@ashlr/hub 3.3.0 → 3.3.2

package/dist/core/daemon/activation-permit.js

@@ -1,69 +1,15 @@
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify, } from 'node:crypto';
-import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, fsyncSync, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
+import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
+import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, fsyncSync, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, unlinkSync, writeSync, } from 'node:fs';
 import { homedir, hostname } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { readBuildIdentity } from '../build-identity.js';
 import { acquireLocalStoreLock, releaseLocalStoreLock, } from '../fleet/local-store-lock.js';
-import { audit } from '../sandbox/audit.js';
 import { killSwitchOn, readEnrollmentRegistry } from '../sandbox/policy.js';
 import { fsyncDirectory } from '../util/durability.js';
 import { assurePrivateStoragePath } from '../util/private-storage.js';
 import { diagnoseGuardHealth } from './guard-health.js';
-/**
- * M461 → M470 daemon activation authority.
- *
- * The default for anyone who has not explicitly run `ashlr activation init`
- * is EXACTLY today's behavior: every guard denies, with the same reasons as
- * before. Authority only exists once an operator:
- *
- *   1. Runs `ashlr activation init` — generates an Ed25519 keypair on this
- *      machine (private key never leaves it) and registers the public half
- *      as a trust root in ~/.ashlr/activation/trust-roots.json (0600, dir
- *      0700, owned by the operator's uid — checked on every read).
- *   2. Runs `ashlr activation grant <scope...>` — signs and mints either a
- *      single-use activation PERMIT (scopes: once, resident) consumed by
- *      `daemon start`, or a standing, expiring GRANT (scopes: residentStanding,
- *      conductor, install, automerge, repair, deploy) checked on every call to
- *      the corresponding guard.
- *
- * `resident` is grantable BOTH ways, and both forms remain live:
- *   - one-shot `resident` permit: fixed 2-minute window, requires a human to
- *     run `grant` immediately before `daemon start`. Unusable after a reboot
- *     with nobody present.
- *   - standing `residentStanding` grant: up to the normal 30-day cap, checked
- *     at resident-daemon startup instead of requiring a fresh permit — this is
- *     what lets a launchd/systemd/Task-Scheduler-triggered restart authorize
- *     itself with no human in the loop. `daemon start` (resident mode) tries
- *     the standing grant first and falls back to the one-shot permit path
- *     unchanged, so an operator who never grants `residentStanding` sees
- *     EXACTLY today's one-shot-only behavior.
- *
- * Both permits and grants are Ed25519-signed, scoped, expiring, and
- * independently revocable (`ashlr activation revoke`). Every init / grant /
- * revoke / consume / denial writes an audit row via ../sandbox/audit.js so
- * an operator can answer "who activated this fleet, when, with what scope."
- *
- * Revocation of a standing grant is file-based: it stops the NEXT
- * authorization check, immediately. For `residentStanding` specifically it is
- * stronger than that — because standing grants are not single-use (unlike the
- * one-shot capability, which a resident loop must consume exactly once, see
- * `tick()`'s `activationScope` handling in ../loop.ts), a resident daemon that
- * started off a standing grant re-checks it on every tick and stops at the
- * next one if the grant is revoked, expired, or its trust root is revoked —
- * not just at the next `daemon start`. It cannot interrupt a tick already in
- * flight.
- *
- * File loading fails CLOSED on every ambiguity: missing, unreadable, wrong
- * permissions, wrong owner, symlinked, malformed, or non-canonically
- * encoded trust-root/grant/permit files are all treated as "no authority" —
- * never as "trust everything." Windows is denied outright: node:fs chmod()
- * on Windows does not restrict per-user read access on NTFS (it only
- * toggles the read-only attribute), so the "reject world/group-readable
- * private files" invariant this module depends on cannot be enforced there.
- */
 const POLICY_VERSION = 'm461-proposal-once-v1';
 const SIGNING_DOMAIN = 'ashlr:daemon-activation-permit:m461:v1\0';
-const GRANT_SIGNING_DOMAIN = 'ashlr:daemon-activation-grant:v1\0';
 const MAX_PERMIT_BYTES = 32 * 1024;
 const MAX_VALIDITY_MS = 120_000;
 const MAX_FUTURE_SKEW_MS = 30_000;
@@ -73,51 +19,18 @@ const PRIVATE_FILE_MODE = 0o600;
 const DIGEST_RE = /^[a-f0-9]{64}$/u;
 const ID_RE = /^[a-f0-9]{32}$/u;
 const KEY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
-const MAX_TRUST_STORE_BYTES = 256 * 1024;
-const MAX_GRANTS_BYTES = 512 * 1024;
-const MAX_LABEL_LENGTH = 200;
-/** Hard cap on any standing grant's validity window (30 days). */
-export const MAX_STANDING_GRANT_VALIDITY_MS = 30 * 24 * 60 * 60 * 1000;
-/** Default TTL `ashlr activation grant` uses when --ttl is not given (24h). */
-export const DEFAULT_STANDING_GRANT_VALIDITY_MS = 24 * 60 * 60 * 1000;
 const capabilityBrand = Symbol('ashlr.daemon-activation-capability');
-/** Every independently grantable scope key, in canonical order. Used by the CLI to validate `grant`/status output. */
-export const DAEMON_ACTIVATION_SCOPE_KEYS = [
-    'once',
-    'resident',
-    'residentStanding',
-    'conductor',
-    'automerge',
-    'repair',
-    'deploy',
-    'install',
-    'proposalOnly',
-];
-const SCOPE_KEYS = DAEMON_ACTIVATION_SCOPE_KEYS;
-/** All-false scope — the base every CLI `grant` invocation flips bits on top of. */
-export const EMPTY_DAEMON_ACTIVATION_SCOPE = Object.freeze({
-    once: false,
-    resident: false,
-    residentStanding: false,
-    conductor: false,
-    automerge: false,
-    repair: false,
-    deploy: false,
-    install: false,
-    proposalOnly: false,
-});
-/** Preserves pre-M470 test/caller behavior when `buildDaemonActivationPermitPayload` omits `scope`. */
-const LEGACY_ONCE_PROPOSAL_SCOPE = Object.freeze({
-    ...EMPTY_DAEMON_ACTIVATION_SCOPE,
-    once: true,
-    proposalOnly: true,
-});
+/**
+ * Provisioning a production trust root requires a reviewed source change.
+ * No environment variable, config field, CLI argument, or writable trust file
+ * can add authority at runtime.
+ */
+export const DAEMON_ACTIVATION_TRUST_ROOTS = Object.freeze([]);
 const validCapabilities = new WeakMap();
-function mintCapability(permitId, scope, validateAtClaim) {
+function mintCapability(permitId, validateAtClaim) {
     const capability = Object.freeze({
         kind: 'proposal-once',
         permitId,
-        scope: Object.freeze({ ...scope }),
         [capabilityBrand]: true,
     });
     validCapabilities.set(capability, validateAtClaim);
@@ -139,6 +52,14 @@ export function isDaemonActivationCapability(value) {
         return false;
     }
 }
+/**
+ * Goal and simple conductors have broader authority than M461's one-item
+ * proposal profile. They remain dormant until a separately reviewed permit
+ * contract exists for those entry points.
+ */
+export function liveConductorActivationAuthorized() {
+    return false;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -245,43 +166,33 @@ function validFileBinding(value) {
         && DIGEST_RE.test(String(value['sha256']));
 }
 function validScope(value) {
-    if (!isRecord(value) || !hasExactKeys(value, SCOPE_KEYS))
-        return false;
-    return SCOPE_KEYS.every((key) => typeof value[key] === 'boolean');
-}
-/**
- * Loading a STANDING GRANT record from disk needs a more forgiving check
- * than minting a new one: `validScope` requires every currently-defined
- * scope key to be present, but a standing grant can live for up to 30 days
- * — long enough to span an `npm`/build upgrade that adds a new key to
- * `DAEMON_ACTIVATION_SCOPE_KEYS` (exactly what `residentStanding` is). A
- * strict exact-key check on LOAD would make `hasExactKeys` reject that one
- * older-format record — and `loadGrantStore()` fails the WHOLE store, not
- * just that record, on any single invalid one, which would silently deny
- * every OTHER still-valid standing grant (conductor/install/etc.) too.
- *
- * This accepts any subset of the current scope keys (no unrecognized keys,
- * every present key boolean) and leaves absent keys simply absent. Every
- * read site treats `record.scope[key] !== true` / falsy the same way
- * `undefined` would, so an old record's missing new-generation keys read as
- * "not granted" — never widened, never silently trusted. Signature
- * verification is unaffected: `grantSigningBytes` canonicalizes whatever
- * `scope` object the record actually contains, i.e. exactly what was
- * originally signed, not a backfilled/padded version — so an old record's
- * signature still verifies against its original (smaller) scope shape.
- */
-function validStoredScope(value) {
-    if (!isRecord(value))
+    if (!isRecord(value) || !hasExactKeys(value, [
+        'action',
+        'once',
+        'dryRun',
+        'resident',
+        'drain',
+        'drainLimit',
+        'proposalOnly',
+        'automerge',
+        'repair',
+        'deploy',
+        'install',
+        'selfTarget',
+    ]))
         return false;
-    for (const key of Object.keys(value)) {
-        if (!SCOPE_KEYS.includes(key))
-            return false;
-    }
-    for (const key of SCOPE_KEYS) {
-        if (key in value && typeof value[key] !== 'boolean')
-            return false;
-    }
-    return true;
+    return value['action'] === 'daemon-proposal-once'
+        && value['once'] === true
+        && value['dryRun'] === false
+        && value['resident'] === false
+        && value['drain'] === false
+        && value['drainLimit'] === null
+        && value['proposalOnly'] === true
+        && value['automerge'] === false
+        && value['repair'] === false
+        && value['deploy'] === false
+        && value['install'] === false
+        && value['selfTarget'] === false;
 }
 function validBindings(value) {
     if (!isRecord(value) || !hasExactKeys(value, [
@@ -374,11 +285,6 @@ function trustRootMap(roots) {
 function equalCanonical(left, right) {
     return canonicalizeDaemonActivationValue(left) === canonicalizeDaemonActivationValue(right);
 }
-/** Which top-level binding fields differ, field by field — never a single opaque yes/no. */
-function bindingFieldMismatches(actual, expected) {
-    const keys = Object.keys(expected);
-    return keys.filter((key) => !equalCanonical(actual[key], expected[key]));
-}
 export function verifyDaemonActivationPermit(value, context, trustRoots) {
     if (trustRoots.length === 0)
         return { ok: false, reason: 'no-trusted-activation-roots' };
@@ -427,11 +333,7 @@ export function verifyDaemonActivationPermit(value, context, trustRoots) {
         guardHealth: 'healthy',
     };
     if (!equalCanonical(envelope.payload.bindings, expectedBindings)) {
-        return {
-            ok: false,
-            reason: 'permit-runtime-binding-mismatch',
-            mismatchedBindings: bindingFieldMismatches(envelope.payload.bindings, expectedBindings),
-        };
+        return { ok: false, reason: 'permit-runtime-binding-mismatch' };
     }
     const publicKey = trusted.get(envelope.payload.keyId);
     if (!publicKey)
@@ -455,7 +357,6 @@ export function verifyDaemonActivationPermit(value, context, trustRoots) {
     };
 }
 export function buildDaemonActivationPermitPayload(input) {
-    const scope = input.scope ?? LEGACY_ONCE_PROPOSAL_SCOPE;
     const payload = {
         schemaVersion: 1,
         policyVersion: POLICY_VERSION,
@@ -464,7 +365,20 @@ export function buildDaemonActivationPermitPayload(input) {
         keyId: input.keyId,
         issuedAt: input.issuedAt,
         expiresAt: input.expiresAt,
-        scope: { ...scope },
+        scope: {
+            action: 'daemon-proposal-once',
+            once: true,
+            dryRun: false,
+            resident: false,
+            drain: false,
+            drainLimit: null,
+            proposalOnly: true,
+            automerge: false,
+            repair: false,
+            deploy: false,
+            install: false,
+            selfTarget: false,
+        },
         bindings: {
             configDigest: input.context.configDigest,
             buildIdentity: { ...input.context.buildIdentity },
@@ -496,12 +410,6 @@ function safeOwnedFile(stat) {
     const privateMode = process.platform === 'win32' || (stat.mode & 63n) === 0n;
     return stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1n && owned && privateMode;
 }
-function safeOwnedDirectory(stat) {
-    const owned = process.platform === 'win32' || typeof process.getuid !== 'function'
-        || stat.uid === BigInt(process.getuid());
-    const privateMode = process.platform === 'win32' || (stat.mode & 63n) === 0n;
-    return stat.isDirectory() && !stat.isSymbolicLink() && owned && privateMode;
-}
 function sameFileSnapshot(left, right) {
     return left.dev === right.dev
         && left.ino === right.ino
@@ -712,26 +620,7 @@ function hashStableReleaseTree(entrypointPath) {
 export function daemonActivationReleaseTreeBinding(entrypointPath) {
     return hashStableReleaseTree(entrypointPath);
 }
-/**
- * Fingerprints "this authority store instance" — the ~/.ashlr directory a
- * permit is bound to — so a permit can't be replayed against a different
- * store (e.g. copied to another machine, or after a full delete+recreate).
- *
- * Deliberately uses dev+ino, NOT mtime. ~/.ashlr's own mtime changes every
- * time a direct child is created or removed — and ordinary `daemon start`
- * does exactly that before it ever reaches this check: acquireDaemonLock()
- * (src/core/daemon/state.ts) creates ~/.ashlr/daemon.lock via
- * `writeFileSync(..., {flag:'wx'})`, a brand-new direct child of ~/.ashlr.
- * Binding to mtime meant every freshly minted permit was invalidated by the
- * daemon's own startup lock-file creation, 100% reproducibly, before it
- * could ever be consumed — a self-inflicted permit-runtime-binding-mismatch,
- * not a real "different store" signal. dev+ino uniquely and STABLY identify
- * the directory's inode: they survive ordinary child churn (locks, control
- * files, receipts) and change only if ~/.ashlr is deleted and recreated (or
- * moved to a different filesystem) — exactly the case this binding exists
- * to catch.
- */
-export function daemonActivationAuthorityStateDigest() {
+function currentAuthorityStateDigest() {
     const home = realpathSync(resolve(homedir()));
     const ashlrHome = realpathSync(join(home, '.ashlr'));
     const state = lstatSync(ashlrHome, { bigint: true });
@@ -750,6 +639,7 @@ export function daemonActivationAuthorityStateDigest() {
             path: ashlrHome,
             dev: state.dev.toString(),
             ino: state.ino.toString(),
+            mtimeNs: state.mtimeNs.toString(),
         },
         enrollment: [...enrollment.repos].sort(),
     }));
@@ -766,7 +656,7 @@ function collectRuntimeContext(cfg) {
         executable: hashStableFile(process.execPath),
         entrypoint: hashStableFile(entrypoint),
         releaseTree: daemonActivationReleaseTreeBinding(entrypoint),
-        authorityStateDigest: daemonActivationAuthorityStateDigest(),
+        authorityStateDigest: currentAuthorityStateDigest(),
         killSwitchOff: !killSwitchOn(),
         guardHealthHealthy: !guard.blocked,
     };
@@ -784,734 +674,7 @@ function daemonActivationNonceReceiptPath(nonceDigest) {
         throw new Error('invalid daemon activation nonce digest');
     return join(homedir(), '.ashlr', 'control', 'activation-receipts', 'by-nonce', `${nonceDigest}.json`);
 }
-// ---------------------------------------------------------------------------
-// Operator authority store — trust roots + standing grants.
-//
-// Root of trust is OS-level file ownership/permissions on the operator's own
-// machine (mirrors the one-shot permit's existing safety model), not a
-// central registry. Every store read fails CLOSED to "no authority" on any
-// ambiguity: missing file, unreadable, wrong owner, wrong permissions,
-// symlinked path, malformed JSON, non-canonical encoding, or duplicate ids.
-// ---------------------------------------------------------------------------
-export function daemonActivationDirPath() {
-    return join(homedir(), '.ashlr', 'activation');
-}
-export function daemonActivationTrustRootsPath() {
-    return join(daemonActivationDirPath(), 'trust-roots.json');
-}
-export function daemonActivationGrantsPath() {
-    return join(daemonActivationDirPath(), 'grants.json');
-}
-export function daemonActivationOperatorKeyPath() {
-    return join(daemonActivationDirPath(), 'operator-private-key.pem');
-}
-function daemonActivationStoreLockPath() {
-    return join(daemonActivationDirPath(), 'activation-store.lock');
-}
-function pathEntryPresent(path) {
-    try {
-        lstatSync(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    }
-}
-/** Safe, non-consuming read of a canonical-JSON-array operator store file. */
-function safeReadOwnedJsonArray(path, anchorPath, maxBytes) {
-    if (process.platform === 'win32') {
-        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    let dirStat;
-    try {
-        dirStat = lstatSync(dirname(path), { bigint: true });
-    }
-    catch (error) {
-        return { ok: false, reason: error.code === 'ENOENT' ? 'missing' : 'stat-failed' };
-    }
-    if (!safeOwnedDirectory(dirStat))
-        return { ok: false, reason: 'unsafe-directory' };
-    const dirAssurance = assurePrivateStoragePath(dirname(path), 'directory', 'inspect-owned', { anchorPath });
-    if (!dirAssurance.ok)
-        return { ok: false, reason: `unsafe-directory:${dirAssurance.reason}` };
-    // Open first, then validate the fd — the check (owner/mode/regular-file/
-    // size) and the read below share one file description, so there is no
-    // window between "checked" and "used" for an attacker to swap the path.
-    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
-    let fd;
-    try {
-        fd = openSync(path, fsConstants.O_RDONLY | noFollow);
-    }
-    catch (error) {
-        return { ok: false, reason: error.code === 'ENOENT' ? 'missing' : 'open-failed' };
-    }
-    try {
-        const opened = fstatSync(fd, { bigint: true });
-        if (!safeOwnedFile(opened) || opened.size <= 0n || opened.size > BigInt(maxBytes)) {
-            return { ok: false, reason: 'unsafe-file' };
-        }
-        const size = Number(opened.size);
-        const bytes = Buffer.alloc(size);
-        let offset = 0;
-        while (offset < size) {
-            const count = readSync(fd, bytes, offset, size - offset, offset);
-            if (count <= 0)
-                return { ok: false, reason: 'short-read' };
-            offset += count;
-        }
-        const after = fstatSync(fd, { bigint: true });
-        if (!sameFileSnapshot(opened, after))
-            return { ok: false, reason: 'changed-during-read' };
-        const text = bytes.toString('utf8');
-        let parsed;
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            return { ok: false, reason: 'invalid-json' };
-        }
-        if (`${canonicalizeDaemonActivationValue(parsed)}\n` !== text) {
-            return { ok: false, reason: 'noncanonical-encoding' };
-        }
-        if (!Array.isArray(parsed))
-            return { ok: false, reason: 'not-an-array' };
-        const fileAssurance = assurePrivateStoragePath(path, 'file', 'inspect-owned', { anchorPath });
-        if (!fileAssurance.ok)
-            return { ok: false, reason: `unsafe-file:${fileAssurance.reason}` };
-        return { ok: true, value: parsed };
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-/** Atomically replace a canonical-JSON-array operator store file (temp write + rename). */
-function writeCanonicalJsonArrayFileAtomic(path, value, anchorPath) {
-    assurePrivateDirectory(dirname(path), anchorPath);
-    const tmpPath = `${path}.tmp-${randomBytes(8).toString('hex')}`;
-    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
-    let fd;
-    try {
-        fd = openSync(tmpPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
-        const initial = fstatSync(fd, { bigint: true });
-        if (!safeOwnedFile(initial) || initial.size !== 0n)
-            throw new Error('unsafe-activation-store-temp-file');
-        fchmodSync(fd, PRIVATE_FILE_MODE);
-        const bytes = Buffer.from(`${canonicalizeDaemonActivationValue(value)}\n`, 'utf8');
-        writeAll(fd, bytes);
-        fsyncSync(fd);
-        const written = fstatSync(fd, { bigint: true });
-        if (!safeOwnedFile(written) || written.size !== BigInt(bytes.length)) {
-            throw new Error('activation-store-temp-file-changed-during-write');
-        }
-        closeSync(fd);
-        fd = undefined;
-        renameSync(tmpPath, path);
-        const assurance = assurePrivateStoragePath(path, 'file', 'secure-created', { anchorPath });
-        if (!assurance.ok)
-            throw new Error(`unsafe-activation-store-path:${assurance.reason}`);
-        fsyncDirectory(dirname(path));
-    }
-    finally {
-        if (fd !== undefined) {
-            try {
-                closeSync(fd);
-            }
-            catch { /* best-effort */ }
-        }
-        try {
-            if (existsSync(tmpPath))
-                unlinkSync(tmpPath);
-        }
-        catch { /* best-effort cleanup */ }
-    }
-}
-function withActivationStoreLock(fn) {
-    const home = resolve(homedir());
-    // Two single-level creates: ~/.ashlr may not exist yet on a machine where
-    // `activation init` is the very first ashlr command ever run.
-    assurePrivateDirectory(join(homedir(), '.ashlr'), home);
-    assurePrivateDirectory(daemonActivationDirPath(), home);
-    const lock = acquireLocalStoreLock(daemonActivationStoreLockPath(), LOCK_WAIT_MS, {
-        anchorPath: home,
-        exactPrivateStorage: true,
-    });
-    if (!lock)
-        throw new Error('activation-store-lock-unavailable');
-    let result;
-    try {
-        result = fn();
-    }
-    catch (error) {
-        releaseLocalStoreLock(lock);
-        throw error;
-    }
-    if (!releaseLocalStoreLock(lock))
-        throw new Error('activation-store-lock-release-failed');
-    return result;
-}
-function readOperatorPrivateKeyPem() {
-    const path = daemonActivationOperatorKeyPath();
-    const home = resolve(homedir());
-    // Open first, then validate the fd. The owner/mode/size check and the read
-    // below run against the same file description, so the path cannot be
-    // swapped between "checked" and "used".
-    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
-    const fd = openSync(path, fsConstants.O_RDONLY | noFollow);
-    try {
-        const opened = fstatSync(fd, { bigint: true });
-        if (!safeOwnedFile(opened) || opened.size <= 0n || opened.size > BigInt(MAX_PERMIT_BYTES)) {
-            throw new Error('unsafe-operator-key-file');
-        }
-        const size = Number(opened.size);
-        const bytes = Buffer.alloc(size);
-        let offset = 0;
-        while (offset < size) {
-            const count = readSync(fd, bytes, offset, size - offset, offset);
-            if (count <= 0)
-                throw new Error('short-operator-key-read');
-            offset += count;
-        }
-        const after = fstatSync(fd, { bigint: true });
-        if (!sameFileSnapshot(opened, after))
-            throw new Error('operator-key-changed-during-read');
-        const assurance = assurePrivateStoragePath(path, 'file', 'inspect-owned', { anchorPath: home });
-        if (!assurance.ok)
-            throw new Error(`unsafe-operator-key-path:${assurance.reason}`);
-        return bytes.toString('utf8');
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-function validTrustRootRecord(value) {
-    if (!isRecord(value) || !hasExactKeys(value, ['keyId', 'publicKeyPem', 'createdAt', 'revokedAt', 'label'])) {
-        return false;
-    }
-    if (typeof value['keyId'] !== 'string' || !KEY_ID_RE.test(value['keyId']))
-        return false;
-    if (typeof value['publicKeyPem'] !== 'string')
-        return false;
-    try {
-        const key = createPublicKey(value['publicKeyPem']);
-        if (key.asymmetricKeyType !== 'ed25519')
-            return false;
-    }
-    catch {
-        return false;
-    }
-    if (!validIsoTimestamp(value['createdAt']))
-        return false;
-    if (value['revokedAt'] !== null && !validIsoTimestamp(value['revokedAt']))
-        return false;
-    if (typeof value['label'] !== 'string' || value['label'].length > MAX_LABEL_LENGTH)
-        return false;
-    return true;
-}
-function loadTrustRootStore() {
-    const read = safeReadOwnedJsonArray(daemonActivationTrustRootsPath(), resolve(homedir()), MAX_TRUST_STORE_BYTES);
-    if (!read.ok) {
-        if (read.reason === 'missing')
-            return { ok: true, records: [] };
-        return { ok: false, reason: read.reason };
-    }
-    const records = [];
-    const seen = new Set();
-    for (const entry of read.value) {
-        if (!validTrustRootRecord(entry) || seen.has(entry.keyId)) {
-            return { ok: false, reason: 'invalid-trust-root-store' };
-        }
-        seen.add(entry.keyId);
-        records.push(entry);
-    }
-    return { ok: true, records };
-}
-/**
- * The ONLY source of production trust roots: an operator-owned, protected
- * file the operator populates via `ashlr activation init`. Missing, unsafe,
- * or malformed → []  — identical denial to before this file loading existed.
- */
-export function loadDaemonActivationTrustRoots() {
-    const loaded = loadTrustRootStore();
-    if (!loaded.ok)
-        return [];
-    return loaded.records
-        .filter((record) => record.revokedAt === null)
-        .map((record) => ({ keyId: record.keyId, publicKeyPem: record.publicKeyPem }));
-}
-/** Full trust-root status (incl. revoked history) for `ashlr activation status`. */
-export function daemonActivationTrustRootStatus() {
-    return loadTrustRootStore();
-}
-function activeTrustRootKeyMap() {
-    const loaded = loadTrustRootStore();
-    if (!loaded.ok)
-        return null;
-    const active = loaded.records
-        .filter((record) => record.revokedAt === null)
-        .map((record) => ({ keyId: record.keyId, publicKeyPem: record.publicKeyPem }));
-    return trustRootMap(active);
-}
-function validGrantRecord(value) {
-    if (!isRecord(value) || !hasExactKeys(value, [
-        'schemaVersion', 'grantId', 'keyId', 'issuedAt', 'expiresAt', 'scope', 'signature', 'revokedAt',
-    ]))
-        return false;
-    if (value['schemaVersion'] !== 1)
-        return false;
-    if (typeof value['grantId'] !== 'string' || !ID_RE.test(value['grantId']))
-        return false;
-    if (typeof value['keyId'] !== 'string' || !KEY_ID_RE.test(value['keyId']))
-        return false;
-    if (!validIsoTimestamp(value['issuedAt']) || !validIsoTimestamp(value['expiresAt']))
-        return false;
-    // validStoredScope (not validScope): a persisted STANDING grant may
-    // predate a newly-added scope key by up to 30 days — see its doc comment.
-    if (!validStoredScope(value['scope']))
-        return false;
-    if (typeof value['signature'] !== 'string')
-        return false;
-    try {
-        const sig = Buffer.from(value['signature'], 'base64');
-        if (sig.length !== 64 || sig.toString('base64') !== value['signature'])
-            return false;
-    }
-    catch {
-        return false;
-    }
-    if (value['revokedAt'] !== null && !validIsoTimestamp(value['revokedAt']))
-        return false;
-    return true;
-}
-function loadGrantStore() {
-    const read = safeReadOwnedJsonArray(daemonActivationGrantsPath(), resolve(homedir()), MAX_GRANTS_BYTES);
-    if (!read.ok) {
-        if (read.reason === 'missing')
-            return { ok: true, records: [] };
-        return { ok: false, reason: read.reason };
-    }
-    const records = [];
-    const seen = new Set();
-    for (const entry of read.value) {
-        if (!validGrantRecord(entry) || seen.has(entry.grantId)) {
-            return { ok: false, reason: 'invalid-grant-store' };
-        }
-        seen.add(entry.grantId);
-        records.push(entry);
-    }
-    return { ok: true, records };
-}
-/** Full standing-grant status (incl. revoked/expired history) for `ashlr activation status`. */
-export function daemonActivationGrantStatus() {
-    return loadGrantStore();
-}
-function grantSigningCore(record) {
-    return {
-        schemaVersion: record.schemaVersion,
-        grantId: record.grantId,
-        keyId: record.keyId,
-        issuedAt: record.issuedAt,
-        expiresAt: record.expiresAt,
-        scope: record.scope,
-    };
-}
-function grantSigningBytes(core) {
-    return Buffer.from(`${GRANT_SIGNING_DOMAIN}${canonicalizeDaemonActivationValue(core)}`, 'utf8');
-}
-export function signDaemonActivationGrant(input) {
-    const core = grantSigningCore({
-        schemaVersion: 1,
-        grantId: input.grantId,
-        keyId: input.keyId,
-        issuedAt: input.issuedAt,
-        expiresAt: input.expiresAt,
-        scope: { ...input.scope },
-    });
-    const key = typeof input.privateKey === 'string' ? createPrivateKey(input.privateKey) : input.privateKey;
-    if (key.type !== 'private' || key.asymmetricKeyType !== 'ed25519') {
-        throw new Error('daemon activation grants require an Ed25519 private key');
-    }
-    const signature = sign(null, grantSigningBytes(core), key).toString('base64');
-    const record = { ...core, signature, revokedAt: null };
-    if (!validGrantRecord(record))
-        throw new Error('invalid daemon activation grant record');
-    return record;
-}
-function auditActivationEvent(action, summary, result) {
-    audit({ action, repo: null, sandboxId: null, summary, result });
-}
-/**
- * Checks whether ANY non-revoked, non-expired, validly-signed standing grant
- * (from a non-revoked trust root) currently grants `scopeKey`. Unlike the
- * one-shot permit, standing grants are NOT bound to exact executable/
- * entrypoint/release-tree hashes — they must remain valid across routine
- * rebuilds within their expiry window. They ARE bound to kill-switch-off,
- * guard-health-healthy, and a non-revoked trust root, and always expire.
- */
-/**
- * Shared core of `daemonActivationScopeGranted`. Returns the matched grant
- * RECORD (not just a boolean) so callers that need to act on it — currently
- * only the resident-standing startup path — can read its scope and grantId
- * without a second, redundant store read. Same checks, same order, as the
- * pre-refactor inline body of `daemonActivationScopeGranted`.
- */
-function findGrantedRecord(scopeKey) {
-    if (process.platform === 'win32') {
-        return { granted: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    if (killSwitchOn())
-        return { granted: false, reason: 'kill-switch-is-on' };
-    let guardHealthy;
-    try {
-        guardHealthy = !diagnoseGuardHealth().blocked;
-    }
-    catch {
-        return { granted: false, reason: 'guard-health-check-failed' };
-    }
-    if (!guardHealthy)
-        return { granted: false, reason: 'guard-health-degraded' };
-    const trusted = activeTrustRootKeyMap();
-    if (!trusted || trusted.size === 0)
-        return { granted: false, reason: 'no-trusted-activation-roots' };
-    const grants = loadGrantStore();
-    if (!grants.ok)
-        return { granted: false, reason: `activation-grant-store-${grants.reason}` };
-    const nowMs = Date.now();
-    for (const record of grants.records) {
-        if (record.revokedAt !== null)
-            continue;
-        if (record.scope[scopeKey] !== true)
-            continue;
-        const publicKey = trusted.get(record.keyId);
-        if (!publicKey)
-            continue;
-        if (Date.parse(record.expiresAt) <= nowMs)
-            continue;
-        let signature;
-        try {
-            signature = Buffer.from(record.signature, 'base64');
-        }
-        catch {
-            continue;
-        }
-        if (!verify(null, grantSigningBytes(grantSigningCore(record)), publicKey, signature))
-            continue;
-        return { granted: true, record };
-    }
-    return { granted: false, reason: 'no-matching-standing-grant' };
-}
-export function daemonActivationScopeGranted(scopeKey) {
-    const found = findGrantedRecord(scopeKey);
-    return found.granted
-        ? { granted: true, reason: `granted-by-${found.record.grantId}` }
-        : { granted: false, reason: found.reason };
-}
-/**
- * The goal and simple conductors consult this every cycle. Real, gated,
- * revocable authority: granted only after `ashlr activation init` +
- * `ashlr activation grant conductor`. Default (no grant) is denied, exactly
- * as before this mechanism existed. Every check is audited.
- */
-export function liveConductorActivationAuthorized() {
-    const check = daemonActivationScopeGranted('conductor');
-    auditActivationEvent('daemon-activation:conductor-check', `conductor activation ${check.granted ? 'authorized' : 'denied'}: ${check.reason}`, check.granted ? 'ok' : 'refused');
-    return check.granted;
-}
-// ---------------------------------------------------------------------------
-// Operator authority mutation — init / grant / revoke. Called from
-// `src/cli/activation.ts`; kept here so all signing/writing stays alongside
-// the verification it must satisfy.
-// ---------------------------------------------------------------------------
-export function generateDaemonActivationOperatorKeypair() {
-    const pair = generateKeyPairSync('ed25519');
-    return {
-        privateKeyPem: pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
-        publicKeyPem: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString(),
-    };
-}
-function sanitizeKeyId(candidate) {
-    const cleaned = candidate.replace(/[^A-Za-z0-9._-]/gu, '-').slice(0, 55);
-    const seeded = cleaned.length > 0 && /^[A-Za-z0-9]/u.test(cleaned) ? cleaned : `k${cleaned}`;
-    return seeded.slice(0, 63) || 'operator';
-}
-/**
- * Generates an Ed25519 keypair on THIS machine (private key never leaves it,
- * written 0600 under an 0700 directory) and registers the public half as a
- * new active trust root. Refuses to silently clobber an existing active
- * root or key file unless `force` is set (key rotation: the new root is
- * ADDED, not swapped in place, so grants signed by an older still-active
- * root keep working until explicitly revoked).
- */
-export function daemonActivationInit(input) {
-    if (process.platform === 'win32') {
-        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    return withActivationStoreLock(() => {
-        const existing = loadTrustRootStore();
-        if (!existing.ok)
-            return { ok: false, reason: existing.reason };
-        const activeCount = existing.records.filter((record) => record.revokedAt === null).length;
-        if (activeCount > 0 && input.force !== true) {
-            return { ok: false, reason: 'trust-root-already-initialized' };
-        }
-        const keyPath = daemonActivationOperatorKeyPath();
-        if (pathEntryPresent(keyPath) && input.force !== true) {
-            return { ok: false, reason: 'operator-key-file-already-exists' };
-        }
-        const { privateKeyPem, publicKeyPem } = generateDaemonActivationOperatorKeypair();
-        const keyId = sanitizeKeyId(`${hostname()}-${randomBytes(4).toString('hex')}`);
-        const now = new Date().toISOString();
-        const record = {
-            keyId,
-            publicKeyPem,
-            createdAt: now,
-            revokedAt: null,
-            label: (input.label ?? '').slice(0, MAX_LABEL_LENGTH),
-        };
-        const home = resolve(homedir());
-        assurePrivateDirectory(daemonActivationDirPath(), home);
-        const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
-        let fd;
-        try {
-            if (pathEntryPresent(keyPath))
-                unlinkSync(keyPath);
-            fd = openSync(keyPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
-            const initial = fstatSync(fd, { bigint: true });
-            if (!safeOwnedFile(initial) || initial.size !== 0n)
-                throw new Error('unsafe-operator-key-file');
-            fchmodSync(fd, PRIVATE_FILE_MODE);
-            writeAll(fd, Buffer.from(privateKeyPem, 'utf8'));
-            fsyncSync(fd);
-            closeSync(fd);
-            fd = undefined;
-            const keyAssurance = assurePrivateStoragePath(keyPath, 'file', 'secure-created', { anchorPath: home });
-            if (!keyAssurance.ok)
-                throw new Error(`unsafe-operator-key-path:${keyAssurance.reason}`);
-            fsyncDirectory(dirname(keyPath));
-        }
-        catch (error) {
-            return { ok: false, reason: error.message || 'operator-key-write-failed' };
-        }
-        finally {
-            if (fd !== undefined) {
-                try {
-                    closeSync(fd);
-                }
-                catch { /* best-effort */ }
-            }
-        }
-        writeCanonicalJsonArrayFileAtomic(daemonActivationTrustRootsPath(), [...existing.records, record], home);
-        auditActivationEvent('daemon-activation:init', `trust root registered: keyId=${keyId} label=${JSON.stringify(record.label)} rotated=${activeCount > 0}`, 'ok');
-        return { ok: true, keyId, publicKeyPem, rotated: activeCount > 0 };
-    });
-}
-export function daemonActivationRevokeTrustRoot(keyId) {
-    if (!KEY_ID_RE.test(keyId))
-        return { ok: false, reason: 'invalid-key-id' };
-    return withActivationStoreLock(() => {
-        const existing = loadTrustRootStore();
-        if (!existing.ok)
-            return { ok: false, reason: existing.reason };
-        const index = existing.records.findIndex((record) => record.keyId === keyId);
-        if (index === -1)
-            return { ok: false, reason: 'trust-root-not-found' };
-        if (existing.records[index].revokedAt !== null) {
-            auditActivationEvent('daemon-activation:revoke-root', `trust root already revoked: keyId=${keyId}`, 'ok');
-            return { ok: true };
-        }
-        const revokedAt = new Date().toISOString();
-        const updated = existing.records.map((record, i) => (i === index ? { ...record, revokedAt } : record));
-        writeCanonicalJsonArrayFileAtomic(daemonActivationTrustRootsPath(), updated, resolve(homedir()));
-        auditActivationEvent('daemon-activation:revoke-root', `trust root revoked: keyId=${keyId}`, 'ok');
-        return { ok: true };
-    });
-}
-export function daemonActivationRevokeGrant(grantId) {
-    if (!ID_RE.test(grantId))
-        return { ok: false, reason: 'invalid-grant-id' };
-    return withActivationStoreLock(() => {
-        const existing = loadGrantStore();
-        if (!existing.ok)
-            return { ok: false, reason: existing.reason };
-        const index = existing.records.findIndex((record) => record.grantId === grantId);
-        if (index === -1)
-            return { ok: false, reason: 'grant-not-found' };
-        if (existing.records[index].revokedAt !== null) {
-            auditActivationEvent('daemon-activation:revoke-grant', `standing grant already revoked: grantId=${grantId}`, 'ok');
-            return { ok: true };
-        }
-        const revokedAt = new Date().toISOString();
-        const updated = existing.records.map((record, i) => (i === index ? { ...record, revokedAt } : record));
-        writeCanonicalJsonArrayFileAtomic(daemonActivationGrantsPath(), updated, resolve(homedir()));
-        auditActivationEvent('daemon-activation:revoke-grant', `standing grant revoked: grantId=${grantId}`, 'ok');
-        return { ok: true };
-    });
-}
-/** Mints a signed, expiring standing grant (conductor/automerge/repair/deploy/install/proposalOnly). */
-export function daemonActivationMintStandingGrant(input) {
-    if (process.platform === 'win32') {
-        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0 || input.ttlMs > MAX_STANDING_GRANT_VALIDITY_MS) {
-        return { ok: false, reason: 'invalid-grant-ttl' };
-    }
-    if (!validScope(input.scope))
-        return { ok: false, reason: 'invalid-grant-scope' };
-    return withActivationStoreLock(() => {
-        const trustStore = loadTrustRootStore();
-        if (!trustStore.ok)
-            return { ok: false, reason: trustStore.reason };
-        const active = trustStore.records.filter((record) => record.revokedAt === null);
-        if (active.length === 0)
-            return { ok: false, reason: 'no-trusted-activation-roots' };
-        if (active.length > 1)
-            return { ok: false, reason: 'ambiguous-signing-key-run-activation-status' };
-        const root = active[0];
-        let privateKeyPem;
-        try {
-            privateKeyPem = readOperatorPrivateKeyPem();
-        }
-        catch (error) {
-            return { ok: false, reason: error.message || 'operator-key-unreadable' };
-        }
-        const existingGrants = loadGrantStore();
-        if (!existingGrants.ok)
-            return { ok: false, reason: existingGrants.reason };
-        const now = Date.now();
-        const record = signDaemonActivationGrant({
-            grantId: randomBytes(16).toString('hex'),
-            keyId: root.keyId,
-            issuedAt: new Date(now).toISOString(),
-            expiresAt: new Date(now + input.ttlMs).toISOString(),
-            scope: input.scope,
-            privateKey: privateKeyPem,
-        });
-        writeCanonicalJsonArrayFileAtomic(daemonActivationGrantsPath(), [...existingGrants.records, record], resolve(homedir()));
-        auditActivationEvent('daemon-activation:grant', `standing grant minted: grantId=${record.grantId} keyId=${root.keyId} `
-            + `scope=${canonicalizeDaemonActivationValue(record.scope)} expiresAt=${record.expiresAt}`, 'ok');
-        return { ok: true, record };
-    });
-}
-/**
- * Mints and pins a single-use activation permit (once/resident scopes) to
- * daemonActivationPermitPath(), ready for `ashlr daemon start` to consume.
- * Signs against THIS exact machine's current build (executable/entrypoint/
- * release-tree hashes) — an operator runs this locally, immediately before
- * starting the daemon it authorizes.
- */
-export function daemonActivationMintOneShotPermit(input) {
-    if (process.platform === 'win32') {
-        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    if (!validScope(input.scope))
-        return { ok: false, reason: 'invalid-grant-scope' };
-    return withActivationStoreLock(() => {
-        const trustStore = loadTrustRootStore();
-        if (!trustStore.ok)
-            return { ok: false, reason: trustStore.reason };
-        const active = trustStore.records.filter((record) => record.revokedAt === null);
-        if (active.length === 0)
-            return { ok: false, reason: 'no-trusted-activation-roots' };
-        if (active.length > 1)
-            return { ok: false, reason: 'ambiguous-signing-key-run-activation-status' };
-        const root = active[0];
-        let privateKeyPem;
-        try {
-            privateKeyPem = readOperatorPrivateKeyPem();
-        }
-        catch (error) {
-            return { ok: false, reason: error.message || 'operator-key-unreadable' };
-        }
-        let configSnapshot;
-        try {
-            configSnapshot = strictConfigSnapshot(input.cfg);
-        }
-        catch {
-            return { ok: false, reason: 'activation-config-not-strict-json' };
-        }
-        // Cheap, context-independent check first: no point collecting a full
-        // runtime context (file hashing, release-tree walk) if there is already
-        // a pending permit occupying the single fixed path.
-        const permitPath = daemonActivationPermitPath();
-        if (pathEntryPresent(permitPath))
-            return { ok: false, reason: 'activation-permit-already-pending' };
-        let context;
-        try {
-            context = collectRuntimeContext(configSnapshot);
-        }
-        catch (error) {
-            return { ok: false, reason: `runtime-context-unavailable:${error.message}` };
-        }
-        if (!context.killSwitchOff)
-            return { ok: false, reason: 'kill-switch-is-on' };
-        if (!context.guardHealthHealthy)
-            return { ok: false, reason: 'guard-health-degraded' };
-        if (!validBuildIdentity(context.buildIdentity)) {
-            // Most commonly: a `git` provenance build with a dirty working tree
-            // (dist/ was built from uncommitted changes). Fail closed — a permit
-            // bound to an untrusted build identity would never verify anyway.
-            return { ok: false, reason: 'runtime-build-identity-untrusted' };
-        }
-        const now = Date.now();
-        const permitId = randomBytes(16).toString('hex');
-        let payload;
-        let envelope;
-        try {
-            payload = buildDaemonActivationPermitPayload({
-                permitId,
-                nonce: randomBytes(32).toString('hex'),
-                keyId: root.keyId,
-                issuedAt: new Date(now).toISOString(),
-                expiresAt: new Date(now + MAX_VALIDITY_MS).toISOString(),
-                scope: input.scope,
-                context,
-            });
-            envelope = signDaemonActivationPermit(payload, privateKeyPem);
-        }
-        catch (error) {
-            return { ok: false, reason: error.message || 'activation-permit-build-failed' };
-        }
-        const home = resolve(homedir());
-        assurePrivateDirectory(dirname(permitPath), home);
-        const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
-        let fd;
-        try {
-            fd = openSync(permitPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
-            const initial = fstatSync(fd, { bigint: true });
-            if (!safeOwnedFile(initial) || initial.size !== 0n)
-                throw new Error('unsafe-activation-permit-file');
-            fchmodSync(fd, PRIVATE_FILE_MODE);
-            const bytes = Buffer.from(`${canonicalizeDaemonActivationValue(envelope)}\n`, 'utf8');
-            writeAll(fd, bytes);
-            fsyncSync(fd);
-            closeSync(fd);
-            fd = undefined;
-            const assurance = assurePrivateStoragePath(permitPath, 'file', 'secure-created', { anchorPath: home });
-            if (!assurance.ok)
-                throw new Error(`unsafe-activation-permit-path:${assurance.reason}`);
-            fsyncDirectory(dirname(permitPath));
-        }
-        catch (error) {
-            return { ok: false, reason: error.message || 'activation-permit-write-failed' };
-        }
-        finally {
-            if (fd !== undefined) {
-                try {
-                    closeSync(fd);
-                }
-                catch { /* best-effort */ }
-            }
-        }
-        auditActivationEvent('daemon-activation:grant', `one-shot permit minted: permitId=${permitId} keyId=${root.keyId} `
-            + `scope=${canonicalizeDaemonActivationValue(input.scope)} expiresAt=${payload.expiresAt}`, 'ok');
-        return { ok: true, permitId, permitPath, expiresAt: payload.expiresAt };
-    });
-}
-// ---------------------------------------------------------------------------
-// One-shot permit inspection / consumption — `ashlr daemon start` [--once].
-// ---------------------------------------------------------------------------
-function activationReadiness(state, reason, trustRootCount, extra) {
+function activationReadiness(state, reason, trustRootCount) {
     return {
         schemaVersion: 1,
         policyVersion: POLICY_VERSION,
@@ -1519,234 +682,112 @@ function activationReadiness(state, reason, trustRootCount, extra) {
         sourceState: state === 'degraded' ? 'degraded' : 'healthy',
         state,
         commandEligible: state === 'ready',
-        requestedShape: extra?.requestedShape ?? 'proposal-once',
+        requestedShape: 'proposal-once',
         trustRootCount,
-        residentAuthorized: extra?.residentAuthorized ?? false,
-        residentStandingAuthorized: extra?.residentStandingAuthorized ?? false,
-        installAuthorized: extra?.installAuthorized ?? false,
-        repairAuthorized: extra?.repairAuthorized ?? false,
+        residentAuthorized: false,
+        installAuthorized: false,
+        repairAuthorized: false,
         reason,
     };
 }
-/** Maps the internal scope-key shape to the DaemonActivationReadiness label. */
-function requestedShapeLabel(shape) {
-    return shape === 'once' ? 'proposal-once' : 'resident';
-}
-/**
- * What activation shape (if any) `opts` is structurally eligible to have
- * authorized at all — independent of whether any permit/trust root exists.
- * `null` means "denied before ever reading a permit," matching the pre-M470
- * behavior for drain modes and any dry-run other than {once:true,dryRun:true}.
- */
-function requestedActivationShape(opts) {
-    if (opts.drain !== undefined || opts.drainLimit !== undefined)
-        return null;
-    if (opts.dryRun === true)
-        return null;
-    if (opts.once === true)
-        return 'once';
-    if (opts.once === false)
-        return 'resident';
-    return null;
-}
-function needsPermit(opts) {
-    return !(opts.once === true && opts.dryRun === true);
-}
-/**
- * Read-only diagnostic (never authorizes, never consumes) for `ashlr
- * activation status`: peeks the pending one-shot permit, recomputes the
- * current runtime context, and reports exactly which binding field(s)
- * differ and what the two values were. `permit-runtime-binding-mismatch`
- * alone can't tell an operator what to fix — this can.
- */
-export function daemonActivationDiagnosePendingPermitBindings(cfg) {
-    const permitPath = daemonActivationPermitPath();
-    if (process.platform === 'win32') {
-        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
-    }
-    let pinned;
+function pathEntryPresent(path) {
     try {
-        pinned = openPinnedPermit(permitPath, resolve(homedir()));
+        lstatSync(path);
+        return true;
     }
     catch (error) {
-        return {
-            ok: false,
-            reason: error.code === 'ENOENT'
-                ? 'activation-permit-missing'
-                : 'activation-permit-inspection-failed',
-        };
-    }
-    try {
-        let envelope;
-        try {
-            envelope = JSON.parse(pinned.text);
-        }
-        catch {
-            return { ok: false, reason: 'invalid-permit-json' };
-        }
-        const parsed = parseEnvelope(envelope);
-        if (!parsed)
-            return { ok: false, reason: 'invalid-permit-schema' };
-        let configSnapshot;
-        try {
-            configSnapshot = strictConfigSnapshot(cfg);
-        }
-        catch {
-            return { ok: false, reason: 'activation-config-not-strict-json' };
-        }
-        let context;
-        try {
-            context = collectRuntimeContext(configSnapshot);
-        }
-        catch (error) {
-            return { ok: false, reason: `runtime-context-unavailable:${error.message}` };
-        }
-        if (!context.killSwitchOff)
-            return { ok: false, reason: 'kill-switch-is-on' };
-        if (!context.guardHealthHealthy)
-            return { ok: false, reason: 'guard-health-degraded' };
-        const expectedBindings = {
-            configDigest: context.configDigest,
-            buildIdentity: context.buildIdentity,
-            executable: context.executable,
-            entrypoint: context.entrypoint,
-            releaseTree: context.releaseTree,
-            authorityStateDigest: context.authorityStateDigest,
-            killSwitch: 'off',
-            guardHealth: 'healthy',
-        };
-        const mismatchedKeys = bindingFieldMismatches(parsed.payload.bindings, expectedBindings);
-        if (mismatchedKeys.length === 0)
-            return { ok: true, reason: 'bindings-match' };
-        const mismatches = {};
-        for (const key of mismatchedKeys) {
-            mismatches[key] = { signed: parsed.payload.bindings[key], current: expectedBindings[key] };
-        }
-        return { ok: false, reason: 'permit-runtime-binding-mismatch', mismatches };
-    }
-    finally {
-        try {
-            closeSync(pinned.fd);
-        }
-        catch { /* diagnostic-only; best-effort close */ }
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
     }
 }
-function inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext, requestedShape, standingAuth) {
-    const shapeLabel = requestedShapeLabel(requestedShape);
-    const extraBase = {
-        requestedShape: shapeLabel,
-        installAuthorized: standingAuth.install,
-        repairAuthorized: standingAuth.repair,
-        residentStandingAuthorized: standingAuth.residentStanding,
-    };
+function inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext) {
     let envelope;
     try {
         envelope = JSON.parse(pinned.text);
     }
     catch {
-        return activationReadiness('degraded', 'invalid-permit-json', trustRoots.length, extraBase);
+        return activationReadiness('degraded', 'invalid-permit-json', trustRoots.length);
     }
     if (`${canonicalizeDaemonActivationValue(envelope)}\n` !== pinned.text) {
-        return activationReadiness('degraded', 'noncanonical-permit-encoding', trustRoots.length, extraBase);
+        return activationReadiness('degraded', 'noncanonical-permit-encoding', trustRoots.length);
     }
     const parsed = parseEnvelope(envelope);
     if (!parsed) {
-        return activationReadiness('degraded', 'invalid-permit-schema', trustRoots.length, extraBase);
+        return activationReadiness('degraded', 'invalid-permit-schema', trustRoots.length);
     }
     let configSnapshot;
     try {
         configSnapshot = strictConfigSnapshot(cfg);
     }
     catch {
-        return activationReadiness('degraded', 'activation-config-not-strict-json', trustRoots.length, extraBase);
+        return activationReadiness('degraded', 'activation-config-not-strict-json', trustRoots.length);
     }
     const context = suppliedContext ?? collectRuntimeContext(configSnapshot);
     if (context.configDigest !== daemonActivationConfigDigest(configSnapshot)) {
-        return activationReadiness('blocked', 'runtime-config-digest-mismatch', trustRoots.length, extraBase);
+        return activationReadiness('blocked', 'runtime-config-digest-mismatch', trustRoots.length);
     }
     const verification = verifyDaemonActivationPermit(parsed, context, trustRoots);
     if (!verification.ok || !verification.permitId) {
-        return activationReadiness('blocked', verification.reason, trustRoots.length, extraBase);
-    }
-    const residentAuthorized = parsed.payload.scope.resident === true;
-    if (parsed.payload.scope[requestedShape] !== true) {
-        return activationReadiness('blocked', 'activation-permit-scope-does-not-grant-requested-shape', trustRoots.length, { ...extraBase, residentAuthorized });
+        return activationReadiness('blocked', verification.reason, trustRoots.length);
     }
     const nonceDigest = sha256(parsed.payload.nonce);
     if (pathEntryPresent(daemonActivationReceiptPath(verification.permitId))
         || pathEntryPresent(daemonActivationNonceReceiptPath(nonceDigest))) {
-        return activationReadiness('blocked', 'activation-permit-already-consumed', trustRoots.length, { ...extraBase, residentAuthorized });
+        return activationReadiness('blocked', 'activation-permit-already-consumed', trustRoots.length);
     }
     const openedAfterInspection = fstatSync(pinned.fd, { bigint: true });
     const namedAfterInspection = lstatSync(permitPath, { bigint: true });
     if (!sameFileSnapshot(pinned.stat, openedAfterInspection)
         || !sameFileSnapshot(openedAfterInspection, namedAfterInspection)) {
-        return activationReadiness('degraded', 'activation-permit-changed-during-inspection', trustRoots.length, { ...extraBase, residentAuthorized });
+        return activationReadiness('degraded', 'activation-permit-changed-during-inspection', trustRoots.length);
     }
-    const readyReason = requestedShape === 'once' ? 'valid-proposal-once-permit' : 'valid-resident-permit';
-    return activationReadiness('ready', readyReason, trustRoots.length, { ...extraBase, residentAuthorized });
+    return activationReadiness('ready', 'valid-proposal-once-permit', trustRoots.length);
 }
 function inspectWithAuthority(cfg, opts, trustRoots, suppliedContext, platform = process.platform) {
-    const standingAuth = {
-        install: daemonActivationScopeGranted('install').granted,
-        repair: daemonActivationScopeGranted('repair').granted,
-        residentStanding: daemonActivationScopeGranted('residentStanding').granted,
-    };
-    const standingAuthorizedFields = {
-        installAuthorized: standingAuth.install,
-        repairAuthorized: standingAuth.repair,
-        residentStandingAuthorized: standingAuth.residentStanding,
-    };
     if (!needsPermit(opts)) {
-        return activationReadiness('ready', 'dry-run-once-does-not-require-activation-permit', trustRoots.length, standingAuthorizedFields);
+        return activationReadiness('ready', 'dry-run-once-does-not-require-activation-permit', trustRoots.length);
     }
-    const requestedShape = requestedActivationShape(opts);
-    if (!requestedShape) {
-        return activationReadiness('blocked', 'activation-permit-cannot-authorize-requested-start-shape', trustRoots.length, standingAuthorizedFields);
+    if (!supportedProposalOnceShape(opts)) {
+        return activationReadiness('blocked', 'activation-permit-cannot-authorize-requested-start-shape', trustRoots.length);
     }
-    const shapeLabel = requestedShapeLabel(requestedShape);
     if (trustRoots.length === 0) {
-        return activationReadiness('blocked', 'no-trusted-activation-roots', 0, {
-            requestedShape: shapeLabel,
-            ...standingAuthorizedFields,
-        });
+        return activationReadiness('blocked', 'no-trusted-activation-roots', 0);
     }
     if (platform === 'win32') {
-        return activationReadiness('blocked', 'activation-permit-v1-unsupported-on-windows', trustRoots.length, { requestedShape: shapeLabel, ...standingAuthorizedFields });
-    }
-    // A valid standing `residentStanding` grant means `daemon start` (resident)
-    // would succeed RIGHT NOW without ever touching the one-shot permit file —
-    // report that directly instead of inspecting a possibly-stale/unreadable
-    // one-shot permit that resident no longer depends on. This is the fix for
-    // status previously showing `resident: degraded
-    // (activation-permit-inspection-failed)` when a stale one-shot permit file
-    // was lying around: that inspection is simply skipped once a standing grant
-    // covers it.
-    if (requestedShape === 'resident' && standingAuth.residentStanding) {
-        return activationReadiness('ready', 'ready-via-standing-resident-grant', trustRoots.length, { requestedShape: shapeLabel, residentAuthorized: true, ...standingAuthorizedFields });
+        return activationReadiness('blocked', 'activation-permit-v1-unsupported-on-windows', trustRoots.length);
     }
     const permitPath = daemonActivationPermitPath();
     let pinned;
     let result;
     try {
         pinned = openPinnedPermit(permitPath, resolve(homedir()));
-        result = inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext, requestedShape, standingAuth);
+        result = inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext);
     }
     catch (error) {
         result = activationReadiness(error.code === 'ENOENT' ? 'blocked' : 'degraded', error.code === 'ENOENT'
             ? 'activation-permit-missing'
-            : 'activation-permit-inspection-failed', trustRoots.length, { requestedShape: shapeLabel, installAuthorized: standingAuth.install, repairAuthorized: standingAuth.repair });
+            : 'activation-permit-inspection-failed', trustRoots.length);
     }
     if (pinned) {
         try {
             closeSync(pinned.fd);
         }
         catch {
-            return activationReadiness('degraded', 'activation-permit-close-failed', trustRoots.length, { requestedShape: shapeLabel, installAuthorized: standingAuth.install, repairAuthorized: standingAuth.repair });
+            return activationReadiness('degraded', 'activation-permit-close-failed', trustRoots.length);
         }
     }
     return result;
 }
+function needsPermit(opts) {
+    return !(opts.once === true && opts.dryRun === true);
+}
+function supportedProposalOnceShape(opts) {
+    return opts.once === true
+        && opts.dryRun !== true
+        && opts.drain === undefined
+        && opts.drainLimit === undefined;
+}
 function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterReceiptPersisted, mayMintCapability) {
     if (!needsPermit(opts)) {
         return {
@@ -1755,8 +796,7 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
             reason: 'dry-run-once-does-not-require-activation-permit',
         };
     }
-    const requestedShape = requestedActivationShape(opts);
-    if (!requestedShape) {
+    if (!supportedProposalOnceShape(opts)) {
         return {
             authorized: false,
             required: true,
@@ -1828,15 +868,6 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
             result = { authorized: false, required: true, reason: 'invalid-permit-schema' };
             return result;
         }
-        if (parsed.payload.scope[requestedShape] !== true) {
-            result = {
-                authorized: false,
-                required: true,
-                reason: 'activation-permit-scope-does-not-grant-requested-shape',
-                permitId: verification.permitId,
-            };
-            return result;
-        }
         const receiptsDir = dirname(daemonActivationReceiptPath(verification.permitId));
         assurePrivateDirectory(receiptsDir, home);
         const receiptPath = daemonActivationReceiptPath(verification.permitId);
@@ -1918,12 +949,12 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
         result = {
             authorized: true,
             required: true,
-            reason: requestedShape === 'once' ? 'proposal-once-activation-authorized' : 'resident-activation-authorized',
+            reason: 'proposal-once-activation-authorized',
             permitId: verification.permitId,
             receiptPath,
             ...(mayMintCapability
                 ? {
-                    capability: mintCapability(verification.permitId, parsed.payload.scope, () => {
+                    capability: mintCapability(verification.permitId, () => {
                         const claimContext = collectRuntimeContext(configSnapshot);
                         return verifyDaemonActivationPermit(parsed, claimContext, trustRoots).ok;
                     }),
@@ -1961,54 +992,18 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
     }
 }
 /**
- * Runtime entrypoint. Trust roots come ONLY from the operator-owned store
- * (see loadDaemonActivationTrustRoots); an npm consumer who never runs
- * `ashlr activation init` sees the store as empty and gets today's exact
- * denial. Every consume attempt — authorized or refused — is audited.
+ * Runtime entrypoint. Its immutable repository-owned roots are the only path
+ * that can mint an in-process activation capability.
  */
 export function consumeDaemonActivationPermit(cfg, opts) {
-    // A resident start tries the standing `residentStanding` grant FIRST. This
-    // is what makes an unattended, launchd/systemd/Task-Scheduler-triggered
-    // restart after reboot possible: there is nobody present to mint a fresh
-    // one-shot permit, but a still-valid, still-signed, non-revoked standing
-    // grant needs no human in the loop. It goes through every check
-    // `daemonActivationScopeGranted` does (platform, kill switch, guard health,
-    // trust root, expiry, revocation, signature) — deliberately NOT the
-    // one-shot permit's build-identity binding, matching every other standing
-    // grant (conductor/install/automerge/repair/deploy), because a standing
-    // grant must keep working across routine rebuilds within its expiry
-    // window. If no standing grant matches, this falls through to the
-    // one-shot permit path unchanged — an operator who has only ever granted
-    // the one-shot form (or nothing) sees EXACTLY today's behavior.
-    if (requestedActivationShape(opts) === 'resident') {
-        const standing = findGrantedRecord('residentStanding');
-        if (standing.granted) {
-            const result = {
-                authorized: true,
-                required: true,
-                reason: `resident-standing-activation-authorized:${standing.record.grantId}`,
-                scope: standing.record.scope,
-                grantId: standing.record.grantId,
-            };
-            auditActivationEvent('daemon-activation:consume', `daemon activation consume authorized: ${result.reason}`, 'ok');
-            return result;
-        }
-        auditActivationEvent('daemon-activation:resident-standing-check', `resident standing grant unavailable (${standing.reason}); falling back to one-shot permit`, 'refused');
-    }
-    const result = consumeWithAuthority(cfg, opts, loadDaemonActivationTrustRoots(), undefined, undefined, true);
-    // The dry-run-once bypass (`required: false`) never touches a permit or
-    // any authority state — it is not a consume attempt, so nothing is audited.
-    if (result.required) {
-        auditActivationEvent('daemon-activation:consume', `daemon activation consume ${result.authorized ? 'authorized' : 'refused'}: ${result.reason}`, result.authorized ? 'ok' : 'refused');
-    }
-    return result;
+    return consumeWithAuthority(cfg, opts, DAEMON_ACTIVATION_TRUST_ROOTS, undefined, undefined, true);
 }
 /**
  * Read-only advisory inspection. A ready result is never authority: daemon
  * start must still reopen, revalidate, durably consume, and mint a capability.
  */
 export function inspectDaemonActivationPermit(cfg, opts) {
-    return inspectWithAuthority(cfg, opts, loadDaemonActivationTrustRoots(), undefined);
+    return inspectWithAuthority(cfg, opts, DAEMON_ACTIVATION_TRUST_ROOTS, undefined);
 }
 /** Test-only inspection with injected roots/context; it cannot mint authority. */
 export function inspectDaemonActivationPermitForVerification(cfg, opts, options) {