@bneb/b4mal 0.1.1 → 0.1.2

package/dist/index.js

@@ -875,6 +875,34 @@ class ArtifactVault {
       if (decompressCode !== 0) {
         throw new Error(`Unpack failed: zstd exited ${decompressCode} (${decompressErr.trim()})`);
       }
+      const typedListProc = Bun.spawn(["tar", "-tvf", tarPath], {
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      const typedList = await new Response(typedListProc.stdout).text();
+      const typedCode = await typedListProc.exited;
+      if (typedCode !== 0) {
+        const typedErr = await new Response(typedListProc.stderr).text();
+        throw new Error(`Unpack failed: could not list archive types (${typedErr.trim()})`);
+      }
+      const TYPE_LABELS = {
+        l: "symlink",
+        h: "hard link",
+        b: "block device",
+        c: "character device",
+        p: "FIFO",
+        s: "socket"
+      };
+      for (const line of typedList.split(`
+`)) {
+        if (!line.trim())
+          continue;
+        const type = line[0];
+        if (type === "-" || type === "d")
+          continue;
+        const kind = TYPE_LABELS[type] ?? `unrecognised (${JSON.stringify(type)})`;
+        throw new Error(`Unpack rejected: archive contains a ${kind} entry: ${line.slice(0, 120)}`);
+      }
       const listProc = Bun.spawn(["tar", "-tf", tarPath], {
         stdout: "pipe",
         stderr: "pipe"
@@ -1621,279 +1649,301 @@ var init_sqlite_ledger = () => {};
 import { join as join8 } from "path";
 import { existsSync as existsSync5 } from "fs";
 import { cpus } from "os";
-
-class DynamicExecutor {
-  static async run(dag, config) {
-    const ledger = config?.projectRoot ? new SQLiteLedger(join8(config.projectRoot, ".b4mal", "cache.db")) : undefined;
-    const concurrency = config?.concurrency ?? cpus().length;
-    const inDegree = new Map(dag.inDegree);
-    const readyQueue = [];
-    for (const [id, count] of inDegree.entries()) {
-      if (count === 0)
-        readyQueue.push(id);
-    }
-    let activeCount = 0;
-    const totalTasks = dag.tasks.size;
-    if (totalTasks === 0) {
-      ledger?.close();
-      return [];
-    }
-    return new Promise((resolve2) => {
-      const settled = new Map;
-      let resolved = false;
-      const settleIfComplete = () => {
-        if (resolved || settled.size < totalTasks)
-          return;
-        resolved = true;
+var DynamicExecutor;
+var init_executor = __esm(() => {
+  init_stream_engine();
+  init_env_sanitizer();
+  init_artifact_vault();
+  init_cache_key();
+  init_sqlite_ledger();
+  DynamicExecutor = class DynamicExecutor {
+    static warnedAboutWhenIf = new Set;
+    static async run(dag, config) {
+      const ledger = config?.projectRoot ? new SQLiteLedger(join8(config.projectRoot, ".b4mal", "cache.db")) : undefined;
+      const concurrency = config?.concurrency ?? cpus().length;
+      const inDegree = new Map(dag.inDegree);
+      const readyQueue = [];
+      for (const [id, count] of inDegree.entries()) {
+        if (count === 0)
+          readyQueue.push(id);
+      }
+      let activeCount = 0;
+      const totalTasks = dag.tasks.size;
+      if (totalTasks === 0) {
         ledger?.close();
-        resolve2([...settled.values()]);
-      };
-      const skipDependentsOf = (failedId) => {
-        const stack = [failedId];
-        while (stack.length > 0) {
-          const current = stack.pop();
-          for (const dependent of dag.dependents.get(current) ?? []) {
-            if (settled.has(dependent))
-              continue;
-            settled.set(dependent, {
-              taskId: dependent,
-              exitCode: 1,
-              stdout: "",
-              stderr: `Skipped: dependency '${current}' failed.`,
-              durationMs: 0,
-              cached: false,
-              skipped: true
-            });
-            stack.push(dependent);
-          }
-        }
-      };
-      const dispatch = async () => {
-        while (readyQueue.length > 0 && activeCount < concurrency) {
-          let taskId;
-          if (config?.chaos) {
-            const randomIndex = Math.floor(Math.random() * readyQueue.length);
-            taskId = readyQueue.splice(randomIndex, 1)[0];
-          } else {
-            taskId = readyQueue.shift();
+        return [];
+      }
+      return new Promise((resolve2) => {
+        const settled = new Map;
+        let resolved = false;
+        const settleIfComplete = () => {
+          if (resolved || settled.size < totalTasks)
+            return;
+          resolved = true;
+          ledger?.close();
+          resolve2([...settled.values()]);
+        };
+        const skipDependentsOf = (failedId) => {
+          const stack = [failedId];
+          while (stack.length > 0) {
+            const current = stack.pop();
+            for (const dependent of dag.dependents.get(current) ?? []) {
+              if (settled.has(dependent))
+                continue;
+              settled.set(dependent, {
+                taskId: dependent,
+                exitCode: 1,
+                stdout: "",
+                stderr: `Skipped: dependency '${current}' failed.`,
+                durationMs: 0,
+                cached: false,
+                skipped: true
+              });
+              stack.push(dependent);
+            }
           }
-          if (settled.has(taskId))
-            continue;
-          const task = dag.tasks.get(taskId);
-          activeCount++;
-          this.executeTask(task, config, ledger).then((result) => {
-            settled.set(taskId, result);
-          }).catch((err) => {
-            const message = err instanceof Error ? err.message : String(err);
-            settled.set(taskId, {
-              taskId,
-              exitCode: 1,
-              stdout: "",
-              stderr: message,
-              durationMs: 0,
-              cached: false
-            });
-          }).finally(() => {
-            activeCount--;
-            const result = settled.get(taskId);
-            const failed = !result || result.exitCode !== 0;
-            if (failed) {
-              skipDependentsOf(taskId);
+        };
+        const dispatch = async () => {
+          while (readyQueue.length > 0 && activeCount < concurrency) {
+            let taskId;
+            if (config?.chaos) {
+              const randomIndex = Math.floor(Math.random() * readyQueue.length);
+              taskId = readyQueue.splice(randomIndex, 1)[0];
             } else {
-              for (const dependent of dag.dependents.get(taskId) || []) {
-                const currentCount = inDegree.get(dependent) - 1;
-                inDegree.set(dependent, currentCount);
-                if (currentCount === 0) {
-                  readyQueue.push(dependent);
+              taskId = readyQueue.shift();
+            }
+            if (settled.has(taskId))
+              continue;
+            const task = dag.tasks.get(taskId);
+            activeCount++;
+            this.executeTask(task, config, ledger).then((result) => {
+              settled.set(taskId, result);
+            }).catch((err) => {
+              const message = err instanceof Error ? err.message : String(err);
+              settled.set(taskId, {
+                taskId,
+                exitCode: 1,
+                stdout: "",
+                stderr: message,
+                durationMs: 0,
+                cached: false
+              });
+            }).finally(() => {
+              activeCount--;
+              const result = settled.get(taskId);
+              const failed = !result || result.exitCode !== 0;
+              if (failed) {
+                skipDependentsOf(taskId);
+              } else {
+                for (const dependent of dag.dependents.get(taskId) || []) {
+                  const currentCount = inDegree.get(dependent) - 1;
+                  inDegree.set(dependent, currentCount);
+                  if (currentCount === 0) {
+                    readyQueue.push(dependent);
+                  }
                 }
               }
-            }
-            StreamEngine.broadcast("wave_complete", {
-              depth: 0,
-              tasks: 1,
-              durationMs: 0,
-              taskIds: [taskId]
+              StreamEngine.broadcast("wave_complete", {
+                depth: 0,
+                tasks: 1,
+                durationMs: 0,
+                taskIds: [taskId]
+              });
+              settleIfComplete();
+              if (!resolved)
+                dispatch();
             });
-            settleIfComplete();
-            if (!resolved)
-              dispatch();
-          });
-        }
-      };
-      try {
-        dispatch();
-      } catch (err) {
-        ledger?.close();
-        throw err;
-      }
-    });
-  }
-  static async executeTask(task, config, ledger) {
-    const projectRoot = config?.projectRoot;
-    const envClaims = task.claims.filter((c) => c.startsWith("env:")).map((c) => c.replace(/^env:/, ""));
-    const requestedEnv = [...new Set([...envClaims, ...task.envReads ?? []])];
-    const writes = task.writes ?? [];
-    const producesArtifact = writes.length > 0;
-    const logicHash = projectRoot ? await computeCacheKey({
-      id: task.id,
-      cmd: task.cmd,
-      reads: task.reads,
-      writes: task.writes,
-      claims: task.claims,
-      envReads: task.envReads
-    }, projectRoot) : undefined;
-    const skipCache = config?.force === true;
-    if (!skipCache && logicHash && config?.remoteVault && projectRoot) {
-      try {
-        const l2Result = await config.remoteVault.checkAndPull(logicHash, projectRoot);
-        if (l2Result) {
-          return {
-            taskId: task.id,
-            exitCode: l2Result.exitCode ?? 0,
-            stdout: "[L2 cache hit \u2014 restored from remote vault]",
-            stderr: "",
-            durationMs: l2Result.durationMs ?? 0,
-            cached: true
-          };
+          }
+        };
+        try {
+          dispatch();
+        } catch (err) {
+          ledger?.close();
+          throw err;
         }
-      } catch (err) {
-        process.stderr.write(`\x1B[2m[L2] pull failed: ${err?.message || err}\x1B[0m
-`);
-      }
+      });
     }
-    if (!skipCache && logicHash && ledger) {
-      const entry = ledger.getEntry(logicHash);
-      if (entry) {
-        const needsArtifact = producesArtifact;
-        const hasArtifact = !needsArtifact || ArtifactVault.hasArtifact(logicHash, projectRoot);
-        if (hasArtifact) {
-          const start2 = performance.now();
-          if (needsArtifact && projectRoot) {
-            await ArtifactVault.unpack(logicHash, projectRoot);
+    static async executeTask(task, config, ledger) {
+      const projectRoot = config?.projectRoot;
+      const envClaims = task.claims.filter((c) => c.startsWith("env:")).map((c) => c.replace(/^env:/, ""));
+      const requestedEnv = [...new Set([...envClaims, ...task.envReads ?? []])];
+      const writes = task.writes ?? [];
+      const producesArtifact = writes.length > 0;
+      const logicHash = projectRoot ? await computeCacheKey({
+        id: task.id,
+        cmd: task.cmd,
+        reads: task.reads,
+        writes: task.writes,
+        claims: task.claims,
+        envReads: task.envReads
+      }, projectRoot) : undefined;
+      const skipCache = config?.force === true;
+      if (task.when) {
+        const w = task.when;
+        if (w.if) {
+          if (!DynamicExecutor.warnedAboutWhenIf.has(task.id)) {
+            DynamicExecutor.warnedAboutWhenIf.add(task.id);
+            process.stderr.write(`\x1B[2m[when] '${task.id}' sets when.if, which is not implemented \u2014 ` + `the condition is ignored and the task will run.\x1B[0m
+`);
           }
-          return {
-            taskId: task.id,
-            exitCode: 0,
-            stdout: entry.stdout ?? "[L1 cache hit \u2014 restored from local vault]",
-            stderr: entry.stderr ?? "",
-            durationMs: entry.durationMs ?? performance.now() - start2,
-            cached: true
-          };
         }
-      }
-    }
-    if (task.when) {
-      const w = task.when;
-      if (w.platform && !w.platform.includes(process.platform)) {
-        return {
-          taskId: task.id,
-          exitCode: 0,
-          stdout: `[skipped \u2014 platform ${process.platform} not in ${w.platform}]`,
-          stderr: "",
-          durationMs: 0,
-          cached: true
-        };
-      }
-      if (w.branch) {
-        const branch = process.env.GIT_BRANCH || process.env.CI_COMMIT_BRANCH || "";
-        const matches = branch === w.branch || new RegExp(`^${w.branch.replace(/\*/g, ".*")}$`).test(branch);
-        if (branch && !matches) {
+        if (w.platform && !w.platform.includes(process.platform)) {
           return {
             taskId: task.id,
             exitCode: 0,
-            stdout: `[skipped \u2014 branch "${branch}" doesn't match "${w.branch}"]`,
+            stdout: `[skipped \u2014 platform ${process.platform} not in ${w.platform}]`,
             stderr: "",
             durationMs: 0,
-            cached: true
+            cached: false,
+            skippedByCondition: true
           };
         }
-      }
-    }
-    const start = performance.now();
-    const sanitizedEnv = EnvSanitizer.sanitize(requestedEnv, process.env);
-    const secrets = task.secrets;
-    if (secrets && secrets.length > 0) {
-      for (const name of secrets) {
-        const val = process.env[name];
-        if (val !== undefined) {
-          sanitizedEnv[name] = val;
+        if (w.branch) {
+          const branch = process.env.GIT_BRANCH || process.env.CI_COMMIT_BRANCH || "";
+          const matches = branch === w.branch || new RegExp(`^${w.branch.replace(/\*/g, ".*")}$`).test(branch);
+          if (branch && !matches) {
+            return {
+              taskId: task.id,
+              exitCode: 0,
+              stdout: `[skipped \u2014 branch "${branch}" doesn't match "${w.branch}"]`,
+              stderr: "",
+              durationMs: 0,
+              cached: false,
+              skippedByCondition: true
+            };
+          }
         }
       }
-    }
-    let finalCmd = task.cmd;
-    const proc = Bun.spawn(finalCmd, {
-      cwd: projectRoot,
-      stdout: "pipe",
-      stderr: "pipe",
-      env: sanitizedEnv
-    });
-    const exitCode = await proc.exited;
-    const durationMs = performance.now() - start;
-    const maxLogSize = 100 * 1024;
-    const rawStdout = await new Response(proc.stdout).text();
-    const rawStderr = await new Response(proc.stderr).text();
-    const stdout = rawStdout.length > maxLogSize ? rawStdout.slice(-maxLogSize) : rawStdout;
-    const stderr = rawStderr.length > maxLogSize ? rawStderr.slice(-maxLogSize) : rawStderr;
-    if (exitCode === 0 && logicHash) {
-      let cacheable = true;
-      if (projectRoot && producesArtifact) {
-        const missing = writes.filter((w) => !existsSync5(join8(projectRoot, w)));
-        if (missing.length > 0) {
-          cacheable = false;
-          process.stderr.write(`\x1B[2m[Cache] '${task.id}' declared output(s) not produced: ` + `${missing.join(", ")} \u2014 task will not be cached.\x1B[0m
-`);
-        } else {
-          try {
-            await ArtifactVault.pack(logicHash, projectRoot, writes);
-          } catch (err) {
-            cacheable = false;
-            process.stderr.write(`\x1B[2m[Cache] pack failed for '${task.id}': ${err instanceof Error ? err.message : err}\x1B[0m
+      if (!skipCache && logicHash && config?.remoteVault && projectRoot) {
+        try {
+          const l2Result = await config.remoteVault.checkAndPull(logicHash, projectRoot);
+          if (l2Result) {
+            if (producesArtifact) {
+              await ArtifactVault.unpack(logicHash, projectRoot);
+            }
+            ledger?.recordEntry({
+              logicHash,
+              taskId: task.id,
+              action: "l2-hit",
+              timestamp: Date.now(),
+              stdout: "[L2 cache hit \u2014 restored from remote vault]",
+              stderr: "",
+              durationMs: l2Result.durationMs ?? 0,
+              exitCode: l2Result.exitCode ?? 0
+            });
+            return {
+              taskId: task.id,
+              exitCode: l2Result.exitCode ?? 0,
+              stdout: "[L2 cache hit \u2014 restored from remote vault]",
+              stderr: "",
+              durationMs: l2Result.durationMs ?? 0,
+              cached: true
+            };
+          }
+        } catch (err) {
+          process.stderr.write(`\x1B[2m[L2] pull failed: ${err?.message || err}\x1B[0m
 `);
+        }
+      }
+      if (!skipCache && logicHash && ledger) {
+        const entry = ledger.getEntry(logicHash);
+        if (entry) {
+          const needsArtifact = producesArtifact;
+          const hasArtifact = !needsArtifact || ArtifactVault.hasArtifact(logicHash, projectRoot);
+          if (hasArtifact) {
+            const start2 = performance.now();
+            if (needsArtifact && projectRoot) {
+              await ArtifactVault.unpack(logicHash, projectRoot);
+            }
+            return {
+              taskId: task.id,
+              exitCode: 0,
+              stdout: entry.stdout ?? "[L1 cache hit \u2014 restored from local vault]",
+              stderr: entry.stderr ?? "",
+              durationMs: entry.durationMs ?? performance.now() - start2,
+              cached: true
+            };
           }
         }
       }
-      if (cacheable) {
-        ledger?.recordEntry({
-          logicHash,
-          taskId: task.id,
-          action: "execute",
-          timestamp: Date.now(),
-          stdout: stdout.trim(),
-          stderr: stderr.trim(),
-          durationMs
-        });
+      const start = performance.now();
+      const sanitizedEnv = EnvSanitizer.sanitize(requestedEnv, process.env);
+      const secrets = task.secrets;
+      if (secrets && secrets.length > 0) {
+        for (const name of secrets) {
+          const val = process.env[name];
+          if (val !== undefined) {
+            sanitizedEnv[name] = val;
+          }
+        }
       }
-      if (projectRoot && config?.remoteVault) {
-        try {
-          await config.remoteVault.pushWithMetadata(logicHash, projectRoot, {
+      let finalCmd = task.cmd;
+      const proc = Bun.spawn(finalCmd, {
+        cwd: projectRoot,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: sanitizedEnv
+      });
+      const exitCode = await proc.exited;
+      const durationMs = performance.now() - start;
+      const maxLogSize = 100 * 1024;
+      const rawStdout = await new Response(proc.stdout).text();
+      const rawStderr = await new Response(proc.stderr).text();
+      const stdout = rawStdout.length > maxLogSize ? rawStdout.slice(-maxLogSize) : rawStdout;
+      const stderr = rawStderr.length > maxLogSize ? rawStderr.slice(-maxLogSize) : rawStderr;
+      if (exitCode === 0 && logicHash) {
+        let cacheable = true;
+        if (projectRoot && producesArtifact) {
+          const missing = writes.filter((w) => !existsSync5(join8(projectRoot, w)));
+          if (missing.length > 0) {
+            cacheable = false;
+            process.stderr.write(`\x1B[2m[Cache] '${task.id}' declared output(s) not produced: ` + `${missing.join(", ")} \u2014 task will not be cached.\x1B[0m
+`);
+          } else {
+            try {
+              await ArtifactVault.pack(logicHash, projectRoot, writes);
+            } catch (err) {
+              cacheable = false;
+              process.stderr.write(`\x1B[2m[Cache] pack failed for '${task.id}': ${err instanceof Error ? err.message : err}\x1B[0m
+`);
+            }
+          }
+        }
+        if (cacheable) {
+          ledger?.recordEntry({
             logicHash,
             taskId: task.id,
-            exitCode,
-            durationMs,
-            signature: null
+            action: "execute",
+            timestamp: Date.now(),
+            stdout: stdout.trim(),
+            stderr: stderr.trim(),
+            durationMs
           });
-        } catch (err) {
-          process.stderr.write(`\x1B[2m[L2] push failed: ${err?.message || err}\x1B[0m
+        }
+        if (projectRoot && config?.remoteVault) {
+          try {
+            await config.remoteVault.pushWithMetadata(logicHash, projectRoot, {
+              logicHash,
+              taskId: task.id,
+              exitCode,
+              durationMs
+            });
+          } catch (err) {
+            process.stderr.write(`\x1B[2m[L2] push failed: ${err?.message || err}\x1B[0m
 `);
+          }
         }
       }
+      return {
+        taskId: task.id,
+        exitCode,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+        durationMs,
+        cached: false
+      };
     }
-    return {
-      taskId: task.id,
-      exitCode,
-      stdout: stdout.trim(),
-      stderr: stderr.trim(),
-      durationMs,
-      cached: false
-    };
-  }
-}
-var init_executor = __esm(() => {
-  init_stream_engine();
-  init_env_sanitizer();
-  init_artifact_vault();
-  init_cache_key();
-  init_sqlite_ledger();
+  };
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -6340,9 +6390,55 @@ var init_s3_adapter = __esm(() => {
   HASH_RE = /^[a-zA-Z0-9_.-]+$/;
 });
 
+// src/core/crypto.ts
+import { timingSafeEqual } from "crypto";
+
+class ArtifactCrypto {
+  secretKey;
+  constructor(secretKey = Bun.env.B4MAL_CACHE_SECRET ?? null) {
+    this.secretKey = secretKey && secretKey.length > 0 ? secretKey : null;
+  }
+  get isEnabled() {
+    return this.secretKey !== null;
+  }
+  sign(contentHash) {
+    if (!this.secretKey)
+      return null;
+    const hasher = new Bun.CryptoHasher("sha256", this.secretKey);
+    hasher.update(contentHash);
+    return hasher.digest("hex");
+  }
+  verify(contentHash, signature) {
+    if (!this.secretKey)
+      return true;
+    if (!signature)
+      return false;
+    const expected = this.sign(contentHash);
+    if (!expected)
+      return false;
+    const expectedBuf = Buffer.from(expected, "hex");
+    const actualBuf = Buffer.from(signature, "hex");
+    if (expectedBuf.length !== actualBuf.length)
+      return false;
+    return timingSafeEqual(expectedBuf, actualBuf);
+  }
+}
+var init_crypto = () => {};
+
 // src/core/remote_vault.ts
 import { join as join9 } from "path";
 import { existsSync as existsSync6, mkdirSync as mkdirSync3, writeFileSync, readFileSync as readFileSync2, unlinkSync as unlinkSync2 } from "fs";
+function sha256Hex(data) {
+  const buf = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
+  return new Bun.CryptoHasher("sha256").update(buf).digest("hex");
+}
+function stableMetadataJson(metadata) {
+  const { signature: _signature, ...rest } = metadata;
+  return JSON.stringify(rest, Object.keys(rest).sort());
+}
+function signedInput(logicHash, payload, metadata) {
+  return `${logicHash}:${sha256Hex(payload)}:${sha256Hex(stableMetadataJson(metadata))}`;
+}
 function embedMetadata(data, metadata) {
   const jsonStr = JSON.stringify(metadata);
   const jsonBytes = Buffer.from(jsonStr, "utf-8");
@@ -6366,10 +6462,13 @@ function parseEmbeddedMetadata(data) {
 
 class RemoteVault {
   adapter;
+  crypto;
   lastPromoted = null;
+  rejected = 0;
   stats = { pushes: 0, pulls: 0, hits: 0, bytesUp: 0, bytesDown: 0 };
-  constructor(adapter) {
+  constructor(adapter, crypto = new ArtifactCrypto) {
     this.adapter = adapter;
+    this.crypto = crypto;
   }
   async checkAndPull(logicHash, projectRoot) {
     if (!this.adapter)
@@ -6387,10 +6486,20 @@ class RemoteVault {
       if (!pulled)
         return null;
       const rawData = await Bun.file(tmpPath).arrayBuffer();
-      const metadata = parseEmbeddedMetadata(Buffer.from(rawData));
+      const payload = Buffer.from(rawData);
+      const metadata = parseEmbeddedMetadata(payload);
       if (!metadata) {
         return null;
       }
+      const headerLen = payload.readUInt32LE(0);
+      const archiveBytes = payload.subarray(4 + headerLen);
+      const signatureValid = this.crypto.verify(signedInput(logicHash, archiveBytes, metadata), metadata.signature ?? undefined);
+      if (!signatureValid) {
+        this.rejected++;
+        process.stderr.write(`\x1B[2m[L2] rejected artifact for ${logicHash.slice(0, 12)}\u2026: ` + `signature missing or invalid \u2014 re-executing\x1B[0m
+`);
+        return null;
+      }
       this.promoteToL1(logicHash, tmpPath, projectRoot);
       this.lastPromoted = logicHash;
       this.stats.hits++;
@@ -6415,8 +6524,10 @@ class RemoteVault {
       const l1Path = ArtifactVault.getArchivePath(logicHash, projectRoot);
       if (!existsSync6(l1Path))
         return false;
-      const rawData = await Bun.file(l1Path).arrayBuffer();
-      const archiveWithMeta = embedMetadata(Buffer.from(rawData), metadata);
+      const rawData = Buffer.from(await Bun.file(l1Path).arrayBuffer());
+      const metaBase = { ...metadata, logicHash };
+      const signature = this.crypto.sign(signedInput(logicHash, rawData, metaBase));
+      const archiveWithMeta = embedMetadata(rawData, { ...metaBase, signature });
       const tmpPath = join9(projectRoot, ".b4mal", `l2-push-${logicHash}.tmp`);
       writeFileSync(tmpPath, new Uint8Array(archiveWithMeta));
       const result = await this.adapter.push(logicHash, tmpPath);
@@ -6452,6 +6563,7 @@ class RemoteVault {
 }
 var init_remote_vault = __esm(() => {
   init_artifact_vault();
+  init_crypto();
 });
 
 // src/core/engine.ts
@@ -6530,6 +6642,14 @@ class B4malEngine {
     }));
     writeFileSync2(this.lockPath, JSON.stringify(tasks, null, 2), "utf-8");
   }
+  readLockfile() {
+    const text = readFileSync3(this.lockPath, "utf-8");
+    try {
+      return JSON.parse(text);
+    } catch (e) {
+      throw new Error(`Failed to parse b4mal.lock: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
   normalizeLockTasks(raw) {
     let entries;
     if (Array.isArray(raw)) {
@@ -6537,21 +6657,32 @@ class B4malEngine {
     } else {
       entries = raw.tasks ?? [];
     }
-    return entries.map((t) => ({
-      id: String(t.id ?? ""),
-      cmd: t.cmd ?? [],
-      dependencies: t.deps ?? t.dependencies ?? [],
-      inputs: t.reads ?? t.inputs ?? [],
-      outputs: t.writes ?? t.outputs ?? [],
-      claims: t.claims ?? [],
-      needsEnv: t.envReads ?? t.needsEnv ?? [],
-      providesEnv: t.envWrites ?? t.providesEnv ?? [],
-      secrets: t.secrets ?? [],
-      env: t.env ?? {},
-      cwd: t.cwd,
-      timeout: t.timeout ?? 300000,
-      cache: t.cache ?? true
-    }));
+    return entries.map((t, index) => {
+      const id = String(t?.id ?? "").trim();
+      if (!id) {
+        throw new Error(`Invalid b4mal.lock: task at index ${index} has no "id".`);
+      }
+      const cmd = t.cmd;
+      if (!Array.isArray(cmd) || cmd.length === 0 || cmd.some((c) => typeof c !== "string")) {
+        throw new Error(`Invalid b4mal.lock: task "${id}" must have a non-empty "cmd" array of strings.`);
+      }
+      return {
+        id,
+        cmd,
+        dependencies: t.deps ?? t.dependencies ?? [],
+        inputs: t.reads ?? t.inputs ?? [],
+        outputs: t.writes ?? t.outputs ?? [],
+        claims: t.claims ?? [],
+        needsEnv: t.envReads ?? t.needsEnv ?? [],
+        providesEnv: t.envWrites ?? t.providesEnv ?? [],
+        secrets: t.secrets ?? [],
+        env: t.env ?? {},
+        cwd: t.cwd,
+        timeout: t.timeout ?? 300000,
+        cache: t.cache ?? true,
+        when: t.when
+      };
+    });
   }
   createRemoteVault() {
     const bucket = process.env.B4MAL_CACHE_BUCKET;
@@ -6587,7 +6718,7 @@ class B4malEngine {
       throw new Error(`No b4mal.lock found. Run 'b4mal init' first.
   Docs: https://github.com/bneb/b4mal/blob/main/docs/guide/getting-started.md`);
     }
-    const raw = JSON.parse(readFileSync3(this.lockPath, "utf-8"));
+    const raw = this.readLockfile();
     const lockTasks = this.normalizeLockTasks(raw);
     const tasks = lockTasks.map((t) => ({
       id: t.id,
@@ -6625,7 +6756,7 @@ class B4malEngine {
       throw new Error(`No b4mal.lock found. Run 'b4mal init' first. (Looked for: ${this.lockPath})
   Docs: https://github.com/bneb/b4mal/blob/main/docs/guide/getting-started.md`);
     }
-    const raw = JSON.parse(readFileSync3(this.lockPath, "utf-8"));
+    const raw = this.readLockfile();
     const lockTasks = this.normalizeLockTasks(raw);
     const tasks = lockTasks.map((t) => ({
       id: t.id,
@@ -6696,7 +6827,7 @@ class B4malEngine {
     if (!existsSync7(this.lockPath)) {
       throw new Error(`No b4mal.lock found.`);
     }
-    const raw = JSON.parse(readFileSync3(this.lockPath, "utf-8"));
+    const raw = this.readLockfile();
     const lockTasks = this.normalizeLockTasks(raw);
     const claims = lockTasks.map((t) => ({
       id: t.id,
@@ -6715,7 +6846,7 @@ class B4malEngine {
       throw new Error(`No b4mal.lock found. Run 'b4mal init' first.
   Docs: https://github.com/bneb/b4mal/blob/main/docs/guide/getting-started.md`);
     }
-    const raw = JSON.parse(readFileSync3(this.lockPath, "utf-8"));
+    const raw = this.readLockfile();
     const lockTasks = this.normalizeLockTasks(raw);
     const tasks = lockTasks.map((t) => ({
       id: t.id,
@@ -10508,24 +10639,35 @@ function findLineForConflict(text, conflict) {
 }
 async function validateDocument(uri, text) {
   try {
-    const tasksRaw = JSON.parse(text);
-    if (!Array.isArray(tasksRaw))
-      return;
-    const tasks = tasksRaw.map((t) => ({
-      id: t.id || "unknown",
-      reads: t.reads || [],
-      writes: t.writes || [],
-      envReads: t.envReads || [],
-      envWrites: t.envWrites || [],
-      claims: t.claims || []
-    }));
-    const result = await FormalShadow.verifyWave(tasks);
-    const diagnostics = result.conflicts.map((conflict) => ({
-      range: { start: { line: findLineForConflict(text, conflict), character: 0 }, end: { line: findLineForConflict(text, conflict), character: 100 } },
-      severity: 1,
-      source: "b4mal",
-      message: `Resource Collision: Task ${conflict.taskA} and ${conflict.taskB} concurrently claim ${conflict.counterexample}`
-    }));
+    const parsed = JSON.parse(text);
+    const raw = Array.isArray(parsed) ? parsed : Object.entries(parsed?.tasks ?? {}).map(([id, t]) => ({ id, ...t }));
+    const deps = new Map;
+    const tasks = raw.map((t) => {
+      const id = String(t.id ?? "unknown");
+      deps.set(id, t.dependencies ?? t.deps ?? []);
+      return {
+        id,
+        reads: t.reads ?? t.inputs ?? [],
+        writes: t.writes ?? t.outputs ?? [],
+        envReads: t.envReads ?? t.needsEnv ?? [],
+        envWrites: t.envWrites ?? t.providesEnv ?? [],
+        claims: t.claims ?? []
+      };
+    });
+    const shadows = await FormalShadow.detectShadowing(tasks, deps);
+    const diagnostics = shadows.map((shadow) => {
+      const resource = shadow.resources?.[0] ?? shadow.counterexample;
+      const message = shadow.kind === "implicit-dependency" ? `${shadow.taskB} reads ${resource} produced by ${shadow.taskA} \u2014 no dependency edge is declared` : `${shadow.taskB} masks ${shadow.taskA} at ${resource} \u2014 the overwrite is ${shadow.ordering === "implicit" ? "not declared" : "declared"}`;
+      return {
+        range: {
+          start: { line: findLineForConflict(text, shadow), character: 0 },
+          end: { line: findLineForConflict(text, shadow), character: 100 }
+        },
+        severity: 2,
+        source: "b4mal",
+        message
+      };
+    });
     sendMessage({ jsonrpc: "2.0", method: "textDocument/publishDiagnostics", params: { uri, diagnostics } });
   } catch {}
 }
@@ -10584,332 +10726,38 @@ var init_server = __esm(() => {
   MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
-// src/schema.ts
-function sanitizePath(p) {
-  if (p.startsWith("/")) {
-    throw new Error(`Absolute paths not allowed: "${p}"`);
-  }
-  if (p.split("/").some((seg) => seg === "..")) {
-    throw new Error(`Path traversal not allowed: "${p}"`);
-  }
-  return p.replace(/\\/g, "/");
-}
-function validTaskIds(tasks) {
-  return Object.keys(tasks).every((k) => VALID_TASK_ID.test(k));
-}
-function allDepsResolve(tasks) {
-  const ids = new Set(Object.keys(tasks));
-  for (const task of Object.values(tasks)) {
-    for (const dep of task.dependencies) {
-      if (!ids.has(dep))
-        return false;
+// src/cli/remote.ts
+var exports_remote = {};
+__export(exports_remote, {
+  RemoteCommand: () => RemoteCommand
+});
+
+class RemoteCommand {
+  static async execute(args) {
+    const sub = args[0];
+    if (sub === "status" || !sub) {
+      await this.status();
+    } else {
+      process.stderr.write(`${c3.red}[FAIL] Unknown remote command: ${sub}. Try: b4mal remote status${c3.reset}
+`);
+      process.exit(1);
     }
   }
-  return true;
-}
-function cartesianSize(matrix) {
-  let size = 1;
-  for (const vals of Object.values(matrix)) {
-    size *= vals.length;
-  }
-  return size;
-}
-function hasNoCycles(tasks) {
-  const WHITE = 0, GRAY = 1, BLACK = 2;
-  const color = new Map;
-  for (const id of Object.keys(tasks))
-    color.set(id, WHITE);
-  function dfs(id) {
-    const c3 = color.get(id);
-    if (c3 === GRAY)
-      return false;
-    if (c3 === BLACK)
-      return true;
-    color.set(id, GRAY);
-    for (const dep of tasks[id]?.dependencies ?? []) {
-      if (!dfs(dep))
-        return false;
-    }
-    color.set(id, BLACK);
-    return true;
-  }
-  for (const id of color.keys()) {
-    if (color.get(id) === WHITE && !dfs(id))
-      return false;
-  }
-  return true;
-}
-var TaskConfigSchema, VALID_TASK_ID, B4malConfigSchema, TaskSchema, PipelineSchema;
-var init_schema = __esm(() => {
-  init_zod();
-  TaskConfigSchema = exports_external.object({
-    cmd: exports_external.array(exports_external.string()).min(1, "cmd must contain at least one element"),
-    dependencies: exports_external.array(exports_external.string()).default([]),
-    inputs: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map(sanitizePath)),
-    outputs: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map(sanitizePath)),
-    claims: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map((c3) => c3.startsWith("fs:") ? `fs:${sanitizePath(c3.slice(3))}` : c3)),
-    needsEnv: exports_external.array(exports_external.string()).default([]),
-    providesEnv: exports_external.array(exports_external.string()).default([]),
-    secrets: exports_external.array(exports_external.string()).default([]),
-    when: exports_external.object({
-      branch: exports_external.string().optional().describe("Glob pattern for branch name"),
-      platform: exports_external.array(exports_external.string()).optional().describe("OS platforms to run on"),
-      if: exports_external.string().optional().describe("Arbitrary condition expression")
-    }).optional(),
-    matrix: exports_external.record(exports_external.array(exports_external.string()).max(10)).optional().refine((m) => !m || Object.keys(m).length <= 4, "Max 4 matrix axes").refine((m) => !m || cartesianSize(m) <= 256, "Max 256 matrix combinations"),
-    env: exports_external.record(exports_external.string()).default({}),
-    cwd: exports_external.string().optional().transform((p) => p ? p.replace(/\\/g, "/") : p).refine((p) => !p || !p.startsWith("/") && !p.split("/").some((seg) => seg === ".."), "cwd must be a relative path within the project root"),
-    timeout: exports_external.number().int().nonnegative().max(3600000).transform((t) => t === 0 ? 300000 : t).default(300000),
-    cache: exports_external.boolean().default(true)
-  });
-  VALID_TASK_ID = /^[a-zA-Z0-9_-]+$/;
-  B4malConfigSchema = exports_external.object({
-    name: exports_external.string().optional(),
-    tasks: exports_external.record(TaskConfigSchema).refine((tasks) => Object.keys(tasks).length > 0, "At least one task is required").refine(validTaskIds, { message: "Task IDs must contain only alphanumeric characters, dashes, and underscores" }).refine(allDepsResolve, { message: "All dependency references must resolve to existing task IDs" }).refine(hasNoCycles, { message: "Circular dependency detected in task dependencies" }),
-    concurrency: exports_external.number().int().nonnegative().default(0),
-    env: exports_external.record(exports_external.string()).default({})
-  });
-  TaskSchema = exports_external.object({
-    id: exports_external.string().min(1),
-    cmd: exports_external.array(exports_external.string()).min(1),
-    env: exports_external.record(exports_external.string()).default({}),
-    dependencies: exports_external.array(exports_external.string()).default([]),
-    cwd: exports_external.string().optional(),
-    timeout: exports_external.number().int().nonnegative().default(0)
-  });
-  PipelineSchema = exports_external.object({
-    name: exports_external.string().min(1),
-    tasks: exports_external.array(TaskSchema).min(1),
-    concurrency: exports_external.number().int().nonnegative().default(0),
-    env: exports_external.record(exports_external.string()).default({})
-  });
-});
-
-// src/config_loader.ts
-var exports_config_loader = {};
-__export(exports_config_loader, {
-  writeLockfileAtomic: () => writeLockfileAtomic,
-  loadConfig: () => loadConfig,
-  isConfigStale: () => isConfigStale,
-  configToTasks: () => configToTasks
-});
-import { existsSync as existsSync14, readFileSync as readFileSync10, statSync, writeFileSync as writeFileSync4, renameSync, realpathSync, rmSync } from "fs";
-import { join as join17, dirname as dirname7 } from "path";
-import { randomBytes, createHash as createHash2 } from "crypto";
-function sortStrings(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function sortedSet(arr) {
-  return [...new Set(arr)].sort(sortStrings);
-}
-function sortedRecordKeys(rec) {
-  if (!rec)
-    return {};
-  const out2 = {};
-  for (const k of Object.keys(rec).sort(sortStrings)) {
-    out2[k] = rec[k];
-  }
-  return out2;
-}
-function resolveConfigPath(projectRoot) {
-  const configPath = join17(projectRoot, "b4mal.config.json");
-  if (!existsSync14(configPath)) {
-    throw new Error(`Configuration file not found: b4mal.config.json (searched in ${projectRoot}). Run 'b4mal init' to create one.`);
-  }
-  return configPath;
-}
-function verifyPathBoundary(configPath, projectRoot) {
-  let realConfigPath;
-  let realRoot;
-  try {
-    realConfigPath = realpathSync(configPath);
-    realRoot = realpathSync(projectRoot);
-  } catch (e) {
-    throw new Error(`Cannot resolve config file path: ${e.message}. Check that b4mal.config.json exists and is accessible.`);
-  }
-  const rootPrefix = realRoot.replace(/\\/g, "/") + "/";
-  const normConfig = realConfigPath.replace(/\\/g, "/");
-  if (!normConfig.startsWith(rootPrefix) && normConfig !== realRoot.replace(/\\/g, "/")) {
-    throw new Error(`Config file resolves outside project root: ${realConfigPath}. Symlinks to external files are not allowed.`);
-  }
-}
-function readAndValidate(configPath) {
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync10(configPath, "utf-8"));
-  } catch (e) {
-    throw new Error(`Failed to parse b4mal.config.json: ${e.message}`);
-  }
-  const result = B4malConfigSchema.safeParse(raw);
-  if (!result.success) {
-    const issues = result.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join(`
-`);
-    throw new Error(`Invalid configuration in b4mal.config.json:
-${issues}`);
-  }
-  return result.data;
-}
-function loadConfig(projectRoot) {
-  const configPath = resolveConfigPath(projectRoot);
-  verifyPathBoundary(configPath, projectRoot);
-  return readAndValidate(configPath);
-}
-function configToTasks(config) {
-  const ids = Object.keys(config.tasks).sort(sortStrings);
-  const tasks = [];
-  for (const id of ids) {
-    const t = config.tasks[id];
-    const matrix = t.matrix;
-    if (matrix) {
-      const expanded = expandMatrix(id, t, matrix);
-      tasks.push(...expanded);
-    } else {
-      tasks.push(buildTask(id, t));
-    }
-  }
-  const seen = new Set;
-  for (const task of tasks) {
-    if (seen.has(task.id)) {
-      throw new Error(`Duplicate task ID after matrix expansion: "${task.id}". Check for collisions between manual task names and matrix-generated names.`);
-    }
-    seen.add(task.id);
-  }
-  return tasks;
-}
-function validateMatrixAxes(baseId, axes, matrix) {
-  for (const axis of axes) {
-    if (!VALID_MATRIX_VALUE.test(axis)) {
-      throw new Error(`Matrix axis name "${axis}" contains invalid characters. Use [a-zA-Z0-9_.-]`);
-    }
-    if (matrix[axis].length === 0) {
-      throw new Error(`Matrix axis "${axis}" for task "${baseId}" has zero values`);
-    }
-    const invalidVal = matrix[axis].find((v) => !VALID_MATRIX_VALUE.test(v));
-    if (invalidVal) {
-      throw new Error(`Matrix value "${invalidVal}" in axis "${axis}" contains invalid characters. Use [a-zA-Z0-9_.-]`);
-    }
-  }
-}
-function cartesianProduct(axes, matrix) {
-  return axes.reduce((combos, axis) => {
-    const sortedVals = matrix[axis].slice().sort(sortStrings);
-    return combos.flatMap((combo) => sortedVals.map((val) => ({ ...combo, [axis]: val })));
-  }, [{}]);
-}
-function expandMatrix(baseId, t, matrix) {
-  const axes = Object.keys(matrix).sort(sortStrings);
-  if (axes.length === 0)
-    return [buildTask(baseId, t)];
-  validateMatrixAxes(baseId, axes, matrix);
-  const combinations = cartesianProduct(axes, matrix);
-  return combinations.map((combo) => {
-    const suffix = axes.map((a) => `${a}=${combo[a]}`).join("-");
-    return buildTask(`${baseId}-${suffix}`, t, combo);
-  });
-}
-function buildTask(id, t, matrixVars) {
-  const norm = (arr) => sortedSet((arr ?? []).map((p) => p.replace(/\\/g, "/")));
-  const env = sortedRecordKeys(t.env ?? {});
-  if (matrixVars) {
-    for (const [k, v] of Object.entries(matrixVars)) {
-      env[`MATRIX_${k.toUpperCase()}`] = v;
-    }
-  }
-  const task = {
-    id,
-    cmd: t.cmd ?? [],
-    dependencies: sortedSet(t.dependencies ?? []),
-    inputs: norm(t.inputs),
-    outputs: norm(t.outputs),
-    claims: norm(t.claims),
-    needsEnv: sortedSet(t.needsEnv ?? []),
-    providesEnv: sortedSet(t.providesEnv ?? []),
-    secrets: sortedSet(t.secrets ?? []),
-    env,
-    timeout: t.timeout ?? 300000,
-    cache: t.cache ?? true,
-    when: t.when
-  };
-  if (t.cwd)
-    task.cwd = t.cwd.replace(/\\/g, "/");
-  return task;
-}
-function writeLockfileAtomic(tasks, lockPath) {
-  const configHash = computeConfigHash(tasks);
-  const envelope = {
-    version: 2,
-    _meta: { configHash },
-    tasks
-  };
-  const json = JSON.stringify(envelope, null, 2);
-  const dir = dirname7(lockPath);
-  const tmpName = `.b4mal-lock-${randomBytes(8).toString("hex")}.tmp`;
-  const tmpPath = join17(dir, tmpName);
-  try {
-    writeFileSync4(tmpPath, json, "utf-8");
-    renameSync(tmpPath, lockPath);
-  } catch (e) {
-    try {
-      if (existsSync14(tmpPath))
-        rmSync(tmpPath);
-    } catch {}
-    throw e;
-  }
-}
-function computeConfigHash(tasks) {
-  const hash = createHash2("sha256");
-  hash.update(JSON.stringify(tasks));
-  return `sha256:${hash.digest("hex")}`;
-}
-function isConfigStale(projectRoot) {
-  const configPath = join17(projectRoot, "b4mal.config.json");
-  const lockPath = join17(projectRoot, "b4mal.lock");
-  if (!existsSync14(configPath))
-    return false;
-  if (!existsSync14(lockPath))
-    return true;
-  const configMtime = statSync(configPath).mtimeMs;
-  const lockMtime = statSync(lockPath).mtimeMs;
-  return configMtime > lockMtime;
-}
-var VALID_MATRIX_VALUE;
-var init_config_loader = __esm(() => {
-  init_schema();
-  VALID_MATRIX_VALUE = /^[a-zA-Z0-9_.-]+$/;
-});
-
-// src/cli/remote.ts
-var exports_remote = {};
-__export(exports_remote, {
-  RemoteCommand: () => RemoteCommand
-});
-
-class RemoteCommand {
-  static async execute(args) {
-    const sub = args[0];
-    if (sub === "status" || !sub) {
-      await this.status();
-    } else {
-      process.stderr.write(`${c3.red}[FAIL] Unknown remote command: ${sub}. Try: b4mal remote status${c3.reset}
-`);
-      process.exit(1);
-    }
-  }
-  static async status() {
-    const bucket = process.env.B4MAL_CACHE_BUCKET;
-    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
-    const endpoint = process.env.AWS_S3_ENDPOINT;
-    process.stdout.write(`
-${c3.bold}L2 Remote Cache Status${c3.reset}
-
-`);
-    if (!bucket || !accessKeyId) {
-      process.stdout.write(`${c3.dim}  Not configured.${c3.reset}
-`);
-      process.stdout.write(`${c3.dim}  Set B4MAL_CACHE_BUCKET + AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY to enable.${c3.reset}
-
-`);
-      process.exit(0);
+  static async status() {
+    const bucket = process.env.B4MAL_CACHE_BUCKET;
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const endpoint = process.env.AWS_S3_ENDPOINT;
+    process.stdout.write(`
+${c3.bold}L2 Remote Cache Status${c3.reset}
+
+`);
+    if (!bucket || !accessKeyId) {
+      process.stdout.write(`${c3.dim}  Not configured.${c3.reset}
+`);
+      process.stdout.write(`${c3.dim}  Set B4MAL_CACHE_BUCKET + AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY to enable.${c3.reset}
+
+`);
+      process.exit(0);
     }
     process.stdout.write(`${c3.dim}  Endpoint:${c3.reset} ${endpoint || "AWS S3 (default)"}
 `);
@@ -10959,21 +10807,21 @@ var exports_watch = {};
 __export(exports_watch, {
   WatchCommand: () => WatchCommand
 });
-import { watch, readFileSync as readFileSync11, existsSync as existsSync15 } from "fs";
-import { join as join18 } from "path";
+import { watch, readFileSync as readFileSync10, existsSync as existsSync14 } from "fs";
+import { join as join17 } from "path";
 function collectWatchDirs(projectRoot) {
-  const lockPath = join18(projectRoot, "b4mal.lock");
-  if (!existsSync15(lockPath))
+  const lockPath = join17(projectRoot, "b4mal.lock");
+  if (!existsSync14(lockPath))
     return new Set;
-  const raw = JSON.parse(readFileSync11(lockPath, "utf-8"));
+  const raw = JSON.parse(readFileSync10(lockPath, "utf-8"));
   const tasks = Array.isArray(raw) ? raw : raw.tasks ?? [];
   const dirs = new Set;
   for (const t of tasks) {
     for (const input of t.inputs ?? []) {
-      dirs.add(join18(projectRoot, input));
+      dirs.add(join17(projectRoot, input));
     }
   }
-  dirs.add(join18(projectRoot, "b4mal.config.json"));
+  dirs.add(join17(projectRoot, "b4mal.config.json"));
   dirs.add(lockPath);
   return dirs;
 }
@@ -11033,6 +10881,85 @@ var init_watch = __esm(() => {
   init_engine();
 });
 
+// src/cli/attest.ts
+var exports_attest = {};
+__export(exports_attest, {
+  AttestHandler: () => AttestHandler
+});
+
+class AttestHandler {
+  static parseArgs(args) {
+    const taskName = args[0] ?? "";
+    const reads = [];
+    const writes = [];
+    const envReads = [];
+    const envWrites = [];
+    const ports = [];
+    for (let i = 1;i < args.length; i++) {
+      const arg = args[i];
+      if (arg.startsWith("fs:write:")) {
+        writes.push(arg.slice(9));
+      } else if (arg.startsWith("fs:read:")) {
+        reads.push(arg.slice(8));
+      } else if (arg.startsWith("fs:")) {
+        reads.push(arg.slice(3));
+      } else if (arg.startsWith("env:write:")) {
+        envWrites.push(arg.slice(10));
+      } else if (arg.startsWith("env:read:")) {
+        envReads.push(arg.slice(9));
+      } else if (arg.startsWith("env:")) {
+        envReads.push(arg.slice(4));
+      } else if (arg.startsWith("port:")) {
+        ports.push(arg.slice(5));
+      }
+    }
+    return { taskName, reads, writes, envReads, envWrites, ports };
+  }
+  static identifyCaller(env) {
+    const caller = env.B4MAL_CALLER;
+    if (!caller)
+      return { name: "unknown", version: "unknown" };
+    const vIdx = caller.lastIndexOf("-v");
+    if (vIdx === -1)
+      return { name: caller, version: "unknown" };
+    return {
+      name: caller.slice(0, vIdx),
+      version: caller.slice(vIdx + 1)
+    };
+  }
+  static toClaim(args) {
+    return {
+      id: args.taskName,
+      reads: [...args.reads],
+      writes: [...args.writes, ...args.ports.map((p) => `port:${p}`)],
+      envReads: [...args.envReads],
+      envWrites: [...args.envWrites]
+    };
+  }
+  static async execute(args, env) {
+    try {
+      if (args.length === 0 || !args[0]) {
+        return { accepted: false, taskName: "", error: "Missing task name" };
+      }
+      const parsed = this.parseArgs(args);
+      const caller = this.identifyCaller(env);
+      const claim = this.toClaim(parsed);
+      return {
+        accepted: true,
+        taskName: parsed.taskName,
+        caller,
+        claim
+      };
+    } catch (e) {
+      return {
+        accepted: false,
+        taskName: args[0] ?? "",
+        error: `Attestation failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+  }
+}
+
 // src/plugin/wasm_registry.ts
 var exports_wasm_registry = {};
 __export(exports_wasm_registry, {
@@ -11051,7 +10978,7 @@ class WasmRegistry {
     }
   }
   async install(url, name) {
-    if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+    if (!name || name.includes("/") || name.includes("\\") || name.includes("..")) {
       throw new Error("Invalid plugin name");
     }
     let res;
@@ -11077,7 +11004,7 @@ class WasmRegistry {
     return pluginPath;
   }
   async run(name) {
-    if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+    if (!name || name.includes("/") || name.includes("\\") || name.includes("..")) {
       throw new Error("Invalid plugin name");
     }
     const pluginPath = path11.join(this.registryDir, `${name}.wasm`);
@@ -14763,10 +14690,10 @@ var require_resolve_block_map = __commonJS((exports) => {
     let offset = bm.offset;
     let commentEnd = null;
     for (const collItem of bm.items) {
-      const { start, key, sep: sep2, value } = collItem;
+      const { start, key, sep, value } = collItem;
       const keyProps = resolveProps.resolveProps(start, {
         indicator: "explicit-key-ind",
-        next: key ?? sep2?.[0],
+        next: key ?? sep?.[0],
         offset,
         onError,
         parentIndent: bm.indent,
@@ -14780,7 +14707,7 @@ var require_resolve_block_map = __commonJS((exports) => {
           else if ("indent" in key && key.indent !== bm.indent)
             onError(offset, "BAD_INDENT", startColMsg);
         }
-        if (!keyProps.anchor && !keyProps.tag && !sep2) {
+        if (!keyProps.anchor && !keyProps.tag && !sep) {
           commentEnd = keyProps.end;
           if (keyProps.comment) {
             if (map.comment)
@@ -14805,7 +14732,7 @@ var require_resolve_block_map = __commonJS((exports) => {
       ctx.atKey = false;
       if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
         onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-      const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+      const valueProps = resolveProps.resolveProps(sep ?? [], {
         indicator: "map-value-ind",
         next: value,
         offset: keyNode.range[2],
@@ -14821,7 +14748,7 @@ var require_resolve_block_map = __commonJS((exports) => {
           if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
             onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
         }
-        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep2, null, valueProps, onError);
+        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep, null, valueProps, onError);
         if (ctx.schema.compat)
           utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
         offset = valueNode.range[2];
@@ -14907,7 +14834,7 @@ var require_resolve_end = __commonJS((exports) => {
     let comment = "";
     if (end) {
       let hasSpace = false;
-      let sep2 = "";
+      let sep = "";
       for (const token of end) {
         const { source, type } = token;
         switch (type) {
@@ -14921,13 +14848,13 @@ var require_resolve_end = __commonJS((exports) => {
             if (!comment)
               comment = cb;
             else
-              comment += sep2 + cb;
-            sep2 = "";
+              comment += sep + cb;
+            sep = "";
             break;
           }
           case "newline":
             if (comment)
-              sep2 += source;
+              sep += source;
             hasSpace = true;
             break;
           default:
@@ -14967,18 +14894,18 @@ var require_resolve_flow_collection = __commonJS((exports) => {
     let offset = fc.offset + fc.start.source.length;
     for (let i = 0;i < fc.items.length; ++i) {
       const collItem = fc.items[i];
-      const { start, key, sep: sep2, value } = collItem;
+      const { start, key, sep, value } = collItem;
       const props = resolveProps.resolveProps(start, {
         flow: fcName,
         indicator: "explicit-key-ind",
-        next: key ?? sep2?.[0],
+        next: key ?? sep?.[0],
         offset,
         onError,
         parentIndent: fc.indent,
         startOnNewline: false
       });
       if (!props.found) {
-        if (!props.anchor && !props.tag && !sep2 && !value) {
+        if (!props.anchor && !props.tag && !sep && !value) {
           if (i === 0 && props.comma)
             onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
           else if (i < fc.items.length - 1)
@@ -15030,8 +14957,8 @@ var require_resolve_flow_collection = __commonJS((exports) => {
           }
         }
       }
-      if (!isMap && !sep2 && !props.found) {
-        const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
+      if (!isMap && !sep && !props.found) {
+        const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
         coll.items.push(valueNode);
         offset = valueNode.range[2];
         if (isBlock(value))
@@ -15043,7 +14970,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
         if (isBlock(key))
           onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
         ctx.atKey = false;
-        const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep ?? [], {
           flow: fcName,
           indicator: "map-value-ind",
           next: value,
@@ -15054,8 +14981,8 @@ var require_resolve_flow_collection = __commonJS((exports) => {
         });
         if (valueProps.found) {
           if (!isMap && !props.found && ctx.options.strict) {
-            if (sep2)
-              for (const st of sep2) {
+            if (sep)
+              for (const st of sep) {
                 if (st === valueProps.found)
                   break;
                 if (st.type === "newline") {
@@ -15072,7 +14999,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
           else
             onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
         }
-        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep2, null, valueProps, onError) : null;
+        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep, null, valueProps, onError) : null;
         if (valueNode) {
           if (isBlock(value))
             onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -15249,7 +15176,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         chompStart = i + 1;
     }
     let value = "";
-    let sep2 = "";
+    let sep = "";
     let prevMoreIndented = false;
     for (let i = 0;i < contentStart; ++i)
       value += lines[i][0].slice(trimIndent) + `
@@ -15267,33 +15194,33 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         indent = "";
       }
       if (type === Scalar.Scalar.BLOCK_LITERAL) {
-        value += sep2 + indent.slice(trimIndent) + content;
-        sep2 = `
+        value += sep + indent.slice(trimIndent) + content;
+        sep = `
 `;
       } else if (indent.length > trimIndent || content[0] === "\t") {
-        if (sep2 === " ")
-          sep2 = `
+        if (sep === " ")
+          sep = `
 `;
-        else if (!prevMoreIndented && sep2 === `
+        else if (!prevMoreIndented && sep === `
 `)
-          sep2 = `
+          sep = `
 
 `;
-        value += sep2 + indent.slice(trimIndent) + content;
-        sep2 = `
+        value += sep + indent.slice(trimIndent) + content;
+        sep = `
 `;
         prevMoreIndented = true;
       } else if (content === "") {
-        if (sep2 === `
+        if (sep === `
 `)
           value += `
 `;
         else
-          sep2 = `
+          sep = `
 `;
       } else {
-        value += sep2 + content;
-        sep2 = " ";
+        value += sep + content;
+        sep = " ";
         prevMoreIndented = false;
       }
     }
@@ -15474,27 +15401,27 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
     if (!match)
       return source;
     let res = match[1];
-    let sep2 = " ";
+    let sep = " ";
     let pos = first.lastIndex;
     line.lastIndex = pos;
     while (match = line.exec(source)) {
       if (match[1] === "") {
-        if (sep2 === `
+        if (sep === `
 `)
-          res += sep2;
+          res += sep;
         else
-          sep2 = `
+          sep = `
 `;
       } else {
-        res += sep2 + match[1];
-        sep2 = " ";
+        res += sep + match[1];
+        sep = " ";
       }
       pos = line.lastIndex;
     }
     const last = /[ \t]*(.*)/sy;
     last.lastIndex = pos;
     match = last.exec(source);
-    return res + sep2 + (match?.[1] ?? "");
+    return res + sep + (match?.[1] ?? "");
   }
   function doubleQuotedValue(source, onError) {
     let res = "";
@@ -16267,14 +16194,14 @@ var require_cst_stringify = __commonJS((exports) => {
       }
     }
   }
-  function stringifyItem({ start, key, sep: sep2, value }) {
+  function stringifyItem({ start, key, sep, value }) {
     let res = "";
     for (const st of start)
       res += st.source;
     if (key)
       res += stringifyToken(key);
-    if (sep2)
-      for (const st of sep2)
+    if (sep)
+      for (const st of sep)
         res += st.source;
     if (value)
       res += stringifyToken(value);
@@ -17404,18 +17331,18 @@ var require_parser = __commonJS((exports) => {
       if (this.type === "map-value-ind") {
         const prev = getPrevProps(this.peek(2));
         const start = getFirstKeyStartProps(prev);
-        let sep2;
+        let sep;
         if (scalar.end) {
-          sep2 = scalar.end;
-          sep2.push(this.sourceToken);
+          sep = scalar.end;
+          sep.push(this.sourceToken);
           delete scalar.end;
         } else
-          sep2 = [this.sourceToken];
+          sep = [this.sourceToken];
         const map = {
           type: "block-map",
           offset: scalar.offset,
           indent: scalar.indent,
-          items: [{ start, key: scalar, sep: sep2 }]
+          items: [{ start, key: scalar, sep }]
         };
         this.onKeyLine = true;
         this.stack[this.stack.length - 1] = map;
@@ -17569,15 +17496,15 @@ var require_parser = __commonJS((exports) => {
               } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                 const start2 = getFirstKeyStartProps(it.start);
                 const key = it.key;
-                const sep2 = it.sep;
-                sep2.push(this.sourceToken);
+                const sep = it.sep;
+                sep.push(this.sourceToken);
                 delete it.key;
                 delete it.sep;
                 this.stack.push({
                   type: "block-map",
                   offset: this.offset,
                   indent: this.indent,
-                  items: [{ start: start2, key, sep: sep2 }]
+                  items: [{ start: start2, key, sep }]
                 });
               } else if (start.length > 0) {
                 it.sep = it.sep.concat(start, this.sourceToken);
@@ -17771,13 +17698,13 @@ var require_parser = __commonJS((exports) => {
           const prev = getPrevProps(parent);
           const start = getFirstKeyStartProps(prev);
           fixFlowSeqItems(fc);
-          const sep2 = fc.end.splice(1, fc.end.length);
-          sep2.push(this.sourceToken);
+          const sep = fc.end.splice(1, fc.end.length);
+          sep.push(this.sourceToken);
           const map = {
             type: "block-map",
             offset: fc.offset,
             indent: fc.indent,
-            items: [{ start, key: fc, sep: sep2 }]
+            items: [{ start, key: fc, sep }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -18049,6 +17976,107 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
+// src/schema.ts
+function sanitizePath(p) {
+  if (p.startsWith("/")) {
+    throw new Error(`Absolute paths not allowed: "${p}"`);
+  }
+  if (p.split("/").some((seg) => seg === "..")) {
+    throw new Error(`Path traversal not allowed: "${p}"`);
+  }
+  return p.replace(/\\/g, "/");
+}
+function validTaskIds(tasks) {
+  return Object.keys(tasks).every((k) => VALID_TASK_ID.test(k));
+}
+function allDepsResolve(tasks) {
+  const ids = new Set(Object.keys(tasks));
+  for (const task of Object.values(tasks)) {
+    for (const dep of task.dependencies) {
+      if (!ids.has(dep))
+        return false;
+    }
+  }
+  return true;
+}
+function cartesianSize(matrix) {
+  let size = 1;
+  for (const vals of Object.values(matrix)) {
+    size *= vals.length;
+  }
+  return size;
+}
+function hasNoCycles(tasks) {
+  const WHITE = 0, GRAY = 1, BLACK = 2;
+  const color = new Map;
+  for (const id of Object.keys(tasks))
+    color.set(id, WHITE);
+  function dfs(id) {
+    const c4 = color.get(id);
+    if (c4 === GRAY)
+      return false;
+    if (c4 === BLACK)
+      return true;
+    color.set(id, GRAY);
+    for (const dep of tasks[id]?.dependencies ?? []) {
+      if (!dfs(dep))
+        return false;
+    }
+    color.set(id, BLACK);
+    return true;
+  }
+  for (const id of color.keys()) {
+    if (color.get(id) === WHITE && !dfs(id))
+      return false;
+  }
+  return true;
+}
+var TaskConfigSchema, VALID_TASK_ID, B4malConfigSchema, TaskSchema, PipelineSchema;
+var init_schema = __esm(() => {
+  init_zod();
+  TaskConfigSchema = exports_external.object({
+    cmd: exports_external.array(exports_external.string()).min(1, "cmd must contain at least one element"),
+    dependencies: exports_external.array(exports_external.string()).default([]),
+    inputs: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map(sanitizePath)),
+    outputs: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map(sanitizePath)),
+    claims: exports_external.array(exports_external.string()).default([]).transform((ps) => ps.map((c4) => c4.startsWith("fs:") ? `fs:${sanitizePath(c4.slice(3))}` : c4)),
+    needsEnv: exports_external.array(exports_external.string()).default([]),
+    providesEnv: exports_external.array(exports_external.string()).default([]),
+    secrets: exports_external.array(exports_external.string()).default([]),
+    when: exports_external.object({
+      branch: exports_external.string().optional().describe("Glob pattern for branch name"),
+      platform: exports_external.array(exports_external.string()).optional().describe("OS platforms to run on"),
+      if: exports_external.string().optional().describe("Arbitrary condition expression")
+    }).optional(),
+    matrix: exports_external.record(exports_external.array(exports_external.string()).max(10)).optional().refine((m) => !m || Object.keys(m).length <= 4, "Max 4 matrix axes").refine((m) => !m || cartesianSize(m) <= 256, "Max 256 matrix combinations"),
+    env: exports_external.record(exports_external.string()).default({}),
+    cwd: exports_external.string().optional().transform((p) => p ? p.replace(/\\/g, "/") : p).refine((p) => !p || !p.startsWith("/") && !p.split("/").some((seg) => seg === ".."), "cwd must be a relative path within the project root"),
+    timeout: exports_external.number().int().nonnegative().max(3600000).transform((t) => t === 0 ? 300000 : t).default(300000),
+    cache: exports_external.boolean().default(true)
+  });
+  VALID_TASK_ID = /^[a-zA-Z0-9_-]+$/;
+  B4malConfigSchema = exports_external.object({
+    name: exports_external.string().optional(),
+    tasks: exports_external.record(TaskConfigSchema).refine((tasks) => Object.keys(tasks).length > 0, "At least one task is required").refine(validTaskIds, { message: "Task IDs must contain only alphanumeric characters, dashes, and underscores" }).refine(allDepsResolve, { message: "All dependency references must resolve to existing task IDs" }).refine(hasNoCycles, { message: "Circular dependency detected in task dependencies" }),
+    concurrency: exports_external.number().int().nonnegative().default(0),
+    env: exports_external.record(exports_external.string()).default({})
+  });
+  TaskSchema = exports_external.object({
+    id: exports_external.string().min(1),
+    cmd: exports_external.array(exports_external.string()).min(1),
+    env: exports_external.record(exports_external.string()).default({}),
+    dependencies: exports_external.array(exports_external.string()).default([]),
+    cwd: exports_external.string().optional(),
+    timeout: exports_external.number().int().nonnegative().default(0)
+  });
+  PipelineSchema = exports_external.object({
+    name: exports_external.string().min(1),
+    tasks: exports_external.array(TaskSchema).min(1),
+    concurrency: exports_external.number().int().nonnegative().default(0),
+    env: exports_external.record(exports_external.string()).default({})
+  });
+});
+
 // src/shim/forecaster.ts
 function measureVolatility(source) {
   if (source.trim().length === 0)
@@ -18221,6 +18249,199 @@ var init_mint_transpiler = __esm(() => {
   init_forecaster();
 });
 
+// src/config_loader.ts
+var exports_config_loader = {};
+__export(exports_config_loader, {
+  writeLockfileAtomic: () => writeLockfileAtomic,
+  loadConfig: () => loadConfig,
+  isConfigStale: () => isConfigStale,
+  configToTasks: () => configToTasks
+});
+import { existsSync as existsSync16, readFileSync as readFileSync12, statSync, writeFileSync as writeFileSync5, renameSync, realpathSync, rmSync } from "fs";
+import { join as join19, dirname as dirname7 } from "path";
+import { randomBytes, createHash as createHash2 } from "crypto";
+function sortStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function sortedSet(arr) {
+  return [...new Set(arr)].sort(sortStrings);
+}
+function sortedRecordKeys(rec) {
+  if (!rec)
+    return {};
+  const out2 = {};
+  for (const k of Object.keys(rec).sort(sortStrings)) {
+    out2[k] = rec[k];
+  }
+  return out2;
+}
+function resolveConfigPath(projectRoot) {
+  const configPath = join19(projectRoot, "b4mal.config.json");
+  if (!existsSync16(configPath)) {
+    throw new Error(`Configuration file not found: b4mal.config.json (searched in ${projectRoot}). Run 'b4mal init' to create one.`);
+  }
+  return configPath;
+}
+function verifyPathBoundary(configPath, projectRoot) {
+  let realConfigPath;
+  let realRoot;
+  try {
+    realConfigPath = realpathSync(configPath);
+    realRoot = realpathSync(projectRoot);
+  } catch (e) {
+    throw new Error(`Cannot resolve config file path: ${e.message}. Check that b4mal.config.json exists and is accessible.`);
+  }
+  const rootPrefix = realRoot.replace(/\\/g, "/") + "/";
+  const normConfig = realConfigPath.replace(/\\/g, "/");
+  if (!normConfig.startsWith(rootPrefix) && normConfig !== realRoot.replace(/\\/g, "/")) {
+    throw new Error(`Config file resolves outside project root: ${realConfigPath}. Symlinks to external files are not allowed.`);
+  }
+}
+function readAndValidate(configPath) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync12(configPath, "utf-8"));
+  } catch (e) {
+    throw new Error(`Failed to parse b4mal.config.json: ${e.message}`);
+  }
+  const result = B4malConfigSchema.safeParse(raw);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join(`
+`);
+    throw new Error(`Invalid configuration in b4mal.config.json:
+${issues}`);
+  }
+  return result.data;
+}
+function loadConfig(projectRoot) {
+  const configPath = resolveConfigPath(projectRoot);
+  verifyPathBoundary(configPath, projectRoot);
+  return readAndValidate(configPath);
+}
+function configToTasks(config) {
+  const ids = Object.keys(config.tasks).sort(sortStrings);
+  const tasks = [];
+  for (const id of ids) {
+    const t = config.tasks[id];
+    const matrix = t.matrix;
+    if (matrix) {
+      const expanded = expandMatrix(id, t, matrix);
+      tasks.push(...expanded);
+    } else {
+      tasks.push(buildTask(id, t));
+    }
+  }
+  const seen = new Set;
+  for (const task of tasks) {
+    if (seen.has(task.id)) {
+      throw new Error(`Duplicate task ID after matrix expansion: "${task.id}". Check for collisions between manual task names and matrix-generated names.`);
+    }
+    seen.add(task.id);
+  }
+  return tasks;
+}
+function validateMatrixAxes(baseId, axes, matrix) {
+  for (const axis of axes) {
+    if (!VALID_MATRIX_VALUE.test(axis)) {
+      throw new Error(`Matrix axis name "${axis}" contains invalid characters. Use [a-zA-Z0-9_.-]`);
+    }
+    if (matrix[axis].length === 0) {
+      throw new Error(`Matrix axis "${axis}" for task "${baseId}" has zero values`);
+    }
+    const invalidVal = matrix[axis].find((v) => !VALID_MATRIX_VALUE.test(v));
+    if (invalidVal) {
+      throw new Error(`Matrix value "${invalidVal}" in axis "${axis}" contains invalid characters. Use [a-zA-Z0-9_.-]`);
+    }
+  }
+}
+function cartesianProduct(axes, matrix) {
+  return axes.reduce((combos, axis) => {
+    const sortedVals = matrix[axis].slice().sort(sortStrings);
+    return combos.flatMap((combo) => sortedVals.map((val) => ({ ...combo, [axis]: val })));
+  }, [{}]);
+}
+function expandMatrix(baseId, t, matrix) {
+  const axes = Object.keys(matrix).sort(sortStrings);
+  if (axes.length === 0)
+    return [buildTask(baseId, t)];
+  validateMatrixAxes(baseId, axes, matrix);
+  const combinations = cartesianProduct(axes, matrix);
+  return combinations.map((combo) => {
+    const suffix = axes.map((a) => `${a}=${combo[a]}`).join("-");
+    return buildTask(`${baseId}-${suffix}`, t, combo);
+  });
+}
+function buildTask(id, t, matrixVars) {
+  const norm = (arr) => sortedSet((arr ?? []).map((p) => p.replace(/\\/g, "/")));
+  const env = sortedRecordKeys(t.env ?? {});
+  if (matrixVars) {
+    for (const [k, v] of Object.entries(matrixVars)) {
+      env[`MATRIX_${k.toUpperCase()}`] = v;
+    }
+  }
+  const task = {
+    id,
+    cmd: t.cmd ?? [],
+    dependencies: sortedSet(t.dependencies ?? []),
+    inputs: norm(t.inputs),
+    outputs: norm(t.outputs),
+    claims: norm(t.claims),
+    needsEnv: sortedSet(t.needsEnv ?? []),
+    providesEnv: sortedSet(t.providesEnv ?? []),
+    secrets: sortedSet(t.secrets ?? []),
+    env,
+    timeout: t.timeout ?? 300000,
+    cache: t.cache ?? true,
+    when: t.when
+  };
+  if (t.cwd)
+    task.cwd = t.cwd.replace(/\\/g, "/");
+  return task;
+}
+function writeLockfileAtomic(tasks, lockPath) {
+  const configHash = computeConfigHash(tasks);
+  const envelope = {
+    version: 2,
+    _meta: { configHash },
+    tasks
+  };
+  const json = JSON.stringify(envelope, null, 2);
+  const dir = dirname7(lockPath);
+  const tmpName = `.b4mal-lock-${randomBytes(8).toString("hex")}.tmp`;
+  const tmpPath = join19(dir, tmpName);
+  try {
+    writeFileSync5(tmpPath, json, "utf-8");
+    renameSync(tmpPath, lockPath);
+  } catch (e) {
+    try {
+      if (existsSync16(tmpPath))
+        rmSync(tmpPath);
+    } catch {}
+    throw e;
+  }
+}
+function computeConfigHash(tasks) {
+  const hash = createHash2("sha256");
+  hash.update(JSON.stringify(tasks));
+  return `sha256:${hash.digest("hex")}`;
+}
+function isConfigStale(projectRoot) {
+  const configPath = join19(projectRoot, "b4mal.config.json");
+  const lockPath = join19(projectRoot, "b4mal.lock");
+  if (!existsSync16(configPath))
+    return false;
+  if (!existsSync16(lockPath))
+    return true;
+  const configMtime = statSync(configPath).mtimeMs;
+  const lockMtime = statSync(lockPath).mtimeMs;
+  return configMtime > lockMtime;
+}
+var VALID_MATRIX_VALUE;
+var init_config_loader = __esm(() => {
+  init_schema();
+  VALID_MATRIX_VALUE = /^[a-zA-Z0-9_.-]+$/;
+});
+
 // src/cli/index.ts
 init_engine();
 import { parseArgs } from "util";
@@ -18397,6 +18618,11 @@ ${c.reset}
 `);
   out(`  ${c.bold}b4mal:      prove \u2192 halt \u2192 fix \u2192 run${c.reset}
 
+`);
+  out(`  ${c.dim}Exit code 1 \u2014 the collision above is fatal, so this mirrors what a${c.reset}
+`);
+  out(`  ${c.dim}real build would do. See docs/reference/cli.md for the rationale.${c.reset}
+
 `);
 }
 async function runDemo() {
@@ -18429,7 +18655,7 @@ ${c.reset}`);
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join11 } from "path";
 var MAX_ASCENT = 5;
-var FALLBACK_VERSION = "0.1.1";
+var FALLBACK_VERSION = "0.1.2";
 var PKG_NAME = "b4mal";
 function barePackageName(name) {
   if (typeof name !== "string" || name.length === 0)
@@ -18598,6 +18824,7 @@ async function main() {
           await CICommand2.execute(Bun.argv);
         } else {
           fail("Unknown setup command. Try: b4mal setup ci");
+          process.exit(1);
         }
         break;
       }
@@ -18608,19 +18835,7 @@ async function main() {
       }
       case "build": {
         banner2("Engaging Wave Orchestrator\u2026");
-        const syncFlag = values.sync || values["from-config"];
-        const configPath = join20(process.cwd(), "b4mal.config.json");
-        if (syncFlag || existsSync17(configPath)) {
-          const { loadConfig: loadConfig2, configToTasks: configToTasks2, writeLockfileAtomic: writeLockfileAtomic2, isConfigStale: isConfigStale2 } = await Promise.resolve().then(() => (init_config_loader(), exports_config_loader));
-          if (syncFlag || isConfigStale2(process.cwd())) {
-            info2("Loading b4mal.config.json...");
-            const config = loadConfig2(process.cwd());
-            const tasks = configToTasks2(config);
-            writeLockfileAtomic2(tasks, join20(process.cwd(), "b4mal.lock"));
-            if (syncFlag)
-              info2("Lockfile regenerated from config (--sync).");
-          }
-        }
+        await syncLockFromConfig(process.cwd(), values.sync || values["from-config"]);
         const dryRun = values["dry-run"];
         const opts = { force: values.force, strict: values.strict };
         if (dryRun) {
@@ -18657,11 +18872,15 @@ async function main() {
           }
           process.exit(1);
         }
-        const hits = result.results.filter((r) => r.cached).length;
-        const misses = result.results.filter((r) => !r.cached).length;
+        const conditionSkipped = result.results.filter((r) => r.skippedByCondition).length;
+        const hits = result.results.filter((r) => r.cached && !r.skippedByCondition).length;
+        const misses = result.results.filter((r) => !r.cached && !r.skippedByCondition).length;
         for (const r of result.results) {
-          if (r.cached) {
+          if (r.cached && !r.skippedByCondition) {
             process.stdout.write(`${c4.cyan}${c4.dim}   \u21A9 ${r.taskId} (cached)${c4.reset}
+`);
+          } else if (r.skippedByCondition) {
+            process.stdout.write(`${c4.dim}   \u2298 ${r.taskId} (skipped \u2014 when condition not met)${c4.reset}
 `);
           } else if (r.skipped) {
             process.stdout.write(`${c4.yellow}   \u2298 ${r.taskId} (skipped \u2014 dependency failed)${c4.reset}
@@ -18680,8 +18899,12 @@ async function main() {
 `);
           }
         }
-        if (hits > 0)
-          info2(`${hits} task(s) restored from cache \u2014 ${misses} executed.`);
+        if (hits > 0) {
+          const skippedNote = conditionSkipped > 0 ? `, ${conditionSkipped} skipped by condition` : "";
+          info2(`${hits} task(s) restored from cache \u2014 ${misses} executed${skippedNote}.`);
+        } else if (conditionSkipped > 0) {
+          info2(`${conditionSkipped} task(s) skipped by condition \u2014 ${misses} executed.`);
+        }
         if (!result.success) {
           const skippedCount = result.results.filter((r) => r.skipped).length;
           fail(skippedCount > 0 ? `One or more tasks failed \u2014 ${skippedCount} downstream task(s) skipped.` : "One or more tasks exited non-zero.");
@@ -18710,6 +18933,7 @@ async function main() {
       case "check": {
         const jsonMode = values.json;
         const isGHA = process.env.GITHUB_ACTIONS === "true";
+        await syncLockFromConfig(process.cwd(), false);
         if (!jsonMode) {
           banner2("Verifying DAG Correctness\u2026");
           info2("Checking resource isolation and shadowing without executing tasks.");
@@ -18746,8 +18970,10 @@ async function main() {
         if (jsonMode) {
           process.stdout.write(JSON.stringify({
             verified: issues === 0,
+            taskCount: plan.totalTasks,
             collisions: plan.conflicts.length,
             shadows: shadows.length,
+            note: plan.totalTasks === 0 ? "no tasks in the lockfile \u2014 nothing was verified" : undefined,
             findings
           }, null, 2) + `
 `);
@@ -18758,7 +18984,8 @@ async function main() {
 `);
           }
           if (issues === 0) {
-            process.stdout.write(`::notice::DAG verified \u2014 no collisions, no shadowing.
+            process.stdout.write(plan.totalTasks === 0 ? `::warning::b4mal check found no tasks in b4mal.lock \u2014 nothing was verified.
+` : `::notice::DAG verified \u2014 no collisions, no shadowing.
 `);
           }
         } else {
@@ -18775,9 +19002,7 @@ async function main() {
 `);
             }
           }
-          if (issues === 0) {
-            ok2("DAG verified \u2014 no collisions, no shadowing.");
-          } else {
+          if (issues > 0) {
             process.stdout.write(`
    ${c4.red}${issues} issue(s) found.${c4.reset}
 `);
@@ -18786,6 +19011,11 @@ async function main() {
             process.stdout.write(`   ${c4.dim}Run 'b4mal build' to execute after fixing the above.${c4.reset}
 
 `);
+          } else if (plan.totalTasks === 0) {
+            warn2("b4mal.lock contains no tasks \u2014 nothing was verified.");
+            info2("Declare tasks in b4mal.config.json, then run: b4mal build --sync");
+          } else {
+            ok2("DAG verified \u2014 no collisions, no shadowing.");
           }
         }
         if (issues > 0)
@@ -18818,6 +19048,13 @@ ${c4.reset}`);
         }
         break;
       }
+      case "attest": {
+        const { AttestHandler: AttestHandler2 } = await Promise.resolve().then(() => exports_attest);
+        const result = await AttestHandler2.execute(positionals.slice(3), process.env);
+        process.stdout.write(JSON.stringify(result, null, 2) + `
+`);
+        process.exit(result.accepted ? 0 : 1);
+      }
       case "analyze": {
         banner2("Generating Visual Observability Dashboard\u2026");
         const outPath = await engine.analyze();
@@ -18826,31 +19063,52 @@ ${c4.reset}`);
         break;
       }
       case "plugin": {
-        const sub = positionals[1];
+        const sub = positionals[3];
         const { WasmRegistry: WasmRegistry2 } = await Promise.resolve().then(() => (init_wasm_registry(), exports_wasm_registry));
         const path12 = await import("path");
         const registry = new WasmRegistry2;
         if (sub === "install") {
-          const url = positionals[2];
-          const name = positionals[3] || path12.basename(url, ".wasm");
+          const url = positionals[4];
           if (!url) {
             fail("Usage: b4mal plugin install <url> [name]");
+            info2("Example: b4mal plugin install https://example.com/my-plugin.wasm");
             process.exit(1);
           }
+          let parsedUrl;
+          try {
+            parsedUrl = new URL(url);
+          } catch {
+            fail(`"${url}" is not a valid URL.`);
+            info2("Expected an absolute URL, e.g. https://example.com/my-plugin.wasm");
+            process.exit(1);
+          }
+          const derived = path12.basename(parsedUrl.pathname, ".wasm");
+          const name = positionals[5] || derived || parsedUrl.hostname || "plugin";
           banner2(`Installing Plugin: ${name}`);
-          const outPath = await registry.install(url, name);
-          ok2(`Plugin successfully installed to ${outPath}`);
+          try {
+            const outPath = await registry.install(url, name);
+            ok2(`Plugin successfully installed to ${outPath}`);
+          } catch (err2) {
+            fail(err2?.message ?? String(err2));
+            process.exit(1);
+          }
         } else if (sub === "run") {
-          const name = positionals[2];
+          const name = positionals[4];
           if (!name) {
             fail("Usage: b4mal plugin run <name>");
             process.exit(1);
           }
           banner2(`Running Plugin: ${name}`);
-          const code = await registry.run(name);
-          ok2(`Plugin exited with code ${code}`);
+          try {
+            const code = await registry.run(name);
+            ok2(`Plugin exited with code ${code}`);
+          } catch (err2) {
+            fail(err2?.message ?? String(err2));
+            process.exit(1);
+          }
         } else {
           fail("Unknown plugin command. Try: install, run");
+          process.exit(1);
         }
         break;
       }
@@ -18890,6 +19148,21 @@ ${c4.dim}${error.stack}${c4.reset}
     engine.close();
   }
 }
+async function syncLockFromConfig(projectRoot, force) {
+  const configPath = join20(projectRoot, "b4mal.config.json");
+  if (!force && !existsSync17(configPath))
+    return;
+  const { loadConfig: loadConfig2, configToTasks: configToTasks2, writeLockfileAtomic: writeLockfileAtomic2, isConfigStale: isConfigStale2 } = await Promise.resolve().then(() => (init_config_loader(), exports_config_loader));
+  if (!force && !isConfigStale2(projectRoot))
+    return;
+  process.stderr.write(`${c4.dim}   Loading b4mal.config.json...${c4.reset}
+`);
+  const tasks = configToTasks2(loadConfig2(projectRoot));
+  writeLockfileAtomic2(tasks, join20(projectRoot, "b4mal.lock"));
+  if (force)
+    process.stderr.write(`${c4.dim}   Lockfile regenerated from config (--sync).${c4.reset}
+`);
+}
 function printUsage() {
   process.stdout.write(`
   ${c4.bold}b4mal${c4.reset} \u2014 Core Build Engine v${getVersion()}
@@ -18906,6 +19179,7 @@ function printUsage() {
     b4mal clean          Purge artifact vault + ledger
     b4mal trace "cmd"    Synthesize a DAG automatically via eBPF
     b4mal plugin         Manage and execute decentralized WASM plugins
+    b4mal attest         Declare a task's resources and get a normalized claim (JSON)
 
   ${c4.bold}Flags:${c4.reset}
     -f, --force             Bypass cache (force re-execution)