@cassiomc1/forgeloop 1.14.0 → 2.0.0-rc.2

package/src/core/attestation-verifier.js

@@ -1,3 +1,4 @@
+import { withProjectReadSnapshot } from "../storage/project-read-snapshot.js";
 import { createHash } from "node:crypto";
 
 import { canonicalFingerprint } from "./artifacts.js";
@@ -8,7 +9,8 @@ import { assertRevisionProvider, resolveRevisionProvider } from "./revision/prov
 import { REVISION_PROVIDERS } from "./revision/registry.js";
 import { assertSigningProvider, resolveSigningProvider } from "./signing/provider.js";
 import { SIGNING_PROVIDERS } from "./signing/registry.js";
-import { taskAttestationBundlePath, taskAttestationStatementPath } from "./task-paths.js";
+import { taskAttestationStatementPath } from "./task-paths.js";
+import { resolveAttestationBundlePath } from "./attachment-paths.js";
 import { ensureWithin, fileExists } from "./filesystem.js";
 import { E_ATTESTATION_CONFIGURATION_INVALID } from "./error-codes.js";
 
@@ -130,6 +132,23 @@ export async function verifyAttestation({
   signingProvider = null,
   trustedRoot = null,
   requireSignature = false,
+} = {}) {
+  const options = { target, packageRoot, taskId, revision, bundlePath, identity, issuer, revisionProvider, signingProvider, trustedRoot, requireSignature };
+  return withProjectReadSnapshot(target, () => verifySelectedAttestation(options));
+}
+
+async function verifySelectedAttestation({
+  target,
+  packageRoot = getPackageRoot(),
+  taskId,
+  revision = null,
+  bundlePath = null,
+  identity = null,
+  issuer = null,
+  revisionProvider = null,
+  signingProvider = null,
+  trustedRoot = null,
+  requireSignature = false,
 } = {}) {
   let effectiveRequireSignature = requireSignature === true;
   let effectiveSigningProvider = signingProvider;
@@ -146,7 +165,6 @@ export async function verifyAttestation({
   } catch (error) {
     if (error.code !== "ARTIFACT_MISSING") configurationError = error;
   }
-  if (effectiveRequireSignature && !effectiveBundlePath) effectiveBundlePath = taskAttestationBundlePath(taskId);
   const result = {
     schemaVersion: 1,
     status: "INVALID",
@@ -166,6 +184,7 @@ export async function verifyAttestation({
     return result;
   }
   try {
+    if (effectiveBundlePath || effectiveRequireSignature) effectiveBundlePath = resolveAttestationBundlePath(target, taskId, effectiveBundlePath);
     const statementArtifact = await readAttestationStatement({ target, packageRoot, taskId });
     const manifestArtifact = await readCodeManifest({ target, packageRoot, taskId });
     await validateAttestationStatement(statementArtifact.value, packageRoot);

package/src/core/attestation.js

@@ -1,3 +1,5 @@
+import { withTaskTransaction } from "./transaction.js";
+import { withProjectReadSnapshot } from "../storage/project-read-snapshot.js";
 import { canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
 import { assertSchema, readSchema } from "./schema-validation.js";
 import { assertSecretFree } from "./receipt.js";
@@ -6,10 +8,11 @@ import { readCodeManifest, validateCodeManifestBindings } from "./code-manifest.
 import {
   taskAttestationStatementPath,
   taskAttestationStatementHistoryPath,
-  taskAttestationBundlePath,
 } from "./task-paths.js";
 import { appendProtocolEvent } from "./events.js";
 import { ensureWithin, fileExists } from "./filesystem.js";
+import { operationalArtifactExists } from "../storage/operational-context.js";
+import { resolveAttestationBundlePath } from "./attachment-paths.js";
 import { E_ATTESTATION_CONFIGURATION_INVALID } from "./error-codes.js";
 
 const STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
@@ -136,8 +139,13 @@ export async function readAttestationStatement({ target, packageRoot = getPackag
 
 export async function writeAttestationStatement({ target, packageRoot = getPackageRoot(), taskId, statement } = {}) {
   await validateAttestationStatement(statement, packageRoot);
+  return withTaskTransaction({ target, taskId, packageRoot, operation: "attestation-create" }, () =>
+    writeValidatedAttestationStatement({ target, packageRoot, taskId, statement }));
+}
+
+async function writeValidatedAttestationStatement({ target, packageRoot, taskId, statement }) {
   const relativePath = taskAttestationStatementPath(taskId);
-  if (await fileExists(ensureWithin(target, relativePath))) {
+  if (operationalArtifactExists(target, relativePath) ?? await fileExists(ensureWithin(target, relativePath))) {
     let previous;
     try {
       previous = await readAttestationStatement({ target, packageRoot, taskId });
@@ -150,7 +158,7 @@ export async function writeAttestationStatement({ target, packageRoot = getPacka
       throw attestationError("E_ATTESTATION_STATEMENT_INVALID", "Attestation statement is immutable within a verification cycle", [relativePath]);
     }
     const historyPath = taskAttestationStatementHistoryPath(taskId, previousCycle);
-    if (!(await fileExists(ensureWithin(target, historyPath)))) {
+    if (!(operationalArtifactExists(target, historyPath) ?? await fileExists(ensureWithin(target, historyPath)))) {
       await writeJsonArtifact(target, historyPath, previous.value, "in-toto-statement", packageRoot, { taskId, operation: "attestation-statement-history" });
     }
   }
@@ -164,7 +172,11 @@ export async function writeAttestationStatement({ target, packageRoot = getPacka
   return { path: relativePath, fingerprint: artifact.fingerprint, statement };
 }
 
-export async function resolveAttestationStatus({ target, packageRoot = getPackageRoot(), taskId, revisionProvider = null, bundlePath = null, requireSignature = false, signingProvider = null, signerPolicy = {} } = {}) {
+export async function resolveAttestationStatus(options = {}) {
+  return withProjectReadSnapshot(options.target, () => resolveSelectedAttestationStatus(options));
+}
+
+async function resolveSelectedAttestationStatus({ target, packageRoot = getPackageRoot(), taskId, revisionProvider = null, bundlePath = null, requireSignature = false, signingProvider = null, signerPolicy = {} } = {}) {
   const result = {
     taskId,
     status: "MISSING",
@@ -192,7 +204,6 @@ export async function resolveAttestationStatus({ target, packageRoot = getPackag
       ...(configuredSigning.policy ?? {}),
       ...signerPolicy,
     };
-    if (effectiveRequireSignature && !effectiveBundlePath) effectiveBundlePath = taskAttestationBundlePath(taskId);
     result.signature = effectiveRequireSignature ? "REQUIRED" : "NOT_CHECKED";
     if ((config.attestation?.mode ?? "off") === "off" && !bundlePath && !effectiveRequireSignature) {
       result.status = "DISABLED";
@@ -208,8 +219,8 @@ export async function resolveAttestationStatus({ target, packageRoot = getPackag
     }
   }
   result.signature = effectiveRequireSignature ? "REQUIRED" : "NOT_CHECKED";
-  if (effectiveRequireSignature && !effectiveBundlePath) effectiveBundlePath = taskAttestationBundlePath(taskId);
   try {
+    if (effectiveBundlePath || effectiveRequireSignature) effectiveBundlePath = resolveAttestationBundlePath(target, taskId, effectiveBundlePath);
     const statement = await readAttestationStatement({ target, packageRoot, taskId });
     const manifest = await readCodeManifest({ target, packageRoot, taskId });
     const provider = revisionProvider ?? manifest.value.capture.revisionProvider;

package/src/core/audit.js

@@ -1,3 +1,4 @@
+import { withProjectReadSnapshot } from "../storage/project-read-snapshot.js";
 import { ARTIFACT_PATHS } from "./artifacts.js";
 import { evaluateCompletion } from "./completion.js";
 import { readManifest } from "./manifest.js";
@@ -108,7 +109,11 @@ async function evaluateLocalAttestation({ target, packageRoot, taskId, completio
   return { ...base, status: "VALID" };
 }
 
-export async function evaluateAudit({
+export async function evaluateAudit(options = {}) {
+  return withProjectReadSnapshot(options.target, () => evaluateSelectedAudit(options));
+}
+
+async function evaluateSelectedAudit({
   target,
   packageRoot,
   strict = false,

package/src/core/bundles.js

@@ -1,6 +1,11 @@
 import { readdir } from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolveAttestationBundlePath } from "./attachment-paths.js";
+import { withOperationalAttachmentFile } from "../storage/operational-attachments.js";
+import { getOperationalStore, operationalArtifactExists, listOperationalArtifactNames } from "../storage/operational-context.js";
 
-import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
+import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, readPortableJsonArtifact, writePortableJsonArtifact } from "./artifacts.js";
 import { validateContract } from "./contract.js";
 import { assertSafePath, ensureWithin, fileExists, readBytes, writeFileAtomic } from "./filesystem.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
@@ -12,11 +17,13 @@ import { taskArtifactPath, taskDirectory, taskStructuralQualityDirectory } from
 import { resolveTaskClaimState } from "./task-claim-state.js";
 import { E_TASK_CLAIM_OWNERSHIP_INCONSISTENT } from "./error-codes.js";
 import { listActions } from "./actions.js";
+import { validateActionArtifact } from "./action-model.js";
 import { validateCanonicalHandoff } from "./handoff.js";
 import { validateVerificationScope } from "./verification-scope.js";
 import { validateResponsibilityContract } from "./responsibility.js";
 import { validateWorkspaceBinding } from "./workspace-binding.js";
 import { validateCodeManifest, validateCodeManifestBindings } from "./code-manifest.js";
+import { withNativeReadScope } from "./native-storage.js";
 import { assertAttestationStatementBindings } from "./attestation-verifier.js";
 import { validateAttestationStatement } from "./attestation.js";
 import {
@@ -27,7 +34,16 @@ import {
 } from "./structural-quality/artifacts.js";
 import { normalizeStructuralQualityConfig, structuralQualityPolicyFingerprint } from "./structural-quality/policy.js";
 
-export const BUNDLE_SCHEMA_VERSION = 1;
+export const BUNDLE_SCHEMA_VERSION = 2;
+
+async function bundleFileBinding(target, relativePath, name) {
+  if (typeof name !== "string" || name.includes("\\") || name.includes("\u0000") || name.split("/").some(part => !part || part === "." || part === "..")) throw Object.assign(new Error("Invalid portable bundle artifact path"), { code: "E_BUNDLE_PATH_INVALID" });
+  const filename = await assertSafePath(target, relativePath);
+  const hash = createHash("sha256");
+  let size = 0;
+  for await (const bytes of createReadStream(filename)) { hash.update(bytes); size += bytes.length; }
+  return { path: name, size, sha256: hash.digest("hex") };
+}
 const BUNDLE_ROOT = ".forgeloop/tasks";
 
 function safeTaskId(taskId) {
@@ -161,10 +177,32 @@ function assertBundledCodeManifestBindings({ loaded, ledger, taskId }) {
   }
 }
 
+/** Export sources may be explicit legacy inputs; selected native authority never falls back. */
+function readBundleSourceJson(target,sourcePath,schemaName,packageRoot){
+ const reader=getOperationalStore(target)?readJsonArtifact:readPortableJsonArtifact;
+ return reader(target,sourcePath,schemaName,packageRoot);
+}
+
+/** Read-only legacy export inspection; operational action listing remains SQLite-only. */
+async function readBundleSourceActions(target,taskId,packageRoot){
+ if(getOperationalStore(target))return listActions(target,{taskId,packageRoot});
+ const directory=`${taskDirectory(taskId)}/actions`;
+ const absolute=await assertSafePath(target,directory);
+ if(!(await fileExists(absolute)))return [];
+ const actions=[];
+ for(const name of (await readdir(absolute)).filter(name=>name.endsWith(".json")).sort()){
+  const artifact=await readPortableJsonArtifact(target,`${directory}/${name}`,"action",packageRoot);
+  const action=validateActionArtifact(artifact.value);
+  if(action.taskId!==taskId || `${action.actionId}.json`!==name)throw bundleBindingError("E_BUNDLE_TASK_MISMATCH","Legacy export action identity differs from its source path");
+  actions.push(action);
+ }
+ return actions.sort((left,right)=>String(left.createdAt).localeCompare(String(right.createdAt)));
+}
+
 async function copyJson(target, sourcePath, destinationPath, schemaName, packageRoot, artifacts, relativeName) {
   try {
-    const value = await readJsonArtifact(target, sourcePath, schemaName, packageRoot);
-    await writeJsonArtifact(target, destinationPath, value.value, schemaName, packageRoot);
+    const value = await readBundleSourceJson(target, sourcePath, schemaName, packageRoot);
+    await writePortableJsonArtifact(target, destinationPath, value.value, schemaName, packageRoot);
     artifacts.push(relativeName);
     return value;
   } catch (error) {
@@ -176,37 +214,52 @@ async function copyJson(target, sourcePath, destinationPath, schemaName, package
 async function copyOptionalJson(target, taskPath, legacyPath, destinationPath, schemaName, packageRoot, artifacts, relativeName) {
   const candidates = [taskPath, legacyPath].filter(Boolean);
   for (const sourcePath of candidates) {
-    if (!(await fileExists(ensureWithin(target, sourcePath)))) continue;
+    if (getOperationalStore(target) && sourcePath === legacyPath) continue;
+    if (!(operationalArtifactExists(target, sourcePath) ?? await fileExists(ensureWithin(target, sourcePath)))) continue;
     return copyJson(target, sourcePath, destinationPath, schemaName, packageRoot, artifacts, relativeName);
   }
   return null;
 }
 
-async function copyRawFile(target, sourcePath, destinationPath, artifacts, relativeName) {
-  if (!(await fileExists(ensureWithin(target, sourcePath)))) return false;
-  await assertSafePath(target, destinationPath);
-  await writeFileAtomic(ensureWithin(target, destinationPath), await readBytes(ensureWithin(target, sourcePath)));
+async function copyRawFile(target, sourcePath, destinationPath, artifacts, relativeName, taskId) {
+  const canonical = getOperationalStore(target) && sourcePath.startsWith(".forgeloop/attachments/objects/");
+  if (!canonical && !(await fileExists(ensureWithin(target, sourcePath)))) return false;
+  await assertSafePath(target, sourcePath);
+  const destination = await assertSafePath(target, destinationPath);
+  await withOperationalAttachmentFile(target, sourcePath, taskId, source => writeFileAtomic(destination, createReadStream(source)));
   artifacts.push(relativeName);
   return true;
 }
 
 async function tryReadJson(target, taskPath, legacyPath, schemaName, packageRoot) {
   try {
-    return await readJsonArtifact(target, taskPath, schemaName, packageRoot);
+    return await readBundleSourceJson(target, taskPath, schemaName, packageRoot);
   } catch (error) {
-    if (error.code === "ARTIFACT_MISSING" && legacyPath) {
-      return await readJsonArtifact(target, legacyPath, schemaName, packageRoot);
+    if (error.code === "ARTIFACT_MISSING" && legacyPath && !getOperationalStore(target)) {
+      return await readBundleSourceJson(target, legacyPath, schemaName, packageRoot);
     }
     throw error;
   }
 }
 
 export async function exportTaskBundle(target, taskId, packageRoot) {
+  return withNativeReadScope(target, async () => {
+    const store = getOperationalStore(target);
+    if (!store) return exportSelectedTaskBundle(target, taskId, packageRoot);
+    const [{ withStorageSnapshot }, { withOperationalStore }, { operationalContext }] = await Promise.all([
+      import("../storage/snapshot.js"), import("../storage/unit-of-work.js"), import("../storage/operational-context.js"),
+    ]);
+    return withStorageSnapshot(store.db, snapshot => operationalContext.run(null,
+      () => withOperationalStore({ db: snapshot, target }, () => exportSelectedTaskBundle(target, taskId, packageRoot))));
+  });
+}
+
+async function exportSelectedTaskBundle(target, taskId, packageRoot) {
   safeTaskId(taskId);
   const directory = bundleDirectory(taskId);
   const artifacts = [];
 
-  if (await fileExists(ensureWithin(target, taskArtifactPath(taskId, "descriptor")))) {
+  if (operationalArtifactExists(target, taskArtifactPath(taskId, "descriptor")) ?? await fileExists(ensureWithin(target, taskArtifactPath(taskId, "descriptor")))) {
     const claimProjection = await resolveTaskClaimState(target, { taskId, packageRoot });
     if (!claimProjection.valid) {
       const error = new Error(`Task ${taskId} claim ownership is inconsistent and cannot be exported safely`);
@@ -255,7 +308,7 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
       error.code = "E_BUNDLE_TASK_MISMATCH";
       throw error;
     }
-    await writeJsonArtifact(target, `${directory}/${destinationName}`, source.value, schemaName, packageRoot);
+    await writePortableJsonArtifact(target, `${directory}/${destinationName}`, source.value, schemaName, packageRoot);
     artifacts.push(destinationName);
   }
 
@@ -295,12 +348,12 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   const qualityBaseline = await readStructuralQualityBaseline(target, taskId, packageRoot);
   const qualityEvaluations = await listStructuralQualityEvaluations(target, taskId, packageRoot);
   if (qualityBaseline) {
-    await writeJsonArtifact(target, `${directory}/structural-quality/baseline.json`, qualityBaseline.value, "structural-quality", packageRoot);
+    await writePortableJsonArtifact(target, `${directory}/structural-quality/baseline.json`, qualityBaseline.value, "structural-quality", packageRoot);
     artifacts.push("structural-quality/baseline.json");
   }
   for (const evaluation of qualityEvaluations) {
     const destination = `structural-quality/evaluations/cycle-${evaluation.value.verificationCycle}-attempt-${evaluation.value.attempt}.json`;
-    await writeJsonArtifact(target, `${directory}/${destination}`, evaluation.value, "structural-quality", packageRoot);
+    await writePortableJsonArtifact(target, `${directory}/${destination}`, evaluation.value, "structural-quality", packageRoot);
     artifacts.push(destination);
   }
 
@@ -330,22 +383,23 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   }
 
   const handoffDirectory = taskArtifactPath(taskId, "handoffs");
-  if (await fileExists(ensureWithin(target, handoffDirectory))) {
-    const handoffEntries = await readdir(ensureWithin(target, handoffDirectory), { withFileTypes: true });
+  const selectedHandoffs = listOperationalArtifactNames(target, taskId, "handoffs");
+  if (selectedHandoffs !== null || await fileExists(ensureWithin(target, handoffDirectory))) {
+    const handoffEntries = selectedHandoffs !== null ? selectedHandoffs.map(name => ({ name, isFile: () => true })) : await readdir(ensureWithin(target, handoffDirectory), { withFileTypes: true });
     for (const entry of handoffEntries
       .filter((item) => item.isFile() && /^handoff-[A-Za-z0-9_-]+\.json$/u.test(item.name))
       .sort((left, right) => left.name.localeCompare(right.name))) {
       const sourcePath = `${handoffDirectory}/${entry.name}`;
-      const handoff = await readJsonArtifact(target, sourcePath, "handoff-envelope", packageRoot);
+      const handoff = await readBundleSourceJson(target, sourcePath, "handoff-envelope", packageRoot);
       await validateCanonicalHandoff(target, handoff.value, { taskId, packageRoot });
       const destination = `handoffs/${entry.name}`;
-      await writeJsonArtifact(target, `${directory}/${destination}`, handoff.value, "handoff-envelope", packageRoot);
+      await writePortableJsonArtifact(target, `${directory}/${destination}`, handoff.value, "handoff-envelope", packageRoot);
       artifacts.push(destination);
     }
   }
 
-  const rawAttestationBundle = `${taskArtifactPath(taskId, "attestations")}/statement.sigstore.json`;
-  await copyRawFile(target, rawAttestationBundle, `${directory}/attestations/statement.sigstore.json`, artifacts, "attestations/statement.sigstore.json");
+  const rawAttestationBundle = resolveAttestationBundlePath(target, taskId);
+  await copyRawFile(target, rawAttestationBundle, `${directory}/attestations/statement.sigstore.json`, artifacts, "attestations/statement.sigstore.json", taskId);
   if (exportedManifest?.value) {
     exportedManifest.value = await validateCodeManifest(exportedManifest.value, packageRoot);
     if (exportedManifest.value.taskId !== taskId) {
@@ -366,10 +420,10 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   if (exportedManifest?.value && exportedStatement?.value) {
     assertAttestationStatementBindings(exportedStatement.value, exportedManifest.value, taskId, canonicalFingerprint(exportedManifest.value));
   }
-  const actionArtifacts = await listActions(target, { packageRoot, taskId });
+  const actionArtifacts = await readBundleSourceActions(target,taskId,packageRoot);
   for (const action of actionArtifacts) {
     const destination = `${directory}/actions/${action.actionId}.json`;
-    await writeJsonArtifact(target, destination, action, "action", packageRoot);
+    await writePortableJsonArtifact(target, destination, action, "action", packageRoot);
     artifacts.push(`actions/${action.actionId}.json`);
   }
 
@@ -380,38 +434,11 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   for (const executionRef of executionRefs) {
     const execution = await readExecutionArtifact({ target, executionRef, packageRoot, taskId });
     const destination = `${directory}/executions/${execution.value.executionId}.json`;
-    await writeJsonArtifact(target, destination, execution.value, "execution", packageRoot);
+    await writePortableJsonArtifact(target, destination, execution.value, "execution", packageRoot);
     artifacts.push(`executions/${execution.value.executionId}.json`);
   }
 
-  // Events
-  let eventsPath = ensureWithin(target, taskArtifactPath(taskId, "events"));
-  if (!(await fileExists(eventsPath))) {
-    eventsPath = ensureWithin(target, ARTIFACT_PATHS.events);
-  }
-  if (await fileExists(eventsPath)) {
-    await assertSafePath(target, `${directory}/events.ndjson`);
-    await writeFileAtomic(ensureWithin(target, `${directory}/events.ndjson`), await readBytes(eventsPath));
-    artifacts.push("events.ndjson");
-  }
-
-  // Gates
-  let gateDirectory = ensureWithin(target, `${taskDirectory(taskId)}/gates`);
-  if (!(await fileExists(gateDirectory))) {
-    gateDirectory = ensureWithin(target, ARTIFACT_PATHS.gates);
-  }
-  if (await fileExists(gateDirectory)) {
-    const entries = await readdir(gateDirectory, { withFileTypes: true });
-    for (const entry of entries.filter((item) => item.isFile() && item.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name))) {
-      const gateName = entry.name.slice(0, -5);
-      const sourcePath = `${gateDirectory.replace(target + "/", "")}/${entry.name}`;
-      const destinationPath = `${directory}/gates/${entry.name}`;
-      const gate = await readJsonArtifact(target, sourcePath, "gate", packageRoot);
-      if (gate.value.taskId !== taskId) continue;
-      await writeJsonArtifact(target, destinationPath, gate.value, "gate", packageRoot);
-      artifacts.push(`gates/${gateName}.json`);
-    }
-  }
+  await exportBundleLedgerAndGates(target, taskId, packageRoot, directory, artifacts);
 
   artifacts.sort();
   const manifest = {
@@ -419,14 +446,17 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
     protocolVersion: PROTOCOL_VERSION,
     taskId,
     artifacts,
+    files: [],
   };
-  await writeJsonArtifact(target, `${directory}/bundle.json`, manifest, "task-bundle", packageRoot);
+  for (const artifact of artifacts) manifest.files.push(await bundleFileBinding(target, `${directory}/${artifact}`, artifact));
+  await writePortableJsonArtifact(target, `${directory}/bundle.json`, manifest, "task-bundle", packageRoot);
   return { ...manifest, path: `${directory}/bundle.json` };
 }
 
 export async function readTaskBundle(target, taskId, packageRoot) {
   const directory = bundleDirectory(taskId);
   const manifest = await readJsonArtifact(target, `${directory}/bundle.json`, "task-bundle", packageRoot);
+  await verifyBundleFileBindings(target, directory, manifest);
   const loaded = {};
   const mappings = {
     "contract.json": ["contract", "current-contract"],
@@ -450,18 +480,7 @@ export async function readTaskBundle(target, taskId, packageRoot) {
   for (const artifact of manifest.value.artifacts) {
     const qualityKind = structuralQualityBundleKind(artifact);
     if (qualityKind) {
-      const qualityArtifact = await readJsonArtifact(target, `${directory}/${artifact}`, "structural-quality", packageRoot);
-      validateStructuralQualityArtifact(qualityArtifact.value, artifact);
-      if (qualityArtifact.value.taskId !== taskId) {
-        throw bundleBindingError("E_BUNDLE_TASK_MISMATCH", `Structural-quality ${qualityKind} taskId does not match its bundle task`);
-      }
-      loaded.structuralQuality ??= { baseline: null, evaluations: [] };
-      if (qualityKind === "baseline") {
-        if (loaded.structuralQuality.baseline) throw bundleBindingError("E_STRUCTURAL_QUALITY_EVIDENCE_STALE", "A bundle cannot contain more than one structural-quality baseline");
-        loaded.structuralQuality.baseline = qualityArtifact.value;
-      } else {
-        loaded.structuralQuality.evaluations.push(qualityArtifact.value);
-      }
+      await loadBundleQualityArtifact(target, directory, artifact, packageRoot, taskId, loaded, qualityKind);
       continue;
     }
     if (artifact.startsWith("executions/") && artifact.endsWith(".json")) {
@@ -501,6 +520,9 @@ export async function readTaskBundle(target, taskId, packageRoot) {
     }
     if (mapping[1] === "continuity") {
       assertContinuitySemantics(loadedArtifact.value);
+      if (loadedArtifact.value.taskId !== taskId) {
+        throw bundleBindingError("E_BUNDLE_TASK_MISMATCH", "Continuity taskId does not match its bundle task");
+      }
     }
     if (mapping[1] === "workspace-binding" && loadedArtifact.value.taskId !== taskId) {
       const error = new Error("Workspace binding taskId does not match its bundle task");
@@ -586,3 +608,75 @@ export async function readTaskBundle(target, taskId, packageRoot) {
   }
   return { manifest: manifest.value, artifacts: loaded };
 }
+
+async function exportBundleLedgerAndGates(target, taskId, packageRoot, directory, artifacts) {
+  // Events
+  const selectedStore = getOperationalStore(target);
+  if (selectedStore) {
+    async function* ledgerBytes() {
+      for (const row of selectedStore.db.prepare("SELECT event_json FROM events WHERE task_id = ? ORDER BY seq").iterate(taskId)) yield `${JSON.stringify(JSON.parse(row.event_json))}\n`;
+    }
+    await writeFileAtomic(await assertSafePath(target, `${directory}/events.ndjson`), ledgerBytes());
+    artifacts.push("events.ndjson");
+  } else {
+  let eventsPath = ensureWithin(target, taskArtifactPath(taskId, "events"));
+  if (!(await fileExists(eventsPath))) {
+    eventsPath = ensureWithin(target, ARTIFACT_PATHS.events);
+  }
+  if (await fileExists(eventsPath)) {
+    await assertSafePath(target, `${directory}/events.ndjson`);
+    await writeFileAtomic(ensureWithin(target, `${directory}/events.ndjson`), await readBytes(eventsPath));
+    artifacts.push("events.ndjson");
+  }
+  }
+
+  // Gates
+  let gateRelativePath = `${taskDirectory(taskId)}/gates`;
+  let gateDirectory = ensureWithin(target, gateRelativePath);
+  const selectedGates = listOperationalArtifactNames(target, taskId, "gates");
+  if (selectedGates === null && !(await fileExists(gateDirectory))) {
+    gateRelativePath = ARTIFACT_PATHS.gates;
+    gateDirectory = ensureWithin(target, gateRelativePath);
+  }
+  if (selectedGates !== null || await fileExists(gateDirectory)) {
+    const entries = selectedGates !== null ? selectedGates.map(name => ({ name, isFile: () => true })) : await readdir(gateDirectory, { withFileTypes: true });
+    for (const entry of entries.filter((item) => item.isFile() && item.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name))) {
+      const gateName = entry.name.slice(0, -5);
+      const sourcePath = `${gateRelativePath}/${entry.name}`;
+      const destinationPath = `${directory}/gates/${entry.name}`;
+      const gate = await readBundleSourceJson(target, sourcePath, "gate", packageRoot);
+      if (gate.value.taskId !== taskId) continue;
+      await writePortableJsonArtifact(target, destinationPath, gate.value, "gate", packageRoot);
+      artifacts.push(`gates/${gateName}.json`);
+    }
+  }
+
+}
+
+async function verifyBundleFileBindings(target, directory, manifest) {
+  if (manifest.value.schemaVersion === 2) {
+    const listed = manifest.value.files.map(file => file.path);
+    if (new Set(listed).size !== listed.length || canonicalFingerprint([...listed].sort()) !== canonicalFingerprint([...manifest.value.artifacts].sort())) {
+      throw Object.assign(new Error("Bundle file bindings disagree with included artifacts"), { code: "E_BUNDLE_DIGEST_INVALID" });
+    }
+    for (const binding of manifest.value.files) {
+      const actual = await bundleFileBinding(target, `${directory}/${binding.path}`, binding.path);
+      if (actual.size !== binding.size || actual.sha256 !== binding.sha256) throw Object.assign(new Error(`Bundle bytes disagree with manifest: ${binding.path}`), { code: "E_BUNDLE_DIGEST_INVALID" });
+    }
+  }
+}
+
+async function loadBundleQualityArtifact(target, directory, artifact, packageRoot, taskId, loaded, qualityKind) {
+  const qualityArtifact = await readJsonArtifact(target, `${directory}/${artifact}`, "structural-quality", packageRoot);
+  validateStructuralQualityArtifact(qualityArtifact.value, artifact);
+  if (qualityArtifact.value.taskId !== taskId) {
+    throw bundleBindingError("E_BUNDLE_TASK_MISMATCH", `Structural-quality ${qualityKind} taskId does not match its bundle task`);
+  }
+  loaded.structuralQuality ??= { baseline: null, evaluations: [] };
+  if (qualityKind === "baseline") {
+    if (loaded.structuralQuality.baseline) throw bundleBindingError("E_STRUCTURAL_QUALITY_EVIDENCE_STALE", "A bundle cannot contain more than one structural-quality baseline");
+    loaded.structuralQuality.baseline = qualityArtifact.value;
+  } else {
+    loaded.structuralQuality.evaluations.push(qualityArtifact.value);
+  }
+}

package/src/core/checkpoint-revalidation.js

@@ -1,3 +1,4 @@
+import { ledgerEventAt, ledgerEventsOfTypes } from "./ledger-event-collection.js";
 import { canonicalFingerprint } from "./artifacts.js";
 import {
   resolveCanonicalRouteEvolution,
@@ -175,7 +176,7 @@ export function resolveCheckpointRevalidationBoundary(events = [], revalidationE
       && candidate?.taskId === revalidationEvent?.taskId
       && candidate?.event === CHECKPOINT_REVALIDATED_EVENT));
   if (index < 0) return null;
-  const commitEvent = events[index + 1];
+  const commitEvent = ledgerEventAt(events, index + 1);
   if (!commitEvent
     || revalidationEvent?.event !== CHECKPOINT_REVALIDATED_EVENT
     || commitEvent.event !== "TRANSACTION_COMMITTED"
@@ -194,9 +195,10 @@ export function resolveCheckpointRevalidationBoundary(events = [], revalidationE
 
 export function validateCheckpointRevalidationEventBindings(events = []) {
   const errors = [];
-  const revalidations = events.filter((event) => event.event === CHECKPOINT_REVALIDATED_EVENT);
-  for (let index = 0; index < revalidations.length; index += 1) {
-    const event = revalidations[index];
+  let previousEvent;
+  for (const event of ledgerEventsOfTypes(events, [CHECKPOINT_REVALIDATED_EVENT])) {
+    const prior = previousEvent;
+    previousEvent = event;
     let details;
     try {
       details = assertCheckpointRevalidatedDetails(event.details);
@@ -207,7 +209,7 @@ export function validateCheckpointRevalidationEventBindings(events = []) {
     if (!resolveCheckpointRevalidationBoundary(events, event)) {
       errors.push(bindingError(`event ${event.seq} must be immediately followed by its checkpoint-revalidate transaction commit`));
     }
-    const previous = revalidations[index - 1]?.details;
+    const previous = prior?.details;
     if (previous) {
       if (!sameRepositoryFingerprint(details.previousRepositoryFingerprint, previous.repositoryFingerprint)) {
         errors.push(bindingError(`event ${event.seq} is disconnected from the previous checkpoint revalidation repository`));
@@ -222,7 +224,7 @@ export function validateCheckpointRevalidationEventBindings(events = []) {
       const contractEvolved = details.contractFingerprint !== previous.contractFingerprint
         && resolveCanonicalContractEvolution(events, {
           taskId: event.taskId,
-          sourceSeq: revalidations[index - 1].seq,
+          sourceSeq: prior.seq,
           sourceContractFingerprint: previous.contractFingerprint,
           targetContractFingerprint: details.contractFingerprint,
         });
@@ -233,7 +235,7 @@ export function validateCheckpointRevalidationEventBindings(events = []) {
         const evolved = details.previousStateRevision > previous.revalidatedStateRevision
           && routeEvolutionAfter(
             events,
-            revalidations[index - 1],
+            prior,
             previous.routeFingerprint,
             details.routeFingerprint,
             details.contractFingerprint,
@@ -294,9 +296,9 @@ function validateLatestCheckpointBinding(state, latest) {
 
 export function validateCheckpointRevalidationCurrentBinding(state, events = []) {
   const errors = [];
-  const revalidations = events.filter((event) => event.event === CHECKPOINT_REVALIDATED_EVENT);
-  const latest = revalidations.at(-1);
-  for (const event of revalidations) {
+  let latest;
+  for (const event of ledgerEventsOfTypes(events, [CHECKPOINT_REVALIDATED_EVENT])) {
+    latest = event;
     const contractError = validateCurrentContractBinding(state, events, event);
     if (contractError) errors.push(contractError);
     const routeError = validateCurrentRouteBinding(state, events, event);