@casecore/release-agent 0.1.1 → 0.1.3

package/README.md

@@ -61,19 +61,42 @@ UUID исходной попытки доставки и UUID команды Cas
 `reconcile(commandId)` вызывает подключённый
 `provider.reconcilePublicationFailure(command, { signal, delivery, recoveryDeadlineAt })`.
 Адаптер возвращает `null` при неопределённом результате либо удерживаемый guard:
-`{ fact, assertOwned(), release({ resolved, proofDigest }) }`.
+`{ fact, baselineReadback, assertOwned(), release({ resolved, proofDigest }) }`.
 `fact` содержит ровно `schema: 1`, `kind: 'failed_before_installation'`,
 `commandId`, `installationKey`, `expectedSource`, исходный `delivery`, свежий
 `observedAt`, `stage: source_ready | ci | build | verify | publish`,
 `authenticated: true`, `executionStopped: true`, `pendingTransaction: false`,
 `publicationResolved: true`, `installationNotStarted: true`.
 
+`baselineReadback` использует существующий формат `ProductionReadback` и
+подтверждает предыдущую рабочую установку под тем же удерживаемым guard.
+Её точная идентичность обязана совпадать с baseline, сохранённым при принятии
+исходной команды. Требуются правильная установка, `source: independent-production`,
+успешный functional smoke с тем же source commit и ссылкой на доказательство.
+`observedAt` и `functionalSmoke.checkedAt` не предшествуют исходному T0,
+не находятся в будущем и отстают от завершения не более чем на 300 секунд.
+Отсутствующий baseline, readback или несовпадение оставляют восстановление pending.
+
 Адаптер подтверждает фактическую остановку исполнителя и его дочерних/удалённых
 операций, исходную идентичность и отсутствие незавершённой установки через
 существующие журналы и механизмы владения продукта. Он удерживает исключение
 конкурирующих действий до сохранения pending-доказательства и подтверждения
 его durable-завершения в `release({ resolved: true, proofDigest })`.
-`proofDigest` имеет вид `sha256:<hex>` и вычисляется движком из `fact`.
+До ACK движок сохраняет точные `fact` и `baselineReadback` в защищённом pending-журнале,
+а readback — в существующем `run.readback`; статус остаётся `blocked`,
+`recoveryState: unverified`, `completedAt: null`.
+Адаптер вычисляет ожидаемый ACK digest общей функцией
+`publicationFailureProofDigest(fact, baselineReadback)` из `@casecore/release-agent`
+или `@casecore/release-agent/producer`. Движок использует ту же функцию;
+копировать реализацию хеша в адаптер не нужно. Функция вычисляет digest,
+а доверенность доказательств и владение проверяются отдельно.
+`proofDigest` связывает оба значения: `sha256:${hash(canonical({ fact, baselineReadback }))}`.
+Здесь `canonical` сортирует ключи верхнего уровня объекта через `localeCompare`
+и возвращает его JSON-строку; `hash` вычисляет SHA-256 от `JSON.stringify`
+этой строки в UTF-8. Вложенные значения сохраняют точный порядок ключей
+переданного адаптером доказательства. Адаптер подтверждает тот же digest.
+Владение и свежесть повторно проверяются перед ACK, а после ACK — локальное
+владение и свежесть перед сохранением завершения.
 Ошибка/потеря ACK не разрешает следующий выпуск. Guard и его callback работают
 внутри доверенного адаптера; HTTP-запрос не может подставить этот результат.
 
@@ -82,6 +105,8 @@ UUID исходной попытки доставки и UUID команды Cas
 этапы. Артефакт и успешная установка не подставляются. Сохранённый pending
 запрещает команды, продолжение и резервирование после перезапуска; восстановление
 проходит через тот же `reconcile` и новую фактическую проверку владения.
+Повторная проверка может обновить время наблюдения, но не исходный baseline.
+Старое завершённое восстановление без readback не превращается в доказанный результат.
 Его отдельный предел — 30 секунд; срок публикации не продлевается.
 Обычный `reserveExclusiveOperation` становится доступен после завершения
 восстановления, когда остальные операции установки также разрешены.
@@ -106,6 +131,61 @@ Alvori — `release-control-source.json`. Для старого формата A
 переход этапа, время, событие и сохранение выполняются общей реализацией;
 адаптер передаёт фактическое начало и завершение своей операции.
 
+Для команды публикации, которая точно не была принята исполнителем, SDK 0.1.3
+предоставляет `store.reconcileNonAdmission(command, trustedHeldContext)`.
+Ответ GET 404, истёкший срок или пустой журнал сами по себе не разрешают этот
+переход. Контекст передаёт точную установку и политику источника, `scope`
+(`tenantId`, `workspaceId`, `parentRunId`, `operationGeneration`,
+`credentialRevision`, `streamId`, `baselineIdentity`), `recoveryDeadlineAt`
+в миллисекундах UTC и доверенный `acquireGuard(command, context)`.
+Срок восстановления ограничен 30 секундами и не меняет исходные T0 и deadline.
+
+Адаптер удерживает общую блокировку приёма, worker, конфигурации и публикации;
+подтверждает остановку всех исходных обработчиков и операций; исключает поздний
+приём; проверяет отсутствие команды в том же защищённом журнале и получает
+свежее независимое подтверждение прежней установки. Он также удерживает
+каноническое владение CaseCore для той же команды, parent run, outbox и scope.
+`acquireGuard` возвращает `null` при неопределённости либо
+`{ fact, baselineReadback, assertOwned(), release({ resolved, proofDigest }) }`.
+Точный формат `NonAdmissionFact` и контекста описан в декларациях SDK.
+Readback использует прежние пять полей `ProductionReadback`, совпадает с
+`scope.baselineIdentity` и подтверждает успешный smoke после исходного T0,
+не старше 300 секунд. Служебные сведения о native владении передаются отдельно.
+
+Движок сохраняет запись `commands[id]` с двумя полями: `command` и
+`admissionRejection`. Последняя содержит `schema: 1`, `state: pending | rejected`,
+точные `fact`, `baselineReadback`, `proofDigest`, стандартный rejected ACK
+и `completedAt`. Запись не содержит accepted timestamp, этапов, очереди,
+артефакта или выполненного запуска. `progress` исключает её из списка запусков.
+Общая функция `nonAdmissionProofDigest(command, fact, baselineReadback)` доступна
+из `@casecore/release-agent` и `@casecore/release-agent/source-store`;
+адаптер использует её для того же native/central ACK, без копии алгоритма хеша.
+
+Сначала сохраняется защищённый pending-запрет позднего приёма, затем проверяются
+владение и свежесть и вызывается `release({ resolved: true, proofDigest })`.
+Он подтверждает фактический native ACK и завершение центральной транзакции
+владения; отрицательный ACK центральной команды применяется отдельно штатным
+путём после окончательного сохранения SDK. Внешняя native блокировка остаётся
+удержанной до возврата метода. После ACK движок повторно проверяет срок и
+свежесть, сохраняет `rejected` и возвращает стандартное подтверждение отказа.
+Повторные `accept` и `reconcile` возвращают тот же отказ для точной команды;
+коллизия UUID с другими входами запрещена.
+
+Потеря ACK, ошибка сохранения или утрата владения оставляют pending и исходную
+неопределённость. `reconcile` для pending возвращает `null`; повторное восстановление
+требует нового фактически удерживаемого guard с прежней идентичностью команды,
+parent, установки, credential revision, stream и baseline. Generation новой
+временной native/central блокировки может отличаться; это не продлевает старую
+блокировку или исходные часы. Прежние точные доказательства сохраняются в
+частном `admissionRejection.priorProofs` (не более 100), новый digest связывает
+текущее доказательство. Уже завершённый отказ и его ACK не переписываются.
+Pending запрещает новый приём; `save` через другие API того же процесса также
+запрещён во время восстановления. Адаптер учитывает этот дискриминатор при
+выборе worker-задач и при изменении конфигурации. Native fence и проверка
+неопределённого состояния после перезапуска остаются обязательны, в том числе
+когда запись pending физически не удалось сохранить. HTTP не принимает
+доверенный callback или эти доказательства из пользовательского JSON.
+
 ## Сборка и выпуск
 
 ```sh

package/dist/index.mjs

@@ -1,4 +1,5 @@
 export * from './pipeline.mjs';
 export * from './source-store.mjs';
 export * from './producer.mjs';
+export { publicationFailureProofDigest } from './producer-publication-failure.mjs';
 export { createProtectedJsonStore } from './journal.mjs';

package/dist/producer-journal.mjs

@@ -1,7 +1,10 @@
 import assert from 'node:assert/strict';
 import { hash, canonical, keys, uuid } from './protocol-internals.mjs';
 import { validateRunnerCommand, validateProducerSnapshot } from './protocol.mjs';
-import { validatePublicationFailureRecord } from './producer-publication-failure.mjs';
+import {
+  validatePublicationFailureRecord,
+  validatePublicationFailureReadback,
+} from './producer-publication-failure.mjs';
 
 /** Validate persisted state before any provider command can run after restart. */
 export function validProducerState(state, installationKey, sourcePolicy) {
@@ -30,7 +33,8 @@ export function validProducerState(state, installationKey, sourcePolicy) {
         validatePublicationFailureRecord(
           item.publicationFailureReconciliation,
           item.command,
-          item.deliveryExecution
+          item.deliveryExecution,
+          item.baseline
         );
     }
     validateProducerSnapshot(
@@ -58,7 +62,21 @@ export function validProducerState(state, installationKey, sourcePolicy) {
         if (reconciliation.state === 'settled') {
           assert.equal(run.status, 'failed');
           assert.equal(run.recoveryState, 'verified');
+          assert.ok(run.completedAt);
+          validatePublicationFailureReadback(
+            reconciliation.baselineReadback,
+            state.commands[run.commandId].command,
+            state.commands[run.commandId].baseline,
+            new Date(run.completedAt)
+          );
         } else assert.equal(run.status, 'blocked');
+        if (reconciliation.baselineReadback != null) {
+          assert.deepEqual(run.readback, reconciliation.baselineReadback);
+          if (reconciliation.state === 'pending') {
+            assert.equal(run.recoveryState, 'unverified');
+            assert.equal(run.completedAt, null);
+          }
+        }
       }
     }
     return true;

package/dist/producer-publication-failure.mjs

@@ -1,10 +1,22 @@
 import assert from 'node:assert/strict';
-import { canonical, hash, keys, timestamp } from './protocol-internals.mjs';
+import {
+  canonical,
+  hash,
+  keys,
+  timestamp,
+  completeIdentity,
+  validateReadback,
+} from './protocol-internals.mjs';
+import { acceptedProduction, sameIdentity } from './protocol.mjs';
 import { validateOriginalDelivery, blocker } from './producer-support.mjs';
 import { verifyPublicationDelivery } from './producer-delivery.mjs';
 import { reservePublicationFailureReconciliation } from './exclusive-operation.mjs';
 
 const stages = ['source_ready', 'ci', 'build', 'verify', 'publish'];
+export function publicationFailureProofDigest(fact, baselineReadback) {
+  return `sha256:${hash(canonical({ fact, baselineReadback }))}`;
+}
+
 export function validatePublicationFailureFact(fact, command, delivery) {
   keys(fact, [
     'schema',
@@ -44,11 +56,45 @@ export function validatePublicationFailureFact(fact, command, delivery) {
   return fact;
 }
 
-export function validatePublicationFailureRecord(record, command, delivery) {
-  keys(record, ['state', 'fact']);
+export function validatePublicationFailureReadback(readback, command, baseline, now) {
+  assert.ok(completeIdentity(baseline?.identity), 'Retained production baseline required');
+  validateReadback(baseline);
+  assert.equal(baseline.installationKey, command.installationKey);
+  validateReadback(readback);
+  assert.ok(sameIdentity(readback.identity, baseline.identity), 'Production baseline changed');
+  assert.equal(readback.installationKey, command.installationKey);
+  assert.equal(readback.source, 'independent-production');
+  assert.equal(readback.functionalSmoke.status, 'passed');
+  assert.equal(readback.functionalSmoke.sourceCommit, baseline.identity.sourceCommit);
+  const observations = [readback.observedAt, readback.functionalSmoke.checkedAt];
+  assert.ok(
+    observations.every((value) => Date.parse(value) >= Date.parse(command.requestedAt)),
+    'Baseline observations must preserve the original request boundary'
+  );
+  if (now) {
+    assert.ok(
+      acceptedProduction(readback, { ...command, expectedIdentity: baseline.identity }, now),
+      'Independent production baseline acceptance required'
+    );
+    assert.ok(
+      observations.every((value) => now.getTime() - Date.parse(value) <= 300000),
+      'Fresh production baseline readback required'
+    );
+  }
+  return readback;
+}
+
+export function validatePublicationFailureRecord(record, command, delivery, baseline) {
+  keys(record, ['state', 'fact'], ['baselineReadback']);
   assert.ok(['pending', 'settled'].includes(record.state));
   assert.ok(record.state === 'pending' || record.fact !== null);
   if (record.fact !== null) validatePublicationFailureFact(record.fact, command, delivery);
+  if (record.baselineReadback != null) {
+    assert.ok(record.fact, 'Baseline proof requires its publication failure fact');
+    validatePublicationFailureReadback(record.baselineReadback, command, baseline);
+  }
+  if (record.state === 'settled')
+    assert.ok(record.baselineReadback, 'Settled recovery requires its production baseline proof');
 }
 
 export async function reconcilePublicationFailure(producer, item, run) {
@@ -86,8 +132,14 @@ export async function reconcilePublicationFailure(producer, item, run) {
       .then(() => owned.release({ resolved: false, proofDigest: null }))
       .catch(() => {});
   try {
-    item.publicationFailureReconciliation ??= { state: 'pending', fact: null };
+    item.publicationFailureReconciliation ??= {
+      state: 'pending',
+      fact: null,
+      baselineReadback: null,
+    };
     assert.equal(item.publicationFailureReconciliation.state, 'pending');
+    run.recoveryState = 'unverified';
+    run.completedAt = null;
     await bounded(producer.save());
     const arriving = Promise.resolve().then(() =>
       producer.provider.reconcilePublicationFailure(structuredClone(item.command), {
@@ -113,8 +165,26 @@ export async function reconcilePublicationFailure(producer, item, run) {
     const fact = structuredClone(
       validatePublicationFailureFact(guard.fact, item.command, item.deliveryExecution)
     );
-    const age = producer.now().getTime() - Date.parse(fact.observedAt);
-    assert.ok(age >= -30000 && age <= 30000, 'Fresh publication failure authority required');
+    const baselineReadback = structuredClone(
+      validatePublicationFailureReadback(
+        guard.baselineReadback,
+        item.command,
+        item.baseline,
+        producer.now()
+      )
+    );
+    const assertFresh = () => {
+      const now = producer.now();
+      assert.ok(
+        now.getTime() <= recoveryDeadlineAt,
+        'Publication failure recovery deadline expired'
+      );
+      const age = now.getTime() - Date.parse(fact.observedAt);
+      assert.ok(age >= -30000 && age <= 30000, 'Fresh publication failure authority required');
+      validatePublicationFailureReadback(baselineReadback, item.command, item.baseline, now);
+      return now;
+    };
+    assertFresh();
     const row = run.stages.find((stage) => stage.id === fact.stage);
     assert.ok(
       row && !['passed', 'reused'].includes(row.status),
@@ -132,18 +202,25 @@ export async function reconcilePublicationFailure(producer, item, run) {
     await bounded(guard.assertOwned());
     lease.assertOwned();
     controller.signal.throwIfAborted();
+    assertFresh();
     item.publicationFailureReconciliation.fact = fact;
+    item.publicationFailureReconciliation.baselineReadback = baselineReadback;
     item.deliveryExecution = structuredClone(fact.delivery);
+    run.readback = structuredClone(baselineReadback);
     await bounded(producer.save());
-    const proofDigest = `sha256:${hash(canonical(fact))}`;
+    const proofDigest = publicationFailureProofDigest(fact, baselineReadback);
     await bounded(guard.assertOwned());
+    lease.assertOwned();
+    controller.signal.throwIfAborted();
+    assertFresh();
     releasing = true;
     await bounded(guard.release({ resolved: true, proofDigest }));
     controller.signal.throwIfAborted();
     lease.assertOwned();
+    const completedAt = assertFresh().toISOString();
     run.status = 'failed';
     run.recoveryState = 'verified';
-    run.completedAt = producer.now().toISOString();
+    run.completedAt = completedAt;
     run.blockers = [
       blocker(
         'FAILED_BEFORE_INSTALLATION',
@@ -166,6 +243,8 @@ export async function reconcilePublicationFailure(producer, item, run) {
     item.publicationFailureReconciliation ??= { state: 'pending', fact: null };
     item.publicationFailureReconciliation.state = 'pending';
     run.status = 'blocked';
+    run.recoveryState = 'unverified';
+    run.completedAt = null;
     run.blockers = [
       blocker(
         'RECONCILIATION_REQUIRED',

package/dist/producer.d.ts

@@ -98,9 +98,14 @@ export interface PublicationFailureFact {
 }
 export interface PublicationFailureGuard {
   fact: PublicationFailureFact;
+  baselineReadback: ProductionReadback;
   assertOwned(): Promise<void>;
   release(options: { resolved: boolean; proofDigest: string | null }): Promise<void>;
 }
+export function publicationFailureProofDigest(
+  fact: PublicationFailureFact,
+  baselineReadback: ProductionReadback
+): string;
 export class ReleaseControlProducer {
   constructor(options: {
     installationKey: string;

package/dist/producer.mjs

@@ -3,6 +3,7 @@ import { sameIdentity, acceptedProduction } from './protocol.mjs';
 import { blocker, failureMessage, failedProduction } from './producer-support.mjs';
 import { ProducerExecution } from './producer-execution.mjs';
 import { reconcilePublicationFailure } from './producer-publication-failure.mjs';
+export { publicationFailureProofDigest } from './producer-publication-failure.mjs';
 export {
   sameIdentity,
   validateExpectedSource,

package/dist/provenance.json

@@ -1,41 +1,42 @@
 {
   "schema": 1,
   "package": "@casecore/release-agent",
-  "version": "0.1.1",
-  "sourceCommit": "afb036322db3a5ff3bbe4d3d2d975837ebf469b1",
+  "version": "0.1.3",
+  "sourceCommit": "a9736762537078698065c74bbb0febb675b980c7",
   "sourceVerified": true,
   "sourceDirty": false,
   "buildKind": "release",
-  "contentDigest": "sha256:c5f5749d35f85bf2ae7878983ecfd0ef77ee065e1526bf29d54680ddf1b9cc70",
+  "contentDigest": "sha256:21d9013bdd65fefe213eee463eaa9dc13bb2ee1647f392e2c6c90ca5953d2886",
   "files": {
     "src/configuration-hook.mjs": "sha256:1171bf982cbf7cb0092f63b633ef0b0a0947d8ed1106f88c9175c8add33d81b1",
     "src/exclusive-operation.mjs": "sha256:5a1d0b7d3aa41b901132e239586d66d6c7aa2c16682a7db033a7aab91b1d781a",
     "src/identity.mjs": "sha256:253021058fc79232d83f3ecba6f1023fd046f27aabdf9c129a103d3c9ccb07f5",
-    "src/index.mjs": "sha256:38d3ebcffe8716f7146c18061d26a392d7784b97a79c59ed53ff839175de2f94",
+    "src/index.mjs": "sha256:76bda5e1dc376bb7033d8fdbddb0afa85c7c68bbe028aea078ffceaaa35ec75e",
     "src/journal.mjs": "sha256:35a2620d56084ec1aa164e09d77b8e77096413d9572f7b601da8ef7149b996bd",
     "src/pipeline.mjs": "sha256:7a2d39d235ce7160441d177200389c5f3eae1cc494ec36082a23e8d64a0abe3f",
     "src/producer-admission.mjs": "sha256:975c7dac25d4c8f94423e5a4db2bd99c556afd6492b26fbda58e841f1df8fc3c",
     "src/producer-delivery.mjs": "sha256:b20d9ae20dee90bbbe739245a84c9f4b91b1ab958b5e2995ff8705da24ba3988",
     "src/producer-execution.mjs": "sha256:6d9fbca493e4386c92c4d853a66ece3677ec7ab644d6da15b68dd744f30186ef",
-    "src/producer-journal.mjs": "sha256:4799a2224ff1004d68892b807b222da708f8f51e0554b01f54d5c877a8ef84bd",
-    "src/producer-publication-failure.mjs": "sha256:513e71276c7ce4088c95cb3605917afc4709cbb7222ac746958923d7f18eac70",
+    "src/producer-journal.mjs": "sha256:0934057702fb611b9a8d9dde58cb2c2024f436a49a4e5f6ab02f8884a320cea7",
+    "src/producer-publication-failure.mjs": "sha256:726b2b85880143b70219473896b894f64b25b1c495f77488f1e73ce950b839f6",
     "src/producer-publication.mjs": "sha256:c09fa07b37507093b71bbaff3af9df8ec2331c0cba24a4b936d247e9b35257f7",
     "src/producer-server.mjs": "sha256:def28e10a17eb80fb04ba69b09050731bb005949f949a7f1fb46dae267323434",
     "src/producer-state.mjs": "sha256:c3fcdace4c6579be092d39803cfb308e4bf88060b3f75bb7fc8b91284609b4ce",
     "src/producer-support.mjs": "sha256:0a10f6fa50cd8e729ba432640d0845004488ead2bcc1c9383f02548037f83d66",
-    "src/producer.mjs": "sha256:7dd4e6118531c25c6d5547d769263858e556731c76af87fba4c21c8ed98b3994",
+    "src/producer.mjs": "sha256:6d0b875a9901a14edf5b93c771356f5352e924ff7977c13b027343c9bdca42f4",
     "src/protocol-internals.mjs": "sha256:d08a0c72079d091792c5327adafac5ffc38ea20138a6c44b88879e7157a890b3",
     "src/protocol.mjs": "sha256:1fe135a2e60922b517886a392c2b0c2250b773abda8b1a1fcd9af86df2be6dae",
     "src/snapshot-validator.mjs": "sha256:1279aa19e0932776bc1998935f70ca6fae65391f96b60e2d65bcab3b2cb46036",
-    "src/source-admission.mjs": "sha256:da083d984b1c0eb018ec464057ce320108a79e1aed3231ab22e8110c32a48363",
-    "src/source-store.mjs": "sha256:5473094f0b75cf73673762530ea1b8db286106c58942bc5670395b0c9fe19a77",
+    "src/source-admission.mjs": "sha256:25e0e3cc163895c3f6b5057162538c4c313bd37e67956c63b2624df52517b437",
+    "src/source-non-admission.mjs": "sha256:a2308518c8337b662946c5778fe30a5a35a6e7f0b8ed6130eeca93d8ea959ded",
+    "src/source-store.mjs": "sha256:b58a833518086a3d64fe163c323c90b6d6f4cd0793982891146c0a5f9d7241b9",
     "src/stage-journal.mjs": "sha256:96321418e4f8b48aba3dd0a4269a8f345d6763acb81f3b1e330ba3baf06a213e",
     "types/index.d.ts": "sha256:92ef7b5600f05d52dcb646fc3e4d2b4944ead52ff1c9ee23bb9f4659bebf05a6",
     "types/journal.d.ts": "sha256:79beb61af50b00400588a87426a7f5b38bf38d4b8224284dc6e0631378aa244e",
     "types/pipeline.d.ts": "sha256:c9135e25fb852377c32a16ce781405393c5857886e3f77754b715747202c70a9",
-    "types/producer.d.ts": "sha256:16ec1e81964a982c9653cdfe70eb3aa22ea8dd7200c2949a8e6731686df7a7bb",
+    "types/producer.d.ts": "sha256:980aad137365f6c131b6bfabfab411a73c4a2b2fb35a167152ef8ed446ec1ade",
     "types/protocol.d.ts": "sha256:02c06986c81bfc4214169f62da8e0566704b71a5add58434dfca92c673fad4ce",
-    "types/source-store.d.ts": "sha256:de044c2bca9826b6c20caefb00d22a4c78183a869b8835fb8f15935989e2372a",
+    "types/source-store.d.ts": "sha256:ce2086dd682e8f57bc5e1581b411ec9fe1cf1cfba8dccafe38c22d102c2b9904",
     "types/types.d.ts": "sha256:cdc6664854bffc371a3da45f29bf1b31f14fd61b66e8f8bae8309dd836f6de6e"
   }
 }

package/dist/source-admission.mjs

@@ -1,5 +1,6 @@
 import { isDeepStrictEqual } from 'node:util';
 import { createHash } from 'node:crypto';
+import { admissionRejectionAck } from './source-non-admission.mjs';
 
 const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
 const identity = (value) =>
@@ -138,6 +139,7 @@ export function admitArtifactCommand(command, state, options, helpers) {
   const reject = (code, message) =>
     ack(command.commandId, 'rejected', sourceBlocker(code, message));
   const duplicate = state.commands[command.commandId];
+  if (duplicate?.admissionRejection) return admissionRejectionAck(duplicate, command);
   if (duplicate)
     return isDeepStrictEqual(duplicate.command, command)
       ? ack(command.commandId, 'reconciled')
@@ -185,10 +187,11 @@ export function admitArtifactCommand(command, state, options, helpers) {
   if (
     Object.values(state.commands).some(
       (record) =>
-        record !== previous &&
-        (['queued', 'running', 'unverified'].includes(record.status) ||
-          (['failed', 'blocked'].includes(record.status) &&
-            !['verified', 'not_required'].includes(record.recoveryState)))
+        record.admissionRejection?.state === 'pending' ||
+        (record !== previous &&
+          (['queued', 'running', 'unverified'].includes(record.status) ||
+            (['failed', 'blocked'].includes(record.status) &&
+              !['verified', 'not_required'].includes(record.recoveryState))))
     )
   )
     return reject('release_in_progress', 'Another canonical execution is not yet reconciled.');
@@ -317,6 +320,7 @@ export function sourceProgress(state, cursor, now, { sourceCandidate, sourceTime
     candidates.set(candidate.id, candidate);
   };
   for (const record of Object.values(state.commands)) {
+    if (record.admissionRejection) continue;
     const sourceCommand = record.sourceCommand ?? record.command;
     const candidate = sourceCandidate(
       sourceCommand.expectedSource,

package/dist/source-non-admission.mjs

@@ -0,0 +1,430 @@
+import assert from 'node:assert/strict';
+import { isDeepStrictEqual } from 'node:util';
+import {
+  canonical,
+  hash,
+  keys,
+  completeIdentity,
+  validateReadback,
+  timestamp,
+} from './protocol-internals.mjs';
+import { acceptedProduction, sameIdentity } from './protocol.mjs';
+import { validPublishCommand } from './source-store.mjs';
+
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+const scopeFields = [
+  'tenantId',
+  'workspaceId',
+  'parentRunId',
+  'operationGeneration',
+  'credentialRevision',
+  'streamId',
+  'baselineIdentity',
+];
+const operations = new Map();
+const reason = {
+  code: 'command_not_admitted',
+  message: 'Команда не была принята исполнителем; отсутствие выполнения подтверждено',
+  retryable: false,
+};
+const acknowledgement = (command) => ({
+  protocolVersion: 1,
+  commandId: command.commandId,
+  runId: command.commandId,
+  state: 'rejected',
+  reason: structuredClone(reason),
+});
+
+export function nonAdmissionProofDigest(command, fact, baselineReadback) {
+  return `sha256:${hash(canonical({ command, fact, baselineReadback }))}`;
+}
+function validateScope(scope) {
+  keys(scope, scopeFields);
+  for (const key of ['tenantId', 'workspaceId', 'parentRunId', 'operationGeneration'])
+    assert.match(scope[key], uuid);
+  assert.ok(Number.isSafeInteger(scope.credentialRevision) && scope.credentialRevision > 0);
+  assert.ok(
+    typeof scope.streamId === 'string' && scope.streamId.length > 0 && scope.streamId.length <= 200
+  );
+  assert.ok(
+    completeIdentity(scope.baselineIdentity),
+    'Complete retained baseline identity required'
+  );
+}
+function validateFact(fact, command, scope) {
+  keys(fact, [
+    'schema',
+    'kind',
+    'commandId',
+    'installationKey',
+    'expectedSource',
+    'executionProvider',
+    'requestedAt',
+    'deadlineAt',
+    ...scopeFields,
+    'observedAt',
+    'authenticated',
+    'admissionStopped',
+    'journalAbsenceVerified',
+    'executionNotStarted',
+    'installationNotStarted',
+    'pendingTransaction',
+    'baselineUnchanged',
+  ]);
+  assert.equal(fact.schema, 1);
+  assert.equal(fact.kind, 'command_not_admitted');
+  for (const key of [
+    'commandId',
+    'installationKey',
+    'executionProvider',
+    'requestedAt',
+    'deadlineAt',
+  ])
+    assert.equal(fact[key], command[key]);
+  assert.deepEqual(fact.expectedSource, command.expectedSource);
+  const actualScope = Object.fromEntries(scopeFields.map((key) => [key, fact[key]]));
+  validateScope(actualScope);
+  if (scope) assert.deepEqual(actualScope, scope, 'Non-admission ownership scope changed');
+  timestamp(fact.observedAt);
+  for (const key of [
+    'authenticated',
+    'admissionStopped',
+    'journalAbsenceVerified',
+    'executionNotStarted',
+    'installationNotStarted',
+    'baselineUnchanged',
+  ])
+    assert.equal(fact[key], true);
+  assert.equal(fact.pendingTransaction, false);
+}
+function validateBaseline(readback, command, fact, now) {
+  validateReadback(readback);
+  assert.equal(readback.installationKey, command.installationKey);
+  assert.ok(
+    sameIdentity(readback.identity, fact.baselineIdentity),
+    'Non-admission baseline changed'
+  );
+  assert.equal(readback.source, 'independent-production');
+  assert.equal(readback.functionalSmoke.status, 'passed');
+  assert.equal(readback.functionalSmoke.sourceCommit, fact.baselineIdentity.sourceCommit);
+  const observations = [readback.observedAt, readback.functionalSmoke.checkedAt];
+  assert.ok(
+    observations.every((value) => Date.parse(value) >= Date.parse(command.requestedAt)),
+    'Baseline proof precedes the original request'
+  );
+  if (now !== undefined) {
+    assert.ok(
+      acceptedProduction(
+        readback,
+        { ...command, expectedIdentity: fact.baselineIdentity },
+        new Date(now)
+      ),
+      'Independent baseline acceptance required'
+    );
+    assert.ok(
+      observations.every((value) => now - Date.parse(value) <= 300000),
+      'Fresh independent baseline required'
+    );
+    const age = now - Date.parse(fact.observedAt);
+    assert.ok(age >= -30000 && age <= 30000, 'Fresh non-admission authority required');
+  }
+}
+function immutableFact(fact) {
+  const { observedAt: _time, operationGeneration: _generation, ...identity } = fact;
+  return identity;
+}
+export function validNonAdmissionRecord(record) {
+  try {
+    keys(record, ['command', 'admissionRejection']);
+    const command = record.command;
+    assert.ok(
+      validPublishCommand(
+        command,
+        command.installationKey,
+        command.expectedSource?.repository,
+        command.expectedSource?.ref
+      )
+    );
+    const proof = record.admissionRejection;
+    keys(
+      proof,
+      [
+        'schema',
+        'state',
+        'fact',
+        'baselineReadback',
+        'proofDigest',
+        'acknowledgement',
+        'completedAt',
+      ],
+      ['priorProofs']
+    );
+    assert.equal(proof.schema, 1);
+    assert.ok(['pending', 'rejected'].includes(proof.state));
+    validateFact(proof.fact, command);
+    validateBaseline(proof.baselineReadback, command, proof.fact);
+    assert.equal(
+      proof.proofDigest,
+      nonAdmissionProofDigest(command, proof.fact, proof.baselineReadback)
+    );
+    assert.deepEqual(proof.acknowledgement, acknowledgement(command));
+    if (proof.priorProofs !== undefined) {
+      assert.ok(Array.isArray(proof.priorProofs) && proof.priorProofs.length <= 100);
+      const digests = new Set([proof.proofDigest]);
+      for (const prior of proof.priorProofs) {
+        keys(prior, ['fact', 'baselineReadback', 'proofDigest']);
+        validateFact(prior.fact, command);
+        validateBaseline(prior.baselineReadback, command, prior.fact);
+        assert.deepEqual(
+          immutableFact(prior.fact),
+          immutableFact(proof.fact),
+          'Retained non-admission scope changed'
+        );
+        assert.equal(
+          prior.proofDigest,
+          nonAdmissionProofDigest(command, prior.fact, prior.baselineReadback)
+        );
+        assert.ok(!digests.has(prior.proofDigest), 'Duplicate non-admission attempt proof');
+        digests.add(prior.proofDigest);
+      }
+    }
+    if (proof.state === 'pending') assert.equal(proof.completedAt, null);
+    else {
+      timestamp(proof.completedAt);
+      validateBaseline(proof.baselineReadback, command, proof.fact, Date.parse(proof.completedAt));
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+export function nonAdmissionBusy(path) {
+  return operations.has(path);
+}
+export function admissionRejectionAck(record, command) {
+  assert.ok(validNonAdmissionRecord(record), 'Invalid non-admission receipt');
+  if (command)
+    assert.deepEqual(record.command, command, 'Command ID is bound to different immutable inputs');
+  assert.equal(record.admissionRejection.state, 'rejected', 'NON_ADMISSION_RECONCILIATION_PENDING');
+  return structuredClone(record.admissionRejection.acknowledgement);
+}
+
+/** The caller supplies actual native and central exclusion; journal absence alone has no authority. */
+export async function reconcileNonAdmission(journal, command, context) {
+  command = structuredClone(command);
+  assert.ok(
+    validPublishCommand(
+      command,
+      context.installationKey,
+      context.repository,
+      context.ref ?? 'main'
+    ),
+    'Invalid scoped source command'
+  );
+  validateScope(context.scope);
+  assert.equal(
+    typeof context.acquireGuard,
+    'function',
+    'Trusted non-admission guard callback required'
+  );
+  const clock = context.now ?? Date.now;
+  const deadline = context.recoveryDeadlineAt;
+  const prior = operations.get(journal.path);
+  assert.ok(
+    !prior || (prior.state === 'held' && prior.commandId === command.commandId),
+    'NON_ADMISSION_OPERATION_BUSY'
+  );
+  const operation = { commandId: command.commandId, state: 'active' };
+  operations.set(journal.path, operation);
+  let guard,
+    timer,
+    releasing = false,
+    settled = false,
+    retain = prior !== undefined;
+  const controller = new AbortController();
+  const signal = context.signal
+    ? AbortSignal.any([context.signal, controller.signal])
+    : controller.signal;
+  const alive = () => {
+    signal.throwIfAborted();
+    assert.ok(
+      Number.isSafeInteger(deadline) && deadline > clock() && deadline <= clock() + 30000,
+      'Non-admission recovery deadline expired'
+    );
+  };
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => {
+        controller.abort();
+        reject(Error('Non-admission recovery timed out'));
+      },
+      Math.max(1, Math.min(30000, deadline - clock()))
+    );
+  });
+  const bounded = (promise) => Promise.race([promise, timeout]);
+  const cleanup = (owned) =>
+    Promise.resolve()
+      .then(() => owned.release({ resolved: false, proofDigest: null }))
+      .catch(() => {});
+  let pending;
+  try {
+    alive();
+    const existing = journal.read().commands[command.commandId];
+    if (existing) {
+      assert.deepEqual(
+        existing.command,
+        command,
+        'Command ID is bound to different immutable inputs'
+      );
+      assert.ok(
+        existing.admissionRejection,
+        'Command already admitted; use its existing recovery boundary'
+      );
+      retain = true;
+      validateFact(existing.admissionRejection.fact, command, {
+        ...context.scope,
+        operationGeneration: existing.admissionRejection.fact.operationGeneration,
+      });
+      if (existing.admissionRejection.state === 'rejected') {
+        settled = true;
+        return admissionRejectionAck(existing, command);
+      }
+    }
+    const arriving = Promise.resolve().then(() =>
+      context.acquireGuard(structuredClone(command), {
+        signal,
+        recoveryDeadlineAt: deadline,
+        scope: structuredClone(context.scope),
+      })
+    );
+    arriving.then(
+      (late) => {
+        if (signal.aborted && late && typeof late.release === 'function') void cleanup(late);
+      },
+      () => {}
+    );
+    guard = await bounded(arriving);
+    if (guard === null) return null;
+    retain = true;
+    assert.ok(
+      guard && typeof guard.assertOwned === 'function' && typeof guard.release === 'function',
+      'Held non-admission guard required'
+    );
+    const fact = structuredClone(guard.fact),
+      baselineReadback = structuredClone(guard.baselineReadback);
+    validateFact(fact, command, context.scope);
+    const fresh = () => {
+      alive();
+      const now = clock();
+      assert.ok(now < deadline, 'Non-admission recovery deadline expired');
+      validateBaseline(baselineReadback, command, fact, now);
+      return now;
+    };
+    await bounded(guard.assertOwned());
+    fresh();
+    const state = journal.read();
+    const previous = state.commands[command.commandId];
+    if (previous) {
+      assert.deepEqual(
+        previous.command,
+        command,
+        'Command ID is bound to different immutable inputs'
+      );
+      assert.ok(previous.admissionRejection?.state === 'pending', 'Non-admission receipt changed');
+      assert.deepEqual(
+        immutableFact(fact),
+        immutableFact(previous.admissionRejection.fact),
+        'Non-admission identity changed'
+      );
+    }
+    assert.ok(
+      Object.entries(state.commands).every(
+        ([id, record]) =>
+          id === command.commandId ||
+          (record.admissionRejection
+            ? record.admissionRejection.state === 'rejected'
+            : !['queued', 'running', 'unverified'].includes(record.status) &&
+              (!['failed', 'blocked'].includes(record.status) ||
+                ['verified', 'not_required'].includes(record.recoveryState)))
+      ),
+      'Other source work requires reconciliation'
+    );
+    assert.ok(
+      previous || Object.keys(state.commands).length < 100,
+      'Source journal retention requires reconciliation'
+    );
+    pending = {
+      command,
+      admissionRejection: {
+        schema: 1,
+        state: 'pending',
+        fact,
+        baselineReadback,
+        proofDigest: nonAdmissionProofDigest(command, fact, baselineReadback),
+        acknowledgement: acknowledgement(command),
+        completedAt: null,
+      },
+    };
+    if (previous) {
+      const retained = previous.admissionRejection;
+      const history = structuredClone(retained.priorProofs ?? []);
+      if (retained.proofDigest !== pending.admissionRejection.proofDigest) {
+        assert.ok(history.length < 100, 'Non-admission attempt retention requires reconciliation');
+        history.push({
+          fact: structuredClone(retained.fact),
+          baselineReadback: structuredClone(retained.baselineReadback),
+          proofDigest: retained.proofDigest,
+        });
+      }
+      pending.admissionRejection.priorProofs = history;
+    }
+    state.commands[command.commandId] = pending;
+    journal.save(state);
+    await bounded(guard.assertOwned());
+    fresh();
+    releasing = true;
+    await bounded(
+      guard.release({ resolved: true, proofDigest: pending.admissionRejection.proofDigest })
+    );
+    fresh();
+    const latest = journal.read();
+    assert.deepEqual(
+      latest.commands[command.commandId],
+      pending,
+      'Protected non-admission receipt changed'
+    );
+    const completed = structuredClone(pending);
+    completed.admissionRejection.state = 'rejected';
+    completed.admissionRejection.completedAt = new Date(fresh()).toISOString();
+    latest.commands[command.commandId] = completed;
+    journal.save(latest);
+    fresh();
+    settled = true;
+    return admissionRejectionAck(completed, command);
+  } catch (error) {
+    if (pending) {
+      try {
+        const latest = journal.read(),
+          selected = latest.commands[command.commandId];
+        if (
+          isDeepStrictEqual(selected, pending) ||
+          (selected?.admissionRejection?.state === 'rejected' &&
+            isDeepStrictEqual(selected.command, command) &&
+            selected.admissionRejection.proofDigest === pending.admissionRejection.proofDigest)
+        ) {
+          latest.commands[command.commandId] = pending;
+          journal.save(latest);
+        }
+      } catch {
+        /* Retain in-process ownership; native startup must also refuse uncertain recovery. */
+      }
+    }
+    throw error;
+  } finally {
+    controller.abort();
+    clearTimeout(timer);
+    if (guard && !settled && !releasing && typeof guard.release === 'function') void cleanup(guard);
+    if (settled || !retain) operations.delete(journal.path);
+    else operation.state = 'held';
+  }
+}

package/dist/source-store.d.ts

@@ -5,7 +5,76 @@ import type {
   Blocker,
   StageId,
   ArtifactIdentity,
+  ProductionReadback,
 } from './types.js';
+export interface NonAdmissionScope {
+  tenantId: string;
+  workspaceId: string;
+  parentRunId: string;
+  operationGeneration: string;
+  credentialRevision: number;
+  streamId: string;
+  baselineIdentity: ArtifactIdentity;
+}
+export interface NonAdmissionFact extends NonAdmissionScope {
+  schema: 1;
+  kind: 'command_not_admitted';
+  commandId: string;
+  installationKey: string;
+  expectedSource: ExpectedSource;
+  executionProvider: 'github' | 'local';
+  requestedAt: string;
+  deadlineAt: string;
+  observedAt: string;
+  authenticated: true;
+  admissionStopped: true;
+  journalAbsenceVerified: true;
+  executionNotStarted: true;
+  installationNotStarted: true;
+  pendingTransaction: false;
+  baselineUnchanged: true;
+}
+export interface NonAdmissionGuard {
+  fact: NonAdmissionFact;
+  baselineReadback: ProductionReadback;
+  assertOwned(): Promise<void>;
+  release(options: { resolved: boolean; proofDigest: string | null }): Promise<void>;
+}
+export interface NonAdmissionContext {
+  installationKey: string;
+  repository: string;
+  ref?: string;
+  scope: NonAdmissionScope;
+  signal?: AbortSignal;
+  recoveryDeadlineAt: number;
+  now?: () => number;
+  acquireGuard(
+    command: RunnerCommand,
+    context: { signal: AbortSignal; recoveryDeadlineAt: number; scope: NonAdmissionScope }
+  ): Promise<NonAdmissionGuard | null>;
+}
+export interface NonAdmissionRecord {
+  command: RunnerCommand;
+  admissionRejection: {
+    schema: 1;
+    state: 'pending' | 'rejected';
+    fact: NonAdmissionFact;
+    baselineReadback: ProductionReadback;
+    proofDigest: string;
+    acknowledgement: Acknowledgement;
+    completedAt: string | null;
+    priorProofs?: {
+      fact: NonAdmissionFact;
+      baselineReadback: ProductionReadback;
+      proofDigest: string;
+    }[];
+  };
+}
+export function nonAdmissionProofDigest(
+  command: RunnerCommand,
+  fact: NonAdmissionFact,
+  baselineReadback: ProductionReadback
+): string;
 export interface SourceState {
   schema: 1;
   cursor: number;
@@ -50,6 +119,10 @@ export function sourceStore(
     options: { installationKey: string; repository: string; ref?: string; now?: number }
   ): Acknowledgement;
   reconcile(commandId: string): Acknowledgement | null;
+  reconcileNonAdmission(
+    command: RunnerCommand,
+    context: NonAdmissionContext
+  ): Promise<Acknowledgement | null>;
 };
 export function progress(
   state: SourceState,

package/dist/source-store.mjs

@@ -1,6 +1,13 @@
 import { isDeepStrictEqual } from 'node:util';
 import { createProtectedJsonStore } from './journal.mjs';
 import { admitArtifactCommand, sourceProgress } from './source-admission.mjs';
+import {
+  validNonAdmissionRecord,
+  admissionRejectionAck,
+  nonAdmissionBusy,
+  reconcileNonAdmission,
+} from './source-non-admission.mjs';
+export { nonAdmissionProofDigest } from './source-non-admission.mjs';
 
 const fields = (value, keys) =>
   value &&
@@ -106,27 +113,29 @@ export function validSourceState(state) {
         record.command?.commandId === id &&
         record.command.protocolVersion === 1 &&
         ['publish', 'deploy', 'retry', 'rollback'].includes(record.command.action) &&
-        [
-          'queued',
-          'running',
-          'failed',
-          'blocked',
-          'deployed',
-          'rolled_back',
-          'unverified',
-        ].includes(record.status) &&
-        sourceTimestamp(record.acceptedAt) &&
-        (record.completedAt === null || sourceTimestamp(record.completedAt)) &&
-        Array.isArray(record.stages) &&
-        record.stages.length === sourceStageDefinitions.length &&
-        sourceStageDefinitions.every(
-          ([stageId]) => record.stages.filter((stage) => stage.id === stageId).length === 1
-        ) &&
-        Array.isArray(record.blockers) &&
-        record.blockers.length <= 100 &&
-        record.dispatches &&
-        typeof record.dispatches === 'object' &&
-        !Array.isArray(record.dispatches)
+        (Object.hasOwn(record, 'admissionRejection')
+          ? validNonAdmissionRecord(record)
+          : [
+              'queued',
+              'running',
+              'failed',
+              'blocked',
+              'deployed',
+              'rolled_back',
+              'unverified',
+            ].includes(record.status) &&
+            sourceTimestamp(record.acceptedAt) &&
+            (record.completedAt === null || sourceTimestamp(record.completedAt)) &&
+            Array.isArray(record.stages) &&
+            record.stages.length === sourceStageDefinitions.length &&
+            sourceStageDefinitions.every(
+              ([stageId]) => record.stages.filter((stage) => stage.id === stageId).length === 1
+            ) &&
+            Array.isArray(record.blockers) &&
+            record.blockers.length <= 100 &&
+            record.dispatches &&
+            typeof record.dispatches === 'object' &&
+            !Array.isArray(record.dispatches))
     ) &&
     Array.isArray(state.events) &&
     state.events.length <= 1000
@@ -134,10 +143,21 @@ export function validSourceState(state) {
 }
 
 /** One host driver writes under its shared flock; atomic readers never infer missing success. */
-export function sourceStore(directory, { filename = 'source-publication.json', validateState = validSourceState } = {}) {
-  const journal = createProtectedJsonStore(directory, { filename, validate: validateState, initial: blank });
+export function sourceStore(
+  directory,
+  { filename = 'source-publication.json', validateState = validSourceState } = {}
+) {
+  const journal = createProtectedJsonStore(directory, {
+    filename,
+    validate: validateState,
+    initial: blank,
+  });
   directory = journal.directory;
-  const { read, save } = journal;
+  const { read } = journal;
+  const save = (state) => {
+    if (nonAdmissionBusy(journal.path)) throw new Error('NON_ADMISSION_OPERATION_BUSY');
+    journal.save(state);
+  };
   const event = (
     state,
     record,
@@ -175,6 +195,13 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
     save,
     event,
     accept(command, { installationKey, repository, ref = 'main', now = Date.now() }) {
+      const retained = read().commands[command?.commandId];
+      if (retained?.admissionRejection) {
+        if (!validPublishCommand(command, installationKey, repository, ref))
+          throw new Error('Invalid scoped source publication command.');
+        return admissionRejectionAck(retained, command);
+      }
+      if (nonAdmissionBusy(journal.path)) throw new Error('NON_ADMISSION_OPERATION_BUSY');
       if (command?.action !== 'publish')
         return admitArtifactCommand(
           command,
@@ -186,6 +213,7 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
         throw new Error('Invalid scoped source publication command.');
       const state = read();
       const previous = state.commands[command.commandId];
+      if (previous?.admissionRejection) return admissionRejectionAck(previous, command);
       if (previous)
         return isDeepStrictEqual(previous.command, command)
           ? ack(command.commandId, 'reconciled')
@@ -207,6 +235,7 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
       if (
         Object.values(state.commands).some(
           (record) =>
+            record.admissionRejection?.state === 'pending' ||
             ['queued', 'running', 'unverified'].includes(record.status) ||
             (['failed', 'blocked'].includes(record.status) &&
               record.recoveryState !== 'verified' &&
@@ -269,7 +298,15 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
     },
     reconcile(commandId) {
       if (!uuid.test(commandId ?? '')) throw new Error('Invalid command identity.');
-      return read().commands[commandId] ? ack(commandId, 'reconciled') : null;
+      const record = read().commands[commandId];
+      if (record?.admissionRejection)
+        return record.admissionRejection.state === 'rejected'
+          ? admissionRejectionAck(record)
+          : null;
+      return record ? ack(commandId, 'reconciled') : null;
+    },
+    reconcileNonAdmission(command, context) {
+      return reconcileNonAdmission(journal, command, context);
     },
   };
 }
@@ -304,11 +341,21 @@ export function sourceCandidate(expectedSource, at, blockers = []) {
     },
   };
 }
-export function progress(state, cursor = '0', now = Date.now(), { validateState = validSourceState } = {}) {
+export function progress(
+  state,
+  cursor = '0',
+  now = Date.now(),
+  { validateState = validSourceState } = {}
+) {
   if (!validateState(state) || !/^\d+$/u.test(cursor) || BigInt(cursor) > BigInt(state.cursor))
     throw new Error('Invalid source journal cursor or state.');
   return sourceProgress(state, cursor, now, { sourceCandidate, sourceTimestamp });
 }
 
-export { completeArtifact, baselineCandidateId, admitArtifactCommand, sourceProgress } from './source-admission.mjs';
+export {
+  completeArtifact,
+  baselineCandidateId,
+  admitArtifactCommand,
+  sourceProgress,
+} from './source-admission.mjs';
 export { createStageJournal } from './stage-journal.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casecore/release-agent",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Общий движок поставки CaseCore с адаптерами продуктов",
   "license": "UNLICENSED",
   "repository": {