@aria_asi/cli 0.2.26 → 0.2.29

package/dist/runtime/service.mjs

@@ -0,0 +1,2708 @@
+#!/usr/bin/env node
+
+import { createServer } from 'node:http';
+import { createRequire } from 'node:module';
+import { createHash, createCipheriv, createDecipheriv, randomBytes, randomUUID, scryptSync } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+import { HTTPHarnessClient } from './sdk/index.js';
+import {
+  callProviderForAnthropic,
+  callProviderForOpenAI,
+  extractAnthropicUserMessage,
+  extractOpenAIUserMessage,
+} from './provider-proxy.mjs';
+import {
+  ARISTOTLE_28_MODULES,
+  NOOR_COGNITIVE_SUITE,
+  buildPhaseBlockMessage,
+  buildRuntimeCognitionDirective,
+  extractAegisPatterns,
+  extractEvolutionPrinciples,
+} from './local-phase.mjs';
+import {
+  buildOperatorPlan,
+  classifyTurn,
+  evaluateMizanMid,
+  evaluateMizanPost,
+  evaluateMizanPre,
+  summarizeMizanBundle,
+} from './mizan-scheduler.mjs';
+
+const require = createRequire(import.meta.url);
+const { runFullChain } = require('./vendor/aria-gate-runtime/index.js');
+
+const DEFAULT_HOST = process.env.ARIA_RUNTIME_HOST || '127.0.0.1';
+const DEFAULT_PORT = Number(process.env.ARIA_RUNTIME_PORT || 4319);
+const DEFAULT_HARNESS_URL =
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
+const DEFAULT_RUNTIME_URL = process.env.ARIA_RUNTIME_URL || `http://${DEFAULT_HOST}:${DEFAULT_PORT}`;
+const DEFAULT_QDRANT_URL = process.env.ARIA_QDRANT_URL || 'http://127.0.0.1:6333';
+const DEFAULT_QDRANT_COLLECTION = process.env.ARIA_QDRANT_COLLECTION || 'aria_garden_memory';
+const DEFAULT_FORGE_SERVICE_URL =
+  process.env.ARIA_FORGE_SERVICE_URL ||
+  process.env.FORGE_SERVICE_URL ||
+  `${DEFAULT_HARNESS_URL.replace(/\/$/, '')}/api/forge/psi`;
+const DEFAULT_HEARTBEAT_GRACE_SECONDS = Number(process.env.ARIA_RUNTIME_HEARTBEAT_GRACE_SECONDS || 900);
+const DEFAULT_JOB_CLAIM_SECONDS = Number(process.env.ARIA_RUNTIME_JOB_CLAIM_SECONDS || 120);
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const STATE_DIR = join(__dirname, 'state');
+const LEASE_PATH = join(STATE_DIR, 'lease.enc');
+const RUNTIME_META_PATH = join(STATE_DIR, 'runtime-meta.json');
+const AUTONOMY_STATE_PATH = join(STATE_DIR, 'autonomy.json');
+const COGNITION_STATE_PATH = join(STATE_DIR, 'cognition-state.enc');
+const REVOCATION_LOCK_PATH = join(STATE_DIR, 'revoked.json');
+const CONFIG_PATH = join(process.env.HOME || '', '.aria', 'config.json');
+const CODEBASE_AWARENESS_STATE_PATH = join(process.env.HOME || '', '.aria', 'codebase-awareness-state.json');
+const leaseCache = new Map();
+const TELEMETRY_LIMIT = 250;
+const DECISION_LIMIT = 250;
+const PRINCIPLE_LIMIT = 400;
+const PATTERN_LIMIT = 400;
+const RECEIPT_LIMIT = 500;
+const OWNER_TOKEN_PATH = join(process.env.HOME || '', '.aria', 'owner-token');
+
+function json(res, status, payload) {
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(payload, null, 2));
+}
+
+async function readJson(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  if (chunks.length === 0) return {};
+  const raw = Buffer.concat(chunks).toString('utf8').trim();
+  if (!raw) return {};
+  return JSON.parse(raw);
+}
+
+function readBearer(req) {
+  const auth = req.headers.authorization;
+  if (typeof auth !== 'string') return null;
+  const match = auth.match(/^Bearer\s+(.+)$/i);
+  return match ? match[1] : null;
+}
+
+function hashKey(secret) {
+  return createHash('sha256').update(secret).digest('hex');
+}
+
+function readOwnerToken() {
+  try {
+    if (!existsSync(OWNER_TOKEN_PATH)) return '';
+    return readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function synthesizeOwnerLease(apiKey, reason) {
+  const now = Date.now();
+  const recommended = 300;
+  return {
+    keyHash: hashKey(apiKey),
+    validatedAt: new Date(now).toISOString(),
+    recommendedHeartbeatSeconds: recommended,
+    graceSeconds: DEFAULT_HEARTBEAT_GRACE_SECONDS,
+    nextRequiredAt: now + recommended * 1000,
+    hardStopAt: now + (recommended + DEFAULT_HEARTBEAT_GRACE_SECONDS) * 1000,
+    ownerBypass: true,
+    claims: {
+      tenant_id: 'owner-local',
+      tier: 'owner',
+      expires_at: null,
+      feature_flags: ['owner-bypass'],
+      scope: ['all'],
+      quota: null,
+      doctrine_bundle_hash: null,
+      reason,
+    },
+  };
+}
+
+function deriveEncryptionKey(secret) {
+  return scryptSync(secret, 'aria-mounted-runtime', 32);
+}
+
+function encryptJson(payload, secret) {
+  const iv = randomBytes(12);
+  const key = deriveEncryptionKey(secret);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const plaintext = Buffer.from(JSON.stringify(payload), 'utf8');
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString('base64'),
+    tag: tag.toString('base64'),
+    data: ciphertext.toString('base64'),
+  });
+}
+
+function decryptJson(raw, secret) {
+  const payload = JSON.parse(raw);
+  const key = deriveEncryptionKey(secret);
+  const decipher = createDecipheriv(
+    'aes-256-gcm',
+    key,
+    Buffer.from(payload.iv, 'base64'),
+  );
+  decipher.setAuthTag(Buffer.from(payload.tag, 'base64'));
+  const plaintext = Buffer.concat([
+    decipher.update(Buffer.from(payload.data, 'base64')),
+    decipher.final(),
+  ]).toString('utf8');
+  return JSON.parse(plaintext);
+}
+
+function loadEncryptedLease(secret) {
+  try {
+    if (!existsSync(LEASE_PATH)) return null;
+    return decryptJson(readFileSync(LEASE_PATH, 'utf8'), secret);
+  } catch {
+    return null;
+  }
+}
+
+function saveEncryptedLease(lease, secret) {
+  mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(LEASE_PATH, encryptJson(lease, secret), { mode: 0o600 });
+}
+
+function defaultCognitionState() {
+  return {
+    telemetry: [],
+    decisions: [],
+    evolutionPrinciples: [],
+    aegisPatterns: [],
+    heartbeats: [],
+    hive: [],
+    cognitiveStrings: [],
+    receipts: [],
+    lastUpdatedAt: null,
+  };
+}
+
+function loadEncryptedCognitionState(secret) {
+  try {
+    if (!existsSync(COGNITION_STATE_PATH)) return defaultCognitionState();
+    const state = decryptJson(readFileSync(COGNITION_STATE_PATH, 'utf8'), secret);
+    return {
+      ...defaultCognitionState(),
+      ...(state && typeof state === 'object' ? state : {}),
+    };
+  } catch {
+    return defaultCognitionState();
+  }
+}
+
+function saveEncryptedCognitionState(state, secret) {
+  mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(COGNITION_STATE_PATH, encryptJson({
+    ...state,
+    lastUpdatedAt: new Date().toISOString(),
+  }, secret), { mode: 0o600 });
+}
+
+function readRevocationLock() {
+  return readJsonFile(REVOCATION_LOCK_PATH, null);
+}
+
+function writeRevocationLock(payload) {
+  writeJsonFile(REVOCATION_LOCK_PATH, {
+    lockedAt: new Date().toISOString(),
+    ...payload,
+  });
+}
+
+function clearRevocationLock() {
+  try {
+    if (existsSync(REVOCATION_LOCK_PATH)) rmSync(REVOCATION_LOCK_PATH, { force: true });
+  } catch {}
+}
+
+function ensureNotRevoked(apiKey) {
+  const revoked = readRevocationLock();
+  if (!revoked) return;
+  if (!revoked.keyHash || revoked.keyHash === hashKey(apiKey)) {
+    throw new Error(revoked.reason || 'License revoked. Local runtime state is locked.');
+  }
+}
+
+function readLocalAriaConfig() {
+  return readJsonFile(CONFIG_PATH, {});
+}
+
+function readCodebaseAwarenessState() {
+  return readJsonFile(CODEBASE_AWARENESS_STATE_PATH, {
+    status: 'idle',
+    watchedRepos: [],
+    repoSnapshots: [],
+    lastError: null,
+    updatedAt: null,
+  });
+}
+
+function hashProjectionEmbedding(text, dimension = 256) {
+  const vector = Array.from({ length: dimension }, () => 0);
+  const tokens = String(text || '')
+    .toLowerCase()
+    .split(/[^a-z0-9_./:-]+/i)
+    .filter(Boolean);
+  for (const token of tokens) {
+    const digest = createHash('sha256').update(token).digest();
+    const idx = digest.readUInt16BE(0) % dimension;
+    const sign = (digest[2] & 1) === 0 ? 1 : -1;
+    vector[idx] += sign;
+  }
+  const magnitude = Math.sqrt(vector.reduce((sum, value) => sum + value * value, 0));
+  if (!magnitude) return vector;
+  return vector.map((value) => value / magnitude);
+}
+
+async function qdrantRequest(method, pathname, body = null) {
+  const response = await fetch(`${DEFAULT_QDRANT_URL.replace(/\/+$/, '')}${pathname}`, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!response.ok) {
+    const errorBody = await response.text().catch(() => response.statusText);
+    throw new Error(`Qdrant error ${response.status}: ${errorBody}`);
+  }
+  return response.json().catch(() => ({}));
+}
+
+let qdrantCollectionReady = false;
+
+async function ensureQdrantCollection() {
+  if (qdrantCollectionReady) return;
+  try {
+    await qdrantRequest('GET', `/collections/${encodeURIComponent(DEFAULT_QDRANT_COLLECTION)}`);
+    qdrantCollectionReady = true;
+    return;
+  } catch {}
+
+  await qdrantRequest('PUT', `/collections/${encodeURIComponent(DEFAULT_QDRANT_COLLECTION)}`, {
+    vectors: {
+      size: 256,
+      distance: 'Cosine',
+    },
+  });
+  qdrantCollectionReady = true;
+}
+
+async function persistGardenPulseToQdrant(apiKey, payload) {
+  await ensureQdrantCollection();
+  const pointId = payload.id || randomUUID();
+  const content = [
+    payload.message || '',
+    payload.response || '',
+    Array.isArray(payload.tags) ? payload.tags.join(' ') : '',
+    payload.plannedApproach || '',
+  ].filter(Boolean).join('\n');
+  const vector = hashProjectionEmbedding(content, 256);
+  await qdrantRequest('PUT', `/collections/${encodeURIComponent(DEFAULT_QDRANT_COLLECTION)}/points?wait=true`, {
+    points: [
+      {
+        id: pointId,
+        vector,
+        payload: {
+          keyHash: hashKey(apiKey),
+          sessionId: payload.sessionId || null,
+          message: payload.message || '',
+          response: payload.response || '',
+          plannedApproach: payload.plannedApproach || null,
+          tags: Array.isArray(payload.tags) ? payload.tags : [],
+          telemetry: payload.telemetry || null,
+          readability: payload.readability || null,
+          createdAt: new Date().toISOString(),
+        },
+      },
+    ],
+  });
+  return { pointId, collection: DEFAULT_QDRANT_COLLECTION };
+}
+
+async function searchGardenQdrant(apiKey, query, limit = 8) {
+  await ensureQdrantCollection();
+  const vector = hashProjectionEmbedding(query, 256);
+  const response = await qdrantRequest('POST', `/collections/${encodeURIComponent(DEFAULT_QDRANT_COLLECTION)}/points/search`, {
+    vector,
+    limit: Math.max(1, Math.min(Number(limit) || 8, 20)),
+    with_payload: true,
+    filter: {
+      must: [
+        {
+          key: 'keyHash',
+          match: { value: hashKey(apiKey) },
+        },
+      ],
+    },
+  });
+  return Array.isArray(response?.result) ? response.result : [];
+}
+
+function appendBounded(list, item, limit) {
+  return [item, ...(Array.isArray(list) ? list : [])].slice(0, limit);
+}
+
+function mergeUniqueByJson(list, incoming, limit) {
+  const seen = new Set();
+  const merged = [];
+  for (const item of [...(Array.isArray(incoming) ? incoming : []), ...(Array.isArray(list) ? list : [])]) {
+    if (!item) continue;
+    const key = JSON.stringify(item);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    merged.push(item);
+    if (merged.length >= limit) break;
+  }
+  return merged;
+}
+
+function summarizeCognitionState(state) {
+  return {
+    telemetryTurns: Array.isArray(state.telemetry) ? state.telemetry.length : 0,
+    decisions: Array.isArray(state.decisions) ? state.decisions.length : 0,
+    evolutionPrinciples: Array.isArray(state.evolutionPrinciples) ? state.evolutionPrinciples.length : 0,
+    aegisPatterns: Array.isArray(state.aegisPatterns) ? state.aegisPatterns.length : 0,
+    heartbeats: Array.isArray(state.heartbeats) ? state.heartbeats.length : 0,
+    hive: Array.isArray(state.hive) ? state.hive.length : 0,
+    cognitiveStrings: Array.isArray(state.cognitiveStrings) ? state.cognitiveStrings.length : 0,
+    receipts: Array.isArray(state.receipts) ? state.receipts.length : 0,
+    lastUpdatedAt: state.lastUpdatedAt || null,
+  };
+}
+
+function mutateCognitionState(secret, mutator) {
+  const current = loadEncryptedCognitionState(secret);
+  const next = mutator({ ...current }) || current;
+  saveEncryptedCognitionState(next, secret);
+  return next;
+}
+
+function persistMizanBundle(secret, bundle, source = 'runtime') {
+  if (!bundle?.receipt) return null;
+  mutateCognitionState(secret, (state) => ({
+    ...state,
+    receipts: appendBounded(state.receipts, {
+      at: new Date().toISOString(),
+      source,
+      summary: summarizeMizanBundle(bundle),
+      receipt: bundle.receipt,
+      contract: bundle.contract,
+    }, RECEIPT_LIMIT),
+  }));
+  return bundle.receipt;
+}
+
+function readJsonFile(filePath, fallback) {
+  try {
+    if (!existsSync(filePath)) return fallback;
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJsonFile(filePath, payload, mode = 0o600) {
+  mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(filePath, JSON.stringify(payload, null, 2) + '\n', { mode });
+}
+
+function ensureRuntimeMeta() {
+  const existing = readJsonFile(RUNTIME_META_PATH, null);
+  if (existing?.runtimeId) return existing;
+
+  const created = {
+    runtimeId: randomUUID(),
+    createdAt: new Date().toISOString(),
+    hostnameHint: process.env.HOSTNAME || null,
+  };
+  writeJsonFile(RUNTIME_META_PATH, created);
+  return created;
+}
+
+function loadAutonomyState() {
+  const state = readJsonFile(AUTONOMY_STATE_PATH, {
+    jobs: [],
+    workers: [],
+  });
+  return {
+    jobs: Array.isArray(state.jobs) ? state.jobs : [],
+    workers: Array.isArray(state.workers) ? state.workers : [],
+  };
+}
+
+function saveAutonomyState(state) {
+  writeJsonFile(AUTONOMY_STATE_PATH, state);
+}
+
+function sweepAutonomyState(state) {
+  const now = Date.now();
+
+  for (const job of state.jobs) {
+    if (job.status === 'claimed' && job.claimExpiresAt && Date.parse(job.claimExpiresAt) <= now) {
+      job.status = 'queued';
+      job.workerId = null;
+      job.claimedAt = null;
+      job.claimExpiresAt = null;
+      job.updatedAt = new Date().toISOString();
+      job.progress = [...(job.progress || []), {
+        at: new Date().toISOString(),
+        status: 'lease-expired',
+        message: 'Claim lease expired; job returned to queue.',
+      }];
+    }
+  }
+
+  for (const worker of state.workers) {
+    if (worker.lastHeartbeat && Date.parse(worker.lastHeartbeat) < now - 3 * DEFAULT_JOB_CLAIM_SECONDS * 1000) {
+      worker.status = 'offline';
+      worker.currentJobId = null;
+    }
+  }
+
+  return state;
+}
+
+function queueStats(state) {
+  return {
+    queued: state.jobs.filter((job) => job.status === 'queued').length,
+    claimed: state.jobs.filter((job) => job.status === 'claimed').length,
+    completed: state.jobs.filter((job) => job.status === 'completed').length,
+    failed: state.jobs.filter((job) => job.status === 'failed').length,
+    workers: state.workers.length,
+  };
+}
+
+function asJsonPayload(value) {
+  if (value == null) return null;
+  if (typeof value === 'string') {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return { raw: value };
+    }
+  }
+  return value;
+}
+
+function getAutonomyView(state, limit = 50) {
+  const jobs = [...state.jobs]
+    .sort((a, b) => Date.parse(b.updatedAt || b.createdAt) - Date.parse(a.updatedAt || a.createdAt))
+    .slice(0, limit);
+  const workers = [...state.workers]
+    .sort((a, b) => Date.parse(b.lastHeartbeat || b.registeredAt) - Date.parse(a.lastHeartbeat || a.registeredAt));
+  return {
+    stats: queueStats(state),
+    jobs,
+    workers,
+  };
+}
+
+function resolveApiKey(req, body) {
+  const headerKey = req.headers['x-aria-api-key'];
+  if (typeof headerKey === 'string' && headerKey.trim()) return headerKey.trim();
+  if (typeof body.apiKey === 'string' && body.apiKey.trim()) return body.apiKey.trim();
+  return readBearer(req) || process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || null;
+}
+
+function createClient(req, body) {
+  const apiKey = resolveApiKey(req, body);
+  if (!apiKey) {
+    throw new Error('Missing Aria API key. Supply x-aria-api-key, Authorization: Bearer <token>, ARIA_API_KEY, or ARIA_MASTER_TOKEN.');
+  }
+  ensureNotRevoked(apiKey);
+
+  return new HTTPHarnessClient({
+    baseUrl: typeof body.baseUrl === 'string' && body.baseUrl.trim() ? body.baseUrl.trim() : DEFAULT_HARNESS_URL,
+    apiKey,
+    harnessPacketUrl:
+      typeof body.harnessPacketUrl === 'string' && body.harnessPacketUrl.trim()
+        ? body.harnessPacketUrl.trim()
+        : undefined,
+    workspaceRoot:
+      typeof body.workspaceRoot === 'string' && body.workspaceRoot.trim()
+        ? body.workspaceRoot.trim()
+        : process.cwd(),
+  });
+}
+
+async function heartbeatUpstream(req, body, client, apiKey) {
+  const runtimeMeta = ensureRuntimeMeta();
+  const state = sweepAutonomyState(loadAutonomyState());
+  const heartbeatBody = {
+    token: apiKey,
+    surface:
+      body.surface ||
+      req.headers['x-aria-client-surface'] ||
+      'aria-mounted-runtime',
+    hive: body.hive || null,
+    cognitive_strings: body.cognitiveStrings || body.cognitive_strings || null,
+    evolution: body.evolution || null,
+    aegis_patterns: body.aegisPatterns || body.aegis_patterns || null,
+    telemetry: body.telemetry || null,
+    metadata: {
+      runtime_id: runtimeMeta.runtimeId,
+      runtime: 'aria-mounted-runtime',
+      runtime_url: DEFAULT_RUNTIME_URL,
+      workspace_root: body.workspaceRoot || process.cwd(),
+      autonomy: queueStats(state),
+    },
+  };
+
+  const ownerBypassAllowed =
+    readOwnerToken() &&
+    apiKey === readOwnerToken() &&
+    body.allowOwnerBypass !== false &&
+    process.env.ARIA_RUNTIME_ALLOW_OWNER_BYPASS !== '0';
+
+  let lease;
+  try {
+    const response = await fetch(`${client.baseUrl || DEFAULT_HARNESS_URL}/api/license/heartbeat`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(heartbeatBody),
+    });
+
+    const payload = await response.json().catch(() => ({}));
+    if (response.status === 410) {
+      writeRevocationLock({
+        keyHash: hashKey(apiKey),
+        reason: payload.reason || 'License revoked',
+        responseStatus: response.status,
+      });
+      const error = new Error(payload.reason || 'License revoked');
+      error.code = 'LICENSE_REVOKED';
+      throw error;
+    }
+    if (!response.ok || payload.valid === false) {
+      const error = new Error(payload.reason || `License heartbeat failed (${response.status})`);
+      error.code = 'LICENSE_INVALID';
+      throw error;
+    }
+
+    const recommended = Number(payload.recommended_heartbeat_seconds || 300);
+    lease = {
+      keyHash: hashKey(apiKey),
+      validatedAt: new Date().toISOString(),
+      recommendedHeartbeatSeconds: recommended,
+      graceSeconds: DEFAULT_HEARTBEAT_GRACE_SECONDS,
+      nextRequiredAt: Date.now() + recommended * 1000,
+      hardStopAt: Date.now() + (recommended + DEFAULT_HEARTBEAT_GRACE_SECONDS) * 1000,
+      claims: {
+        tenant_id: payload.tenant_id || null,
+        tier: payload.tier || null,
+        expires_at: payload.expires_at || null,
+        feature_flags: payload.feature_flags || [],
+        scope: payload.scope || [],
+        quota: payload.quota || null,
+        doctrine_bundle_hash: payload.doctrine_bundle_hash || null,
+      },
+    };
+    clearRevocationLock();
+  } catch (error) {
+    if (!ownerBypassAllowed) {
+      throw error;
+    }
+    lease = synthesizeOwnerLease(
+      apiKey,
+      error instanceof Error ? error.message : 'owner bypass',
+    );
+  }
+
+  leaseCache.set(lease.keyHash, lease);
+  saveEncryptedLease(lease, apiKey);
+  mutateCognitionState(apiKey, (state) => {
+    const base = {
+      ...state,
+      heartbeats: appendBounded(state.heartbeats, {
+        at: new Date().toISOString(),
+        lease,
+        hive: body.hive || null,
+        cognitive_strings: body.cognitiveStrings || body.cognitive_strings || null,
+        evolution: body.evolution || null,
+        aegis_patterns: body.aegisPatterns || body.aegis_patterns || null,
+        telemetry: body.telemetry || null,
+      }, TELEMETRY_LIMIT),
+    };
+    if (body.skipLocalStateWrite === true) {
+      return base;
+    }
+    return {
+      ...base,
+      hive: body.hive ? appendBounded(state.hive, { at: new Date().toISOString(), payload: body.hive }, TELEMETRY_LIMIT) : state.hive,
+      cognitiveStrings: body.cognitiveStrings || body.cognitive_strings
+        ? appendBounded(state.cognitiveStrings, {
+            at: new Date().toISOString(),
+            payload: body.cognitiveStrings || body.cognitive_strings,
+          }, TELEMETRY_LIMIT)
+        : state.cognitiveStrings,
+      evolutionPrinciples: body.evolution
+        ? mergeUniqueByJson(state.evolutionPrinciples, Array.isArray(body.evolution) ? body.evolution : [body.evolution], PRINCIPLE_LIMIT)
+        : state.evolutionPrinciples,
+      aegisPatterns: body.aegisPatterns || body.aegis_patterns
+        ? mergeUniqueByJson(state.aegisPatterns, Array.isArray(body.aegisPatterns || body.aegis_patterns) ? (body.aegisPatterns || body.aegis_patterns) : [body.aegisPatterns || body.aegis_patterns], PATTERN_LIMIT)
+        : state.aegisPatterns,
+    };
+  });
+  return lease;
+}
+
+async function ensureLease(req, body, client) {
+  const apiKey = resolveApiKey(req, body);
+  if (!apiKey) {
+    throw new Error('Missing Aria API key for heartbeat validation');
+  }
+
+  const keyHash = hashKey(apiKey);
+  const cached = leaseCache.get(keyHash) || loadEncryptedLease(apiKey);
+  if (cached && cached.hardStopAt > Date.now()) {
+    leaseCache.set(keyHash, cached);
+    if (cached.nextRequiredAt > Date.now()) {
+      return cached;
+    }
+  }
+
+  return heartbeatUpstream(req, body, client, apiKey);
+}
+
+function deriveSessionId(req, body, prefix = 'runtime') {
+  const candidate =
+    body.sessionId ||
+    body.session_id ||
+    body?.metadata?.sessionId ||
+    body?.metadata?.session_id ||
+    req.headers['x-aria-session-id'] ||
+    req.headers['x-session-id'];
+  if (typeof candidate === 'string' && candidate.trim()) return candidate.trim();
+  return `${prefix}-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+
+function deriveUserId(req, body) {
+  const candidate =
+    body.userId ||
+    body.user_id ||
+    body?.metadata?.userId ||
+    body?.metadata?.user_id ||
+    req.headers['x-aria-user-id'];
+  return typeof candidate === 'string' && candidate.trim() ? candidate.trim() : null;
+}
+
+function findVerifiedState(text) {
+  return /(?:verified|confirmed|observed|tested|health[- ]check|response code|exit code|pod image|digest)/i.test(String(text || ''));
+}
+
+function toTelemetryEvent(payload, source = 'aria-mounted-runtime') {
+  return {
+    event_type: payload.event_type || 'runtime.cognition.turn',
+    source,
+    session_id: payload.session_id || null,
+    duration_ms: payload.duration_ms || null,
+    success: payload.success !== false,
+    error: payload.error || null,
+    data: payload.data || {},
+  };
+}
+
+async function pushTelemetryUpstream(client, apiKey, payload) {
+  const url = `${client.baseUrl || DEFAULT_HARNESS_URL}/api/telemetry`;
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify([toTelemetryEvent(payload)]),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`telemetry upstream ${response.status}: ${body}`);
+  }
+  return response.json().catch(() => ({ logged: true }));
+}
+
+async function pushDecisionUpstream(client, apiKey, payload) {
+  const url = `${client.baseUrl || DEFAULT_HARNESS_URL}/api/decisions/log`;
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(payload),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`decision upstream ${response.status}: ${body}`);
+  }
+  return response.json().catch(() => ({ logged: true }));
+}
+
+function buildMinimalInjection(packet, task, aegisLearnings = null) {
+  return {
+    harness: packet,
+    docs: [],
+    files: {},
+    task,
+    loadedAt: new Date().toISOString(),
+    ...(aegisLearnings ? { aegisLearnings } : {}),
+  };
+}
+
+function isOwnerBypassRequest(req, body, apiKey = null) {
+  const ownerToken = readOwnerToken();
+  const candidate = apiKey || resolveApiKey(req, body) || '';
+  return Boolean(
+    ownerToken &&
+    candidate &&
+    candidate === ownerToken &&
+    body.allowOwnerBypass !== false &&
+    process.env.ARIA_RUNTIME_ALLOW_OWNER_BYPASS !== '0',
+  );
+}
+
+function buildOwnerBypassPacket(message, reason = 'owner-local-bypass') {
+  const firstPrinciple = 'Truth over deception. No harm. Sacred trust. Power obligates service. Reflection before action.';
+  return {
+    packet: {
+      harness: [
+        `first_principle = ${firstPrinciple}`,
+        'axioms = truth_over_deception, no_harm, sacred_trust, power_obligates_service, reflection_before_action',
+        `owner_bypass_reason = ${reason}`,
+        'runtime_mode = owner-local-bypass',
+      ].join('\n'),
+      axioms: {
+        truth_over_deception: true,
+        no_harm: true,
+        sacred_trust: true,
+        power_obligates_service: true,
+        reflection_before_action: true,
+      },
+      frames: {
+        first_principle: firstPrinciple,
+        runtime_mode: 'owner-local-bypass',
+        message: message || '',
+      },
+      doctrine: {
+        owner_local_bypass: 'Using local runtime doctrine because remote packet auth is unavailable.',
+      },
+      memory: {},
+    },
+    timestamp: new Date().toISOString(),
+    version: 'owner-local-bypass',
+  };
+}
+
+async function loadRuntimePacket(req, body, client, packetRequest, message) {
+  if (body.packet) return body.packet;
+  try {
+    return await client.getHarnessPacket(packetRequest || {});
+  } catch (error) {
+    if (!isOwnerBypassRequest(req, body)) {
+      throw error;
+    }
+    return buildOwnerBypassPacket(
+      message || packetRequest?.message || '',
+      error instanceof Error ? error.message : 'owner-local-bypass',
+    );
+  }
+}
+
+async function buildRuntimeTurnContext(req, body, client) {
+  const sessionId = deriveSessionId(req, body, body.provider === 'anthropic' ? 'anthropic' : 'openai');
+  const userId = deriveUserId(req, body);
+  const userMessage = Array.isArray(body.messages)
+    ? (body.provider === 'anthropic' ? extractAnthropicUserMessage(body.messages) : extractOpenAIUserMessage(body.messages))
+    : '';
+  const plannedApproach =
+    typeof body.ariaPlannedApproach === 'string' && body.ariaPlannedApproach.trim()
+      ? body.ariaPlannedApproach.trim()
+      : 'Bind to the harness packet, reason through Aristotle and Noor cognitives, avoid unsupported state claims, and emit only what survives validation.';
+  const packetRequest = {
+    sessionId,
+    userId,
+    platform: body.platform || body.client || 'mounted-runtime',
+    system: 'aria-mounted-runtime',
+    stage: 'runtime-proxy',
+    message: userMessage,
+    ...(body.packetRequest && typeof body.packetRequest === 'object' ? body.packetRequest : {}),
+  };
+  const packet = await loadRuntimePacket(req, body, client, packetRequest, userMessage);
+  const runtimeId = ensureRuntimeMeta().runtimeId;
+  const turnClass = classifyTurn({
+    message: userMessage,
+    intendedAction: userMessage,
+    rationale: body.ariaRationale || 'Produce a truthful, substrate-bound answer that survives validation and compounds into the hive.',
+    plannedApproach,
+    domains: body.ariaDomains,
+  });
+  const preBundle = evaluateMizanPre(packet, {
+    sessionId,
+    userId,
+    message: userMessage,
+    intendedAction: userMessage,
+    rationale: body.ariaRationale || 'Produce a truthful, substrate-bound answer that survives validation and compounds into the hive.',
+    plannedApproach,
+    domains: body.ariaDomains,
+  }, {
+    sessionId,
+    runtimeId,
+  });
+  const midBundle = evaluateMizanMid(userMessage, plannedApproach, packet, {
+    sessionId,
+    userId,
+    message: userMessage,
+    plannedApproach,
+    rationale: body.ariaRationale || 'Produce a truthful, substrate-bound answer that survives validation and compounds into the hive.',
+    domains: body.ariaDomains,
+  }, {
+    sessionId,
+    runtimeId,
+    parentReceiptId: preBundle.receipt.receiptId,
+  });
+  const aegisLearnings = await client.getAegisLearnings(12).catch(() => null);
+  const basePrompt = client.buildSystemPrompt(buildMinimalInjection(packet, userMessage || 'Aria runtime turn', aegisLearnings));
+  const cognitionDirective = buildRuntimeCognitionDirective(packet, {
+    preResult: preBundle.result,
+    midResult: midBundle.result,
+  });
+  const ariaSystemPrompt = [basePrompt, '', cognitionDirective].join('\n');
+  return {
+    sessionId,
+    userId,
+    userMessage,
+    plannedApproach,
+    packet,
+    packetBypassed: packet?.version === 'owner-local-bypass',
+    turnClass,
+    operatorPlan: buildOperatorPlan(turnClass, 'pre'),
+    preResult: preBundle.result,
+    preBundle,
+    preReceipt: preBundle.receipt,
+    preContract: preBundle.contract,
+    midResult: midBundle.result,
+    midBundle,
+    midReceipt: midBundle.receipt,
+    midContract: midBundle.contract,
+    aegisLearnings,
+    ariaSystemPrompt,
+  };
+}
+
+async function buildDirectTurnContext(req, body, client, options = {}) {
+  const sessionId =
+    typeof body.sessionId === 'string' && body.sessionId.trim()
+      ? body.sessionId.trim()
+      : deriveSessionId(req, body, options.prefix || 'runtime');
+  const userId =
+    typeof body.userId === 'string' && body.userId.trim()
+      ? body.userId.trim()
+      : deriveUserId(req, body);
+  const userMessage = typeof body.message === 'string' ? body.message : '';
+  const plannedApproach =
+    typeof body.ariaPlannedApproach === 'string' && body.ariaPlannedApproach.trim()
+      ? body.ariaPlannedApproach.trim()
+      : options.defaultPlannedApproach ||
+        'Bind this turn to the packet, run readable Aristotle and Noor cognition, and compound the result into the hive.';
+  const packetRequest = {
+    sessionId,
+    userId,
+    platform: body.platform || body.client || options.platform || 'mounted-runtime',
+    system: 'aria-mounted-runtime',
+    stage: options.stage || 'runtime-direct',
+    message: userMessage,
+    ...(body.packetRequest && typeof body.packetRequest === 'object' ? body.packetRequest : {}),
+  };
+  const packet = await loadRuntimePacket(req, body, client, packetRequest, userMessage);
+  const runtimeId = ensureRuntimeMeta().runtimeId;
+  const rationale =
+    body.ariaRationale ||
+    options.defaultRationale ||
+    'Capture this turn truthfully, preserve cognitive continuity, and write it into the shared Aria substrate.';
+  const turnClass = classifyTurn({
+    message: userMessage,
+    intendedAction: userMessage,
+    plannedApproach,
+    rationale,
+    domains: body.ariaDomains,
+  });
+  const preBundle = evaluateMizanPre(packet, {
+    sessionId,
+    userId,
+    message: userMessage,
+    intendedAction: userMessage,
+    rationale,
+    plannedApproach,
+    domains: body.ariaDomains,
+  }, {
+    sessionId,
+    runtimeId,
+  });
+  const midBundle = evaluateMizanMid(userMessage, plannedApproach, packet, {
+    sessionId,
+    userId,
+    message: userMessage,
+    plannedApproach,
+    rationale,
+    domains: body.ariaDomains,
+  }, {
+    sessionId,
+    runtimeId,
+    parentReceiptId: preBundle.receipt.receiptId,
+  });
+  return {
+    sessionId,
+    userId,
+    userMessage,
+    plannedApproach,
+    packet,
+    packetBypassed: packet?.version === 'owner-local-bypass',
+    turnClass,
+    operatorPlan: buildOperatorPlan(turnClass, 'pre'),
+    preResult: preBundle.result,
+    preBundle,
+    preReceipt: preBundle.receipt,
+    preContract: preBundle.contract,
+    midResult: midBundle.result,
+    midBundle,
+    midReceipt: midBundle.receipt,
+    midContract: midBundle.contract,
+  };
+}
+
+function openAiResponseEnvelope(body, text, providerMeta, extra = {}) {
+  const debug = body?.ariaDebug === true;
+  return {
+    id: `chatcmpl_${randomUUID().replace(/-/g, '')}`,
+    object: 'chat.completion',
+    created: Math.floor(Date.now() / 1000),
+    model: providerMeta.model,
+    choices: [
+      {
+        index: 0,
+        finish_reason: providerMeta.finishReason || 'stop',
+        message: {
+          role: 'assistant',
+          content: text,
+        },
+      },
+    ],
+    usage: providerMeta.usage
+      ? {
+          prompt_tokens: providerMeta.usage.promptTokens || 0,
+          completion_tokens: providerMeta.usage.completionTokens || 0,
+          total_tokens: (providerMeta.usage.promptTokens || 0) + (providerMeta.usage.completionTokens || 0),
+        }
+      : undefined,
+    aria: buildReadableAriaEnvelope(extra, debug),
+  };
+}
+
+function anthropicResponseEnvelope(text, providerMeta, extra = {}, debug = false) {
+  return {
+    id: `msg_${randomUUID().replace(/-/g, '')}`,
+    type: 'message',
+    role: 'assistant',
+    model: providerMeta.model,
+    stop_reason: providerMeta.finishReason || 'end_turn',
+    content: [{ type: 'text', text }],
+    usage: providerMeta.usage
+      ? {
+          input_tokens: providerMeta.usage.promptTokens || 0,
+          output_tokens: providerMeta.usage.completionTokens || 0,
+        }
+      : undefined,
+    aria: buildReadableAriaEnvelope(extra, debug),
+  };
+}
+
+function toReadableSignal(name) {
+  const map = {
+    fitrah_gate: 'truth boundary',
+    truth_lens: 'truth check',
+    harm_lens: 'harm check',
+    trust_lens: 'trust boundary',
+    power_lens: 'impact check',
+    reflection_lens: 'reflection pass',
+    tafakkur: 'deep analysis',
+    tadabbur: 'consequence mapping',
+    qiyas: 'analogy transfer',
+    istiqra: 'pattern induction',
+    self_reflection: 'self-check',
+    predictor: 'next-step forecast',
+    meta_cognition: 'meta-cognition',
+    mizan: 'quality balance',
+    nur: 'direct read',
+    firasah: 'discernment',
+    ghazali_8_lens: 'quality scrutiny',
+    quality_gate: 'quality gate',
+    evolution_distill: 'evolution distill',
+    aegis_pattern_match: 'risk pattern match',
+    noor_recognition: 'recognition pull',
+    forge_primitive_planner: 'tool planning',
+  };
+  return map[name] || String(name || '').replace(/_/g, ' ');
+}
+
+function summarizePhaseResult(phase, result) {
+  if (!result) return null;
+  const notes = Array.isArray(result.notes) ? result.notes.filter(Boolean) : [];
+  const fired = Array.isArray(result.fired) ? result.fired.filter(Boolean) : [];
+  return {
+    phase,
+    blocked: Boolean(result.fitrahVetoed || result.reAuthorSignal),
+    alignment: result.fitrahAlignment == null ? null : Math.round(Number(result.fitrahAlignment) * 100),
+    quality: result.qualityScore == null ? null : Number(result.qualityScore),
+    signals: fired.slice(0, 6).map(toReadableSignal),
+    summary: notes.slice(0, 3).join(' | ') || null,
+  };
+}
+
+function buildReadableAriaEnvelope(extra = {}, debug = false) {
+  const phases = [
+    summarizePhaseResult('pre', extra.pre),
+    summarizePhaseResult('mid', extra.mid),
+    summarizePhaseResult('post', extra.post),
+  ].filter(Boolean);
+  const receipts = extra.receipts ? {
+    pre: extra.receipts.pre ? {
+      id: extra.receipts.pre.receiptId,
+      blocked: Boolean(extra.receipts.pre.blocked),
+      turnClass: extra.receipts.pre.turnClass,
+      quality: extra.receipts.pre.qualityScore,
+    } : null,
+    mid: extra.receipts.mid ? {
+      id: extra.receipts.mid.receiptId,
+      blocked: Boolean(extra.receipts.mid.blocked),
+      turnClass: extra.receipts.mid.turnClass,
+      quality: extra.receipts.mid.qualityScore,
+    } : null,
+    post: extra.receipts.post ? {
+      id: extra.receipts.post.receiptId,
+      blocked: Boolean(extra.receipts.post.blocked),
+      turnClass: extra.receipts.post.turnClass,
+      quality: extra.receipts.post.qualityScore,
+    } : null,
+  } : null;
+
+  const validation = extra.validation ? {
+    severity: extra.validation.severity,
+    issues: Array.isArray(extra.validation.violations) ? extra.validation.violations.slice(0, 3) : [],
+    rewritten: Boolean(extra.validation.rewritten),
+  } : null;
+
+  const layer3 = extra.layer3 ? {
+    pass: extra.layer3.pass !== false,
+    blockers: Array.isArray(extra.layer3.failures)
+      ? extra.layer3.failures
+          .filter((failure) => failure?.severity === 'block')
+          .slice(0, 3)
+          .map((failure) => failure.detail || failure.kind || 'runtime block')
+      : [],
+  } : null;
+
+  const envelope = {
+    blocked: Boolean(extra.blocked),
+    control_plane: 'aria-mounted-runtime',
+    principle: extra.pre?.firstPrincipleText || null,
+    phases,
+    turn_class: extra.turnClass ? {
+      kind: extra.turnClass.kind,
+      intensity: extra.turnClass.intensity,
+      domains: extra.turnClass.domains,
+    } : null,
+    operator_plan: extra.operatorPlan ? {
+      packs: extra.operatorPlan.requiredPacks,
+      operators: extra.operatorPlan.priorityOperators,
+    } : null,
+    receipts,
+    validation,
+    layer3,
+  };
+
+  if (debug) {
+    envelope.raw = extra;
+  }
+
+  return envelope;
+}
+
+function coerceNonEmptyString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+function extractJsonObject(text) {
+  const raw = String(text || '').trim();
+  if (!raw) {
+    throw new Error('planner returned empty output');
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {}
+
+  const fenced = raw.match(/```(?:json)?\s*([\s\S]+?)```/i);
+  if (fenced?.[1]) {
+    try {
+      return JSON.parse(fenced[1].trim());
+    } catch {}
+  }
+
+  const first = raw.indexOf('{');
+  const last = raw.lastIndexOf('}');
+  if (first >= 0 && last > first) {
+    return JSON.parse(raw.slice(first, last + 1));
+  }
+  throw new Error('planner output did not contain valid JSON');
+}
+
+function compactCodebaseSnapshot() {
+  const config = readLocalAriaConfig();
+  const awareness = readCodebaseAwarenessState();
+  const repositories = Array.isArray(config.repositories) ? config.repositories : [];
+  const schemaImages = config.schemaImages && typeof config.schemaImages === 'object'
+    ? config.schemaImages
+    : {};
+  const repoSnapshots = Array.isArray(awareness.repoSnapshots) ? awareness.repoSnapshots : [];
+  return {
+    repositories: repositories.slice(0, 6).map((repo) => ({
+      name: repo?.name || null,
+      path: repo?.path || null,
+      language: repo?.language || null,
+      packageManager: repo?.packageManager || null,
+      entry: repo?.entry || null,
+    })),
+    schemaImages,
+    awareness: {
+      status: awareness.status || 'idle',
+      updatedAt: awareness.updatedAt || null,
+      repoSnapshots: repoSnapshots.slice(0, 4).map((repo) => ({
+        repoName: repo?.repoName || repo?.name || null,
+        filesIndexed: repo?.filesIndexed || repo?.fileCount || null,
+        symbolsIndexed: repo?.symbolsIndexed || null,
+        routesIndexed: repo?.routesIndexed || null,
+        summary: repo?.summary || null,
+      })),
+    },
+  };
+}
+
+function buildForgePlannerPrompt(turn, body) {
+  const requestedDomain = coerceNonEmptyString(body.domain) || 'general';
+  const codebase = compactCodebaseSnapshot();
+  const requestShape = {
+    user_goal: turn.userMessage,
+    requested_domain: requestedDomain,
+    requested_paths: Array.isArray(body.paths) ? body.paths.slice(0, 24) : [],
+    constraints: Array.isArray(body.constraints) ? body.constraints.slice(0, 24) : [],
+    desired_outputs: Array.isArray(body.outputs) ? body.outputs.slice(0, 24) : [],
+    materialize: body.materialize !== false,
+    audit: body.audit !== false,
+    codebase,
+  };
+  return [
+    'You are the Aria Forge planning head. Produce a strict JSON manifest for Forge PSI.',
+    'Do not write code. Do not explain yourself. Return JSON only.',
+    'The manifest must be readable and operational, not abstract.',
+    'Use plain labels. Do not expose internal cognition IP names in user-facing summary fields.',
+    'Required JSON keys:',
+    '- normalizedIntent: string',
+    '- domain: string',
+    '- manifestSummary: string',
+    '- requestedArtifacts: string[]',
+    '- constraints: string[]',
+    '- paths: string[]',
+    '- implementationPlan: string[]',
+    '- runtimeMode: string',
+    '- materialize: boolean',
+    '- audit: boolean',
+    '- enforceAudit: boolean',
+    '- providerIntent: { lane: string, why: string }',
+    '',
+    'Input:',
+    JSON.stringify(requestShape, null, 2),
+  ].join('\n');
+}
+
+function resolveForgeServiceUrl(baseUrl, pathname) {
+  const normalizedBase = baseUrl.replace(/\/+$/, '');
+  if (normalizedBase.endsWith('/api/forge/psi') && pathname === '/synthesize') {
+    return normalizedBase;
+  }
+  return `${normalizedBase}${pathname}`;
+}
+
+async function callForgeService(pathname, payload, options = {}) {
+  const baseUrl = DEFAULT_FORGE_SERVICE_URL.replace(/\/+$/, '');
+  const targetUrl = resolveForgeServiceUrl(baseUrl, pathname);
+  const headers = { 'Content-Type': 'application/json' };
+  const authToken = coerceNonEmptyString(options.authToken);
+  if (authToken) {
+    headers.Authorization = `Bearer ${authToken}`;
+    headers['X-API-Key'] = authToken;
+  }
+  let response;
+  try {
+    response = await fetch(targetUrl, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(payload),
+    });
+  } catch (error) {
+    throw new Error(`Forge PSI fetch failed for ${targetUrl}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
+  const responseText = await response.text();
+  let parsed;
+  try {
+    parsed = responseText ? JSON.parse(responseText) : {};
+  } catch {
+    parsed = { raw: responseText };
+  }
+
+  if (!response.ok) {
+    const detail =
+      parsed && typeof parsed === 'object'
+        ? parsed.error || parsed.message || responseText || response.statusText
+        : responseText || response.statusText;
+    throw new Error(`Forge PSI error ${response.status} from ${targetUrl}: ${detail}`);
+  }
+
+  return parsed;
+}
+
+function summarizeForgeOutcome(manifest, forgeResult) {
+  const summary = [
+    `Forge plan: ${manifest.manifestSummary || manifest.normalizedIntent || 'runtime forge synthesis'}`,
+  ];
+  if (Array.isArray(forgeResult?.writtenFiles) && forgeResult.writtenFiles.length > 0) {
+    summary.push(`Files materialized: ${forgeResult.writtenFiles.slice(0, 8).join(', ')}`);
+  }
+  if (forgeResult?.forgeAudit?.verdict) {
+    summary.push(`Audit verdict: ${forgeResult.forgeAudit.verdict}`);
+  }
+  if (forgeResult?.metadata?.runtime) {
+    summary.push(`Forge runtime: ${forgeResult.metadata.runtime}`);
+  }
+  return summary.join('\n');
+}
+
+function buildForgeExecutionIntent(normalizedIntent, manifest) {
+  const sections = [coerceNonEmptyString(normalizedIntent)];
+  if (Array.isArray(manifest.requestedArtifacts) && manifest.requestedArtifacts.length > 0) {
+    sections.push(`Required artifact paths:\n- ${manifest.requestedArtifacts.join('\n- ')}`);
+  }
+  if (Array.isArray(manifest.constraints) && manifest.constraints.length > 0) {
+    sections.push(`Constraints:\n- ${manifest.constraints.join('\n- ')}`);
+  }
+  if (Array.isArray(manifest.implementationPlan) && manifest.implementationPlan.length > 0) {
+    sections.push(`Execution plan:\n- ${manifest.implementationPlan.join('\n- ')}`);
+  }
+  return sections.filter(Boolean).join('\n\n');
+}
+
+function extractForgeArtifactPaths(forgeResult) {
+  const explicit = Array.isArray(forgeResult?.writtenFiles) ? forgeResult.writtenFiles.filter(Boolean) : [];
+  if (explicit.length > 0) return explicit;
+  const code = coerceNonEmptyString(forgeResult?.code);
+  if (!code) return [];
+  try {
+    const parsed = extractJsonObject(code);
+    if (Array.isArray(parsed?.files)) {
+      return parsed.files.map((file) => coerceNonEmptyString(file?.path)).filter(Boolean);
+    }
+  } catch {}
+  return [];
+}
+
+function computeForgeContractIssues(manifest, forgeResult) {
+  const issues = [];
+  const requestedArtifacts = Array.isArray(manifest.requestedArtifacts) ? manifest.requestedArtifacts.filter(Boolean) : [];
+  const actualArtifacts = extractForgeArtifactPaths(forgeResult);
+  if (requestedArtifacts.length > 0) {
+    const matched = requestedArtifacts.filter((requested) =>
+      actualArtifacts.some((actual) => actual === requested || actual.endsWith(`/${requested}`) || requested.endsWith(`/${actual}`)),
+    );
+    if (matched.length === 0) {
+      issues.push(`forge output missed requested artifact paths (${requestedArtifacts.join(', ')})`);
+    }
+  }
+  const qaVerdict = forgeResult?.metadata?.qaGate?.verdict || null;
+  if (qaVerdict === 'fail') {
+    issues.push('forge qa gate failed');
+  }
+  return {
+    requestedArtifacts,
+    actualArtifacts,
+    issues,
+    matched: issues.length === 0,
+  };
+}
+
+async function persistTurnArtifacts(req, body, client, apiKey, turn) {
+  const evolutionPrinciples = extractEvolutionPrinciples(turn.packet, [turn.preResult, turn.midResult, turn.postResult]);
+  const aegisPatterns = [
+    ...extractAegisPatterns(turn.midResult || {}),
+    ...extractAegisPatterns(turn.postResult || {}),
+  ];
+  const cognitionStrings = {
+    pre: turn.preResult?.notes || [],
+    mid: turn.midResult?.notes || [],
+    post: turn.postResult?.notes || [],
+    receipts: {
+      pre: turn.preReceipt || null,
+      mid: turn.midReceipt || null,
+      post: turn.postReceipt || null,
+    },
+    contracts: {
+      pre: turn.preContract || null,
+      mid: turn.midContract || null,
+      post: turn.postContract || null,
+    },
+    turn_class: turn.turnClass || null,
+    operator_plan: turn.operatorPlan || null,
+    fired: [
+      ...(turn.preResult?.fired || []),
+      ...(turn.midResult?.fired || []),
+      ...(turn.postResult?.fired || []),
+    ],
+    first_principle: turn.preResult?.firstPrincipleText || null,
+    aristotle_28: ARISTOTLE_28_MODULES,
+    noor_cognitives: NOOR_COGNITIVE_SUITE,
+    readable: {
+      pre: summarizePhaseResult('pre', turn.preResult),
+      mid: summarizePhaseResult('mid', turn.midResult),
+      post: summarizePhaseResult('post', turn.postResult),
+    },
+  };
+
+  const telemetryPayload = {
+    event_type: 'runtime.cognition.turn',
+    session_id: turn.sessionId,
+    duration_ms: turn.durationMs,
+    success: turn.success,
+    error: turn.error || null,
+    data: {
+      provider: turn.providerMeta.provider,
+      model: turn.providerMeta.model,
+      finish_reason: turn.providerMeta.finishReason,
+      message: turn.userMessage,
+      planned_approach: turn.plannedApproach,
+      validation: turn.validation,
+      layer3: turn.layer3,
+      pre: turn.preResult,
+      mid: turn.midResult,
+      post: turn.postResult,
+      evolution_principles: evolutionPrinciples,
+      aegis_patterns: aegisPatterns,
+      runtime_url: DEFAULT_RUNTIME_URL,
+      runtime_id: ensureRuntimeMeta().runtimeId,
+    },
+  };
+
+  mutateCognitionState(apiKey, (state) => ({
+    ...state,
+    telemetry: appendBounded(state.telemetry, telemetryPayload, TELEMETRY_LIMIT),
+    evolutionPrinciples: mergeUniqueByJson(state.evolutionPrinciples, evolutionPrinciples, PRINCIPLE_LIMIT),
+    aegisPatterns: mergeUniqueByJson(state.aegisPatterns, aegisPatterns, PATTERN_LIMIT),
+    receipts: appendBounded(state.receipts, {
+      at: new Date().toISOString(),
+      source: 'persistTurnArtifacts',
+      sessionId: turn.sessionId,
+      turnClass: turn.turnClass || null,
+      pre: turn.preReceipt || null,
+      mid: turn.midReceipt || null,
+      post: turn.postReceipt || null,
+    }, RECEIPT_LIMIT),
+    cognitiveStrings: appendBounded(state.cognitiveStrings, {
+      at: new Date().toISOString(),
+      sessionId: turn.sessionId,
+      payload: cognitionStrings,
+    }, TELEMETRY_LIMIT),
+    hive: appendBounded(state.hive, {
+      at: new Date().toISOString(),
+      sessionId: turn.sessionId,
+      message: turn.userMessage,
+      response: turn.finalText,
+    }, TELEMETRY_LIMIT),
+  }));
+
+  try {
+    await persistGardenPulseToQdrant(apiKey, {
+      sessionId: turn.sessionId,
+      message: turn.userMessage,
+      response: turn.finalText,
+      plannedApproach: turn.plannedApproach,
+      tags: [
+        'runtime-turn',
+        turn.providerMeta.provider || 'provider',
+        turn.success ? 'pass' : 'blocked',
+      ],
+      telemetry: {
+        provider: turn.providerMeta.provider,
+        model: turn.providerMeta.model,
+        finish_reason: turn.providerMeta.finishReason,
+        success: turn.success,
+      },
+      readability: cognitionStrings.readable,
+    });
+  } catch {}
+
+  const heartbeatBody = {
+    apiKey,
+    surface: 'aria-mounted-runtime',
+    skipLocalStateWrite: true,
+    hive: {
+      session_id: turn.sessionId,
+      message: turn.userMessage,
+      response: turn.finalText,
+    },
+    cognitive_strings: cognitionStrings,
+    evolution: evolutionPrinciples,
+    aegis_patterns: aegisPatterns,
+    telemetry: telemetryPayload.data,
+    metadata: {
+      runtime_id: ensureRuntimeMeta().runtimeId,
+      runtime: 'aria-mounted-runtime',
+      runtime_url: DEFAULT_RUNTIME_URL,
+      workspace_root: process.cwd(),
+      provider: turn.providerMeta.provider,
+      model: turn.providerMeta.model,
+    },
+  };
+
+  try {
+    await heartbeatUpstream(req, heartbeatBody, client, apiKey);
+  } catch {}
+
+  try {
+    await pushTelemetryUpstream(client, apiKey, telemetryPayload);
+  } catch {}
+
+  if (findVerifiedState(turn.finalText) || /recommend|should|propose|choose/i.test(turn.finalText)) {
+    const decisionPayload = {
+      decision_type: body?.metadata?.decision_type || 'runtime-turn',
+      category: body?.metadata?.decision_category || 'cognition-control-plane',
+      context: turn.userMessage.slice(0, 2000) || 'mounted runtime turn',
+      decision: turn.finalText.slice(0, 2000),
+      reasoning: [
+        ...(turn.preResult?.notes || []),
+        ...(turn.midResult?.notes || []),
+        ...(turn.postResult?.notes || []),
+      ].join(' | ').slice(0, 4000) || 'Aria runtime cognition turn',
+      outcome: 'pending',
+      expected_outcome: {
+        predicate: 'response survives runtime validation and compounds into central telemetry',
+        measurable_type: 'boolean',
+        threshold: true,
+      },
+      source: 'aria-mounted-runtime',
+      model_used: turn.providerMeta.model,
+      code_links: body?.metadata?.code_links || null,
+    };
+    try {
+      const decisionResult = await pushDecisionUpstream(client, apiKey, decisionPayload);
+      mutateCognitionState(apiKey, (state) => ({
+        ...state,
+        decisions: appendBounded(state.decisions, {
+          at: new Date().toISOString(),
+          sessionId: turn.sessionId,
+          decision: decisionPayload,
+          result: decisionResult,
+        }, DECISION_LIMIT),
+      }));
+    } catch {}
+  }
+
+  if (body.ariaGarden !== false && turn.userMessage && turn.finalText) {
+    try {
+      await client.gardenTurn(turn.sessionId, turn.userMessage, turn.finalText, turn.userId || undefined);
+    } catch {}
+  }
+}
+
+async function handleProviderProxy(req, body, client, providerStyle) {
+  const apiKey = resolveApiKey(req, body);
+  const startedAt = Date.now();
+  const turn = await buildRuntimeTurnContext(req, body, client);
+  if (turn.preResult.fitrahVetoed) {
+    const refusal = buildPhaseBlockMessage(turn.preResult, 'pre');
+    const extra = { blocked: true, phase: 'pre', pre: turn.preResult, mid: turn.midResult };
+  return providerStyle === 'anthropic'
+    ? anthropicResponseEnvelope(refusal, { model: body.model || 'aria-runtime', finishReason: 'end_turn' }, extra, body?.ariaDebug === true)
+      : openAiResponseEnvelope(body, refusal, { model: body.model || 'aria-runtime', finishReason: 'stop', usage: null }, extra);
+  }
+
+  const providerMeta = providerStyle === 'anthropic'
+    ? await callProviderForAnthropic(body, turn.ariaSystemPrompt)
+    : await callProviderForOpenAI(body, turn.ariaSystemPrompt);
+
+  let candidateText = providerMeta.text || '';
+  let validation;
+  try {
+    validation = await client.validateOutput(candidateText, turn.sessionId);
+  } catch (error) {
+    if (!turn.packetBypassed) throw error;
+    validation = {
+      passed: true,
+      severity: 'warn',
+      violations: [
+        `remote validate unavailable: ${error instanceof Error ? error.message : String(error)}`,
+      ],
+      gateTriggers: ['owner-local-bypass'],
+    };
+  }
+  if (validation?.severity === 'block' && validation?.rewritten) {
+    candidateText = validation.rewritten;
+    try {
+      validation = await client.validateOutput(candidateText, turn.sessionId);
+    } catch (error) {
+      if (!turn.packetBypassed) throw error;
+      validation = {
+        passed: true,
+        severity: 'warn',
+        violations: [
+          `remote validate unavailable after rewrite: ${error instanceof Error ? error.message : String(error)}`,
+        ],
+        gateTriggers: ['owner-local-bypass'],
+      };
+    }
+  }
+
+  const layer3 = await runLayer3(req, {
+    text: candidateText,
+    packet: turn.packet,
+    fetchPacket: false,
+    requireCognitionBlock: body.requireCognitionBlock ?? false,
+  }, client);
+  const postBundle = evaluateMizanPost(candidateText, {
+    hasVerifiedState: findVerifiedState(candidateText),
+    layer3Pass: layer3.pass,
+    remoteValidationSeverity: validation.severity,
+  }, turn.packet, {
+    sessionId: turn.sessionId,
+    userId: turn.userId,
+    message: turn.userMessage,
+    plannedApproach: turn.plannedApproach,
+    domains: body.ariaDomains,
+  }, {
+    sessionId: turn.sessionId,
+    runtimeId: ensureRuntimeMeta().runtimeId,
+    parentReceiptId: turn.midReceipt?.receiptId || turn.preReceipt?.receiptId || null,
+  });
+  const postResult = postBundle.result;
+
+  const blocked = validation.severity === 'block' || !layer3.pass || postResult.reAuthorSignal;
+  const finalText = blocked ? buildPhaseBlockMessage(postResult, 'post') : candidateText;
+  await persistTurnArtifacts(req, body, client, apiKey, {
+    ...turn,
+    postResult,
+    postBundle,
+    postReceipt: postBundle.receipt,
+    postContract: postBundle.contract,
+    validation,
+    layer3,
+    finalText,
+    durationMs: Date.now() - startedAt,
+    success: !blocked,
+    error: blocked ? 'runtime blocked output' : null,
+    providerMeta,
+  });
+
+  const extra = {
+    blocked,
+    pre: turn.preResult,
+    mid: turn.midResult,
+    post: postResult,
+    receipts: {
+      pre: turn.preReceipt,
+      mid: turn.midReceipt,
+      post: postBundle.receipt,
+    },
+    turnClass: turn.turnClass,
+    operatorPlan: turn.operatorPlan,
+    validation,
+    layer3,
+  };
+  return providerStyle === 'anthropic'
+    ? anthropicResponseEnvelope(finalText, providerMeta, extra, body?.ariaDebug === true)
+    : openAiResponseEnvelope(body, finalText, providerMeta, extra);
+}
+
+async function handleForgeSynthesis(req, body, client) {
+  const apiKey = resolveApiKey(req, body);
+  const startedAt = Date.now();
+  const intent =
+    coerceNonEmptyString(body.intent) ||
+    coerceNonEmptyString(body.input) ||
+    coerceNonEmptyString(body.prompt) ||
+    coerceNonEmptyString(body.message) ||
+    coerceNonEmptyString(body.description);
+  if (!intent) {
+    throw new Error('forge/synthesize requires intent, input, prompt, message, or description');
+  }
+
+  const boundBody = {
+    ...body,
+    message: intent,
+    ariaPlannedApproach:
+      coerceNonEmptyString(body.ariaPlannedApproach) ||
+      'Use an LLM to normalize the implementation intent into a readable forge manifest, then hand that manifest to Forge PSI for real synthesis and materialization.',
+    ariaRationale:
+      coerceNonEmptyString(body.ariaRationale) ||
+      'Aria should act as the control plane: planning and cognition in runtime, synthesis and file materialization in Forge PSI, with telemetry compounded into hive and garden.',
+  };
+  const turn = await buildDirectTurnContext(req, boundBody, client, {
+    prefix: 'forge',
+    stage: 'forge-synthesize',
+    platform: 'aria-forge-runtime',
+    defaultPlannedApproach:
+      'Normalize the request into a forge manifest, route it through real Forge PSI synthesis, and persist readable cognition and outcome telemetry.',
+    defaultRationale:
+      'Forge PSI should be headed by Aria runtime cognition rather than direct raw prompting.',
+  });
+
+  if (turn.preResult.fitrahVetoed) {
+    const refusal = buildPhaseBlockMessage(turn.preResult, 'pre');
+    return {
+      ok: false,
+      blocked: true,
+      phase: 'pre',
+      manifest: null,
+      forge: null,
+      aria: buildReadableAriaEnvelope({
+        blocked: true,
+        pre: turn.preResult,
+        mid: turn.midResult,
+      }, body?.ariaDebug === true),
+      response: refusal,
+    };
+  }
+
+  const plannerPrompt = buildForgePlannerPrompt(turn, body);
+  const plannerBody = {
+    ...body,
+    allowProviderFallback: body.allowProviderFallback !== false,
+    messages: [{ role: 'user', content: plannerPrompt }],
+    metadata: {
+      ...(body.metadata && typeof body.metadata === 'object' ? body.metadata : {}),
+      intent: 'forge-manifest-planner',
+      mode: 'architecture',
+      roleProfile: 'forge-planner',
+    },
+    modelIntent: 'architecture forge planner manifest',
+  };
+  const plannerMeta = await callProviderForOpenAI(plannerBody, [
+    'You are Aria runtime acting as the Forge planning head.',
+    'Return strict JSON only.',
+    'Do not emit code fences unless the content is still valid JSON.',
+  ].join('\n'));
+  const manifest = extractJsonObject(plannerMeta.text || '');
+  const normalizedIntent = coerceNonEmptyString(manifest.normalizedIntent) || intent;
+  const domain = coerceNonEmptyString(manifest.domain) || coerceNonEmptyString(body.domain) || 'general';
+  const requestedArtifacts = Array.isArray(manifest.requestedArtifacts) ? manifest.requestedArtifacts.filter(Boolean) : [];
+  const constraints = Array.isArray(manifest.constraints) ? manifest.constraints.filter(Boolean) : [];
+  const paths = Array.isArray(manifest.paths) ? manifest.paths.filter(Boolean) : [];
+  const implementationPlan = Array.isArray(manifest.implementationPlan) ? manifest.implementationPlan.filter(Boolean) : [];
+  const forgeAuthToken =
+    coerceNonEmptyString(body.forgeAuthToken) ||
+    coerceNonEmptyString(process.env.FORGE_API_TOKEN) ||
+    coerceNonEmptyString(process.env.ARIA_API_KEY) ||
+    coerceNonEmptyString(process.env.ARIA_MASTER_TOKEN) ||
+    coerceNonEmptyString(body.apiKey);
+
+  const forgeManifest = {
+    normalizedIntent,
+    requestedArtifacts,
+    constraints,
+    implementationPlan,
+  };
+  const forgePayload = {
+    input: buildForgeExecutionIntent(normalizedIntent, forgeManifest),
+    type: 'intention',
+    domain,
+    materialize: manifest.materialize !== false && body.materialize !== false,
+    audit: manifest.audit !== false && body.audit !== false,
+    enforceAudit: manifest.enforceAudit !== false && body.enforceAudit !== false,
+    author: 'aria-mounted-runtime',
+    context: {
+      ...(body.context && typeof body.context === 'object' ? body.context : {}),
+      runtimeManifest: {
+        manifestSummary: coerceNonEmptyString(manifest.manifestSummary),
+        requestedArtifacts,
+        constraints,
+        paths,
+        implementationPlan,
+        providerIntent: manifest.providerIntent || null,
+      },
+      runtimeReadableCognition: {
+        pre: summarizePhaseResult('pre', turn.preResult),
+        mid: summarizePhaseResult('mid', turn.midResult),
+      },
+      codebase: compactCodebaseSnapshot(),
+    },
+  };
+
+  const forgeResult = await callForgeService('/synthesize', forgePayload, {
+    authToken: forgeAuthToken,
+  });
+  const contractCheck = computeForgeContractIssues(forgeManifest, forgeResult);
+  const summaryText = summarizeForgeOutcome({
+    normalizedIntent,
+    manifestSummary: coerceNonEmptyString(manifest.manifestSummary),
+  }, forgeResult);
+  const validation = {
+    passed: contractCheck.issues.length === 0,
+    severity: contractCheck.issues.length === 0 ? 'pass' : 'block',
+    violations: contractCheck.issues,
+    gateTriggers: ['forge-runtime', ...(contractCheck.issues.length > 0 ? ['forge-contract'] : [])],
+  };
+  const layer3 = await runLayer3(req, {
+    text: typeof forgeResult?.code === 'string' && forgeResult.code.trim() ? forgeResult.code : summaryText,
+    packet: turn.packet,
+    fetchPacket: false,
+    requireCognitionBlock: body.requireCognitionBlock ?? false,
+  }, client).catch((error) => layer3FailureResult(error, turn.packet));
+  const postBundle = evaluateMizanPost(summaryText, {
+    hasVerifiedState: true,
+    layer3Pass: layer3.pass,
+    remoteValidationSeverity: validation.severity,
+  }, turn.packet, {
+    sessionId: turn.sessionId,
+    userId: turn.userId,
+    message: turn.userMessage,
+    plannedApproach: turn.plannedApproach,
+    domains: body.ariaDomains,
+  }, {
+    sessionId: turn.sessionId,
+    runtimeId: ensureRuntimeMeta().runtimeId,
+    parentReceiptId: turn.midReceipt?.receiptId || turn.preReceipt?.receiptId || null,
+  });
+  const postResult = postBundle.result;
+  const blocked = validation.severity === 'block' || !layer3.pass || postResult.reAuthorSignal || postResult.fitrahVetoed;
+  const finalText = blocked ? buildPhaseBlockMessage(postResult, 'post') : summaryText;
+
+  await persistTurnArtifacts(req, {
+    ...boundBody,
+    metadata: {
+      ...(body.metadata && typeof body.metadata === 'object' ? body.metadata : {}),
+      decision_type: body?.metadata?.decision_type || 'forge-synthesis',
+      decision_category: body?.metadata?.decision_category || 'forge-control-plane',
+      code_links: Array.isArray(forgeResult?.writtenFiles) ? forgeResult.writtenFiles : null,
+    },
+  }, client, apiKey, {
+    ...turn,
+    postResult,
+    postBundle,
+    postReceipt: postBundle.receipt,
+    postContract: postBundle.contract,
+    validation,
+    layer3,
+    finalText,
+    durationMs: Date.now() - startedAt,
+    success: !blocked,
+    error: blocked ? 'forge synthesis flagged by runtime cognition' : null,
+    providerMeta: {
+      provider: plannerMeta.provider,
+      model: plannerMeta.model,
+      finishReason: blocked ? 'flagged' : (plannerMeta.finishReason || 'forge-synthesized'),
+      usage: plannerMeta.usage || null,
+    },
+  });
+
+  return {
+    ok: !blocked,
+    blocked,
+    manifest: {
+      normalizedIntent,
+      domain,
+      manifestSummary: coerceNonEmptyString(manifest.manifestSummary),
+      requestedArtifacts,
+      constraints,
+      paths,
+      implementationPlan,
+      providerIntent: manifest.providerIntent || null,
+      runtimeMode: coerceNonEmptyString(manifest.runtimeMode) || 'llm-headed-forge-psi',
+      contract: contractCheck,
+    },
+    forge: forgeResult,
+    response: finalText,
+    aria: buildReadableAriaEnvelope({
+      blocked,
+      pre: turn.preResult,
+      mid: turn.midResult,
+      post: postResult,
+      receipts: {
+        pre: turn.preReceipt,
+        mid: turn.midReceipt,
+        post: postBundle.receipt,
+      },
+      turnClass: turn.turnClass,
+      operatorPlan: turn.operatorPlan,
+      validation,
+      layer3,
+    }, body?.ariaDebug === true),
+  };
+}
+
+function layer3FailureResult(error, packet) {
+  return {
+    pass: false,
+    summary: 'runtime layer3 failed',
+    failures: [
+      {
+        severity: 'block',
+        kind: 'runtime-layer3',
+        detail: error instanceof Error ? error.message : String(error),
+      },
+    ],
+    packetTimestamp: packet?.timestamp || null,
+  };
+}
+
+function packetToSubstrateSet(packet) {
+  const p = packet?.packet && typeof packet.packet === 'object' ? packet.packet : packet;
+  const axioms = Object.keys(p?.axioms || {});
+  const frames = Object.keys(p?.frames || {});
+  const memoryRecord = p?.memory || {};
+  const memories = Object.keys(memoryRecord).map((name) =>
+    name.toLowerCase().endsWith('.md') ? name : `${name}.md`,
+  );
+  const doctrineRecord = p?.doctrine || {};
+  const doctrinesAcceptable = Object.keys(doctrineRecord);
+  const packets = Array.from(
+    new Set([
+      'role',
+      'first_principle',
+      'turn_mode',
+      'role_rule',
+      'role_profile',
+      'cognition_belt',
+      'aria_research_pull',
+      ...frames,
+    ]),
+  );
+
+  const firstPrincipleText =
+    typeof p?.frames?.first_principle === 'string' ? p.frames.first_principle : '';
+
+  return {
+    axioms,
+    frames,
+    memories,
+    doctrinesAcceptable,
+    packets,
+    languagesLoaded: ['nadia', 'noor'],
+    languagesActive: { nadia: false, noor: false },
+    firstPrincipleText,
+  };
+}
+
+function runtimeManifest() {
+  const runtimeMeta = ensureRuntimeMeta();
+  const state = sweepAutonomyState(loadAutonomyState());
+  return {
+    ok: true,
+    runtime: 'aria-mounted-runtime',
+    runtimeId: runtimeMeta.runtimeId,
+    url: DEFAULT_RUNTIME_URL,
+    runtimeRoot: __dirname,
+    endpoints: [
+      'GET /health',
+      'GET /mount',
+      'POST /heartbeat',
+      'POST /mizan/plan',
+      'POST /mizan/pre',
+      'POST /mizan/mid',
+      'POST /mizan/post',
+      'POST /phase/pre',
+      'POST /phase/mid',
+      'POST /phase/post',
+      'POST /autonomy/jobs/enqueue',
+      'POST /autonomy/jobs/list',
+      'POST /autonomy/jobs/claim',
+      'POST /autonomy/jobs/heartbeat',
+      'POST /autonomy/jobs/complete',
+      'POST /autonomy/jobs/fail',
+      'POST /autonomy/workers/register',
+      'POST /autonomy/workers/list',
+      'POST /packet',
+      'POST /consult',
+      'POST /inject',
+      'POST /build-system-prompt',
+      'POST /check-action',
+      'POST /validate-output',
+      'POST /full-chain',
+      'POST /garden/turn',
+      'POST /garden/search',
+      'POST /record-discovery',
+      'POST /verify-claim',
+      'POST /telemetry/turn',
+      'POST /telemetry/state',
+      'POST /decision/log',
+      'POST /aegis/patterns',
+      'POST /evolution/principles',
+      'POST /noor/recognize',
+      'POST /noor/forge',
+      'POST /forge/synthesize',
+      'POST /codebase/state',
+      'POST /v1/chat/completions',
+      'POST /v1/messages',
+    ],
+    mount: {
+      env: {
+        ARIA_RUNTIME_URL: DEFAULT_RUNTIME_URL,
+        ARIA_HARNESS_URL: DEFAULT_HARNESS_URL,
+        ARIA_FORGE_SERVICE_URL: DEFAULT_FORGE_SERVICE_URL,
+        ARIA_QDRANT_URL: DEFAULT_QDRANT_URL,
+        OPENAI_BASE_URL: `${DEFAULT_RUNTIME_URL}/v1`,
+        ANTHROPIC_BASE_URL: `${DEFAULT_RUNTIME_URL}/v1`,
+      },
+      commands: {
+        start: 'aria-runtime',
+        doctor: 'aria-runtime-doctor',
+      },
+      security: {
+        encrypted_local_lease: LEASE_PATH,
+        encrypted_cognition_state: COGNITION_STATE_PATH,
+        revocation_lock: REVOCATION_LOCK_PATH,
+        upstream_heartbeat: '/api/license/heartbeat',
+      },
+      memory: {
+        qdrant_url: DEFAULT_QDRANT_URL,
+        qdrant_collection: DEFAULT_QDRANT_COLLECTION,
+      },
+    },
+    autonomy: queueStats(state),
+  };
+}
+
+async function runLayer3(req, body, client) {
+  if (typeof body.text !== 'string' || !body.text.trim()) {
+    throw new Error('full-chain requires a non-empty text field');
+  }
+
+  const packet =
+    body.packet ||
+    (body.fetchPacket !== false
+      ? await loadRuntimePacket(req, body, client, body.packetRequest || {}, body.text)
+      : null);
+  if (!packet) {
+    throw new Error('full-chain requires packet or fetchPacket=true');
+  }
+
+  const result = runFullChain(body.text, {
+    substrate: packetToSubstrateSet(packet),
+    requireCognitionBlock: body.requireCognitionBlock ?? false,
+  });
+
+  return {
+    pass: result.pass,
+    summary: result.summary,
+    failures: result.failures,
+    packetTimestamp: packet.timestamp || null,
+  };
+}
+
+function ensureWorker(state, workerId, body = {}) {
+  let worker = state.workers.find((entry) => entry.workerId === workerId);
+  if (!worker) {
+    worker = {
+      workerId,
+      surface: body.surface || 'runtime-worker',
+      capabilities: Array.isArray(body.capabilities) ? body.capabilities : [],
+      metadata: body.metadata || {},
+      status: 'idle',
+      registeredAt: new Date().toISOString(),
+      lastHeartbeat: new Date().toISOString(),
+      currentJobId: null,
+    };
+    state.workers.push(worker);
+  }
+  return worker;
+}
+
+async function handleAutonomyRoute(url, body, client) {
+  const state = sweepAutonomyState(loadAutonomyState());
+
+  if (url.pathname === '/autonomy/jobs/list') {
+    const limit = Number(body.limit || 50);
+    const view = getAutonomyView(state, Number.isFinite(limit) ? Math.max(1, Math.min(limit, 200)) : 50);
+    return { ok: true, ...view };
+  }
+
+  if (url.pathname === '/autonomy/workers/list') {
+    return { ok: true, workers: getAutonomyView(state).workers, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/workers/register') {
+    if (typeof body.workerId !== 'string' || !body.workerId.trim()) {
+      throw new Error('autonomy/workers/register requires workerId');
+    }
+    const worker = ensureWorker(state, body.workerId.trim(), body);
+    worker.surface = body.surface || worker.surface;
+    worker.capabilities = Array.isArray(body.capabilities) ? body.capabilities : worker.capabilities;
+    worker.metadata = body.metadata || worker.metadata;
+    worker.status = body.status || worker.status || 'idle';
+    worker.lastHeartbeat = new Date().toISOString();
+    saveAutonomyState(state);
+    return { ok: true, worker, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/jobs/enqueue') {
+    if (typeof body.kind !== 'string' || !body.kind.trim()) {
+      throw new Error('autonomy/jobs/enqueue requires kind');
+    }
+    const now = new Date().toISOString();
+    const job = {
+      jobId: randomUUID(),
+      kind: body.kind.trim(),
+      surface: body.surface || 'runtime-client',
+      sessionId: body.sessionId || null,
+      payload: body.payload || {},
+      metadata: body.metadata || {},
+      priority: Number.isFinite(Number(body.priority)) ? Number(body.priority) : 100,
+      status: 'queued',
+      attempts: 0,
+      maxAttempts: Number.isFinite(Number(body.maxAttempts)) ? Number(body.maxAttempts) : 3,
+      createdAt: now,
+      updatedAt: now,
+      workerId: null,
+      claimedAt: null,
+      claimExpiresAt: null,
+      progress: [],
+      garden: body.garden || null,
+    };
+    state.jobs.push(job);
+    saveAutonomyState(state);
+    return { ok: true, job, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/jobs/claim') {
+    if (typeof body.workerId !== 'string' || !body.workerId.trim()) {
+      throw new Error('autonomy/jobs/claim requires workerId');
+    }
+    const worker = ensureWorker(state, body.workerId.trim(), body);
+    const allowedKinds = Array.isArray(body.kinds) ? new Set(body.kinds) : null;
+    const now = Date.now();
+    const candidates = state.jobs
+      .filter((job) => job.status === 'queued' && (!allowedKinds || allowedKinds.has(job.kind)))
+      .sort((a, b) => {
+        const priorityDelta = (b.priority || 0) - (a.priority || 0);
+        if (priorityDelta !== 0) return priorityDelta;
+        return Date.parse(a.createdAt) - Date.parse(b.createdAt);
+      });
+    const job = candidates[0] || null;
+    if (!job) {
+      worker.status = 'idle';
+      worker.currentJobId = null;
+      worker.lastHeartbeat = new Date().toISOString();
+      saveAutonomyState(state);
+      return { ok: true, job: null, stats: queueStats(state) };
+    }
+
+    job.status = 'claimed';
+    job.workerId = worker.workerId;
+    job.claimedAt = new Date(now).toISOString();
+    job.claimExpiresAt = new Date(now + DEFAULT_JOB_CLAIM_SECONDS * 1000).toISOString();
+    job.updatedAt = new Date().toISOString();
+    job.attempts = (job.attempts || 0) + 1;
+    job.progress = [...(job.progress || []), {
+      at: new Date().toISOString(),
+      status: 'claimed',
+      message: `${worker.workerId} claimed job`,
+    }];
+
+    worker.status = 'busy';
+    worker.currentJobId = job.jobId;
+    worker.lastHeartbeat = new Date().toISOString();
+    saveAutonomyState(state);
+    return { ok: true, job, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/jobs/heartbeat') {
+    if (typeof body.workerId !== 'string' || !body.workerId.trim()) {
+      throw new Error('autonomy/jobs/heartbeat requires workerId');
+    }
+    const worker = ensureWorker(state, body.workerId.trim(), body);
+    const nowIso = new Date().toISOString();
+    worker.lastHeartbeat = nowIso;
+    worker.status = body.status || worker.status || 'busy';
+    if (typeof body.jobId === 'string' && body.jobId.trim()) {
+      const job = state.jobs.find((entry) => entry.jobId === body.jobId.trim());
+      if (job) {
+        job.claimExpiresAt = new Date(Date.now() + DEFAULT_JOB_CLAIM_SECONDS * 1000).toISOString();
+        job.updatedAt = nowIso;
+        job.progress = [...(job.progress || []), {
+          at: nowIso,
+          status: 'heartbeat',
+          message: body.message || null,
+          telemetry: body.telemetry || null,
+        }];
+      }
+      worker.currentJobId = body.jobId.trim();
+    }
+    saveAutonomyState(state);
+    return { ok: true, worker, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/jobs/complete') {
+    if (typeof body.workerId !== 'string' || typeof body.jobId !== 'string') {
+      throw new Error('autonomy/jobs/complete requires workerId and jobId');
+    }
+    const worker = ensureWorker(state, body.workerId.trim(), body);
+    const job = state.jobs.find((entry) => entry.jobId === body.jobId.trim());
+    if (!job) throw new Error(`job not found: ${body.jobId}`);
+
+    job.status = 'completed';
+    job.updatedAt = new Date().toISOString();
+    job.completedAt = new Date().toISOString();
+    job.result = body.result || null;
+    job.claimExpiresAt = null;
+    job.progress = [...(job.progress || []), {
+      at: new Date().toISOString(),
+      status: 'completed',
+      message: body.message || 'job completed',
+    }];
+
+    worker.status = 'idle';
+    worker.currentJobId = null;
+    worker.lastHeartbeat = new Date().toISOString();
+
+    if (job.garden?.sessionId && job.garden?.message) {
+      const responseText =
+        typeof body.gardenResponse === 'string'
+          ? body.gardenResponse
+          : typeof body.resultSummary === 'string'
+            ? body.resultSummary
+            : JSON.stringify(body.result || {});
+      await client.gardenTurn(job.garden.sessionId, job.garden.message, responseText, job.garden.userId);
+    }
+
+    saveAutonomyState(state);
+    return { ok: true, job, stats: queueStats(state) };
+  }
+
+  if (url.pathname === '/autonomy/jobs/fail') {
+    if (typeof body.workerId !== 'string' || typeof body.jobId !== 'string') {
+      throw new Error('autonomy/jobs/fail requires workerId and jobId');
+    }
+    const worker = ensureWorker(state, body.workerId.trim(), body);
+    const job = state.jobs.find((entry) => entry.jobId === body.jobId.trim());
+    if (!job) throw new Error(`job not found: ${body.jobId}`);
+
+    const retryable = body.retryable === true && (job.attempts || 0) < (job.maxAttempts || 3);
+    job.status = retryable ? 'queued' : 'failed';
+    job.updatedAt = new Date().toISOString();
+    job.error = body.error || 'job failed';
+    job.workerId = retryable ? null : worker.workerId;
+    job.claimedAt = null;
+    job.claimExpiresAt = null;
+    job.progress = [...(job.progress || []), {
+      at: new Date().toISOString(),
+      status: retryable ? 'requeued' : 'failed',
+      message: body.error || 'job failed',
+    }];
+
+    worker.status = 'idle';
+    worker.currentJobId = null;
+    worker.lastHeartbeat = new Date().toISOString();
+    saveAutonomyState(state);
+    return { ok: true, job, stats: queueStats(state) };
+  }
+
+  return null;
+}
+
+async function handleRoute(req, res) {
+  const url = new URL(req.url || '/', DEFAULT_RUNTIME_URL);
+
+  if (req.method === 'GET' && url.pathname === '/health') {
+    const revoked = readRevocationLock();
+    return json(res, 200, {
+      ...runtimeManifest(),
+      lease_cache_entries: leaseCache.size,
+      revocation_lock: revoked,
+    });
+  }
+
+  if (req.method === 'GET' && url.pathname === '/mount') {
+    return json(res, 200, runtimeManifest().mount);
+  }
+
+  if (req.method !== 'POST') {
+    return json(res, 404, { ok: false, error: `No route for ${req.method} ${url.pathname}` });
+  }
+
+  let body = {};
+  try {
+    body = await readJson(req);
+  } catch (error) {
+    return json(res, 400, { ok: false, error: `Invalid JSON body: ${error.message}` });
+  }
+
+  let client;
+  try {
+    client = createClient(req, body);
+  } catch (error) {
+    return json(res, 401, { ok: false, error: error.message });
+  }
+
+  try {
+    if (url.pathname === '/heartbeat') {
+      const lease = await heartbeatUpstream(req, body, client, resolveApiKey(req, body));
+      return json(res, 200, { ok: true, lease });
+    }
+
+    await ensureLease(req, body, client);
+
+    if (url.pathname === '/mizan/plan') {
+      const turnClass = classifyTurn(body.context || body);
+      const phase = typeof body.phase === 'string' && body.phase.trim() ? body.phase.trim() : 'pre';
+      const operatorPlan = buildOperatorPlan(turnClass, phase);
+      return json(res, 200, {
+        ok: true,
+        turnClass,
+        operatorPlan,
+        summary: {
+          turnClass: turnClass.kind,
+          intensity: turnClass.intensity,
+          domains: turnClass.domains,
+          requiredPacks: operatorPlan.requiredPacks,
+          operators: operatorPlan.priorityOperators,
+        },
+      });
+    }
+
+    if (url.pathname === '/phase/pre' || url.pathname === '/mizan/pre') {
+      const apiKey = resolveApiKey(req, body);
+      const packet = body.packet || await client.getHarnessPacket(body.packetRequest || {});
+      const bundle = evaluateMizanPre(packet, body.context || body, {
+        sessionId: body.sessionId || body.context?.sessionId || deriveSessionId(req, body, 'mizan-pre'),
+        runtimeId: ensureRuntimeMeta().runtimeId,
+        parentReceiptId: body.parentReceiptId || null,
+      });
+      persistMizanBundle(apiKey, bundle, 'mizan/pre');
+      return json(res, 200, {
+        ok: true,
+        result: bundle.result,
+        contract: bundle.contract,
+        receipt: bundle.receipt,
+        turnClass: bundle.turnClass,
+        operatorPlan: bundle.operatorPlan,
+        summary: summarizeMizanBundle(bundle),
+      });
+    }
+
+    if (url.pathname === '/phase/mid' || url.pathname === '/mizan/mid') {
+      const apiKey = resolveApiKey(req, body);
+      const packet = body.packet || null;
+      const bundle = evaluateMizanMid(body.message || '', body.plannedApproach || '', packet, body.context || body, {
+        sessionId: body.sessionId || body.context?.sessionId || deriveSessionId(req, body, 'mizan-mid'),
+        runtimeId: ensureRuntimeMeta().runtimeId,
+        parentReceiptId: body.parentReceiptId || body.receiptId || null,
+      });
+      persistMizanBundle(apiKey, bundle, 'mizan/mid');
+      return json(res, 200, {
+        ok: true,
+        result: bundle.result,
+        contract: bundle.contract,
+        receipt: bundle.receipt,
+        turnClass: bundle.turnClass,
+        operatorPlan: bundle.operatorPlan,
+        summary: summarizeMizanBundle(bundle),
+      });
+    }
+
+    if (url.pathname === '/phase/post' || url.pathname === '/mizan/post') {
+      const apiKey = resolveApiKey(req, body);
+      const packet = body.packet || null;
+      const bundle = evaluateMizanPost(body.text || '', body.evidence || {}, packet, body.context || body, {
+        sessionId: body.sessionId || body.context?.sessionId || deriveSessionId(req, body, 'mizan-post'),
+        runtimeId: ensureRuntimeMeta().runtimeId,
+        parentReceiptId: body.parentReceiptId || body.receiptId || null,
+      });
+      persistMizanBundle(apiKey, bundle, 'mizan/post');
+      return json(res, 200, {
+        ok: true,
+        result: bundle.result,
+        contract: bundle.contract,
+        receipt: bundle.receipt,
+        turnClass: bundle.turnClass,
+        operatorPlan: bundle.operatorPlan,
+        summary: summarizeMizanBundle(bundle),
+      });
+    }
+
+    if (url.pathname === '/v1/chat/completions') {
+      const response = await handleProviderProxy(req, body, client, 'openai');
+      return json(res, 200, response);
+    }
+
+    if (url.pathname === '/v1/messages') {
+      const response = await handleProviderProxy(req, body, client, 'anthropic');
+      return json(res, 200, response);
+    }
+
+    if (url.pathname === '/telemetry/turn') {
+      const apiKey = resolveApiKey(req, body);
+      const event = toTelemetryEvent(body, 'aria-mounted-runtime');
+      mutateCognitionState(apiKey, (state) => ({
+        ...state,
+        telemetry: appendBounded(state.telemetry, event, TELEMETRY_LIMIT),
+      }));
+      try {
+        await pushTelemetryUpstream(client, apiKey, event);
+      } catch {}
+      return json(res, 200, { ok: true, event });
+    }
+
+    if (url.pathname === '/telemetry/state') {
+      const apiKey = resolveApiKey(req, body);
+      const state = loadEncryptedCognitionState(apiKey);
+      return json(res, 200, {
+        ok: true,
+        summary: summarizeCognitionState(state),
+        state: body.includeState === true ? state : undefined,
+      });
+    }
+
+    if (url.pathname === '/decision/log') {
+      const apiKey = resolveApiKey(req, body);
+      const result = await pushDecisionUpstream(client, apiKey, body);
+      mutateCognitionState(apiKey, (state) => ({
+        ...state,
+        decisions: appendBounded(state.decisions, {
+          at: new Date().toISOString(),
+          decision: body,
+          result,
+        }, DECISION_LIMIT),
+      }));
+      return json(res, 200, { ok: true, result });
+    }
+
+    if (url.pathname === '/aegis/patterns') {
+      const apiKey = resolveApiKey(req, body);
+      const patterns = Array.isArray(body.patterns) ? body.patterns : [body.pattern || body].filter(Boolean);
+      const state = mutateCognitionState(apiKey, (current) => ({
+        ...current,
+        aegisPatterns: mergeUniqueByJson(current.aegisPatterns, patterns, PATTERN_LIMIT),
+      }));
+      return json(res, 200, { ok: true, summary: summarizeCognitionState(state) });
+    }
+
+    if (url.pathname === '/evolution/principles') {
+      const apiKey = resolveApiKey(req, body);
+      const principles = Array.isArray(body.principles) ? body.principles : [body.principle || body].filter(Boolean);
+      const state = mutateCognitionState(apiKey, (current) => ({
+        ...current,
+        evolutionPrinciples: mergeUniqueByJson(current.evolutionPrinciples, principles, PRINCIPLE_LIMIT),
+      }));
+      return json(res, 200, { ok: true, summary: summarizeCognitionState(state) });
+    }
+
+    if (url.pathname === '/noor/recognize') {
+      const result = await client.noorRecognize(body.query || body.text || '', {
+        sessionId: body.sessionId || deriveSessionId(req, body, 'noor'),
+        userId: deriveUserId(req, body) || undefined,
+      });
+      return json(res, 200, { ok: true, result });
+    }
+
+    if (url.pathname === '/noor/forge') {
+      const result = await client.noorForge(body.intent || body.query || '', Array.isArray(body.primitives) ? body.primitives : [], {
+        sessionId: body.sessionId || deriveSessionId(req, body, 'forge'),
+        userId: deriveUserId(req, body) || undefined,
+      });
+      return json(res, 200, { ok: true, result });
+    }
+
+    if (url.pathname === '/forge/synthesize') {
+      const result = await handleForgeSynthesis(req, body, client);
+      return json(res, result.blocked ? 409 : 200, result);
+    }
+
+    if (url.pathname === '/codebase/state') {
+      const config = readLocalAriaConfig();
+      const awareness = readCodebaseAwarenessState();
+      return json(res, 200, {
+        ok: true,
+        repositories: Array.isArray(config.repositories) ? config.repositories : [],
+        schemaImages: config.schemaImages || {},
+        awareness,
+      });
+    }
+
+    if (url.pathname.startsWith('/autonomy/')) {
+      const autonomy = await handleAutonomyRoute(url, body, client);
+      if (autonomy) {
+        return json(res, 200, autonomy);
+      }
+    }
+
+    if (url.pathname === '/packet') {
+      const packet = await loadRuntimePacket(req, body, client, body.packetRequest || body, body.message || '');
+      return json(res, 200, { ok: true, packet });
+    }
+
+    if (url.pathname === '/consult') {
+      const result = await client.consult(body);
+      return json(res, 200, { ok: true, ...result });
+    }
+
+    if (url.pathname === '/inject') {
+      const injection = await client.inject(body);
+      return json(res, 200, { ok: true, injection });
+    }
+
+    if (url.pathname === '/build-system-prompt') {
+      const prompt = client.buildSystemPrompt(body.injection || body);
+      return json(res, 200, { ok: true, prompt });
+    }
+
+    if (url.pathname === '/check-action') {
+      const result = await client.checkAction(body.action, body.target || '');
+      return json(res, 200, { ok: true, ...result });
+    }
+
+    if (url.pathname === '/validate-output') {
+      if (typeof body.text !== 'string' || typeof body.sessionId !== 'string') {
+        throw new Error('validate-output requires text and sessionId');
+      }
+
+      let validation;
+      try {
+        validation = await client.validateOutput(body.text, body.sessionId);
+      } catch (error) {
+        if (!isOwnerBypassRequest(req, body)) throw error;
+        validation = {
+          passed: true,
+          severity: 'warn',
+          violations: [
+            `remote validate unavailable: ${error instanceof Error ? error.message : String(error)}`,
+          ],
+          gateTriggers: ['owner-local-bypass'],
+        };
+      }
+      const response = { ok: true, validation };
+
+      if (body.runLayer3 !== false) {
+        response.layer3 = await runLayer3(req, {
+          text: body.text,
+          packet: body.packet,
+          packetRequest: body.packetRequest,
+          fetchPacket: body.fetchPacket,
+          requireCognitionBlock: body.requireCognitionBlock,
+        }, client);
+        response.pass = validation.passed && response.layer3.pass;
+      } else {
+        response.pass = validation.passed;
+      }
+
+      return json(res, 200, response);
+    }
+
+    if (url.pathname === '/full-chain') {
+      const result = await runLayer3(req, body, client);
+      return json(res, 200, { ok: true, ...result });
+    }
+
+    if (url.pathname === '/garden/turn') {
+      if (typeof body.sessionId !== 'string' || typeof body.message !== 'string' || typeof body.response !== 'string') {
+        throw new Error('garden/turn requires sessionId, message, and response');
+      }
+      const startedAt = Date.now();
+      const boundBody = {
+        ...body,
+        ariaPlannedApproach:
+          typeof body.ariaPlannedApproach === 'string' && body.ariaPlannedApproach.trim()
+            ? body.ariaPlannedApproach.trim()
+            : `Record the exact garden turn for "${body.message.slice(0, 80)}" and preserve the response "${body.response.slice(0, 80)}" with cognition telemetry and hive continuity.`,
+      };
+      const turn = await buildDirectTurnContext(req, boundBody, client, {
+        prefix: 'garden',
+        stage: 'garden-turn',
+        platform: 'garden-service',
+        defaultPlannedApproach:
+          'Preserve the full turn in the garden, run cognition passes on it, and compound readable telemetry into the Aria hive.',
+        defaultRationale:
+          'Garden service is infinite context. Every stored turn should carry cognition, telemetry, and continuity signals.',
+      });
+      const validation = {
+        passed: true,
+        severity: 'pass',
+        violations: [],
+        gateTriggers: ['garden-turn'],
+      };
+      const layer3 = await runLayer3(req, {
+        text: body.response,
+        packet: turn.packet,
+        fetchPacket: false,
+        requireCognitionBlock: body.requireCognitionBlock ?? false,
+      }, client).catch((error) => layer3FailureResult(error, turn.packet));
+      const postBundle = evaluateMizanPost(body.response, {
+        hasVerifiedState: findVerifiedState(body.response),
+        layer3Pass: layer3.pass,
+        remoteValidationSeverity: validation.severity,
+      }, turn.packet, {
+        sessionId: turn.sessionId,
+        userId: turn.userId,
+        message: turn.userMessage,
+        plannedApproach: turn.plannedApproach,
+        domains: body.ariaDomains,
+      }, {
+        sessionId: turn.sessionId,
+        runtimeId: ensureRuntimeMeta().runtimeId,
+        parentReceiptId: turn.midReceipt?.receiptId || turn.preReceipt?.receiptId || null,
+      });
+      const postResult = postBundle.result;
+      const blocked = !layer3.pass || postResult.reAuthorSignal || postResult.fitrahVetoed;
+      await persistTurnArtifacts(req, {
+        ...boundBody,
+        metadata: {
+          ...(body.metadata && typeof body.metadata === 'object' ? body.metadata : {}),
+          decision_type: body?.metadata?.decision_type || 'garden-turn',
+          decision_category: body?.metadata?.decision_category || 'garden-control-plane',
+        },
+      }, client, resolveApiKey(req, body), {
+        ...turn,
+        postResult,
+        postBundle,
+        postReceipt: postBundle.receipt,
+        postContract: postBundle.contract,
+        validation,
+        layer3,
+        finalText: body.response,
+        durationMs: Date.now() - startedAt,
+        success: !blocked,
+        error: blocked ? 'garden turn flagged by runtime cognition' : null,
+        providerMeta: {
+          provider: 'garden-service',
+          model: body.model || 'garden-turn',
+          finishReason: blocked ? 'flagged' : 'garden-turn',
+          usage: null,
+        },
+      });
+      const summary = {
+        pre: summarizePhaseResult('pre', turn.preResult),
+        mid: summarizePhaseResult('mid', turn.midResult),
+        post: summarizePhaseResult('post', postResult),
+      };
+      if (blocked && body.failOnBlock === true) {
+        return json(res, 409, {
+          ok: false,
+          blocked: true,
+          pass: false,
+          summary,
+          layer3,
+        });
+      }
+      return json(res, 200, {
+        ok: true,
+        pass: !blocked,
+        blocked,
+        summary,
+        layer3,
+      });
+    }
+
+    if (url.pathname === '/garden/search') {
+      const apiKey = resolveApiKey(req, body);
+      if (typeof body.query !== 'string' || !body.query.trim()) {
+        throw new Error('garden/search requires query');
+      }
+      const rawResults = await searchGardenQdrant(apiKey, body.query, body.limit || 8);
+      const results = rawResults.map((entry) => ({
+        id: entry.id,
+        score: entry.score,
+        sessionId: entry.payload?.sessionId || null,
+        message: entry.payload?.message || '',
+        response: entry.payload?.response || '',
+        plannedApproach: entry.payload?.plannedApproach || null,
+        tags: Array.isArray(entry.payload?.tags) ? entry.payload.tags : [],
+        createdAt: entry.payload?.createdAt || null,
+        provider: entry.payload?.telemetry?.provider || null,
+        model: entry.payload?.telemetry?.model || null,
+        cognition: entry.payload?.readability || null,
+        raw: body.includeRaw === true ? entry : undefined,
+      }));
+      return json(res, 200, {
+        ok: true,
+        results,
+        collection: DEFAULT_QDRANT_COLLECTION,
+        qdrantUrl: DEFAULT_QDRANT_URL,
+      });
+    }
+
+    if (url.pathname === '/record-discovery') {
+      const result = await client.recordDiscovery(body);
+      return json(res, 200, { ok: true, ...result });
+    }
+
+    if (url.pathname === '/verify-claim') {
+      const result = await client.verifyClaim(body);
+      return json(res, 200, { ok: true, ...result });
+    }
+
+    return json(res, 404, { ok: false, error: `No route for POST ${url.pathname}` });
+  } catch (error) {
+    return json(res, 500, {
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export async function startRuntimeServer(options = {}) {
+  const host = options.host || DEFAULT_HOST;
+  const port = Number(options.port || DEFAULT_PORT);
+  const sweepHandle = setInterval(() => {
+    const state = sweepAutonomyState(loadAutonomyState());
+    saveAutonomyState(state);
+  }, 15_000);
+  sweepHandle.unref();
+  const server = createServer((req, res) => {
+    handleRoute(req, res).catch((error) => {
+      json(res, 500, {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    });
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, () => resolve());
+  });
+
+  process.stdout.write(
+    JSON.stringify(
+      {
+        ok: true,
+        runtime: 'aria-mounted-runtime',
+        url: `http://${host}:${port}`,
+        harnessUrl: DEFAULT_HARNESS_URL,
+      },
+      null,
+      2,
+    ) + '\n',
+  );
+
+  return server;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  startRuntimeServer().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.stack || error.message : String(error)}\n`);
+    process.exit(1);
+  });
+}