b2fc685465c42cd8cd7"
       },
       {
         "byteLength": 1910,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/mission/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/mission/SKILL.md",
         "sha256": "f4ce9c60c3d12ba45e9eaba0069ed9d8936438a15e0ae1974fa8b15a17ae67a1"
       },
       {
         "byteLength": 3167,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/projectman/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/projectman/SKILL.md",
         "sha256": "2ff36573d7bf85b2212d1c819bb692cbdfb49f4ea77fdd95d0a263c4007c31b0"
       },
       {
         "byteLength": 1621,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/sys/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/sys/SKILL.md",
         "sha256": "89cb838aafed26874a0fbc121078435a2ec27bf2901527a51515833e63b1dff4"
       },
       {
         "byteLength": 1865,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/view/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/view/SKILL.md",
         "sha256": "644603a17444374025acf52975dc5df04e1412d69965b210a28b6b5ed203c90b"
       },
       {
         "byteLength": 3093,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/references/working-disciplines/SKILL.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/references/working-disciplines/SKILL.md",
         "sha256": "406c7215917ff68e22c221847c72af9c38dc9ddab6cb0a4beaedd46038bda08d"
       },
       {
         "byteLength": 3333,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/agent-assets.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/agent-assets.md",
         "sha256": "12ef09138579d9bfc75a33d51c78bc50d8b34556eb6070af64a8c03d93927f05"
       },
       {
         "byteLength": 7702,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/agentspace.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/agentspace.md",
         "sha256": "18924d928b659eb80a7736a104b56b9693cffe91cc4499e739a2a67a0922c519"
       },
       {
-        "byteLength": 51366,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/aops-cli.md",
-        "sha256": "bcf09a9246da2854ef7d3a057688fccd8c5c06613f41044d3d8bc556e623bac8"
+        "byteLength": 52016,
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/aops-cli.md",
+        "sha256": "9984693a3bed26654e7beace62f61dc5227306e4c253ca63f8f3582bed6929a4"
       },
       {
-        "byteLength": 4675,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/aops-system.md",
-        "sha256": "3e001003b36c6cc392e8998b1399ac36558438b49a7cfe1a6b482edfdbf44bb7"
+        "byteLength": 5564,
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/aops-system.md",
+        "sha256": "f22e10256fc70764b951a3fb3326abf7bcaf8c0821ec9c85182d51d18da4b52b"
       },
       {
         "byteLength": 5664,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/chatv3.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/chatv3.md",
         "sha256": "80c8654463ee21bad8cd1a6557cc6476df788fd8f557441987c94d81ebf23ffd"
       },
       {
         "byteLength": 5838,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/docman.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/docman.md",
         "sha256": "0e434b7bf043260038d12062b1adc5cbf4ba0adf918c9fdf879262dc50bd779c"
       },
       {
         "byteLength": 6660,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/projectman.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/projectman.md",
         "sha256": "23289f31414c9d753f348efb6b5c1e58fe1ff217b6c730d6443279e6052a0509"
       },
       {
         "byteLength": 3432,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/sys.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/sys.md",
         "sha256": "3959f5c044314be14f368529edffd7adb80bb475b659397c6f4bbec8086c5f28"
       },
       {
         "byteLength": 27262,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/files/user-guides/working-disciplines.md",
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/files/user-guides/working-disciplines.md",
         "sha256": "c440185924c91755008ce9977c1ab3128994973038e610fe04cad392b14af79b"
       },
       {
         "byteLength": 3978,
-        "ref": "agent-assets/core/e66703ed1e78896b46a4124b8c26f2972a504900425517ea51f1dcc484d411a1/manifest.json",
-        "sha256": "7bd0dae26ac1f2c4a626be098cf16fc03770903bfa563d8983c25d4e2b850909"
+        "ref": "agent-assets/core/387548b990d0cfef6a92805f39d18c2ae6b4bb6b1e42ea42e6c597ea7d207447/manifest.json",
+        "sha256": "779e586e3a308fdcb2807dcc3a7f0e169b70d8ebff1f23bc27d785f03fd124b1"
       },
       {
         "byteLength": 621,
@@ -133,12 +133,12 @@
       {
         "byteLength": 926,
         "ref": "agent-assets/inventory.json",
-        "sha256": "8ea98c67db89ee60010818de0323280ee13cc39dfe4e4b6db8b1f538654556a4"
+        "sha256": "d7fa6b1266894d6730ca688be6e696ae613c3ea1bc57ea2198158060192aa9e7"
       },
       {
         "byteLength": 281,
         "ref": "agent-assets/projection.json",
-        "sha256": "cdd37ff6e95a06384310ea293d9b9f2453066ad04d55e98033d630d7a5e19310"
+        "sha256": "59bd38f95ce1047dded991728089d00ae21c3affacf1240d0f13f2052fda2c13"
       }
     ],
     "gateway": {
@@ -149,16 +149,16 @@
     },
     "inventory": {
       "ref": "agent-assets/inventory.json",
-      "sha256": "8ea98c67db89ee60010818de0323280ee13cc39dfe4e4b6db8b1f538654556a4"
+      "sha256": "d7fa6b1266894d6730ca688be6e696ae613c3ea1bc57ea2198158060192aa9e7"
     },
     "kind": "aops-community-agent-assets-release-v1",
     "projection": {
       "ref": "agent-assets/projection.json",
-      "sha256": "cdd37ff6e95a06384310ea293d9b9f2453066ad04d55e98033d630d7a5e19310"
+      "sha256": "59bd38f95ce1047dded991728089d00ae21c3affacf1240d0f13f2052fda2c13"
     },
     "root": "agent-assets",
     "schemaVersion": 1,
-    "setSha256": "c2f35b08f0bed8495acdb386959b968eaf1cc7962ffe75f037514c323ec3b8d3"
+    "setSha256": "08aca523632b9f6a46843a744fb08120b9efd34ef90694dd636c12275ba39204"
   },
   "evidence": {
     "signature": {
@@ -166,10 +166,10 @@
     }
   },
   "kind": "aops-community-agent-assets-bundle-v1",
-  "releaseVersion": "0.3.17",
+  "releaseVersion": "0.3.18",
   "schemaVersion": 1,
   "source": {
-    "commit": "8ec9dbd13f555253a1450fda1018707576832e24",
+    "commit": "9625e4bb91ced6a1f3883eaa8f1c1b61003dab49",
     "repository": "git+https://github.com/eeemzs/aops-platform",
     "root": "apps/aops-cli/assets/agent-assets"
   }

package/agent-assets-release/agent-assets-release.sigstore.json

@@ -4,13 +4,13 @@
     "x509CertificateChain": {
       "certificates": [
         {
-          "rawBytes": "MIIHdTCCBvugAwIBAgIUZd2FCK0o+geU3MbUqTyTz9wwGqEwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwODE0MTE0OTU5WhcNMjYwODE0MTE1OTU5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhU4CclVZEMV1ZklWXJZpDBq2Tldtdg+xyBkWkMVFR9Jj2BIeq757uE1oNDfSy2AQdrH+1litREcyTIRqarMpNqOCBhowggYWMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUR3VQ5fDFcaHkPFa+MhMK2mtOC4gwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wdAYDVR0RAQH/BGowaIZmaHR0cHM6Ly9naXRodWIuY29tL2VlZW16cy9hb3BzLXBsYXRmb3JtLy5naXRodWIvd29ya2Zsb3dzL3NpZ24tcHVibGljLWFnZW50LWFzc2V0cy55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoOGVjOWRiZDEzZjU1NTI1M2ExNDUwZmRhMTAxODcwNzU3NjgzMmUyNDAxBgorBgEEAYO/MAEEBCNTaWduIGV4YWN0IHB1YmxpYyBBT1BTIGFnZW50IGFzc2V0czAiBgorBgEEAYO/MAEFBBRlZWVtenMvYW9wcy1wbGF0Zm9ybTAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4wOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMHYGCisGAQQBg78wAQkEaAxmaHR0cHM6Ly9naXRodWIuY29tL2VlZW16cy9hb3BzLXBsYXRmb3JtLy5naXRodWIvd29ya2Zsb3dzL3NpZ24tcHVibGljLWFnZW50LWFzc2V0cy55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoOGVjOWRiZDEzZjU1NTI1M2ExNDUwZmRhMTAxODcwNzU3NjgzMmUyNDAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0wOAYKKwYBBAGDvzABDQQqDCg4ZWM5ZGJkMTNmNTU1MjUzYTE0NTBmZGExMDE4NzA3NTc2ODMyZTI0MB8GCisGAQQBg78wAQ4EEQwPcmVmcy9oZWFkcy9tYWluMBoGCisGAQQBg78wAQ8EDAwKMTMxNjI1NTAyNjApBgorBgEEAYO/MAEQBBsMGWh0dHBzOi8vZ2l0aHViLmNvbS9lZWVtenMwGQYKKwYBBAGDvzABEQQLDAkxMDkzMTA3NzQwdgYKKwYBBAGDvzABEgRoDGZodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0vLmdpdGh1Yi93b3JrZmxvd3Mvc2lnbi1wdWJsaWMtYWdlbnQtYXNzZXRzLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDCg4ZWM5ZGJkMTNmNTU1MjUzYTE0NTBmZGExMDE4NzA3NTc2ODMyZTI0MCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0vYWN0aW9ucy9ydW5zLzMxNzk3NzMyMzcxL2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMFIGCisGAQQBg78wARgERAxCcmVwbzplZWVtenNAMTA5MzEwNzc0L2FvcHMtcGxhdGZvcm1AMTMxNjI1NTAyNjpyZWY6cmVmcy9oZWFkcy9tYWluMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGgABuI8gAABAMASDBGAiEA6oMIw5HslIVThsBdjutRllYO7JmbLcC74Lhe0+Cf8AgCIQDQnMc5+LVb7uqc9zQCWk6+aKVGcF/5slatYoh4d5O/0jAKBggqhkjOPQQDAwNoADBlAjEAqF59n/6aJqg0gsTXqlmv9CgkzrYtZg68jGMx49iAVnnaNbu8p3tDdv5ISK6jqnNzAjAtp5hvZjizXZ90I2Si3dUm6cw4RnwGY2ajP326dNry6Aek/RHAsf7Q1zlmfPiH/1M="
+          "rawBytes": "MIIHczCCBvqgAwIBAgIUdeNa7JRGS7GE7Ik4OOY2fT9ivgIwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwODE0MjA0OTMzWhcNMjYwODE0MjA1OTMzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqc9n//da3ZYztX+FL55rwnd6HIKR04R6cBwhd6o8EjYXrkx7Te0bH6H1eUUBuYpBtJeCEHPy6i42TLYGQsIZBqOCBhkwggYVMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUz271iaiRST8SxR7NePwmvDb5vcMwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wdAYDVR0RAQH/BGowaIZmaHR0cHM6Ly9naXRodWIuY29tL2VlZW16cy9hb3BzLXBsYXRmb3JtLy5naXRodWIvd29ya2Zsb3dzL3NpZ24tcHVibGljLWFnZW50LWFzc2V0cy55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoOTYyNWU0YmI5MWNlZDZhMWYzODgzZWFhOGYxYzFiNjEwMDNkYWI0OTAxBgorBgEEAYO/MAEEBCNTaWduIGV4YWN0IHB1YmxpYyBBT1BTIGFnZW50IGFzc2V0czAiBgorBgEEAYO/MAEFBBRlZWVtenMvYW9wcy1wbGF0Zm9ybTAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4wOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMHYGCisGAQQBg78wAQkEaAxmaHR0cHM6Ly9naXRodWIuY29tL2VlZW16cy9hb3BzLXBsYXRmb3JtLy5naXRodWIvd29ya2Zsb3dzL3NpZ24tcHVibGljLWFnZW50LWFzc2V0cy55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoOTYyNWU0YmI5MWNlZDZhMWYzODgzZWFhOGYxYzFiNjEwMDNkYWI0OTAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0wOAYKKwYBBAGDvzABDQQqDCg5NjI1ZTRiYjkxY2VkNmExZjM4ODNlYWE4ZjFjMWI2MTAwM2RhYjQ5MB8GCisGAQQBg78wAQ4EEQwPcmVmcy9oZWFkcy9tYWluMBoGCisGAQQBg78wAQ8EDAwKMTMxNjI1NTAyNjApBgorBgEEAYO/MAEQBBsMGWh0dHBzOi8vZ2l0aHViLmNvbS9lZWVtenMwGQYKKwYBBAGDvzABEQQLDAkxMDkzMTA3NzQwdgYKKwYBBAGDvzABEgRoDGZodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0vLmdpdGh1Yi93b3JrZmxvd3Mvc2lnbi1wdWJsaWMtYWdlbnQtYXNzZXRzLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDCg5NjI1ZTRiYjkxY2VkNmExZjM4ODNlYWE4ZjFjMWI2MTAwM2RhYjQ5MCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vZWVlbXpzL2FvcHMtcGxhdGZvcm0vYWN0aW9ucy9ydW5zLzMxODM5NjA3ODY4L2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMFIGCisGAQQBg78wARgERAxCcmVwbzplZWVtenNAMTA5MzEwNzc0L2FvcHMtcGxhdGZvcm1AMTMxNjI1NTAyNjpyZWY6cmVmcy9oZWFkcy9tYWluMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGgAgmEXgAABAMARzBFAiEAiL4ymZ51Y8wZejrsE8a0+0BFKY7nuxFE0MAxqqMZefkCICmZxkBmPjOOySdkigRBcaOgomeIcjuvSefFyqvawkP9MAoGCCqGSM49BAMDA2cAMGQCMBINp3pCiAnV7UX/VDb4hNTa0RERcs6IVyuxfDpmfCbFkhTOjvc93rJ88xI7Ng3LVwIwCMLmUU2j1ZiBY6GJExF4c7kuSK7BCsFMaUjlb/zBao4hNDYACWGZQWO4nPsZz6zm"
         }
       ]
     },
     "tlogEntries": [
       {
-        "logIndex": "2465979414",
+        "logIndex": "2468930510",
         "logId": {
           "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
         },
@@ -18,29 +18,29 @@
           "kind": "hashedrekord",
           "version": "0.0.1"
         },
-        "integratedTime": "1786708199",
+        "integratedTime": "1786740573",
         "inclusionPromise": {
-          "signedEntryTimestamp": "MEUCIQDVnCXmd+dWXPUkUON8AVS8ZRn283AkgGzNmkTHkJAWgQIgIwVrGFuSw4eWBWi/lYSkC8opUmxTIUV7hEz66phFDyU="
+          "signedEntryTimestamp": "MEYCIQDhORlKgbFD7fA5gLwoultbfLUWyUmn1ygQV8tjcW7BHAIhALIHSkMod4Y+tvnhcq3mWvrbmvA6spp7uAf30ynpc32a"
         },
         "inclusionProof": {
-          "logIndex": "2344075152",
-          "rootHash": "MFPm5ZK2IJadoJv25QXAXMlVuU8+zS6SZ7Nn9MDd2xY=",
-          "treeSize": "2344075153",
+          "logIndex": "2347026248",
+          "rootHash": "RtUFOrRHoskbD5PYp854fA66uRpkhbwg4SZb418qtvg=",
+          "treeSize": "2347026263",
           "hashes": [
-            "SMl+GjVkpYO17Wk15ocgG0G1zbe3yqMSWIADCVhLJ24=",
-            "4v8ukh0jyMhNoIC9+Hc5C2m0nzFkrHq3QO+wH10KeyA=",
-            "pIgZ6vz3Mk4eGNNRH5Wy+dBKs5rIkJdEah66rNbTwSk=",
-            "pVwjzLJV20sCktXk94djrr5/OJqlH7IUcgGIkYrbFeY=",
-            "6osWRQiHRK4k211kZtmBHe1IllhEmP0y3h/6Adr83oU=",
-            "c0DIFoh0xqW9ThjdbTlsAt4DsK3zJbBGSl6daBybD/E=",
-            "Xeo0pZcWuagGcBqP71AcDgW8STqCapcM2CIiGPAZjz4=",
-            "ocsZkH5kOmi9eSvVYRkmnJxkZ1wc5GUj4fwnzvUgMS8=",
-            "Y0ICJNF38CtIcmOhOCyK7eoXS4xQ59KVY4TawSGrJTg=",
-            "ccTvbOUW4YI2E3+5Xg5I4Lh6n83Y7DgVCnXgAq9LKW4=",
-            "X5s9oIuHyPBfQ1DjKPt6MdhcRih6HtpYCLIAhs6gbIg=",
-            "AqJKrVZwx+xCo0abYNJUukaSFnUE+wTFdVpt1GaS0g0=",
-            "K7ya/tAh7mL8QFPaTZ3AhGARblg3/o9WAf5/JvDGSqk=",
-            "fdUMQV0uAsazK6HFzp8+Hq/NxW+XhzMqMGn3OWKFCSA=",
+            "SSA8HXZ1E1sc4aNG7TE5iZgLHBmE6D+z+oVvNIJqtUw=",
+            "9A/j0m2YOudeWtOnw3MNwPo9ZZqPjBpYJzMPlmkyNBs=",
+            "h1eISEt3cSqISIkMgwDZ2JRH6ER+w9An4OUJSwylnn0=",
+            "d1XqpyxCg04G4HL2h+qukpDDv34QR8/jzImmTxMlRZI=",
+            "RuKhiSwwkfjDlmEsSalCg+qJcEWVuagaxrlJvY4A5rs=",
+            "iQeZiZPGfDs4CDmrAuDHJpo7p3elMeYaNtIhhb5OERA=",
+            "dqn2aDir33pkavJtjAWCfWBLVTKbFzfE7AJ3Y9lSwGI=",
+            "uVSnQwhY9bumTQrrHHW/XFcSOHDmb6Gr0G0J5lemSFc=",
+            "7lgnNTxg6FwbJv2J184+C9emUBzg6fryouoYogqxb6M=",
+            "phs23xXNQ9VojvixMwpgiHO7GZg0yOYjcK8K3ZQh960=",
+            "QxfKGVNfBgdLBO8hfscwuCykK1JsG4ehf/aNkLm6GL8=",
+            "s5E9cyfPV5iYeoP4ngJ8bEF5+ErZqr5ThFo2awVdIO4=",
+            "K1vfg3sJABH0J5LZVXFihxGvE7G/oc8VMVnGIJWGyJ4=",
+            "rMc0j4Grkbg91aezLH+VaNa8WInEP33cVjZOfF8d11w=",
             "L1XzmA0JH00/N2sVFkU4WHPKi2wzrlh+VIop3VzmV2s=",
             "0qBvTqmqSnaffENLNDR34y9oY/4UQsDsIQcllDxgne0=",
             "mYkFdqU5C9m3w88wTn9l6UpYo+PI93c232s+vBiBEpM=",
@@ -48,10 +48,10 @@
             "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="
           ],
           "checkpoint": {
-            "envelope": "rekor.sigstore.dev - 1193050959916656506\n2344075153\nMFPm5ZK2IJadoJv25QXAXMlVuU8+zS6SZ7Nn9MDd2xY=\n\n— rekor.sigstore.dev wNI9ajBFAiA0MMJmzGvWhm901tjKpkUGmzcZ0lihQX+tamCvnHk2UAIhAIvECN+l8DDcxg5PpoGmkBTyj0tyfWfcV2KXo7mYn56I\n"
+            "envelope": "rekor.sigstore.dev - 1193050959916656506\n2347026263\nRtUFOrRHoskbD5PYp854fA66uRpkhbwg4SZb418qtvg=\n\n— rekor.sigstore.dev wNI9ajBFAiAjECxzEY+qYNfPo226KB7MDGYSGJGw5AliWON1FirLUgIhAPDcs7rzExG0WeuKtYSujkJvybVIYWPpBw+HYxYFkyn0\n"
           }
         },
-        "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjNjcxZjBhNTM5M2QwNDc4ZjRmOTFkMDBkMjVhZDM5YWYyYWQ0ZTIzYTAwZGUxYjEzYzVlZWZkOTg4MTkxMDdkIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRkhQemM4Q2k1a05Pb1l6R1c4czIxUW5wNStxbkNkVUllSGtxVElPZTRPMEFpQWtnT2xzazV3NldhYThHVnJyNmJ6cG5majlPSGJ0bnBlQ1oyTnJEQ2JvTUE9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaGtWRU5EUW5aMVowRjNTVUpCWjBsVldtUXlSa05MTUc4cloyVlZNMDFpVlhGVWVWUjZPWGQzUjNGRmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFUlRCTlZFVXdUMVJWTlZkb1kwNU5hbGwzVDBSRk1FMVVSVEZQVkZVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZvVlRSRFkyeFdXa1ZOVmpGYWEyeFhXRXBhY0VSQ2NUSlViR1IwWkdjcmVIbENhMWNLYTAxV1JsSTVTbW95UWtsbGNUYzFOM1ZGTVc5T1JHWlRlVEpCVVdSeVNDc3hiR2wwVWtWamVWUkpVbkZoY2sxd1RuRlBRMEpvYjNkbloxbFhUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZTTTFaUkNqVm1SRVpqWVVoclVFWmhLMDFvVFVzeWJYUlBRelJuZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJSQldVUldVakJTUVZGSUwwSkhiM2RoU1ZwdFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKV2JGcFhNVFpqZVRsb1lqTkNlZ3BNV0VKeldWaFNiV0l6U25STWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTTA1d1dqSTBkR05JVm1saVIyeHFURmRHYmxwWE5UQk1WMFo2Q21NeVZqQmplVFUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJyUjBOcGMwZEJVVkZDWnpjNGQwRlJSVVZMTW1nd1pFaENlazlwT0hZS1pFYzVjbHBYTkhWWlYwNHdZVmM1ZFdONU5XNWhXRkp2WkZkS01XTXlWbmxaTWpsMVpFZFdkV1JETldwaU1qQjNTSGRaUzB0M1dVSkNRVWRFZG5wQlFncEJaMUZTWkRJNWVXRXlXbk5pTTJSbVdrZHNlbU5IUmpCWk1tZDNUbWRaUzB0M1dVSkNRVWRFZG5wQlFrRjNVVzlQUjFacVQxZFNhVnBFUlhwYWFsVXhDazVVU1RGTk1rVjRUa1JWZDFwdFVtaE5WRUY0VDBSamQwNTZWVE5PYW1kNlRXMVZlVTVFUVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZGUWtOT1ZHRlhaSFVLU1VkV05GbFhUakJKU0VJeFdXMTRjRmw1UWtKVU1VSlVTVWRHYmxwWE5UQkpSMFo2WXpKV01HTjZRV2xDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0pTYkFwYVYxWjBaVzVOZGxsWE9YZGplVEYzWWtkR01GcHRPWGxpVkVGa1FtZHZja0puUlVWQldVOHZUVUZGUjBKQk9YbGFWMXA2VERKb2JGbFhVbnBNTWpGb0NtRlhOSGRQZDFsTFMzZFpRa0pCUjBSMmVrRkNRMEZSZEVSRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZta0taRmhPYkdOdFRuWmlibEpzWW01UmRWa3lPWFJOU0ZsSFEybHpSMEZSVVVKbk56aDNRVkZyUldGQmVHMWhTRkl3WTBoTk5reDVPVzVoV0ZKdlpGZEpkUXBaTWpsMFRESldiRnBYTVRaamVUbG9Zak5DZWt4WVFuTlpXRkp0WWpOS2RFeDVOVzVoV0ZKdlpGZEpkbVF5T1hsaE1scHpZak5rZWt3elRuQmFNalIwQ21OSVZtbGlSMnhxVEZkR2JscFhOVEJNVjBaNll6SldNR041TlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVJS1p6YzRkMEZSYjBWTFozZHZUMGRXYWs5WFVtbGFSRVY2V21wVk1VNVVTVEZOTWtWNFRrUlZkMXB0VW1oTlZFRjRUMFJqZDA1NlZUTk9hbWQ2VFcxVmVRcE9SRUZrUW1kdmNrSm5SVVZCV1U4dlRVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNTNXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRndDa1JEWkc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFphVjFac1lsaHdla3d5Um5aalNFMTBZMGQ0YUdSSFduWmpiVEIzVDBGWlMwdDNXVUlLUWtGSFJIWjZRVUpFVVZGeFJFTm5ORnBYVFRWYVIwcHJUVlJPYlU1VVZURk5hbFY2V1ZSRk1FNVVRbTFhUjBWNFRVUkZORTU2UVROT1ZHTXlUMFJOZVFwYVZFa3dUVUk0UjBOcGMwZEJVVkZDWnpjNGQwRlJORVZGVVhkUVkyMVdiV041T1c5YVYwWnJZM2s1ZEZsWGJIVk5RbTlIUTJselIwRlJVVUpuTnpoM0NrRlJPRVZFUVhkTFRWUk5lRTVxU1RGT1ZFRjVUbXBCY0VKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUW5OTlIxZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZta0tURzFPZG1KVE9XeGFWMVowWlc1TmQwZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUUxRWEzcE5WRUV6VG5wUmQyUm5XVXRMZDFsQ1FrRkhSQXAyZWtGQ1JXZFNiMFJIV205a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFphVjFac1lsaHdla3d5Um5aalNFMTBZMGQ0YUdSSFduWmpiVEIyQ2t4dFpIQmtSMmd4V1drNU0ySXpTbkphYlhoMlpETk5kbU15Ykc1aWFURjNaRmRLYzJGWFRYUlpWMlJzWW01UmRGbFlUbnBhV0ZKNlRHNXNkR0pGUW5rS1dsZGFla3d5YUd4WlYxSjZUREl4YUdGWE5IZFBRVmxMUzNkWlFrSkJSMFIyZWtGQ1JYZFJjVVJEWnpSYVYwMDFXa2RLYTAxVVRtMU9WRlV4VFdwVmVncFpWRVV3VGxSQ2JWcEhSWGhOUkVVMFRucEJNMDVVWXpKUFJFMTVXbFJKTUUxRFJVZERhWE5IUVZGUlFtYzNPSGRCVWxGRlJYZDNVbVF5T1hsaE1scHpDbUl6WkdaYVIyeDZZMGRHTUZreVozZFhkMWxMUzNkWlFrSkJSMFIyZWtGQ1JsRlNUa1JGZEc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFlLV2xkV2JHSlljSHBNTWtaMlkwaE5kR05IZUdoa1IxcDJZMjB3ZGxsWFRqQmhWemwxWTNrNWVXUlhOWHBNZWsxNFRucHJNMDU2VFhsTmVtTjRUREpHTUFwa1IxWjBZMGhTZWt4NlJYZEdkMWxMUzNkWlFrSkJSMFIyZWtGQ1JtZFJTa1JCWkhkamJXd3lXVmhTYkUxR1NVZERhWE5IUVZGUlFtYzNPSGRCVW1kRkNsSkJlRU5qYlZaM1lucHdiRnBYVm5SbGJrNUJUVlJCTlUxNlJYZE9lbU13VERKR2RtTklUWFJqUjNob1pFZGFkbU50TVVGTlZFMTRUbXBKTVU1VVFYa0tUbXB3ZVZwWFdUWmpiVlp0WTNrNWIxcFhSbXRqZVRsMFdWZHNkVTFKUjB4Q1oyOXlRbWRGUlVGa1dqVkJaMUZEUWtnd1JXVjNRalZCU0dOQk0xUXdkd3BoYzJKSVJWUktha2RTTkdOdFYyTXpRWEZLUzFoeWFtVlFTek12YURSd2VXZERPSEEzYnpSQlFVRkhaMEZDZFVrNFowRkJRa0ZOUVZORVFrZEJhVVZCQ2padlRVbDNOVWh6YkVsV1ZHaHpRbVJxZFhSU2JHeFpUemRLYldKTVkwTTNORXhvWlRBclEyWTRRV2REU1ZGRVVXNU5ZelVyVEZaaU4zVnhZemw2VVVNS1YyczJLMkZMVmtkalJpODFjMnhoZEZsdmFEUmtOVTh2TUdwQlMwSm5aM0ZvYTJwUFVGRlJSRUYzVG05QlJFSnNRV3BGUVhGR05UbHVMelpoU25Gbk1BcG5jMVJZY1d4dGRqbERaMnQ2Y2xsMFdtYzJPR3BIVFhnME9XbEJWbTV1WVU1aWRUaHdNM1JFWkhZMVNWTkxObXB4Yms1NlFXcEJkSEExYUhaYWFtbDZDbGhhT1RCSk1sTnBNMlJWYlRaamR6UlNibmRIV1RKaGFsQXpNalprVG5KNU5rRmxheTlTU0VGelpqZFJNWHBzYldaUWFVZ3ZNVTA5Q2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIn19fX0="
+        "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmZGQwM2U4YTNmZDEyNTU2MzI1MzI4OGY2OWQ1ODlkYjRiOWJjZDg4ZDhkOTllYTkwZmU4ODRhOGQ1MTI1N2QzIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJQTh3UzVqdWNQb0xWU0tTNlg0anNoWGVPN0k1VDZTSWtrT0RGc0craVowdEFpQjdTSklucDR0cU80V2kwTXh1Wkt3RXJIdGVlSXBjUG4rcTRBOGROMW1SVWc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaGpla05EUW5aeFowRjNTVUpCWjBsVlpHVk9ZVGRLVWtkVE4wZEZOMGxyTkU5UFdUSm1WRGxwZG1kSmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFUlRCTmFrRXdUMVJOZWxkb1kwNU5hbGwzVDBSRk1FMXFRVEZQVkUxNlYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZ4WXpsdUx5OWtZVE5hV1hwMFdDdEdURFUxY25kdVpEWklTVXRTTURSU05tTkNkMmdLWkRadk9FVnFXVmh5YTNnM1ZHVXdZa2cyU0RGbFZWVkNkVmx3UW5SS1pVTkZTRkI1Tm1rME1sUk1XVWRSYzBsYVFuRlBRMEpvYTNkbloxbFdUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlY2TWpjeENtbGhhVkpUVkRoVGVGSTNUbVZRZDIxMlJHSTFkbU5OZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJSQldVUldVakJTUVZGSUwwSkhiM2RoU1ZwdFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKV2JGcFhNVFpqZVRsb1lqTkNlZ3BNV0VKeldWaFNiV0l6U25STWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTTA1d1dqSTBkR05JVm1saVIyeHFURmRHYmxwWE5UQk1WMFo2Q21NeVZqQmplVFUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJyUjBOcGMwZEJVVkZDWnpjNGQwRlJSVVZMTW1nd1pFaENlazlwT0hZS1pFYzVjbHBYTkhWWlYwNHdZVmM1ZFdONU5XNWhXRkp2WkZkS01XTXlWbmxaTWpsMVpFZFdkV1JETldwaU1qQjNTSGRaUzB0M1dVSkNRVWRFZG5wQlFncEJaMUZTWkRJNWVXRXlXbk5pTTJSbVdrZHNlbU5IUmpCWk1tZDNUbWRaUzB0M1dVSkNRVWRFZG5wQlFrRjNVVzlQVkZsNVRsZFZNRmx0U1RWTlYwNXNDbHBFV21oTlYxbDZUMFJuZWxwWFJtaFBSMWw0V1hwR2FVNXFSWGROUkU1cldWZEpNRTlVUVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZGUWtOT1ZHRlhaSFVLU1VkV05GbFhUakJKU0VJeFdXMTRjRmw1UWtKVU1VSlVTVWRHYmxwWE5UQkpSMFo2WXpKV01HTjZRV2xDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0pTYkFwYVYxWjBaVzVOZGxsWE9YZGplVEYzWWtkR01GcHRPWGxpVkVGa1FtZHZja0puUlVWQldVOHZUVUZGUjBKQk9YbGFWMXA2VERKb2JGbFhVbnBNTWpGb0NtRlhOSGRQZDFsTFMzZFpRa0pCUjBSMmVrRkNRMEZSZEVSRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZta0taRmhPYkdOdFRuWmlibEpzWW01UmRWa3lPWFJOU0ZsSFEybHpSMEZSVVVKbk56aDNRVkZyUldGQmVHMWhTRkl3WTBoTk5reDVPVzVoV0ZKdlpGZEpkUXBaTWpsMFRESldiRnBYTVRaamVUbG9Zak5DZWt4WVFuTlpXRkp0WWpOS2RFeDVOVzVoV0ZKdlpGZEpkbVF5T1hsaE1scHpZak5rZWt3elRuQmFNalIwQ21OSVZtbGlSMnhxVEZkR2JscFhOVEJNVjBaNll6SldNR041TlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVJS1p6YzRkMEZSYjBWTFozZHZUMVJaZVU1WFZUQlpiVWsxVFZkT2JGcEVXbWhOVjFsNlQwUm5lbHBYUm1oUFIxbDRXWHBHYVU1cVJYZE5SRTVyV1ZkSk1BcFBWRUZrUW1kdmNrSm5SVVZCV1U4dlRVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNTNXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRndDa1JEWkc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFphVjFac1lsaHdla3d5Um5aalNFMTBZMGQ0YUdSSFduWmpiVEIzVDBGWlMwdDNXVUlLUWtGSFJIWjZRVUpFVVZGeFJFTm5OVTVxU1RGYVZGSnBXV3ByZUZreVZtdE9iVVY0V21wTk5FOUVUbXhaVjBVMFdtcEdhazFYU1RKTlZFRjNUVEpTYUFwWmFsRTFUVUk0UjBOcGMwZEJVVkZDWnpjNGQwRlJORVZGVVhkUVkyMVdiV041T1c5YVYwWnJZM2s1ZEZsWGJIVk5RbTlIUTJselIwRlJVVUpuTnpoM0NrRlJPRVZFUVhkTFRWUk5lRTVxU1RGT1ZFRjVUbXBCY0VKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUW5OTlIxZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZta0tURzFPZG1KVE9XeGFWMVowWlc1TmQwZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUUxRWEzcE5WRUV6VG5wUmQyUm5XVXRMZDFsQ1FrRkhSQXAyZWtGQ1JXZFNiMFJIV205a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFphVjFac1lsaHdla3d5Um5aalNFMTBZMGQ0YUdSSFduWmpiVEIyQ2t4dFpIQmtSMmd4V1drNU0ySXpTbkphYlhoMlpETk5kbU15Ykc1aWFURjNaRmRLYzJGWFRYUlpWMlJzWW01UmRGbFlUbnBhV0ZKNlRHNXNkR0pGUW5rS1dsZGFla3d5YUd4WlYxSjZUREl4YUdGWE5IZFBRVmxMUzNkWlFrSkJSMFIyZWtGQ1JYZFJjVVJEWnpWT2Fra3hXbFJTYVZscWEzaFpNbFpyVG0xRmVBcGFhazAwVDBST2JGbFhSVFJhYWtacVRWZEpNazFVUVhkTk1sSm9XV3BSTlUxRFJVZERhWE5IUVZGUlFtYzNPSGRCVWxGRlJYZDNVbVF5T1hsaE1scHpDbUl6WkdaYVIyeDZZMGRHTUZreVozZFhkMWxMUzNkWlFrSkJSMFIyZWtGQ1JsRlNUa1JGZEc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFlLV2xkV2JHSlljSHBNTWtaMlkwaE5kR05IZUdoa1IxcDJZMjB3ZGxsWFRqQmhWemwxWTNrNWVXUlhOWHBNZWsxNFQwUk5OVTVxUVROUFJGazBUREpHTUFwa1IxWjBZMGhTZWt4NlJYZEdkMWxMUzNkWlFrSkJSMFIyZWtGQ1JtZFJTa1JCWkhkamJXd3lXVmhTYkUxR1NVZERhWE5IUVZGUlFtYzNPSGRCVW1kRkNsSkJlRU5qYlZaM1lucHdiRnBYVm5SbGJrNUJUVlJCTlUxNlJYZE9lbU13VERKR2RtTklUWFJqUjNob1pFZGFkbU50TVVGTlZFMTRUbXBKTVU1VVFYa0tUbXB3ZVZwWFdUWmpiVlp0WTNrNWIxcFhSbXRqZVRsMFdWZHNkVTFKUjB0Q1oyOXlRbWRGUlVGa1dqVkJaMUZEUWtoM1JXVm5RalJCU0ZsQk0xUXdkd3BoYzJKSVJWUktha2RTTkdOdFYyTXpRWEZLUzFoeWFtVlFTek12YURSd2VXZERPSEEzYnpSQlFVRkhaMEZuYlVWWVowRkJRa0ZOUVZKNlFrWkJhVVZCQ21sTU5IbHRXalV4V1RoM1dtVnFjbk5GT0dFd0t6QkNSa3RaTjI1MWVFWkZNRTFCZUhGeFRWcGxabXREU1VOdFduaHJRbTFRYWs5UGVWTmthMmxuVWtJS1kyRlBaMjl0WlVsamFuVjJVMlZtUm5seGRtRjNhMUE1VFVGdlIwTkRjVWRUVFRRNVFrRk5SRUV5WTBGTlIxRkRUVUpKVG5BemNFTnBRVzVXTjFWWUx3cFdSR0kwYUU1VVlUQlNSVkpqY3paSlZubDFlR1pFY0cxbVEySkdhMmhVVDJwMll6a3pja280T0hoSk4wNW5NMHhXZDBsM1EwMU1iVlZWTW1veFdtbENDbGsyUjBwRmVFWTBZemRyZFZOTE4wSkRjMFpOWVZWcWJHSXZla0poYnpSb1RrUlpRVU5YUjFwUlYwODBibEJ6V25vMmVtMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifX19fQ=="
       }
     ],
     "timestampVerificationData": {}
@@ -59,8 +59,8 @@
   "messageSignature": {
     "messageDigest": {
       "algorithm": "SHA2_256",
-      "digest": "xnHwpTk9BHj0+R0A0lrTmvKtTiOgDeGxPF7v2YgZEH0="
+      "digest": "/dA+ij/RJVYyUyiPadWJ20ubzYjY2Z6pD+iEqNUSV9M="
     },
-    "signature": "MEQCIFHPzc8Ci5kNOoYzGW8s21Qnp5+qnCdUIeHkqTIOe4O0AiAkgOlsk5w6Waa8GVrr6bzpnfj9OHbtnpeCZ2NrDCboMA=="
+    "signature": "MEQCIA8wS5jucPoLVSKS6X4jshXeO7I5T6SIkkODFsG+iZ0tAiB7SJInp4tqO4Wi0MxuZKwErHteeIpcPn+q4A8dN1mRUg=="
   }
 }

package/assets/agent-assets/core/user-guides/aops-cli.md

@@ -61,6 +61,19 @@ aops update prepare --json
 aops update apply --plan <update-plan.json> --confirm <sha256-plan-id> --json
 ```
 
+For the one-time transition from a CLI released before candidate-owned update
+execution, prepare with the installed CLI and apply through the exact external
+target package instead:
+
+```text
+# macOS/Linux (`NUL` replaces `/dev/null` on Windows)
+npm exec --yes --registry=https://registry.npmjs.org --userconfig=/dev/null --package=@aopslabs/aops@<exact-target> -- aops update bridge --plan <update-plan.json> --confirm <sha256-plan-id> --json
+```
+
+`update bridge` refuses to run from the installed old CLI and requires its own
+package version to equal the immutable plan target. Future transitions use the
+normal candidate-owned `update apply` path.
+
 Prepare is non-mutating and retains exact candidate and rollback tarballs.
 Apply stops Cockpit before Server, installs the public closure as one global
 CLI with its exact nested Server, repeatedly checks loopback health, and

package/assets/agent-assets/core/user-guides/aops-system.md

@@ -55,6 +55,21 @@ aops update prepare --json
 aops update apply --plan <update-plan.json> --confirm <sha256-plan-id> --json
 ```
 
+CLI versions released before candidate-owned execution cannot retroactively
+load the safer apply implementation. For that one transition, let the
+installed old CLI run `prepare`, then launch the exact target package outside
+the global installation and use its explicit bridge command. macOS/Linux:
+
+```text
+npm exec --yes --registry=https://registry.npmjs.org --userconfig=/dev/null --package=@aopslabs/aops@<exact-target> -- aops update bridge --plan <update-plan.json> --confirm <sha256-plan-id> --json
+```
+
+Windows uses the same command with `--userconfig=NUL`. The bridge rejects the
+installed old CLI entrypoint and a candidate version that differs from the
+plan target; that external candidate then stages and re-verifies the complete
+executor closure before any global mutation. Once this transition succeeds,
+ordinary TUI and headless Apply actions use candidate-owned execution.
+
 All metadata and tarball reads are pinned to the public npm registry. A legacy
 top-level Server dedupe is treated as a repairable package-layout issue. The
 updater does not publish packages, create tags/releases, or replace the normal

package/dist/commands/community-server.js

@@ -440,6 +440,7 @@ async function runWithOperationJournal(params) {
             code: 'community_server_operation_failed',
             phase: 'operation',
             details: {
+                operationId: journal.record().id,
                 operation: params.operation,
                 journalPhase: journal.record().phase,
                 journalStep: journal.record().step,

package/dist/commands/global-update.js

@@ -1,14 +1,18 @@
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, readFileSync, realpathSync, writeFileSync, } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { compareCanonicalText } from '@aopslabs/artifact-trust-contracts';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
+import { isCommunityDiagnosticV1 } from '../lib/community-diagnostic.js';
 const CHECK_CONTRACT = 'aops.global-update-check/v1';
 const PLAN_CONTRACT = 'aops.global-update-plan/v1';
 const RESULT_CONTRACT = 'aops.global-update-result/v1';
+const EXECUTOR_CONTRACT = 'aops.global-update-executor/v1';
+const RESULT_FILE = 'update-result.json';
+const EXECUTOR_RECEIPT_FILE = 'executor-receipt.json';
 const PUBLIC_REGISTRY = 'https://registry.npmjs.org';
 const EXACT_STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
 const PLAN_ID = /^sha256:[a-f0-9]{64}$/u;
@@ -20,6 +24,16 @@ const HEALTH_SAMPLES = 4;
 const HEALTH_INTERVAL_MS = 3_000;
 const HEALTH_STARTUP_ATTEMPTS = 30;
 const HEALTH_STARTUP_INTERVAL_MS = 2_000;
+class ChildCommandError extends Error {
+    status;
+    diagnostic;
+    constructor(command, status, diagnostic) {
+        super(`${path.basename(command)} failed with status ${status ?? 'unknown'}`);
+        this.name = 'ChildCommandError';
+        this.status = status;
+        this.diagnostic = diagnostic;
+    }
+}
 function cleanEnvironment() {
     return {
         ...process.env,
@@ -44,7 +58,17 @@ function defaultRunner(command, args, cwd = process.cwd()) {
     });
     if (result.error)
         throw result.error;
-    assert.equal(result.status, 0, `${command} ${args.join(' ')} failed\n${result.stdout}\n${result.stderr}`);
+    if (result.status !== 0) {
+        let diagnostic;
+        try {
+            const parsed = JSON.parse(result.stderr.trim());
+            if (isCommunityDiagnosticV1(parsed.error))
+                diagnostic = parsed.error;
+        }
+        catch {
+        }
+        throw new ChildCommandError(command, result.status, diagnostic);
+    }
     return result.stdout;
 }
 export function resolveNpmInvocation(options = {}) {
@@ -54,13 +78,12 @@ export function resolveNpmInvocation(options = {}) {
     const nodeExecutable = path.resolve(options.nodeExecutable ?? process.execPath);
     const environment = options.environment ?? process.env;
     const fileExists = options.fileExists ?? existsSync;
-    const candidates = [
-        path.join(path.dirname(nodeExecutable), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-    ];
+    const candidates = [];
     const npmExecPath = environment.npm_execpath?.trim();
     if (npmExecPath && /^npm-cli\.(?:c?js)$/iu.test(path.basename(npmExecPath))) {
         candidates.push(path.resolve(npmExecPath));
     }
+    candidates.push(path.join(path.dirname(nodeExecutable), 'node_modules', 'npm', 'bin', 'npm-cli.js'));
     for (const entry of String(environment.PATH ?? '').split(path.delimiter)) {
         if (!entry.trim())
             continue;
@@ -108,6 +131,57 @@ export function compareStableVersions(left, right) {
 function sha256(file) {
     return createHash('sha256').update(readFileSync(file)).digest('hex');
 }
+function executorTreeInventory(executorRoot) {
+    const root = plainDirectory(executorRoot, 'candidate executor root');
+    const records = [];
+    let totalBytes = 0;
+    const visit = (directory, prefix) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })
+            .sort((left, right) => compareCanonicalText(left.name, right.name))) {
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolute = path.join(directory, entry.name);
+            const stat = lstatSync(absolute);
+            const normalizedRelative = relative.replace(/\\/gu, '/');
+            if (stat.isSymbolicLink()) {
+                const target = readlinkSync(absolute);
+                const resolved = realpathSync.native(absolute);
+                ensureWithin(root, resolved, `candidate executor link ${normalizedRelative}`);
+                records.push({
+                    path: normalizedRelative,
+                    type: 'link',
+                    target: target.replace(/\\/gu, '/'),
+                    resolved: path.relative(root, resolved).replace(/\\/gu, '/'),
+                });
+                assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+                continue;
+            }
+            if (stat.isDirectory()) {
+                records.push({ path: normalizedRelative, type: 'directory', mode: stat.mode & 0o777 });
+                assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+                visit(absolute, relative);
+                continue;
+            }
+            assert.equal(stat.isFile(), true, `candidate executor entry invalid: ${normalizedRelative}`);
+            const canonical = plainFile(absolute, `candidate executor file ${normalizedRelative}`);
+            ensureWithin(root, canonical, `candidate executor file ${normalizedRelative}`);
+            totalBytes += stat.size;
+            records.push({
+                path: normalizedRelative,
+                type: 'file',
+                mode: stat.mode & 0o777,
+                bytes: stat.size,
+                sha256: sha256(canonical),
+            });
+            assert.equal(records.length <= 20_000, true, 'candidate executor entry bound exceeded');
+            assert.equal(totalBytes <= 512 * 1024 * 1024, true, 'candidate executor package byte bound exceeded');
+        }
+    };
+    visit(root, '');
+    return {
+        entryCount: records.length,
+        sha256: createHash('sha256').update(JSON.stringify(records)).digest('hex'),
+    };
+}
 function plainDirectory(candidate, label) {
     const absolute = path.resolve(candidate);
     const stat = lstatSync(absolute);
@@ -364,6 +438,136 @@ export function readGlobalUpdatePlan(planPath) {
     assert.equal(plan.safety.healthStartupIntervalMs, HEALTH_STARTUP_INTERVAL_MS);
     return plan;
 }
+function readCandidateExecutorReceipt(plan, receiptPath) {
+    const operationRoot = plainDirectory(plan.operationRoot, 'global update operation root');
+    const resolved = plainFile(receiptPath, 'global update executor receipt');
+    assert.equal(resolved, path.join(operationRoot, EXECUTOR_RECEIPT_FILE), 'global update executor receipt must stay at the operation root');
+    const receipt = parseJson(readFileSync(resolved, 'utf8'), 'global_update_executor_receipt');
+    assert.equal(receipt.schemaVersion, 1);
+    assert.equal(receipt.contract, EXECUTOR_CONTRACT);
+    assert.equal(receipt.planId, plan.planId, 'global update executor plan identity mismatch');
+    const executorRoot = plainDirectory(receipt.executorRoot, 'global update executor root');
+    ensureWithin(operationRoot, executorRoot, 'global update executor root');
+    assert.equal(executorRoot, path.join(operationRoot, 'executor'));
+    const entrypoint = plainFile(receipt.entrypoint, 'global update executor entrypoint');
+    ensureWithin(executorRoot, entrypoint, 'global update executor entrypoint');
+    assert.equal(entrypoint, receipt.entrypoint, 'global update executor entrypoint must be canonical');
+    assert.match(receipt.entrypointSha256, SHA256);
+    assert.equal(sha256(entrypoint), receipt.entrypointSha256, 'global update executor entrypoint changed');
+    const candidate = packageRecordByName(plan.candidates, '@aopslabs/aops');
+    assert.equal(receipt.candidate.version, candidate.version);
+    assert.equal(receipt.candidate.sha256, candidate.sha256);
+    const executorPackageRoot = path.join(executorRoot, 'node_modules', '@aopslabs', 'aops');
+    const executorManifest = packageManifest(executorPackageRoot, '@aopslabs/aops');
+    assert.equal(executorManifest.version, plan.target.packages.cli);
+    const dependencies = executorManifest.dependencies;
+    assert.equal(dependencies?.['@aopslabs/aops-server'], plan.target.packages.server);
+    const executorServer = packageManifest(path.join(executorRoot, 'node_modules', '@aopslabs', 'aops-server'), '@aopslabs/aops-server');
+    assert.equal(executorServer.version, plan.target.packages.server);
+    assert.equal(Number.isSafeInteger(receipt.executorEntryCount), true);
+    assert.match(receipt.executorContentSha256, SHA256);
+    const inventory = executorTreeInventory(executorRoot);
+    assert.equal(inventory.entryCount, receipt.executorEntryCount, 'candidate executor entry count changed');
+    assert.equal(inventory.sha256, receipt.executorContentSha256, 'candidate executor content changed');
+    return receipt;
+}
+export function stageCandidateGlobalUpdateExecutor(plan, run = defaultRunner) {
+    const receiptPath = path.join(plan.operationRoot, EXECUTOR_RECEIPT_FILE);
+    if (existsSync(receiptPath)) {
+        return { receipt: readCandidateExecutorReceipt(plan, receiptPath), receiptPath };
+    }
+    const executorRoot = path.join(plan.operationRoot, 'executor');
+    assert.equal(existsSync(executorRoot), false, 'unverified global update executor directory already exists');
+    mkdirSync(executorRoot, { mode: 0o700 });
+    const cacheRoot = path.join(plan.operationRoot, 'cache');
+    mkdirSync(cacheRoot, { recursive: true, mode: 0o700 });
+    const cli = packageRecordByName(plan.candidates, '@aopslabs/aops');
+    const server = packageRecordByName(plan.candidates, '@aopslabs/aops-server');
+    runNpm(run, publicNpmArgs([
+        '--prefix',
+        executorRoot,
+        'install',
+        '--ignore-scripts',
+        '--omit=dev',
+        '--prefer-offline',
+        `--cache=${cacheRoot}`,
+        '--fund=false',
+        '--audit=false',
+        cli.path,
+        server.path,
+    ]));
+    const entrypoint = plainFile(path.join(executorRoot, 'node_modules', '@aopslabs', 'aops', 'dist', 'main.js'), 'global update executor entrypoint');
+    const inventory = executorTreeInventory(executorRoot);
+    const receipt = {
+        schemaVersion: 1,
+        contract: EXECUTOR_CONTRACT,
+        planId: plan.planId,
+        executorRoot: plainDirectory(executorRoot, 'global update executor root'),
+        entrypoint,
+        entrypointSha256: sha256(entrypoint),
+        executorEntryCount: inventory.entryCount,
+        executorContentSha256: inventory.sha256,
+        candidate: { version: cli.version, sha256: cli.sha256 },
+    };
+    writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    return { receipt: readCandidateExecutorReceipt(plan, receiptPath), receiptPath };
+}
+function validateCandidateExecutorInvocation(plan, receiptPath) {
+    const receipt = readCandidateExecutorReceipt(plan, receiptPath);
+    const invokedEntrypoint = plainFile(process.argv[1], 'invoked AOPS CLI entrypoint');
+    assert.equal(invokedEntrypoint, receipt.entrypoint, 'candidate update execution must run from the verified staged entrypoint');
+    return receipt;
+}
+export function validateLegacyGlobalUpdateBridgeInvocation(plan, invokedEntrypoint = process.argv[1]) {
+    const invoked = plainFile(invokedEntrypoint, 'legacy update bridge candidate entrypoint');
+    const globalCliRoot = plainDirectory(path.dirname(path.dirname(plan.cliPath)), 'planned global CLI root');
+    const relativeToGlobal = path.relative(globalCliRoot, invoked);
+    assert.equal(relativeToGlobal.startsWith('..') || path.isAbsolute(relativeToGlobal), true, 'legacy update bridge must run from an external exact candidate, not the installed old CLI');
+    const candidateRoot = plainDirectory(path.dirname(path.dirname(invoked)), 'legacy update bridge candidate root');
+    const manifest = packageManifest(candidateRoot, '@aopslabs/aops');
+    const version = exactVersion(manifest.version, 'legacy update bridge candidate version');
+    assert.equal(version, plan.target.packages.cli, 'legacy update bridge candidate must match the plan target');
+    return { candidateRoot, version };
+}
+export function dispatchGlobalUpdate(options, run = defaultRunner) {
+    const plan = readGlobalUpdatePlan(options.plan);
+    assert.equal(options.confirm, plan.planId, 'global update confirmation does not match the exact plan');
+    const resultPath = path.join(plan.operationRoot, RESULT_FILE);
+    assert.equal(existsSync(resultPath), false, 'global_update_plan_already_terminal');
+    let executorStarted = false;
+    try {
+        const { receipt, receiptPath } = stageCandidateGlobalUpdateExecutor(plan, run);
+        executorStarted = true;
+        return parseJson(run(process.execPath, [
+            receipt.entrypoint,
+            'update',
+            'apply',
+            '--plan',
+            options.plan,
+            '--confirm',
+            options.confirm,
+            '--executor-receipt',
+            receiptPath,
+            '--json',
+        ]).trim(), 'global_update_candidate_result');
+    }
+    catch (error) {
+        if (!existsSync(resultPath)) {
+            writeTerminalUpdateResult(plan, {
+                schemaVersion: 1,
+                contract: RESULT_CONTRACT,
+                status: executorStarted ? 'executor-result-missing' : 'executor-staging-failed',
+                planId: plan.planId,
+                failedStage: executorStarted ? 'candidate-executor' : 'stage-candidate-executor',
+                globalState: executorStarted ? 'unknown-requires-inspection' : 'unchanged',
+                rollbackPerformed: false,
+                error: safeUpdateError(error),
+                events: [],
+            });
+        }
+        throw new Error(`global update candidate executor failed; diagnostic record: ${resultPath}`, { cause: error });
+    }
+}
 export function installGlobalUpdateClosure(run, plan, records, topology) {
     const cli = packageRecordByName(records, '@aopslabs/aops');
     const server = packageRecordByName(records, '@aopslabs/aops-server');
@@ -528,9 +732,61 @@ export function validateLoopbackOrigin(value, label) {
     assert.equal(url.hash, '', `${label} must not include a fragment`);
     return url.origin;
 }
+function nestedCommunityDiagnostic(error) {
+    const pending = [error];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const candidate = pending.shift();
+        if (!candidate || visited.has(candidate))
+            continue;
+        visited.add(candidate);
+        if (typeof candidate === 'object') {
+            const record = candidate;
+            if (isCommunityDiagnosticV1(record.diagnostic))
+                return record.diagnostic;
+            if (record.cause)
+                pending.push(record.cause);
+            if (candidate instanceof AggregateError)
+                pending.push(...candidate.errors);
+        }
+    }
+    return undefined;
+}
+function safeUpdateError(error) {
+    const diagnostic = nestedCommunityDiagnostic(error);
+    if (diagnostic) {
+        const details = diagnostic.details;
+        return Object.fromEntries(Object.entries({
+            code: diagnostic.code,
+            causeCode: diagnostic.cause.code,
+            phase: diagnostic.phase,
+            operationId: typeof details.operationId === 'string' && UUID.test(details.operationId)
+                ? details.operationId
+                : undefined,
+            operation: typeof details.operation === 'string' ? details.operation : undefined,
+            journalPhase: typeof details.journalPhase === 'string' ? details.journalPhase : undefined,
+            journalStep: typeof details.journalStep === 'string' ? details.journalStep : undefined,
+        }).filter(([, value]) => value !== undefined));
+    }
+    const original = error instanceof Error ? error.message : String(error ?? 'global update failed');
+    const message = original
+        .split(/\r?\n/u, 1)[0]
+        .replace(/https?:\/\/\S+/giu, '[REDACTED_URL]')
+        .replace(/((?:password|passwd|secret|token|api[_-]?key|authorization)\s*[=:]\s*)\S+/giu, '$1[REDACTED]')
+        .replace(/(?:[A-Za-z]:\\|\/)\S+/gu, '[REDACTED_PATH]')
+        .slice(0, 500);
+    const code = /\b(?:aops|community|global_update)_[a-z0-9_]+\b/iu.exec(original)?.[0]?.toLowerCase()
+        ?? 'global_update_failed';
+    return { code, message };
+}
+function writeTerminalUpdateResult(plan, result) {
+    const resultPath = path.join(plan.operationRoot, RESULT_FILE);
+    writeFileSync(resultPath, `${JSON.stringify(result, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+}
 export async function applyGlobalUpdate(options, run = defaultRunner, execution = defaultExecutionDependencies) {
     const plan = readGlobalUpdatePlan(options.plan);
     assert.equal(options.confirm, plan.planId, 'global update confirmation does not match the exact plan');
+    assert.equal(existsSync(path.join(plan.operationRoot, RESULT_FILE)), false, 'global_update_plan_already_terminal');
     const current = inspectGlobalInstall(run);
     assert.deepEqual(current.packages, plan.prior.packages, 'global packages changed after update planning');
     assert.deepEqual(current.topology, plan.prior.topology, 'global package topology changed after update planning');
@@ -538,31 +794,39 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
     assertHealthyServices(serviceSnapshot(run, current.cliPath));
     const events = [];
     let applicationUpdateId = null;
+    let failedStage = 'stop-cockpit';
     try {
         stopService(run, current.cliPath, 'cockpit');
         events.push('stopped:cockpit');
+        failedStage = 'stop-server';
         stopService(run, current.cliPath, 'server');
         events.push('stopped:server');
+        failedStage = 'install-candidate';
         installGlobalUpdateClosure(run, plan, plan.candidates, plan.target.topology);
         events.push('installed:candidate');
+        failedStage = 'verify-candidate';
         const updated = inspectGlobalInstall(run);
         assert.deepEqual(updated.packages, plan.target.packages, 'installed candidate closure is not exact');
         assert.deepEqual(updated.topology, plan.target.topology, 'installed candidate topology is not canonical');
         if (plan.prior.packages.server === plan.target.packages.server) {
+            failedStage = 'start-unchanged-server';
             startService(run, updated.cliPath, 'server');
             events.push('started:server-unchanged');
         }
         else {
+            failedStage = 'update-server-application';
             applicationUpdateId = updateServerApplication(run, updated.cliPath, {
                 prior: plan.prior.packages.server,
                 target: plan.target.packages.server,
             });
             events.push('updated:server');
         }
+        failedStage = 'start-cockpit';
         startService(run, updated.cliPath, 'cockpit');
         events.push('started:cockpit');
+        failedStage = 'stable-health';
         const healthEvidence = await assertStableHealth(run, plan, execution);
-        return {
+        const result = {
             schemaVersion: 1,
             contract: RESULT_CONTRACT,
             status: 'updated',
@@ -573,9 +837,13 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
             healthEvidence,
             next: 'Exit and reopen the AOPS TUI to run the newly installed binary.',
         };
+        writeTerminalUpdateResult(plan, result);
+        return result;
     }
     catch (updateError) {
+        const updateStage = failedStage;
         events.push('rollback:started');
+        let rollbackError;
         try {
             stopService(run, plan.cliPath, 'cockpit', true);
             stopService(run, plan.cliPath, 'server', true);
@@ -611,10 +879,50 @@ export async function applyGlobalUpdate(options, run = defaultRunner, execution
                 events.push('rollback:services-recovered');
             }
             catch (serviceRecoveryError) {
+                writeTerminalUpdateResult(plan, {
+                    schemaVersion: 1,
+                    contract: RESULT_CONTRACT,
+                    status: 'recovery-required',
+                    planId: plan.planId,
+                    failedStage: updateStage,
+                    rollbackPerformed: true,
+                    rollback: { status: 'failed', error: safeUpdateError(rollbackError) },
+                    serviceRecovery: { status: 'failed', error: safeUpdateError(serviceRecoveryError) },
+                    error: safeUpdateError(updateError),
+                    events,
+                });
                 throw new AggregateError([updateError, rollbackError, serviceRecoveryError], `global update, automatic rollback, and service recovery failed; services may remain stopped; recovery artifacts remain at ${plan.operationRoot}`);
             }
+            writeTerminalUpdateResult(plan, {
+                schemaVersion: 1,
+                contract: RESULT_CONTRACT,
+                status: 'failed-restored',
+                planId: plan.planId,
+                failedStage: updateStage,
+                installed: plan.prior.packages,
+                rollbackPerformed: true,
+                rollback: {
+                    status: 'healthy',
+                    recovery: 'services-recovered',
+                    applicationRollbackError: safeUpdateError(rollbackError),
+                },
+                error: safeUpdateError(updateError),
+                events,
+            });
             throw new AggregateError([updateError, rollbackError], `global update and application rollback failed; prior exact packages and healthy services were restored; recovery artifacts remain at ${plan.operationRoot}`);
         }
+        writeTerminalUpdateResult(plan, {
+            schemaVersion: 1,
+            contract: RESULT_CONTRACT,
+            status: 'failed-restored',
+            planId: plan.planId,
+            failedStage: updateStage,
+            installed: plan.prior.packages,
+            rollbackPerformed: true,
+            rollback: { status: 'healthy' },
+            error: safeUpdateError(updateError),
+            events,
+        });
         throw new Error('global update failed; the prior exact packages were restored and are healthy', { cause: updateError });
     }
 }
@@ -639,7 +947,27 @@ export function makeGlobalUpdateCommand() {
         .description('Apply one exact prepared plan with automatic rollback and health verification')
         .requiredOption('--plan <path>', 'Exact update-plan.json path returned by prepare')
         .requiredOption('--confirm <plan-id>', 'Exact sha256 plan id returned by prepare')
+        .addOption(new Option('--executor-receipt <path>').hideHelp())
         .option('--json', 'Output JSON')
-        .action(async (options) => output(await applyGlobalUpdate(options), options.json === true));
+        .action(async (options) => {
+        if (typeof options.executorReceipt === 'string') {
+            const plan = readGlobalUpdatePlan(options.plan);
+            validateCandidateExecutorInvocation(plan, options.executorReceipt);
+            output(await applyGlobalUpdate(options), options.json === true);
+            return;
+        }
+        output(dispatchGlobalUpdate(options), options.json === true);
+    });
+    command
+        .command('bridge')
+        .description('Apply an old-CLI plan from an externally launched exact public candidate')
+        .requiredOption('--plan <path>', 'Exact update-plan.json path returned by the installed old CLI')
+        .requiredOption('--confirm <plan-id>', 'Exact sha256 plan id returned by prepare')
+        .option('--json', 'Output JSON')
+        .action((options) => {
+        const plan = readGlobalUpdatePlan(options.plan);
+        validateLegacyGlobalUpdateBridgeInvocation(plan);
+        output(dispatchGlobalUpdate(options), options.json === true);
+    });
     return command;
 }

package/dist/lib/agent-assets/native-fs.js

@@ -543,9 +543,9 @@ function defaultNativeRoot() {
     return moduleDirectory.endsWith(`${path.sep}dist`) ? bundled : compiledOrSource;
 }
 function injectedNativeManifestSha256() {
-    return typeof "6164b5c4d71eb6eed7d12b49faf10cd9f7c5324de4e893f50087e7089b5483b3" === 'undefined'
+    return typeof "859b976094fe8cde402fd4ff8b48716df0360ce7e30e698f43b6515216f4c95f" === 'undefined'
         ? undefined
-        : "6164b5c4d71eb6eed7d12b49faf10cd9f7c5324de4e893f50087e7089b5483b3";
+        : "859b976094fe8cde402fd4ff8b48716df0360ce7e30e698f43b6515216f4c95f";
 }
 function sha256(bytes) {
     return createHash('sha256').update(bytes).digest('hex');

package/native/manifest.json

@@ -42,7 +42,7 @@
       "capabilityClass": "windows-ntfs-crash-recoverable-v1",
       "qualification": {
         "relativePath": "qualifications/win32-x64.json",
-        "sha256": "08d7ccc099bcc86e1e4a8cea6ea0d7b50eee76f3a126d6020bf11b2b2edacb3c"
+        "sha256": "57572099d109ed36bd889f2b9f68a1b3bb4b02d31dc776ac9bd1e40c05c83693"
       }
     }
   ]

package/native/qualifications/win32-x64.json

@@ -7,7 +7,7 @@
   "filesystem": "NTFS",
   "primitiveProfile": "windows-createfile-flush-movefileex-v1",
   "capabilityClass": "windows-ntfs-crash-recoverable-v1",
-  "evidenceSha256": "dd80c815d10feb9499911bc5eb9c3bf56964afe66faa894ebc9de478cb0e5311",
+  "evidenceSha256": "8f3be9ab0d760a626f18989308788bd3f590169212bf5ba56cfc255c1c845f89",
   "crashInjectionPoints": [
     "authority-history",
     "authority-current",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
   "aopsDockerServerVersion": "0.2.15",
@@ -44,6 +44,7 @@
     "test:package-identity": "node --test test/package-identity.test.mjs test/npm-tar-entry-mode.test.mjs",
     "test:tui-launcher": "node --test test/tui-launcher.test.mjs",
     "test:global-update": "node --test test/global-update.test.mjs test/cli-error-format.test.mjs",
+    "test:global-update-public-bridge": "node scripts/verify-global-update-public-bridge.mjs",
     "test:skill-discovery": "node --test test/skill-discovery.test.mjs",
     "test:target-auth": "node --test test/target-auth.test.mjs test/device-login.test.mjs",
     "test:target-transport": "node --test test/target-transport.test.mjs",