@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/init/derive.js

@@ -1,7 +1,9 @@
 // Proposes interview answers from files a repository already carries. It owns reading those files
-// and attributing each proposed value to its source; it must not decide or write anything. Every
-// fact is inferred: init surfaces it with its source and the operator confirms it, because a
-// config that looks complete but holds guesses is the failure cockpit exists to prevent.
+// and attributing each proposed value to its source; it must not decide or write anything. A fact
+// is "derived" when it is the complete answer to an interview field read exactly from its source,
+// which the setup agent may accept and bring-up then proves; every other fact is "inferred": a hint
+// or a partial value that needs judgement, because a config that looks complete but holds guesses
+// is the failure cockpit exists to prevent.
 // Deliberately cheap and exact: Dockerfile, env template variable names, Compose files and CI
 // service containers, test entry points and run scripts from build and package manifests, Node
 // lockfiles, and each repository's origin remote from .git/config. It starts no process. Orchestrator
@@ -9,7 +11,7 @@
 import { lstat, readdir, realpath } from 'node:fs/promises';
 import { basename, isAbsolute, relative as pathRelative, resolve, sep } from 'node:path';
 import { parse as parseToml } from 'smol-toml';
-import { parse as parseYaml } from 'yaml';
+import { LineCounter, parse as parseYaml, parseDocument } from 'yaml';
 import { readBoundedInput } from '../config/load.js';
 import { errorCause, hasErrorCode } from '../environment/contract.js';
 import { assessComposeTopology, bindHolder, composeBindPath, composeProjectDirectory, composePublishedPorts, splitComposeShort } from '../environment/compose-topology.js';
@@ -230,33 +232,43 @@ const PORT_VARIABLE = /^\$\{([A-Z][A-Z0-9_]*)(?:(:?-)(\d{1,5}))?\}$|^\$([A-Z][A-
 function entries(value) {
     return Array.isArray(value) ? value : [];
 }
+const at = (file, path) => {
+    const line = file.line(path);
+    return line === undefined ? file.source : `${file.source}:${line}`;
+};
+function services(file) {
+    const value = file.document?.services;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return [];
+    return Object.entries(value)
+        .filter((entry) => !!entry[1] && typeof entry[1] === 'object' && !Array.isArray(entry[1]));
+}
 /**
  * Reads the bind sources and published host-port variables of the Compose files init proposes.
  * Bind sources resolve as `up` resolves them: against the first file's directory, with each
  * proposed sibling variable set to its directory and any other variable to its own default.
+ * The bases are complete only when every published host port was read; otherwise the map is a
+ * partial proposal that needs the person.
  */
 function composeFacts(files, root, variables, skipped) {
     const binds = [];
-    // Each base keeps every file that publishes it, so the proposal names where each value came from.
+    // Each base keeps every file and line that publishes it, so the proposal names where each value came from.
     const bases = new Map();
     const conflicting = new Set();
-    for (const { source, document } of files) {
-        const services = document?.services;
-        if (!services || typeof services !== 'object' || Array.isArray(services))
-            continue;
-        for (const service of Object.values(services)) {
-            if (!service || typeof service !== 'object')
-                continue;
+    let basesComplete = true;
+    for (const file of files) {
+        const { source } = file;
+        for (const [name, service] of services(file)) {
             for (const volume of entries(service.volumes)) {
                 const segments = typeof volume === 'string' ? splitComposeShort(volume) : undefined;
                 const raw = segments && segments.length >= 2 ? segments[0]
                     : volume && typeof volume === 'object' && volume.type === 'bind'
                         ? volume.source : undefined;
-                const path = typeof raw === 'string' ? composeBindPath(raw, composeProjectDirectory(root, files.map(file => file.source)), variables) : undefined;
+                const path = typeof raw === 'string' ? composeBindPath(raw, composeProjectDirectory(root, files.map(row => row.source)), variables) : undefined;
                 if (path !== undefined && path !== 'volume')
                     binds.push({ source, path });
             }
-            for (const port of entries(service.ports)) {
+            for (const [index, port] of entries(service.ports).entries()) {
                 const segments = typeof port === 'string' ? splitComposeShort(port) : undefined;
                 const published = segments && segments.length >= 2 ? segments[segments.length - 2]
                     : port && typeof port === 'object' ? port.published : undefined;
@@ -265,30 +277,101 @@ function composeFacts(files, root, variables, skipped) {
                     continue;
                 const match = typeof published === 'string' ? PORT_VARIABLE.exec(published) : null;
                 if (!match) {
+                    basesComplete = false;
                     skipped.push({ source, reason: `publishes host port ${String(published)} that is not read from a variable with a default, so every stack would bind the same host port and check refuses it; publish it as \${NAME:-<port>} and declare NAME under [ports.bases]` });
                     continue;
                 }
-                const name = (match[1] ?? match[4]);
+                const variable = (match[1] ?? match[4]);
                 const base = match[3] === undefined ? undefined : Number(match[3]);
                 if (base === undefined || base < 1 || base > 65_535) {
-                    skipped.push({ source, reason: `publishes a host port from \${${name}} with no default, so its base port cannot be read; declare ${name} under [ports.bases]` });
+                    basesComplete = false;
+                    skipped.push({ source, reason: `publishes a host port from \${${variable}} with no default, so its base port cannot be read; declare ${variable} under [ports.bases]` });
                     continue;
                 }
-                const known = bases.get(name);
+                const known = bases.get(variable);
                 if (known && known.base !== base)
-                    conflicting.add(name);
+                    conflicting.add(variable);
+                const where = at(file, ['services', name, 'ports', index]);
                 if (!known)
-                    bases.set(name, { base, sources: [source] });
-                else if (!known.sources.includes(source))
-                    known.sources.push(source);
+                    bases.set(variable, { base, files: [source], at: [where] });
+                else {
+                    if (!known.files.includes(source))
+                        known.files.push(source);
+                    known.at.push(where);
+                }
             }
         }
     }
-    for (const name of conflicting) {
-        skipped.push({ source: bases.get(name).sources.join(', '), reason: `publishes \${${name}} with different defaults, so its base port cannot be read; declare ${name} under [ports.bases]` });
-        bases.delete(name);
+    for (const variable of conflicting) {
+        basesComplete = false;
+        skipped.push({ source: bases.get(variable).files.join(', '), reason: `publishes \${${variable}} with different defaults, so its base port cannot be read; declare ${variable} under [ports.bases]` });
+        bases.delete(variable);
     }
-    return { binds, bases };
+    return { binds, bases, basesComplete };
+}
+const BYTE_UNITS = { '': 1, b: 1, k: 1024, kb: 1024, m: 1024 ** 2, mb: 1024 ** 2, g: 1024 ** 3, gb: 1024 ** 3 };
+/** Compose's byte notation, as Docker reads it: a byte count, or a number with a binary b, k, m or g unit. */
+function composeBytes(value) {
+    if (typeof value === 'number')
+        return Number.isFinite(value) && value > 0 ? value : undefined;
+    const match = typeof value === 'string' ? /^(\d+(?:\.\d+)?)\s*([a-z]*)$/i.exec(value.trim()) : null;
+    const unit = match ? BYTE_UNITS[match[2].toLowerCase()] : undefined;
+    return match && unit !== undefined && Number(match[1]) > 0 ? Number(match[1]) * unit : undefined;
+}
+function composeCpus(value) {
+    const cpus = typeof value === 'number' ? value : typeof value === 'string' && /^\d+(?:\.\d+)?$/.test(value.trim()) ? Number(value) : NaN;
+    return Number.isFinite(cpus) && cpus > 0 ? cpus : undefined;
+}
+/**
+ * The memory and CPU floor the one proposed Compose file records: each default service's limit
+ * times its replicas, summed, because the runtime must hold every service at its limit at once.
+ * A service with no limit leaves that resource unrecorded, and a service whose two spellings of a
+ * limit disagree is reported instead of guessed between.
+ */
+function composeLimits(file, skipped) {
+    // A service behind a profile does not start unless that profile is activated.
+    const started = services(file).filter(([, service]) => service.profiles === undefined);
+    if (started.length === 0)
+        return [];
+    const resources = [
+        { key: 'runtime_memory_mb', label: 'memory', long: 'memory', short: 'mem_limit', read: composeBytes,
+            total: (sum) => Math.ceil(sum / 1024 ** 2) },
+        { key: 'runtime_cpus', label: 'CPU', long: 'cpus', short: 'cpus', read: composeCpus,
+            total: (sum) => Math.round(sum * 1000) / 1000 },
+    ];
+    const facts = [];
+    for (const resource of resources) {
+        let sum = 0;
+        const parts = [];
+        const lines = [];
+        let complete = true;
+        for (const [name, service] of started) {
+            const deployPath = ['services', name, 'deploy', 'resources', 'limits', resource.long];
+            const deployed = field(field(field(service.deploy, 'resources'), 'limits'), resource.long);
+            const short = service[resource.short];
+            const [declared, path] = deployed !== undefined ? [deployed, deployPath] : [short, ['services', name, resource.short]];
+            const amount = resource.read(declared);
+            if (deployed !== undefined && short !== undefined && resource.read(short) !== amount) {
+                skipped.push({ source: at(file, deployPath), reason: `service ${name} sets its ${resource.label} limit twice, as ${resource.short} and as deploy.resources.limits.${resource.long}, with different values, so no ${resource.key} is proposed; keep one of them` });
+                complete = false;
+                continue;
+            }
+            if (amount === undefined) {
+                complete = false;
+                continue;
+            }
+            const replicas = field(service.deploy, 'replicas') ?? service.scale ?? 1;
+            const count = typeof replicas === 'number' && Number.isInteger(replicas) && replicas >= 0 ? replicas : 1;
+            sum += amount * count;
+            parts.push(`${name} ${String(declared)}${count === 1 ? '' : ` x${count}`}`);
+            lines.push(at(file, path));
+        }
+        if (complete && sum > 0)
+            facts.push({ fields: ['environment.machine'], target: `environment.machine.${resource.key}`, value: resource.total(sum),
+                provenance: { kind: 'derived', source: lines.join(', '),
+                    reason: `the ${resource.label} limits of every service ${file.source} starts by default (${parts.join(', ')}), summed: the runtime must hold each service at its limit at once` } });
+    }
+    return facts;
 }
 async function detectTestEntry(read, readJson, present, node) {
     for (const name of ['MODULE.bazel', 'WORKSPACE.bazel', 'WORKSPACE']) {
@@ -415,6 +498,20 @@ export async function deriveInferredFacts(input) {
         }
     };
     const composeFiles = [];
+    // Compose files are read with their line positions, so a derived value names the line it came from.
+    const parseCompose = (source, text) => {
+        const lineCounter = new LineCounter();
+        const parsed = parseDocument(text, { lineCounter });
+        const error = parsed.errors[0];
+        if (error) {
+            skipped.push({ source, reason: `is not valid YAML (${error.name})` });
+            return undefined;
+        }
+        return { source, document: parsed.toJS(), line: path => {
+                const offset = parsed.getIn(path, true)?.range?.[0];
+                return offset === undefined ? undefined : lineCounter.linePos(offset).line;
+            } };
+    };
     const seenServices = new Set();
     const readOrigin = async (directory) => {
         const marker = relative(directory, '.git');
@@ -555,14 +652,14 @@ export async function deriveInferredFacts(input) {
             const text = await read(directory.path, name);
             if (text === undefined)
                 continue;
-            const document = parseYamlText(source, text);
-            if (document !== undefined) {
+            const file = parseCompose(source, text);
+            if (file !== undefined) {
                 if (source === '..' || source.startsWith('../') || isAbsolute(source)) {
                     skipped.push({ source,
                         reason: `is outside the cockpit root, so environment.compose_files cannot represent it; write a compose.yml at the cockpit root that reaches each checkout through its sibling variable${slug === undefined ? '' : ` (such as \${${deriveSiblingVariable(slug)}})`} and answer environment.compose_files = ["compose.yml"]; then rerun ${initCommand({ root: configurationRoot })} with the options you ran it with` });
                 }
                 else
-                    composeFiles.push({ source, document });
+                    composeFiles.push(file);
             }
             break;
         }
@@ -642,19 +739,24 @@ export async function deriveInferredFacts(input) {
                     ? `${placed}; acquire "auto" with its origin remote, so setup clones it where a checkout is absent; add its purpose`
                     : `${placed}; acquire "none" because ${origin.reason}; add its purpose` } });
     }
-    if (compose.bases.size > 0) {
-        const sources = [...new Set([...compose.bases.values()].flatMap(row => row.sources))];
-        const publishers = sources.map(source => `${source} publishes ${[...compose.bases].filter(([, row]) => row.sources.includes(source)).map(([name]) => name).join(', ')}`);
+    if (composeFiles.length > 0 && (compose.bases.size > 0 || compose.basesComplete)) {
+        const files = [...new Set([...compose.bases.values()].flatMap(row => row.files))];
+        const publishers = files.map(file => `${file} publishes ${[...compose.bases].filter(([, row]) => row.files.includes(file)).map(([name]) => name).join(', ')}`);
         facts.push({ fields: ['ports.bases'], target: 'ports.bases', value: Object.fromEntries([...compose.bases].map(([name, row]) => [name, row.base])),
-            provenance: { kind: 'inferred', source: sources.join(', '),
-                reason: `${publishers.join('; ')} from variables with these defaults; check requires every published host port to come from a [ports.bases] variable, so each stack leases its own` } });
+            provenance: compose.bases.size === 0
+                ? { kind: 'derived', source: composeFiles.map(file => file.source).join(', '),
+                    reason: 'no service publishes a host port, so no stack needs a base port' }
+                : { kind: compose.basesComplete ? 'derived' : 'inferred', source: [...new Set([...compose.bases.values()].flatMap(row => row.at))].join(', '),
+                    reason: `${publishers.join('; ')} from variables with these defaults; check requires every published host port to come from a [ports.bases] variable, so each stack leases its own${compose.basesComplete ? '' : '; a published host port could not be read (see inferenceSkipped), so this map is incomplete'}` } });
     }
     // compose-first resolves every relative path against the first listed file's directory, so one
     // product Compose file can be run in place but several cannot be listed together.
-    if (composeFiles.length === 1)
+    if (composeFiles.length === 1) {
         facts.unshift({ fields: ['environment.compose_files'], target: 'environment.compose_files', value: [composeFiles[0].source],
-            provenance: { kind: 'inferred', source: composeFiles[0].source,
+            provenance: { kind: 'derived', source: composeFiles[0].source,
                 reason: 'a Compose file already exists, so cockpit can run it as written' } });
+        facts.push(...composeLimits(composeFiles[0], skipped));
+    }
     else if (composeFiles.length > 1)
         skipped.push({ source: composeFiles.map(file => file.source).join(', '),
             reason: `are Compose files in different repositories, and compose-first resolves every relative path against the first listed file's directory, so they cannot be listed together; write one compose.yml at the cockpit root that runs their services, reaching each checkout through its sibling variable (${[...siblingPaths.keys()].map(name => `\${${name}}`).join(', ')}), and answer environment.compose_files = ["compose.yml"]` });
@@ -703,6 +805,7 @@ export async function composeFindings(input) {
                 continue;
             const health = service.healthcheck;
             services.set(id, { id, ports, mountSources: [], build: service.build !== undefined,
+                containerName: typeof service.container_name === 'string' ? service.container_name : null,
                 image: typeof service.image === 'string' ? service.image : null,
                 healthcheck: health !== undefined && health !== null && health.disable !== true && !(Array.isArray(health.test) && health.test[0] === 'NONE') });
         }
@@ -710,6 +813,7 @@ export async function composeFindings(input) {
     const bases = draft.ports?.bases;
     const found = await assessComposeTopology([...services.values()], { projectDirectory: composeProjectDirectory(input.root, references),
         portVariables: bases !== null && typeof bases === 'object' ? Object.keys(bases) : [], siblings: [], hostPaths: [] });
-    return [...unread, ...found.filter(row => row.code === 'COMPOSE_PORT_NOT_LEASED' || row.code === 'COMPOSE_HEALTHCHECK_MISSING')
+    return [...unread, ...found.filter(row => row.code === 'COMPOSE_PORT_NOT_LEASED' || row.code === 'COMPOSE_CONTAINER_NAME_FIXED' || row.code === 'COMPOSE_IMAGE_TAG_SHARED'
+            || row.code === 'COMPOSE_HEALTHCHECK_MISSING')
             .map(row => ({ ...row, severity: 'warning' }))];
 }

package/dist/init/draft.d.ts

@@ -1,5 +1,5 @@
 import type { Diagnostic } from '../diagnostics.js';
-import { type AnswerProvenance, type UnconfirmedAnswer } from './render.js';
+import { type AnswerProvenance, type DerivedAnswer, type UnconfirmedAnswer } from './render.js';
 /**
  * The directory holding the repositories, and optionally the direct children to observe. A cockpit
  * created beside a product repository observes only that repository in their shared parent, which
@@ -11,10 +11,10 @@ export interface EstateObservationInput {
     readonly repositories?: readonly string[];
     readonly rootIsRepository?: true;
 }
-export interface EstateObservationAdapters {
+interface EstateObservationAdapters {
     readonly observe: (input: EstateObservationInput) => Promise<unknown>;
 }
-export type EstateClassification = 'one-sibling' | 'incomplete-multi-repository' | 'no-runnable-product' | 'ready-multi-repository';
+type EstateClassification = 'one-sibling' | 'incomplete-multi-repository' | 'no-runnable-product' | 'ready-multi-repository';
 export interface EstateClassificationResult {
     readonly classification: EstateClassification;
     readonly sourceObservationSha256: string;
@@ -48,32 +48,34 @@ interface OutcomeBase {
     result: {
         document: string;
         unconfirmed?: readonly UnconfirmedAnswer[];
+        derived?: readonly DerivedAnswer[];
     } | null;
     status: number;
     question?: DocumentConfigurationQuestion | null;
 }
-export interface CompleteDocumentOutcome extends OutcomeBase {
+interface CompleteDocumentOutcome extends OutcomeBase {
     kind: 'complete';
     artifact: string;
     result: {
         document: string;
         unconfirmed?: readonly UnconfirmedAnswer[];
+        derived?: readonly DerivedAnswer[];
     };
     status: 0;
 }
-export interface GapDraftOutcome extends OutcomeBase {
+interface GapDraftOutcome extends OutcomeBase {
     kind: 'gap-draft';
     artifact: string;
     result: {
         document: string;
     };
 }
-export interface SkippedScopeOutcome extends OutcomeBase {
+interface SkippedScopeOutcome extends OutcomeBase {
     kind: 'skipped-scope';
     artifact: null;
     result: null;
 }
-export interface RefusedDocumentOutcome extends OutcomeBase {
+interface RefusedDocumentOutcome extends OutcomeBase {
     kind: 'refusal';
     artifact: null;
     result: null;
@@ -88,15 +90,15 @@ export interface DocumentCommandInput {
     /** How init observed the estate when it is not the cockpit root's children: a dedicated or an in-repo cockpit. */
     estate?: EstateObservationInput;
 }
-export type DocumentConfigurationField = 'cockpit.name' | 'sibling' | 'estate.runnable' | 'ports.bases' | 'environment.install_policies' | 'environment.test_data' | 'environment.compose_files' | 'environment.machine' | 'environment.posture' | 'testing' | 'guards' | 'configuration.defaults';
-export interface DocumentConfigurationQuestion {
+type DocumentConfigurationField = 'cockpit.name' | 'sibling' | 'estate.runnable' | 'ports.bases' | 'environment.install_policies' | 'environment.test_data' | 'environment.compose_files' | 'environment.machine' | 'environment.posture' | 'testing' | 'guards' | 'configuration.defaults';
+interface DocumentConfigurationQuestion {
     readonly id: `question:${string}`;
     readonly field: DocumentConfigurationField;
     readonly source: string;
     readonly why: string;
     readonly expectedSha256?: string;
 }
-export type { AnswerProvenance, UnconfirmedAnswer } from './render.js';
+export type { AnswerProvenance, DerivedAnswer, UnconfirmedAnswer } from './render.js';
 export declare function isAnswerProvenance(value: unknown): value is AnswerProvenance;
 export interface DocumentConfigurationAnswer {
     readonly questionId: string;
@@ -104,7 +106,7 @@ export interface DocumentConfigurationAnswer {
     readonly sha256: string;
     readonly provenance: AnswerProvenance;
 }
-export interface DocumentConfigurationInput {
+interface DocumentConfigurationInput {
     readonly sourceObservationSha256: string;
     readonly classification?: EstateClassification;
     readonly answers: readonly DocumentConfigurationAnswer[];

package/dist/init/draft.js

@@ -1,8 +1,10 @@
 import { createHash } from 'node:crypto';
+import { unconfirmedFix } from '../guards/answer-confirmation.js';
 import { lstat, readFile, readdir, realpath } from 'node:fs/promises';
 import { basename, isAbsolute, relative, resolve, sep } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { initCommand } from '../fix-catalogue.js';
+import { canonicalJson } from '../canonical-json.js';
 import { readBoundedInput, schemaIssueSummary, STRUCTURED_INPUT_BYTE_LIMIT } from '../config/load.js';
 import { errorCause, snapshotJson, RefusalError, tryParseJson, hasErrorCode } from '../environment/contract.js';
 import { judgePostureDeclaration } from '../environment/posture-observation.js';
@@ -10,7 +12,7 @@ import { isSensitiveField, redactSensitiveText } from '../environment/sensitive.
 import { CockpitConfig, Guards, InstallPolicy, MachineFloor, Testing, configurationDefaults } from '../schema.js';
 import { toSiblingRows } from '../emit.js';
 import { gaps, parseRegistry } from '../registry-resolve/registry.js';
-import { ANSWER_PROVENANCES, renderCompleteDocument, renderIncompleteDocument, UNCONFIRMED_FIX, unconfirmedReason, } from './render.js';
+import { ANSWER_PROVENANCES, confirmedBy, renderCompleteDocument, renderIncompleteDocument, unconfirmedReason, } from './render.js';
 import { COMPOSE_NAMES, NODE_LOCKFILE_NAMES, deriveInferredFacts, readDockerfileFacts } from './derive.js';
 import { productPackageManifest } from '../team-metadata.js';
 import { refusalOutcome as refusal } from '../refusal.js';
@@ -653,18 +655,21 @@ const QUESTION_WHY = {
     policies: 'declare one row per toolchain and lockfile with any build or test command the guard should allow',
     testData: 'answer with exactly { seeded_data: boolean, signed_in_users: boolean } to state whether this local setup needs seeded data and signed-in users; each false field records a precise not-declared decision, while true keeps the product-owned declaration work visible without claiming that data or authentication exists',
     composeFiles: 'list the Compose files, relative to the cockpit root, that run the product, such as ["compose.yml"]; cockpit runs them as written. A small app with no Compose file gets a starting one, which it then owns, from npx --no cockpit init <cockpit root> --scaffold-compose <app dir> --port <port>',
-    machine: 'declare the machine floor the product needs from the container runtime: runtime_memory_mb, runtime_cpus, free_disk_mb and cold_start_seconds; these are product requirements a person states: cockpit never proposes them, because no product file records them and this machine\'s capacity is not what the product needs',
+    machine: 'declare the machine floor the product needs from the container runtime: runtime_memory_mb, runtime_cpus, free_disk_mb and cold_start_seconds; init proposes memory and CPUs from the Compose file\'s service limits, or from this machine\'s measured runtime where no limit records them; nothing records free disk or the cold start time, so a person states those, or the setup agent marks its choice "agent-default"',
     posture: `preflight refuses a runtime until its posture is declared: addressing is "port" (localhost:<port>) or "hostname"; authentication is "none" (no sign-in), "bypassed" (sign-in turned off locally) or "real"; posture_requirements names what depends on them, each tagged with the posture it needs. For a plain localhost stack with no sign-in, answer ${JSON.stringify({ addressing: 'port', authentication: 'none', posture_requirements: [{ requirement: 'leased-localhost-ports', addressing: 'port' }] })}`,
     testing: 'declare the product\'s test commands as [testing] stages and gates: a targeted gate agents run while iterating and a full gate they run before handing back shared changes; init proposes them from test entry points it finds on disk. Answer "none" when the product has no tests yet: no work can then be graded PASS, and doctor warns until gates are declared',
     guards: 'name the database hosts and live vendor API hosts of every non-local environment the product has (production, staging, shared dev or QA): cockpit runs only locally, so the guard denies agent commands that reach them; answer { "hosted_db_hosts": [], "vendor_endpoint_hosts": [] } to record that none exists',
-    defaults: 'confirm the exact surfaced inferred and schema-default values before completing the document',
+    defaults: 'a person confirms the values the draft lists under its person heading (protected branches, guard allow and deny lists, approved MCP servers, resettable volumes, generated host paths, and anything a registry left to a guess); expectedSha256 covers only those, and the setup agent accepts the schema defaults and the cockpit\'s own layout, which bring-up proves',
 };
 /** How a decision comment attributes an answer, so a value the agent chose never reads as one a person stated. */
 const STATED_BY = {
     'operator-confirmed': 'the operator stated that',
     'agent-default': 'the setup agent assumed, as a default, that',
     unattributed: 'the answers file, without saying who chose it, states that',
+    derived: 'init read from the product files that',
 };
+const isRecord = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const DERIVED_FIX = 'answer the value init proposes for this field under interview.outstanding, whose provenance kind is "derived"; otherwise mark the answer "human" once a person states it, or "agent-default" when you chose it';
 const noGuardHostsDecision = (provenance) => `${STATED_BY[provenance]} no non-local environment (production, staging, shared) has a database or live vendor host for the guard to deny`;
 const runnableWhy = (gaps) => `resolve the exact current runnable gaps: ${gaps.map(gap => `${gap.field} from ${gap.source}`).join('; ')}`;
 /**
@@ -698,7 +703,11 @@ function configurationQuestion(context, field, why, expectedSha256) {
         source: `configuration:${context.sourceObservationSha256}`,
         why, ...(expectedSha256 === undefined ? {} : { expectedSha256 }) };
 }
-function readConfigurationAnswer(answers, index, question) {
+/**
+ * The answer to the current question. One marked derived must be exactly the value init read for
+ * the field from an exact source: the provenance is checked, never taken on the answers file's word.
+ */
+function readConfigurationAnswer(answers, index, question, derived) {
     const answer = answers[index];
     if (!answer)
         return { kind: 'pending' };
@@ -708,7 +717,13 @@ function readConfigurationAnswer(answers, index, question) {
         const value = JSON.parse(answer.bytes);
         if (containsSensitiveField(value))
             return { kind: 'refusal', outcome: refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', 'operator answers cannot contain sensitive fields', question.field) };
-        return { kind: 'answer', value, provenance: answer.provenance };
+        if (answer.provenance !== 'derived')
+            return { kind: 'answer', value, provenance: answer.provenance };
+        if (derived === undefined)
+            return { kind: 'refusal', outcome: refusal('DOCUMENT_CONFIGURATION_ANSWER_NOT_DERIVED', `the ${question.field} answer is marked derived, but init read no complete value for it from an exact source`, question.field, DERIVED_FIX) };
+        if (canonicalJson(value) !== canonicalJson(derived.value))
+            return { kind: 'refusal', outcome: refusal('DOCUMENT_CONFIGURATION_ANSWER_NOT_DERIVED', `the ${question.field} answer is marked derived, but it is not ${JSON.stringify(derived.value)}, the value init read from ${derived.source}`, question.field, DERIVED_FIX) };
+        return { kind: 'answer', value, provenance: answer.provenance, source: derived.source };
     }
     catch {
         return { kind: 'refusal', outcome: refusal(// The parser message would quote the operator's answer.
@@ -806,20 +821,29 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         : input.estate && root ? relative(root, input.estate.root) || '.' : '.';
     const destination = input.output ? resolve(input.output) : null;
     let answerIndex = 0;
+    let inference;
     let siblingRows;
     let siblingAnswerRows = [];
-    // Every answer a person did not state is listed in cockpit.toml, so it never reads as theirs.
+    // Every answer a person did not state is listed in cockpit.toml, so it never reads as theirs; one
+    // accepted as read names the file it was read from instead.
     const unconfirmed = [];
-    const record = (field, provenance) => {
-        if (provenance !== 'operator-confirmed')
-            unconfirmed.push({ field, provenance });
+    const derived = [];
+    const record = (field, read) => {
+        if (read.provenance === 'derived')
+            derived.push({ field, source: read.source });
+        else if (read.provenance !== 'operator-confirmed')
+            unconfirmed.push({ field, provenance: read.provenance });
+    };
+    const derivedFact = (target) => {
+        const fact = inference?.facts.find(row => row.target === target && row.provenance.kind === 'derived');
+        return fact && { value: fact.value, source: fact.provenance.source };
     };
     // Always asked, with the directory name as the proposal: the name scopes Compose projects, state
     // and generated files, so renaming after sync is a migration, and setup agents that were never
     // asked renamed the cockpit by hand afterwards.
     const proposedName = cockpitName(root);
     const nameQuestion = configurationQuestion(context, 'cockpit.name', proposedName ? QUESTION_WHY.nameProposed : QUESTION_WHY.name);
-    const nameRead = readConfigurationAnswer(configuration.answers, answerIndex, nameQuestion);
+    const nameRead = readConfigurationAnswer(configuration.answers, answerIndex, nameQuestion, proposedName === undefined ? undefined : { value: proposedName, source: 'the cockpit root directory name' });
     if (nameRead.kind === 'pending')
         return pendingConfiguration({ name: proposedName, defaults, siblings: detected,
             attributions: inferGreenfieldSiblingRoot(buildAttributions({ name: proposedName, defaults, siblings: detected }, root, defaultSource), siblingsRoot), gaps: [] }, destination, nameQuestion);
@@ -829,7 +853,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
     if (!parsedName.success)
         return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the cockpit name answer does not match the schema: ${issueSummary(parsedName.error)}`, nameQuestion.field);
     const name = parsedName.data.name;
-    record('cockpit.name', nameRead.provenance);
+    record('cockpit.name', nameRead);
     answerIndex += 1;
     const detectedRows = toSiblingRows(detected);
     const needsSiblingAnswer = detected.length === 0 || gaps([...detected]).some(gap => gap.blocking);
@@ -854,7 +878,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
             return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', 'the operator-confirmed sibling declarations are invalid or change detected registry facts', question.field);
         }
         siblingRows = parsed.data;
-        record('sibling', read.provenance);
+        record('sibling', read);
         answerIndex += 1;
     }
     else {
@@ -865,7 +889,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         siblingAnswerRows = detectedRows;
     }
     // Read with the same inference init proposed from, so a defaulted toolchain names the lockfile it overrode.
-    const inference = defaultSource === 'estate' && root ? await deriveInferredFacts({ root: resolve(root, siblingsRoot ?? '.'),
+    inference = defaultSource === 'estate' && root ? await deriveInferredFacts({ root: resolve(root, siblingsRoot ?? '.'),
         configurationRoot: root, repositories: siblingRows.map(row => ({ slug: row.slug, path: row.dir })) }) : undefined;
     if (estateRunnable.length > 0) {
         const dispositionSlugs = estateRunnable.map(row => row.slug);
@@ -917,11 +941,11 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         if (configuration.classification === 'one-sibling'
             && [...runnableResolutions.values()].every(row => !row.runnable))
             return refusal('DOCUMENT_NO_RUNNABLE_PRODUCT', 'the operator-confirmed estate contains no runnable product', question.field);
-        record('estate.runnable', read.provenance);
+        record('estate.runnable', read);
         answerIndex += 1;
     }
     const portQuestion = configurationQuestion(context, 'ports.bases', QUESTION_WHY.ports);
-    const portRead = readConfigurationAnswer(configuration.answers, answerIndex, portQuestion);
+    const portRead = readConfigurationAnswer(configuration.answers, answerIndex, portQuestion, derivedFact('ports.bases'));
     const previewRows = documentedRows(siblingRows);
     const attributions = defaultAttributions(defaults, siblingAnswerRows, detected, root, defaultSource, siblingsRoot, inference);
     if (portRead.kind === 'pending')
@@ -932,7 +956,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
     const parsedPorts = CockpitConfig.shape.ports.safeParse({ ...defaults.ports, bases: portRead.value });
     if (!parsedPorts.success)
         return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the operator-confirmed port bases do not match the schema: ${issueSummary(parsedPorts.error)}`, portQuestion.field);
-    record('ports.bases', portRead.provenance);
+    record('ports.bases', portRead);
     answerIndex += 1;
     let environment = defaults.environment;
     let testData;
@@ -949,7 +973,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         const parsedPolicies = InstallPolicy.array().max(256).safeParse(policyRead.value);
         if (!parsedPolicies.success)
             return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the operator-confirmed install policies do not match the schema: ${issueSummary(parsedPolicies.error)}`, policyQuestion.field);
-        record('environment.install_policies', policyRead.provenance);
+        record('environment.install_policies', policyRead);
         answerIndex += 1;
         if (registrySha256 === null) {
             const testDataQuestion = configurationQuestion(context, 'environment.test_data', QUESTION_WHY.testData);
@@ -967,11 +991,11 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
                 return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', 'the local test-data answer must be exactly { seeded_data: boolean, signed_in_users: boolean }', testDataQuestion.field);
             testData = { seeded_data: value.seeded_data,
                 signed_in_users: value.signed_in_users, provenance: testDataRead.provenance };
-            record('environment.test_data', testDataRead.provenance);
+            record('environment.test_data', testDataRead);
             answerIndex += 1;
         }
         const composeQuestion = configurationQuestion(context, 'environment.compose_files', QUESTION_WHY.composeFiles);
-        const composeRead = readConfigurationAnswer(configuration.answers, answerIndex, composeQuestion);
+        const composeRead = readConfigurationAnswer(configuration.answers, answerIndex, composeQuestion, derivedFact('environment.compose_files'));
         if (composeRead.kind === 'pending')
             return pendingConfiguration({ name, defaults, siblings: previewRows,
                 attributions, gaps: [] }, destination, composeQuestion);
@@ -987,12 +1011,11 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         const defaultIndex = attributions.findIndex(row => row.target === 'environment.compose_files');
         if (defaultIndex >= 0)
             attributions.splice(defaultIndex, 1);
-        record('environment.compose_files', composeRead.provenance);
+        record('environment.compose_files', composeRead);
         answerIndex += 1;
         // Every runtime command refuses a declared runtime with no floor, so a configuration that
-        // declares one is incomplete until the operator states it. Nothing proposes it: Compose
-        // deploy.resources limits are per-container ceilings that most files omit, and docker info
-        // reports this machine's capacity, not what the product needs.
+        // declares one is incomplete until it is answered. The interview proposes memory and CPUs,
+        // but free disk and the cold start time have no source, so the answer is never derived.
         const machineQuestion = configurationQuestion(context, 'environment.machine', QUESTION_WHY.machine);
         const machineRead = readConfigurationAnswer(configuration.answers, answerIndex, machineQuestion);
         if (machineRead.kind === 'pending')
@@ -1004,7 +1027,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         if (!parsedMachine.success)
             return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the operator-confirmed machine floor does not match the schema: ${issueSummary(parsedMachine.error)}`, machineQuestion.field);
         environment = { ...environment, machine: parsedMachine.data };
-        record('environment.machine', machineRead.provenance);
+        record('environment.machine', machineRead);
         answerIndex += 1;
         const postureQuestion = configurationQuestion(context, 'environment.posture', QUESTION_WHY.posture);
         const postureRead = readConfigurationAnswer(configuration.answers, answerIndex, postureQuestion);
@@ -1027,7 +1050,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         if (postureFailures.length > 0)
             return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the operator-confirmed posture would fail preflight: ${postureFailures.map(row => row.reason).join('; ')}`, postureQuestion.field);
         environment = parsedPosture.data;
-        record('environment.posture', postureRead.provenance);
+        record('environment.posture', postureRead);
         answerIndex += 1;
         // Asked, never defaulted: a cockpit with no gate cannot grade work, and "none" is a decision
         // a person makes, not the absence of an answer.
@@ -1049,7 +1072,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
                     ? `: ${issueSummary(parsedTesting.error)}` : ''}`, testingQuestion.field);
             testing = parsedTesting.data;
         }
-        record('testing', testingRead.provenance);
+        record('testing', testingRead);
         answerIndex += 1;
     }
     // Left as schema defaults, both lists are empty and the guard denies nothing by host, which no
@@ -1069,7 +1092,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
         return refusal('DOCUMENT_CONFIGURATION_ANSWER_INVALID', `the operator-confirmed guard hosts must be exactly { hosted_db_hosts, vendor_endpoint_hosts }${parsedGuards
             ? `: ${issueSummary(parsedGuards.error)}` : ''}`, guardQuestion.field);
     const noGuardHosts = parsedGuards.data.hosted_db_hosts.length === 0 && parsedGuards.data.vendor_endpoint_hosts.length === 0;
-    record('guards', guardRead.provenance);
+    record('guards', guardRead);
     answerIndex += 1;
     const candidate = CockpitConfig.safeParse({ ...(unconfirmed.length === 0 ? {} : { unconfirmed: unconfirmed.map(row => row.field) }),
         ...defaults, cockpit: { ...defaults.cockpit, name,
@@ -1083,7 +1106,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
             || configuration.classification === 'incomplete-multi-repository') && candidate.data.sibling.length < 2) {
         return refusal('DOCUMENT_CONFIGURATION_APPLICABILITY_INVALID', 'the sibling declarations do not match the current estate classification', 'sibling');
     }
-    const expectedSha256 = confirmationDigest(attributions);
+    const expectedSha256 = confirmationDigest(attributions.filter(row => confirmedBy(row) === 'person'));
     const defaultsQuestion = configurationQuestion(context, 'configuration.defaults', QUESTION_WHY.defaults, expectedSha256);
     const defaultsRead = readConfigurationAnswer(configuration.answers, answerIndex, defaultsQuestion);
     if (defaultsRead.kind === 'pending')
@@ -1114,12 +1137,12 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
                     : 'signed-in users: required but unresolved; declare seeded personas and browser authentication states before claiming signed-in testing'
                 : `signed-in users: not declared because ${STATED_BY[testData.provenance]} this local setup does not need them`] : []),
     ];
-    const artifact = renderCompleteDocument(candidate.data, SCHEMA_DIRECTIVE, decisions, unconfirmed);
+    const artifact = renderCompleteDocument(candidate.data, SCHEMA_DIRECTIVE, decisions, unconfirmed, derived);
     const diagnostics = diagnosticsFor(attributions, []);
     for (const row of unconfirmed)
         diagnostics.push({ severity: 'warning', code: 'DOCUMENT_ANSWER_UNCONFIRMED', target: row.field,
             message: `${unconfirmedReason(row)}, so cockpit.toml lists it under unconfirmed and doctor warns until a person confirms it`,
-            fix: UNCONFIRMED_FIX });
+            fix: unconfirmedFix([row.field]) });
     if (noGuardHosts)
         diagnostics.push({ severity: 'info', code: 'DOCUMENT_GUARD_HOSTS_NONE', target: 'guards',
             message: `${noGuardHostsDecision(guardRead.provenance)}, so the guard denies no command by host`,
@@ -1129,7 +1152,7 @@ async function completeConfigurationDocument(input, root, registrySha256, detect
             message: 'no runnable product was observed, so this configuration declares no runtime environment and no Compose file: sync publishes the harness surfaces only, and up, logs and the other runtime commands refuse',
             fix: 'once a product runs, declare environment.compose_files and run npx --no cockpit sync --config <your cockpit.toml>' });
     return { kind: 'complete', artifact, destination, diagnostics,
-        result: { document: artifact, ...(unconfirmed.length === 0 ? {} : { unconfirmed: unconfirmed }) },
+        result: { document: artifact, ...(unconfirmed.length === 0 ? {} : { unconfirmed }), ...(derived.length === 0 ? {} : { derived }) },
         status: 0, question: null };
 }
 export async function draftFromRegistry(input, estateGaps = [], estateRunnable = []) {