@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/cli/help.js

@@ -1,4 +1,171 @@
+import { AppError } from "../shared/errors.js";
+import { commandInputs, commandAliases } from "./command-inputs.js";
+import { commandKeyForPositions, globalOptionDocumentation, optionsForCommandTree, routerNativeRoute } from "./command-metadata.js";
 const helpPages = new Map([
+    ["flow mb-init", `dd-flow init / flow mb-init - managed project Memory Bank initialization
+
+Usage:
+  dd-flow init --project-root /absolute/project --workspace-root /absolute/workspace --request-id ID --intake-file /absolute/intake.txt --intake-sha256 SHA256 --git-route integration_branch_direct --integration-branch main [--profile ID-or-alias] [--detach] --json
+  dd-flow flow mb-init --project-root /absolute/project --workspace-root /absolute/workspace --request-id ID [--detach] --json
+
+Both spellings share one command definition and dispatcher. Fresh execution
+requires the original bounded UTF-8 intake bytes and explicit Git policy.
+setup installs the computer-level canon; init initializes the specified project.
+Missing executor defaults or prerequisites refuse before project publication.
+Profiles, descriptor, engine and original request are frozen before dispatch.
+
+Replay uses the exact retained request, not current defaults, aliases or canon.
+Omitted selectors reuse original choices; supplied selectors must match them.
+The original intake file need not survive replay: its supplied hash must match
+the retained bytes. --stage-profile stage=profile and --work-profile profile
+are repeatable approved overrides, frozen before launch.
+
+--profile-file /absolute/profile.json is exclusive with --profile and supplies
+one complete validated operation-only profile. It never saves a global profile
+or changes defaults; a conflicting saved ID/alias refuses. Replay may omit this
+file after removal; if supplied, its admitted profile must match the original.
+When no default or explicit profile exists, an interactive terminal uses the
+shared executor dialog. Creation is operation-only here; skip is not allowed.
+--non-interactive, JSON and non-terminal input never ask and missing choices
+refuse before project effects. Use profiles commands for explicit global saves.
+
+The existing managed controller owns Sessions and execution. The default waits
+for completion, recovery or a user/context boundary; --detach returns its
+accepted receipt. Observer disconnection does not stop the controller.
+--prepare-only publishes the normal project bootstrap and frozen RUN, but does
+not launch a controller or provider Session. It is not a dry run and is exclusive
+with --detach. A runner may then use run drive launch with its own context and
+bounded stop/capture policy. Exact preparation replay never stops or replaces
+an existing controller.
+Use existing scoped run drive status / run control commands to observe,
+answer, pause, stop or reconcile the retained RUN. Native/attached public
+selection is not yet exposed; no failed route silently becomes native.`],
+    ["flow", `dd-flow flow - engine-owned workflow catalog
+
+Usage:
+  dd-flow flow list --json
+  dd-flow flow show <id> --json
+
+Inspection never opens a runtime database, initializes a home or runs agents.
+The catalog reports handler registration separately from RUN readiness. A
+pending handler set cannot execute; registered handlers still require selected
+canon, frozen descriptor/schema admission, workspace and execution readiness.
+These inspection commands do not start init or qualify an installed route.`],
+    ["models", `dd-flow models - reviewed seed and scoped offline observations
+
+Usage:
+  dd-flow models list --json
+  dd-flow models show <model> --harness family --provider provider --json
+  dd-flow models list --harness family --provider provider --account-sha256 <digest> --observation-file /absolute/listing.json --json
+
+No database, credentials, network, executable discovery or provider process is
+opened. --seed-file selects reviewed seed-only catalog data; otherwise the
+bundled adapter-derived seed is used. Families not yet curated are explicit.
+Unknown seed settings are not profile defaults or model recommendations.
+
+Observations require an exact harness/provider/account scope. A matching listed
+model remains unknown for account access and flow qualification. Missing or
+unavailable listing retains seed entries; a foreign scope is ignored. show
+refuses an absent model rather than inventing availability. Exit 2 is invalid
+input; exit 1 is missing/unreadable input or an absent selected model.`],
+    ["completion", `dd-flow completion - shell completion from the accepted command grammar
+
+Usage:
+  dd-flow completion bash
+  dd-flow completion zsh
+  dd-flow completion fish
+
+Prints a shell script to stdout; it does not modify shell configuration. Load
+the script in your shell after reviewing it. Zsh requires compinit first.
+Scripts query completion candidates with literal argv; they do not initialize
+a home, open a database, inspect profiles or invoke harness processes.`],
+    ["harnesses", `dd-flow harnesses - static installation discovery
+
+Usage:
+  dd-flow harnesses list --json
+  dd-flow harnesses show <family> --json
+  dd-flow harnesses discover [--harness family --executable /absolute/path] --json
+  dd-flow harnesses probe-version --harness family --allow-processes --allow-credentials --allow-writes [--executable /absolute/path --timeout-ms 3000] --json
+  dd-flow harnesses doctor --harness family --allow-processes --allow-credentials [--allow-services --allow-writes --executable /absolute/path] --json
+
+Lists all six supported families, including missing installations. Multiple
+installations require explicit selection. Presence does not establish version,
+protocol, auth, model access or qualification. list/show/discover never launch a
+process, inspect credentials, create a home or open a runtime database.
+probe-version is an explicit diagnostic exception: it runs installed code only
+after all three effect permissions are supplied. It bounds time/output and does
+not establish protocol compatibility, account access or flow qualification.
+doctor invokes the existing bundled adapter only after its classified effects
+are admitted: Codex/OpenCode/Droid require services and writes; Agy requires
+writes; ZCode/Grok require processes and credentials. ZCode also requires
+--native-executable. OpenCode requires --state-dir for an existing daemon whose
+executable binding matches; doctor never starts or stops that daemon.
+For Droid, the OS ps utility must be available on PATH before doctor starts;
+missing physical-settlement tooling refuses without launching a provider.
+Reports are bounded/redacted observations, not native qualification or account access.
+Use --timeout-ms 1..60000 to bound the diagnostic, not productive work.
+Optional --provider and --account-sha256 must be supplied together. They bind
+reported model names to an operator-declared, unverified scope, not an observed
+credential identity. --model-observation-file explicitly publishes a standalone
+snapshot usable by models list --observation-file. Listings are incomplete;
+an absent adapter list is unavailable, never an empty verified inventory. No
+account access or qualification is inferred; publication failure does not rerun
+the admitted diagnostic. The destination must differ from --response-file.`],
+    ["setup", `dd-flow setup - global installation readiness
+
+Usage:
+  dd-flow setup --canon-source /path/to/release-bundle --trust-file operator-trust.json --request-id ID --skip-agent-setup --non-interactive --json
+  dd-flow setup update --canon-source /path/to/release-bundle --trust-file operator-trust.json --request-id ID --skip-agent-setup --json
+  dd-flow setup status --json
+
+The local bundle contains release-envelope.json, canon.tgz and engine.tgz.
+Trust uses dd-flow/release-trust@1 and must be selected independently of the
+envelope. Stable is the default channel; preview/development require --channel.
+Without --skip-agent-setup, select --profile or an existing global default.
+--profile-file supplies a complete validated profile for headless onboarding;
+it is mutually exclusive with --profile and --skip-agent-setup. Profile files
+never import credentials or silently change operator defaults.
+No missing profile is replaced by an automatically selected model.
+In an interactive terminal, a missing profile opens an explicit executor choice
+only after the authenticated installation is committed:
+profile ID/alias, file:/absolute/profile.json, create or skip. create asks for
+every profile field and explicit confirmation, without probing providers.
+Separate yes/no questions authorize saving and global default selection; no
+settings are written by the dialog itself. JSON/JSONL output,
+--non-interactive and non-terminal input never prompt. Cancellation leaves the
+installation committed and onboarding pending; replay the same request to resume
+or explicitly skip onboarding. The separate onboarding receipt freezes the
+selected profile and save/default consent before profile effects. A completed
+onboarding replay never restores later settings. Existing request-bound profile
+choices keep their original identity and recovery semantics.
+--save-profile-intent supplies explicit frozen profile creation/default consent
+for persistence. The selected profile must match; skip conflicts. Setup retains
+the complete intent in its request and uses a profiles_saved checkpoint. A
+committed replay never restores settings changed after the original installation.
+Without a new explicit executor choice, an exact request retry reuses its retained
+executor and save/default consent rather than asking again or choosing a new default.
+Status inspects the selected installation and retained cache without opening or
+migrating SQLite, registering a project, discovering providers or running agents.
+Installation readiness and runtime qualification are separate facts.
+`],
+    ["profiles", `dd-flow profiles - home-only executor settings
+
+Usage:
+  dd-flow profiles list --json
+  dd-flow profiles show <ID-or-alias> --json
+  dd-flow profiles create --file profile.json --expected-revision SHA256 [--set-default] --json
+  dd-flow profiles edit --file profile.json --expected-revision SHA256 --json
+  dd-flow profiles remove <ID> --expected-revision SHA256 --json
+  dd-flow profiles alias <alias> (--target ID | --remove) --expected-revision SHA256 --json
+  dd-flow profiles set-default [ID-or-alias | --clear] --expected-revision SHA256 --json
+
+Read the current revision with profiles list before changing settings. Writes
+are atomic and reject concurrent/stale changes. Aliases point directly to IDs,
+not other aliases. Profile files use dd-flow/agent-profile@1 and reject secret
+fields. Existing legacy IDs are imported on the first successful write without
+editing their files. Thereafter profile-settings.json is the sole owner.
+Existing RUNs use frozen snapshots, not mutable profile settings. This command
+never registers a project, selects a model automatically or creates a runtime DB.`],
     ["runtime scope", `Usage:
   dd-flow runtime scope fence --scope-id EVAL_ID --request-id ID --json
   dd-flow runtime scope status --scope-id EVAL_ID --json
@@ -197,7 +364,7 @@ Usage:
   dd-flow run recovery inspect|begin|seal|capture|resume <RUN-ID|RUN-short-id> --project-root <root> --json
   dd-flow run snapshot create <RUN-ID|RUN-short-id> (--stage-entry <stage>|--candidate|--incomplete|--recovery-id <RCV-ID>) --project-root <root> --output <directory> --json
   dd-flow run snapshot restore --snapshot <directory> --project-root <prepared-root> [--recovery-id <RCV-ID>] --json
-  dd-flow run snapshot bootstrap create --project-root <root> --output <directory> --json
+  dd-flow run snapshot bootstrap create --project-root <root> --output <directory> [--flow sdlc|mb-init] --json
   dd-flow run snapshot bootstrap restore --snapshot <directory> --project-root <prepared-root> --json
   dd-flow run fork --from <sealed-stage-entry-snapshot> --output <empty-directory> --engine-version <exact-version> --request-id <id> [--integrity-checksum <sha256>] --json
   dd-flow run timeline <RUN-ID|RUN-short-id> --project-root <root> --json
@@ -559,8 +726,12 @@ Examples:
 
 Usage:
   dd-flow memory permissions preflight --root <project-root> --memory-bank <path> [--tasks <path>] --flow <flow> --mode <mode> --json
+  dd-flow memory finish integrate --run <run-id> --project-root <project-root> --json
+  dd-flow memory finish evidence --run <run-id> --project-root <project-root> --json
 
-permissions preflight checks project, Memory Bank, and optional .tasks read/write permissions before memory flows mutate files. It never runs privileged repair commands. A completed assessment returns JSON on stdout with exit_code 0 when the flow can continue and exit_code 1 when permission blockers are found. Runtime/configuration mistakes exit 2 as structured errors.`
+permissions preflight checks project, Memory Bank, and optional .tasks read/write permissions before memory flows mutate files. It never runs privileged repair commands. A completed assessment returns JSON on stdout with exit_code 0 when the flow can continue and exit_code 1 when permission blockers are found. Runtime/configuration mistakes exit 2 as structured errors.
+
+finish integrate commits only the accepted Memory Bank and owned lint configuration, then performs the retained local integration route. It preserves unrelated files and never pushes or changes Git identity/configuration. An uncertain original Git effect must be observed, not blindly repeated. finish evidence then publishes actual coverage, integration and ordinary-entry preparation references; neither command accepts the finish result or completes the RUN.`
     ],
     [
         "memory permissions",
@@ -663,10 +834,73 @@ worktree plan suggests a project-scoped service checkout under DD_FLOW_HOME/proj
     ]
 ]);
 export function helpForArgs(args) {
-    const helpIndex = args.findIndex((arg) => arg === "--help" || arg === "-h");
-    if (helpIndex === -1) {
+    return resolveHelp(args)?.text;
+}
+export function hasHelpIntent(args) {
+    const end = args.indexOf("--");
+    return args.slice(0, end < 0 ? args.length : end).some(arg => arg === "--help" || arg === "-h");
+}
+/** Pure early resolver: no filesystem, runtime context, process dispatch or output-file access. */
+export function resolveHelp(args) {
+    if (!hasHelpIntent(args))
         return undefined;
+    const end = args.indexOf("--"), tokens = args.slice(0, end < 0 ? args.length : end);
+    const positions = [], selectors = [], supplied = [];
+    let json = false;
+    const switches = new Set([...globalOptionDocumentation.filter(o => o.kind === "switch").map(o => o.name),
+        ...Object.values(commandInputs).flatMap(input => input.switches)]);
+    for (let index = 0; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (token === "--help" || token === "-h")
+            continue;
+        if (token === "--option" || token.startsWith("--option=")) {
+            const value = token.startsWith("--option=") ? token.slice(9) : tokens[++index];
+            if (!value || value === "--help" || value === "-h")
+                throw helpUsage("--option requires one option selector");
+            selectors.push(value.replace(/^--/, ""));
+            continue;
+        }
+        if (token.startsWith("--")) {
+            const name = token.slice(2).split("=", 1)[0];
+            supplied.push(name);
+            if (token === "--json")
+                json = true;
+            if (!token.includes("=") && !switches.has(name) && tokens[index + 1] && !tokens[index + 1].startsWith("-"))
+                index++;
+        }
+        else if (token.startsWith("-"))
+            throw helpUsage(`Unknown short option: ${token}`);
+        else
+            positions.push(token);
     }
-    const path = args.slice(0, helpIndex).filter((arg) => !arg.startsWith("--")).join(" ");
-    return helpPages.get(path) ?? helpPages.get(path.split(" ").slice(0, 2).join(" ")) ?? helpPages.get("");
+    if (selectors.length > 1)
+        throw helpUsage("--option must occur once");
+    const selected = commandKeyForPositions(positions);
+    const command = selected ?? positions.join(" ");
+    const commands = Object.keys(commandInputs).filter(key => !command || key === command || key.startsWith(`${command} `));
+    if (command && commands.length === 0)
+        throw helpUsage(`Unknown help command: ${command}`);
+    const optionMap = new Map(optionsForCommandTree(command).map(option => [option.name, option]));
+    // Invalid response transport is intentionally irrelevant to help, including missing/repeated values.
+    for (const name of supplied)
+        if (!optionMap.has(name))
+            throw helpUsage(`Unknown option --${name} for ${command || "root"}`);
+    const option = selectors.length ? optionMap.get(selectors[0]) : null;
+    if (selectors.length && !option)
+        throw helpUsage(`Unknown option selector: ${selectors[0]}`);
+    const options = [...optionMap.values()].sort((a, b) => a.name.localeCompare(b.name, "en"));
+    const input = selected ? commandInputs[selected] : undefined;
+    const canonical = commandAliases[command] ?? command;
+    const pageKey = [...helpPages.keys()].filter(key => key && (canonical === key || canonical.startsWith(`${key} `)))
+        .sort((a, b) => b.length - a.length)[0] ?? "";
+    const detail = (value) => `--${value.name}${value.kind === "value" ? " <value>" : ""}${value.required ? " (required)" : ""}${value.repeatable ? " (repeatable)" : ""}\n  ${value.description}${value.choices.length ? `\n  Allowed: ${value.choices.join(", ")}` : ""}`;
+    const usage = input ? `\nExact command: dd-flow ${command}${input.positions[0] ? ` <argument>${input.positions[0] > 1 ? ` × ${input.positions[0]}` : ""}` : ""}\n` : "";
+    return { json,
+        text: option ? `dd-flow ${command} --option ${option.name} --help\n\n${detail(option)}`
+            : `${helpPages.get(pageKey)}${usage}\n${input?.retired ? `Retired: ${input.retired}\n` : ""}\n${command ? "" : "Command paths:\n"}${input ? "" : commands.map(key => `  ${key}`).join("\n")}\n\nOptions:\n${options.map(detail).join("\n")}`,
+        data: { schema_id: "dd-flow/cli-help@1", command, alias_of: commandAliases[command] ?? null, commands, options, option: option ?? null,
+            router_native: selected ? routerNativeRoute(selected) : true, retired: input?.retired ?? null } };
+}
+function helpUsage(message) {
+    return new AppError("usage", `${message}; use dd-flow --help`, 2, { phase: "help", effect: "no_effect", recoverable: true, help_topic: "dd-flow --help" });
 }

package/dist/cli/input-preparation.js

@@ -32,11 +32,42 @@ export function prepareError(error, input = {}) {
         phase: "prepare", effect: "no_effect", recoverable: true, ...input, cause: code ?? String(error)
     });
 }
-export function prepareTextFile(file, label = "input file") {
-    const prepared = prepareFileBytes(file, label);
-    return { file: prepared.file, text: prepared.bytes.toString("utf8") };
+export function prepareTextFile(file, label = "input file", maxBytes) {
+    const prepared = prepareFileBytes(file, label, maxBytes);
+    if (maxBytes === undefined)
+        return { file: prepared.file, text: prepared.bytes.toString("utf8") };
+    try {
+        return { file: prepared.file, text: new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(prepared.bytes) };
+    }
+    catch {
+        return prepareError(new AppError("validation", `${label} must contain valid UTF-8`, 2), { file: prepared.file, label });
+    }
 }
-export function prepareFileBytes(file, label = "input file") {
+export async function readBoundedUtf8Stream(stream, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+        throw new AppError("usage", "Invalid input byte bound", 2);
+    const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    let data = "", byteLength = 0;
+    for await (const chunk of stream) {
+        const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        byteLength += bytes.length;
+        if (byteLength > maxBytes)
+            throw new AppError("usage", "Standard input exceeds its byte bound", 2);
+        try {
+            data += decoder.decode(bytes, { stream: true });
+        }
+        catch {
+            throw new AppError("validation", "Standard input must contain valid UTF-8", 2);
+        }
+    }
+    try {
+        return data + decoder.decode();
+    }
+    catch {
+        throw new AppError("validation", "Standard input must contain valid UTF-8", 2);
+    }
+}
+export function prepareFileBytes(file, label = "input file", maxBytes) {
     const absolute = path.resolve(file);
     let descriptor;
     try {
@@ -45,7 +76,25 @@ export function prepareFileBytes(file, label = "input file") {
         if (!stat.isFile()) {
             throw new AppError("input_file_not_regular", `${label} must be a readable regular file: ${absolute}`, 2, { file: absolute, label });
         }
-        return { file: absolute, bytes: fs.readFileSync(descriptor) };
+        if (maxBytes === undefined)
+            return { file: absolute, bytes: fs.readFileSync(descriptor) };
+        if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+            throw new AppError("usage", "Invalid input byte bound", 2);
+        const oversized = () => new AppError("usage", `${label} exceeds its byte bound`, 2);
+        if (stat.size > maxBytes)
+            throw oversized();
+        // Read at most one extra byte: the file can grow after fstat.
+        const buffer = Buffer.alloc(maxBytes + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const count = fs.readSync(descriptor, buffer, length, buffer.length - length, null);
+            if (!count)
+                break;
+            length += count;
+        }
+        if (length > maxBytes)
+            throw oversized();
+        return { file: absolute, bytes: buffer.subarray(0, length) };
     }
     catch (error) {
         if (error?.code === "ENOENT") {

package/dist/cli/memory-flow-admission.js

@@ -0,0 +1,44 @@
+import { prepareCommandRoute } from "./command-inputs.js";
+import { parseOutputOptions } from "./output-options.js";
+import { readBoundedUtf8Stream, prepareJsonText } from "./input-preparation.js";
+import { PreparedInstalledFlowSource } from "../services/installed-flow-source.js";
+import { hybridDigest } from "../services/hybrid-contracts.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { writePreparationError } from "./error-output.js";
+import { memoryInitStartupInputSchemas } from "../services/memory-init-startup-custody.js";
+/** Executing engine's real handler admission only. The caller owns independent
+ * release/source selection; this command never opens storage or creates a RUN. */
+export async function runMemoryFlowAdmissionCli(args, io = process) {
+    try {
+        const output = parseOutputOptions(args), route = prepareCommandRoute(output.args);
+        if (route.key !== "runtime flow admit" || output.responseFile || output.progressJsonl) {
+            throw new AppError("usage", "Flow admission accepts bounded stdin and stdout output only", 2, { effect: "no_effect" });
+        }
+        const input = prepareJsonText(await readBoundedUtf8Stream(io.stdin, 64 * 1024 * 1024), { file: "<stdin>", label: "flow admission" }).value;
+        if (!input || typeof input !== "object" || Array.isArray(input)
+            || !["source,source_sha256", "source,source_sha256,startup_input_schema"].includes(Object.keys(input).sort().join())) {
+            throw new AppError("usage", "Flow admission requires an exact source snapshot and independent digest", 2, { effect: "no_effect" });
+        }
+        const selected = input;
+        const startupSchema = memoryInitStartupInputSchemas.find(schema => schema === selected.startup_input_schema);
+        if (Object.hasOwn(selected, "startup_input_schema") && startupSchema === undefined) {
+            throw new AppError("usage", "Executing engine does not support the requested startup input schema", 2, { effect: "no_effect" });
+        }
+        if (typeof selected.source_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(selected.source_sha256)) {
+            throw new AppError("usage", "Flow admission requires a SHA-256 source digest", 2, { effect: "no_effect" });
+        }
+        const source = PreparedInstalledFlowSource.restoreRetained(selected.source, selected.source_sha256);
+        const flow = source.resolveRegisteredFlow();
+        const facts = { schema_id: startupSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
+            ...(startupSchema === undefined ? {} : { startup_input_schema: startupSchema }),
+            flow_id: "mb-init", source_sha256: source.sha256,
+            descriptor_sha256: source.descriptorReference().sha256, stages: flow.descriptor.stages.map(stage => stage.id) };
+        io.stdout.write(`${JSON.stringify({ ok: true, action: "runtime_flow_admit", facts, sha256: hybridDigest(facts) }, null, output.json ? undefined : 2)}\n`);
+        return 0;
+    }
+    catch (error) {
+        const record = errorRecord(error);
+        writePreparationError(io, args, record);
+        return record.exitCode;
+    }
+}

package/dist/cli/memory-init-invocation.js

@@ -0,0 +1,78 @@
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "../services/hybrid-contracts.js";
+import { prepareCommandRoute } from "./command-inputs.js";
+const stages = new Set(["preflight", "discover", "compose", "verify", "review", "finish"]);
+function refuse(message) {
+    throw new AppError("usage", message, 2, { phase: "prepare", effect: "no_effect" });
+}
+/** Pure invocation preparation. File bytes, stored replay and productive
+ * authority remain with their existing owners; no ambient defaults here. */
+export function prepareMemoryInitInvocation(args) {
+    const route = prepareCommandRoute(args);
+    if (!["init", "flow mb-init"].includes(route.key))
+        refuse("Use init or flow mb-init");
+    const options = route.parsed.options;
+    const value = (name) => options.get(name)?.[0];
+    const scope = { projectRoot: value("project-root"), workspaceRoot: value("workspace-root"), requestId: value("request-id") };
+    if (![scope.projectRoot, scope.workspaceRoot].every(path.isAbsolute)
+        || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId))
+        refuse("Init needs absolute roots and a bounded request id");
+    const execution = {};
+    const maxParallel = value("max-parallel");
+    const delegation = value("delegation"), nativeConfigHome = value("native-config-home");
+    if (maxParallel !== undefined || delegation !== undefined)
+        execution.delegation = {
+            mode: delegation === "native" ? "native" : "external", max_parallel: Number(maxParallel ?? 1)
+        };
+    if (delegation === "native" && Number(maxParallel ?? 1) > 15)
+        refuse("Native concurrency must be 1..15");
+    if (nativeConfigHome !== undefined && (!path.isAbsolute(nativeConfigHome) || delegation !== "native")
+        || options.has("allow-live-probe") && delegation !== "native")
+        refuse("Native probe options require explicit native delegation; an optional config home must be absolute");
+    const profile = value("profile");
+    const profileFile = value("profile-file");
+    if (profileFile !== undefined && (!path.isAbsolute(profileFile) || profile !== undefined))
+        refuse("--profile-file must be absolute and is exclusive with --profile");
+    if (profile !== undefined)
+        execution.rootProfile = profile;
+    for (const assignment of options.get("stage-profile") ?? []) {
+        const at = assignment.indexOf("="), stage = assignment.slice(0, at), profile = assignment.slice(at + 1);
+        if (at < 1 || !stages.has(stage) || !profile.trim() || execution.stageProfiles?.[stage] !== undefined)
+            refuse("--stage-profile requires a unique stage=profile assignment");
+        (execution.stageProfiles ??= {})[stage] = profile;
+    }
+    if (options.has("work-profile")) {
+        execution.workProfiles = [...options.get("work-profile")];
+        if (new Set(execution.workProfiles).size !== execution.workProfiles.length)
+            refuse("--work-profile must not repeat a profile");
+    }
+    const intakeFile = value("intake-file"), intakeSha256 = value("intake-sha256");
+    if (Boolean(intakeFile) !== Boolean(intakeSha256)
+        || intakeSha256 !== undefined && !/^[a-f0-9]{64}$/.test(intakeSha256)
+        || intakeFile !== undefined && !path.isAbsolute(intakeFile))
+        refuse("Original intake needs an absolute --intake-file and --intake-sha256 pair");
+    const gitRoute = value("git-route"), integrationBranch = value("integration-branch");
+    if (Boolean(gitRoute) !== Boolean(integrationBranch))
+        refuse("--git-route and --integration-branch must be supplied together");
+    const gitPolicy = gitRoute === undefined ? undefined : {
+        route: gitRoute, integrationBranch: integrationBranch
+    };
+    if (options.has("prepare-only") && options.has("detach"))
+        refuse("--prepare-only does not launch a controller and is exclusive with --detach");
+    return { scope, execution, gitPolicy, intakeFile, intakeSha256, profileFile, nativeConfigHome, allowLiveProbe: options.has("allow-live-probe"), nonInteractive: options.has("non-interactive"), detach: options.has("detach"), prepareOnly: options.has("prepare-only") };
+}
+/** Omitted selectors replay the retained choices, never current aliases.
+ * Supplied selectors must equal the original raw selection, not merely resolve
+ * to today's equivalent profile. Intake paths are locators, hashes bind bytes. */
+export function assertMemoryInitInvocationReplay(invocation, original, intakeSha256) {
+    if (hybridDigest(invocation.scope) !== hybridDigest(original.scope)
+        || invocation.intakeSha256 !== undefined && invocation.intakeSha256 !== intakeSha256
+        || invocation.gitPolicy !== undefined && hybridDigest(invocation.gitPolicy) !== hybridDigest(original.git_policy)
+        || Object.entries(invocation.execution).some(([key, value]) => !Object.hasOwn(original.execution, key)
+            || hybridDigest(value) !== hybridDigest(key === "delegation" && invocation.execution.delegation?.mode === "native"
+                ? { mode: original.execution.delegation?.mode, max_parallel: original.execution.delegation?.max_parallel }
+                : original.execution[key]))) {
+        throw new AppError("memory_init_request_conflict", "Request id belongs to different original init inputs", 1, { effect: "no_effect", next_action: "replay_exact_request_or_choose_new_id" });
+    }
+}