@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.140

package/dist/services/memory-init-git-policy.js

@@ -0,0 +1,136 @@
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
+const event = "memory.init_git_policy", token = Symbol("memory-init-git-policy");
+function refuse(reason) {
+    throw new AppError("memory_init_git_policy_invalid", "Init lacks explicit retained Git policy", 2, { reason, effect: "no_effect" });
+}
+function validScope(scope) {
+    if (!scope || typeof scope.requestId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId)
+        || typeof scope.projectRoot !== "string" || !path.isAbsolute(scope.projectRoot)
+        || typeof scope.workspaceRoot !== "string" || !path.isAbsolute(scope.workspaceRoot)
+        || Object.keys(scope).sort().join() !== "projectRoot,requestId,workspaceRoot")
+        refuse("invalid_request_scope");
+}
+/** SQL preservation, not fresh policy inference, Git execution or permission. */
+export function readMemoryInitGitPolicy(context, scope) {
+    validScope(scope);
+    const rows = context.db.all(`SELECT payload_json FROM audit_events WHERE event_type=?
+    AND json_extract(payload_json,'$.scope.requestId')=? AND json_extract(payload_json,'$.scope.projectRoot')=?
+    AND json_extract(payload_json,'$.scope.workspaceRoot')=? LIMIT 2`, [event, scope.requestId, scope.projectRoot, scope.workspaceRoot]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 32 * 1024)
+        refuse("ambiguous_or_unbounded_policy");
+    let value;
+    try {
+        value = JSON.parse(rows[0].payload_json);
+    }
+    catch {
+        return refuse("invalid_policy_receipt");
+    }
+    if (!value || value.schema_id !== "dd-flow/memory-init-git-policy@1" || hybridDigest(value.scope) !== hybridDigest(scope)
+        || Object.keys(value).sort().join() !== "initial_head,integration_branch,push_authorized,repository,route,schema_id,scope,source,target_sha256,workspace_branch"
+        || value.source !== "explicit_request" || value.push_authorized !== false
+        || !["integration_branch_direct", "feature_worktree"].includes(value.route)
+        || typeof value.target_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.target_sha256)
+        || typeof value.repository !== "string" || !path.isAbsolute(value.repository)
+        || typeof value.workspace_branch !== "string" || !value.workspace_branch
+        || typeof value.integration_branch !== "string" || !value.integration_branch
+        || (value.initial_head !== null && (typeof value.initial_head !== "string" || !/^[a-f0-9]{40,64}$/.test(value.initial_head))))
+        refuse("policy_receipt_changed");
+    return structuredClone(value);
+}
+/** Explicit request choice frozen against genuine no-effect target preflight.
+ * Retaining this receipt must precede bootstrap publication. It grants no
+ * dispatch authority by itself or compatibility with a historical bootstrap.
+ * Memory finish integrates only after independently accepted current review;
+ * this receipt never authorizes push. */
+export class PreparedMemoryInitGitPolicy {
+    #target;
+    #receipt;
+    constructor(key, target, receipt) {
+        if (key !== token)
+            refuse("policy_token_required");
+        this.#target = target;
+        this.#receipt = structuredClone(receipt);
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (!(input.target instanceof PreparedMemoryInitTarget))
+            refuse("prepared_target_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const prepared = this.prepareFresh(context.env, input);
+        const receipt = prepared.value(), retained = readMemoryInitGitPolicy(context, receipt.scope);
+        if (retained && hybridDigest(retained) !== hybridDigest(receipt))
+            refuse("policy_request_conflict");
+        return prepared;
+    }
+    /** Fresh explicit policy before opening runtime stores. This checks Git and
+     * scope, but grants no SQL custody, integration or provider authority. */
+    static prepareFresh(environment, input) {
+        if (!(input.target instanceof PreparedMemoryInitTarget))
+            refuse("prepared_target_required");
+        const selection = input.selection;
+        if (!selection || Object.keys(selection).sort().join() !== "integrationBranch,route"
+            || !["integration_branch_direct", "feature_worktree"].includes(selection.route)
+            || typeof selection.integrationBranch !== "string" || !selection.integrationBranch || selection.integrationBranch.startsWith("-") || selection.integrationBranch.length > 1024
+            || [...selection.integrationBranch].some(character => character.charCodeAt(0) <= 32 || character.charCodeAt(0) === 127))
+            refuse("explicit_policy_required");
+        input.target.revalidate();
+        const facts = input.target.facts(), scope = { requestId: facts.request_id, projectRoot: facts.project_root, workspaceRoot: facts.workspace_root };
+        if (!facts.tool_probes)
+            refuse("fresh_target_required");
+        const env = Object.fromEntries(Object.entries(environment).filter(([key]) => !key.startsWith("GIT_")));
+        const result = spawnSync(facts.tools.git, ["check-ref-format", `refs/heads/${selection.integrationBranch}`], { env: { ...env, GIT_OPTIONAL_LOCKS: "0" }, encoding: "utf8", timeout: 5000, maxBuffer: 64 * 1024, shell: false, windowsHide: true });
+        if (result.error || result.signal || result.status !== 0)
+            refuse("invalid_integration_branch");
+        if (selection.route === "integration_branch_direct"
+            ? scope.projectRoot !== scope.workspaceRoot || facts.branch !== selection.integrationBranch
+            : scope.projectRoot === scope.workspaceRoot || facts.branch === selection.integrationBranch)
+            refuse("route_workspace_mismatch");
+        if (selection.route === "feature_worktree") {
+            const branch = spawnSync(facts.tools.git, ["-C", scope.projectRoot, "rev-parse", "--verify", `refs/heads/${selection.integrationBranch}^{commit}`], { env: { ...env, GIT_OPTIONAL_LOCKS: "0" }, encoding: "utf8", timeout: 5000, maxBuffer: 64 * 1024, shell: false, windowsHide: true });
+            if (branch.error || branch.signal || branch.status !== 0 || !/^[a-f0-9]{40,64}$/.test(branch.stdout.trim()))
+                refuse("integration_branch_unavailable");
+        }
+        const receipt = { schema_id: "dd-flow/memory-init-git-policy@1", scope, target_sha256: input.target.sha256,
+            repository: facts.repository, workspace_branch: facts.branch, initial_head: facts.head, source: "explicit_request",
+            route: selection.route, integration_branch: selection.integrationBranch, push_authorized: false };
+        return new PreparedMemoryInitGitPolicy(token, input.target, receipt);
+    }
+    value() { return structuredClone(this.#receipt); }
+    retain(context) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        this.#target.revalidate();
+        return context.db.writeTransaction(() => this.retainPreparedSql(context), "memoryInit.retainGitPolicy");
+    }
+    /** Metadata-only publication for an already prepared aggregate owner. */
+    retainPreparedSql(context) {
+        if (!context.db.isOwnedWriteTransaction?.())
+            refuse("owned_policy_writer_required");
+        const receipt = readMemoryInitGitPolicy(context, this.#receipt.scope);
+        if (receipt) {
+            if (hybridDigest(receipt) !== hybridDigest(this.#receipt))
+                refuse("policy_request_conflict");
+            return receipt;
+        }
+        const scope = this.#receipt.scope;
+        if (context.db.get(`SELECT 1 FROM audit_events WHERE event_type IN ('memory.init_project_bootstrap_intent','memory.init_project_bootstrap')
+        AND json_extract(payload_json,'$.scope.requestId')=? AND json_extract(payload_json,'$.scope.projectRoot')=?
+        AND json_extract(payload_json,'$.scope.workspaceRoot')=? LIMIT 1`, [scope.requestId, scope.projectRoot, scope.workspaceRoot]))
+            refuse("policy_must_precede_bootstrap");
+        appendAudit(context, { eventType: event, payload: this.#receipt });
+        this.assertCustody(context);
+        return this.value();
+    }
+    assertCustody(context) {
+        if (hybridDigest(readMemoryInitGitPolicy(context, this.#receipt.scope)) !== hybridDigest(this.#receipt))
+            refuse("policy_receipt_changed");
+    }
+}

package/dist/services/memory-init-lint-capability.js

@@ -0,0 +1,185 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+function refuse(reason) {
+    throw new AppError("memory_init_lint_capability_failed", "Selected mb-lint cannot validate Memory Bank documents", 1, { reason, effect: "no_effect", next_action: "repair_prerequisite_then_retry" });
+}
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const logical = ".memory-bank/index.md";
+const validDocument = `---
+file: '.memory-bank/index.md'
+description: 'Isolated deterministic capability probe.'
+purpose: 'Validate the selected linter without reading project documents.'
+version: '0.1.0'
+date: '2026-01-01'
+status: 'DRAFT'
+c4_level: 'documentation'
+parent: null
+tags: [capability-probe]
+---
+
+# Isolated capability probe
+`;
+/** Shape validation for historical SQL custody, never executable qualification. */
+export function isMemoryInitLintCapabilityFacts(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const facts = value, hashes = ["executable_sha256", "valid_document_sha256", "invalid_document_sha256",
+        "positive_report_sha256", "negative_report_sha256", "required_fields_report_sha256", "missing_link_report_sha256"];
+    return facts.schema_id === "dd-flow/memory-init-lint-capability@1" && typeof facts.executable === "string" && path.isAbsolute(facts.executable)
+        && typeof facts.version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(facts.version)
+        && Object.keys(facts).length === hashes.length + 3
+        && hashes.every(key => typeof facts[key] === "string" && /^[a-f0-9]{64}$/.test(facts[key]));
+}
+/** Tests deterministic JSON lint behavior, not semantic grounding or provider readiness.
+ * CLI writes only its own temporary files containing fixed probe data.
+ */
+export class PreparedMemoryInitLintCapability {
+    sha256;
+    #facts;
+    constructor(facts) {
+        this.#facts = facts;
+        this.sha256 = hybridDigest(facts);
+        Object.freeze(this);
+    }
+    static prepare(target, env) {
+        if (!(target instanceof PreparedMemoryInitTarget))
+            refuse("unprepared_target");
+        const selected = target.facts(), executable = selected.tools["mb-lint"], probe = selected.tool_probes?.["mb-lint"];
+        if (!probe)
+            refuse("missing_selected_tool_probe");
+        const checksum = () => {
+            try {
+                return hash(readBoundedReleaseFile(executable, 64 * 1024 * 1024));
+            }
+            catch {
+                return refuse("selected_executable_unavailable");
+            }
+        };
+        if (checksum() !== probe.executable_sha256)
+            refuse("selected_executable_changed");
+        let scratch, rootOwner, primary, prepared;
+        try {
+            scratch = fs.mkdtempSync(path.join(os.tmpdir(), "dd-flow-init-lint-"));
+            rootOwner = fs.lstatSync(scratch);
+            const bank = path.join(scratch, ".memory-bank");
+            fs.mkdirSync(bank);
+            const bankOwner = fs.lstatSync(bank);
+            const file = path.join(scratch, logical);
+            fs.writeFileSync(file, validDocument, { flag: "wx", mode: 0o600 });
+            const fileOwner = fs.lstatSync(file);
+            let expectedDocument = validDocument;
+            const same = (actual, selected) => actual.dev === selected.dev && actual.ino === selected.ino;
+            const ownDirectories = () => {
+                const root = fs.lstatSync(scratch), directory = fs.lstatSync(bank);
+                if (!root.isDirectory() || !directory.isDirectory() || !same(root, rootOwner) || !same(directory, bankOwner))
+                    refuse("probe_directory_owner_changed");
+            };
+            const writeProbe = (document) => {
+                ownDirectories();
+                const fd = fs.openSync(file, fs.constants.O_WRONLY | (fs.constants.O_NOFOLLOW ?? 0));
+                try {
+                    const actual = fs.fstatSync(fd);
+                    if (!actual.isFile() || actual.nlink !== 1 || !same(actual, fileOwner))
+                        refuse("probe_file_owner_changed");
+                    fs.ftruncateSync(fd, 0);
+                    fs.writeFileSync(fd, document);
+                    expectedDocument = document;
+                }
+                finally {
+                    fs.closeSync(fd);
+                }
+            };
+            const probeEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith("GIT_")));
+            const run = (status, rule) => {
+                ownDirectories();
+                const result = spawnSync(executable, ["--root", scratch, "--files", logical, "--format", "json"], { cwd: scratch, env: { ...probeEnv, GIT_OPTIONAL_LOCKS: "0" }, shell: false, windowsHide: true, timeout: 5000, maxBuffer: 256 * 1024 });
+                if (result.error || result.signal || result.status !== status)
+                    refuse("lint_probe_execution_failed");
+                ownDirectories();
+                const actual = fs.lstatSync(file);
+                if (!actual.isFile() || actual.nlink !== 1 || !same(actual, fileOwner)
+                    || hash(readBoundedReleaseFile(file, 64 * 1024)) !== hash(Buffer.from(expectedDocument)))
+                    refuse("probe_input_changed");
+                let report;
+                try {
+                    report = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(result.stdout));
+                }
+                catch {
+                    return refuse("lint_probe_invalid_json");
+                }
+                if (!report || report.tool !== "mb-lint" || report.version !== probe.version || report.root !== "."
+                    || report.memoryBank !== ".memory-bank" || !Array.isArray(report.findings)
+                    || !report.summary || typeof report.summary !== "object")
+                    refuse("lint_probe_invalid_report");
+                const summary = report.summary;
+                if (Object.keys(summary).length !== 4 || ["errors", "warnings", "info", "suggestions"].some(key => !Number.isSafeInteger(summary[key]) || Number(summary[key]) < 0)
+                    || summary.errors !== report.findings.filter(value => value?.severity === "error").length)
+                    refuse("lint_probe_invalid_summary");
+                if (status === 0 && (Object.values(summary).some(value => value !== 0) || report.findings.length !== 0))
+                    refuse("valid_document_rejected");
+                if (status === 1 && (!(Number(summary.errors) > 0) || !report.findings.some(value => value && typeof value === "object"
+                    && value.ruleId === rule && value.severity === "error" && value.file === logical)))
+                    refuse(`lint_rule_not_detected:${rule}`);
+                return hybridDigest(report);
+            };
+            const positive = run(0), invalid = "---\nfile: [\n---\n\n# Invalid YAML probe\n";
+            writeProbe(invalid);
+            const negative = run(1, "frontmatter/parseable");
+            writeProbe("---\nfile: '.memory-bank/index.md'\n---\n\n# Missing frontmatter fields\n");
+            const fields = run(1, "frontmatter/required-fields");
+            writeProbe(`${validDocument}\n[Missing target](missing-probe-target.md)\n`);
+            const links = run(1, "links/markdown-target-exists");
+            if (checksum() !== probe.executable_sha256)
+                refuse("selected_executable_changed");
+            prepared = new PreparedMemoryInitLintCapability({ schema_id: "dd-flow/memory-init-lint-capability@1",
+                executable, executable_sha256: probe.executable_sha256, version: probe.version,
+                valid_document_sha256: hash(Buffer.from(validDocument)), invalid_document_sha256: hash(Buffer.from(invalid)),
+                positive_report_sha256: positive, negative_report_sha256: negative,
+                required_fields_report_sha256: fields, missing_link_report_sha256: links });
+        }
+        catch (error) {
+            primary = error instanceof AppError ? error : new AppError("memory_init_lint_capability_failed", "Lint probe observation failed", 1, { reason: "lint_probe_observation_failed", effect: "no_effect", next_action: "repair_prerequisite_then_retry" });
+        }
+        if (scratch)
+            try {
+                const actual = fs.lstatSync(scratch);
+                if (!rootOwner || !actual.isDirectory() || actual.dev !== rootOwner.dev || actual.ino !== rootOwner.ino)
+                    refuse("probe_root_owner_changed");
+                fs.rmSync(scratch, { recursive: true });
+            }
+            catch {
+                throw new AppError("memory_init_lint_probe_cleanup_failed", "Isolated lint probe requires cleanup", 1, { reason: primary instanceof AppError ? primary.details.reason : primary ? "probe_failed" : "cleanup_failed",
+                    effect: "partial", owned_probe_path: scratch, next_action: "reconcile_owned_probe" });
+            }
+        if (primary)
+            throw primary;
+        return prepared;
+    }
+    facts() { return { ...this.#facts }; }
+    revalidate(target, _env) {
+        if (!(target instanceof PreparedMemoryInitTarget))
+            refuse("unprepared_target");
+        const selected = target.facts(), probe = selected.tool_probes?.["mb-lint"];
+        if (!probe || selected.tools["mb-lint"] !== this.#facts.executable
+            || probe.version !== this.#facts.version || probe.executable_sha256 !== this.#facts.executable_sha256)
+            refuse("lint_capability_changed");
+        // This instance already passed the functional probes. Publication checks
+        // preserve its selected executable, not repeat qualification after effects.
+        let checksum;
+        try {
+            checksum = hash(readBoundedReleaseFile(this.#facts.executable, 64 * 1024 * 1024));
+        }
+        catch {
+            return refuse("selected_executable_unavailable");
+        }
+        if (checksum !== this.#facts.executable_sha256)
+            refuse("selected_executable_changed");
+    }
+}

package/dist/services/memory-init-native-capacity.js

@@ -0,0 +1,296 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash } from "node:crypto";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
+import { runHarnessAdapter, adapterSessionId } from "./harness-adapter.js";
+import { renderCapacityInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { normalizeNativeChildren } from "../harness-runtime/lib/native-children.mjs";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { inspectDaemonOperation } from "../harness-runtime/lib/daemon-operations.mjs";
+import { nativeCommandFingerprint } from "../harness-runtime/lib/native-request-proof.mjs";
+import { continueProviderCapacity } from "./provider-capacity.js";
+import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
+const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason, effect = "no_effect") {
+    throw new AppError("memory_init_native_capacity_required", "Native startup requires its exact qualified probe", 1, { reason, effect, next_action: "reconcile_exact_native_probe" });
+}
+function read(file) {
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.nlink !== 1)
+            refuse("linked_probe_receipt", "unknown");
+        return JSON.parse(readBoundedReleaseFile(file, 1024 * 1024).toString("utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function retain(file, value) {
+    fs.writeFileSync(file, JSON.stringify(value), { flag: "wx", mode: 0o600 });
+}
+function publicReply(result) {
+    const reply = { ok: true, ...result };
+    // The daemon retains this transport-only shutdown marker, but its public
+    // response deliberately omits it (dd-codex-daemon response projection).
+    delete reply._shutdown;
+    return reply;
+}
+/** Technical child probe: no RUN, project registration, lifecycle hooks or
+ * operator profile writes. An unresolved intent never authorizes redispatch. */
+export async function produceMemoryInitNativeCapacity(input) {
+    if (!input.allowLiveProbe || !Number.isInteger(input.maximum) || input.maximum < 1 || input.maximum > 15
+        || !/^[a-f0-9]{64}$/.test(input.requestSha256)
+        || input.nativeConfigHome !== undefined && !path.isAbsolute(input.nativeConfigHome))
+        refuse("explicit_probe_authorization_required");
+    const nativeConfigHome = input.nativeConfigHome ?? input.env.CODEX_HOME ?? path.join(input.env.HOME ?? os.homedir(), ".codex");
+    const executable = resolveHarnessCommand(input.home, input.profile.harness, "adapter");
+    const runtime = resolveHarnessCommand(input.home, input.profile.harness, "runtime");
+    const identity = { schema_id: "dd-flow/memory-native-probe-input@1", scope: input.scope,
+        profile: input.profile, maximum: input.maximum, native_config_home: nativeConfigHome,
+        request_sha256: input.requestSha256, adapter: { path: executable, sha256: sha(readBoundedReleaseFile(executable, 16 * 1024 * 1024)) },
+        runtime: { path: runtime, sha256: sha(readBoundedReleaseFile(runtime, 256 * 1024 * 1024)) } };
+    const root = path.join(input.home, "memory-init-native-probes", hybridDigest(input.scope));
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (fs.realpathSync(root) !== root)
+        refuse("linked_probe_root", "unknown");
+    const lease = acquireInstallationLock(path.join(root, "probe.lock"), hybridDigest(identity));
+    try {
+        const prior = read(path.join(root, "input.json"));
+        if (prior && hybridDigest(prior) !== hybridDigest(identity))
+            refuse("probe_selection_changed", "unknown");
+        if (!prior)
+            retain(path.join(root, "input.json"), identity);
+        const result = read(path.join(root, "capacity.json"));
+        const publish = async (proof) => {
+            const cleanup = proof.cleanup;
+            const start = read(path.join(root, "daemon-start.json"));
+            const rootSessionId = adapterSessionId(read(path.join(root, "session-create.json")));
+            const inspected = read(path.join(root, "session-inspect.json"));
+            const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
+            const promptRoot = `memory-native:${hybridDigest(identity)}:session-prompt`;
+            const intents = fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+            if (intents.length > MAX_OVERLOAD_RETRIES)
+                refuse("probe_capacity_budget_changed", "unknown");
+            const promptPhases = ["session-prompt", ...intents.map(intent => `session-prompt-capacity-${intent.ordinal}`)];
+            for (let index = 0; index < intents.length; index++) {
+                const intent = intents[index];
+                if (intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== promptRoot || intent.session_id !== rootSessionId
+                    || intent.ordinal !== index + 1 || intent.operation_id !== `${promptRoot}:capacity:${index + 1}:session.prompt`
+                    || intent.predecessor !== (index ? intents[index - 1].operation_id : promptRoot))
+                    refuse("probe_capacity_chain_changed", "unknown");
+            }
+            for (const phase of ["daemon-start", "session-create", ...promptPhases, "daemon-stop"]) {
+                const continuation = /^session-prompt-capacity-(\d+)$/.exec(phase);
+                const operationId = continuation ? `${promptRoot}:capacity:${continuation[1]}:session.prompt` : `memory-native:${hybridDigest(identity)}:${phase}`;
+                const observed = await inspectDaemonOperation(path.join(root, "daemon"), operationId).catch(() => null);
+                const fingerprint = read(path.join(root, `${phase}.request-proof.json`));
+                const intent = read(path.join(root, `${phase}.intent.json`));
+                const expected = read(path.join(root, `${phase}.json`));
+                if (!observed || !fingerprint || fingerprint.command_sha256 !== intent?.command_sha256
+                    || observed.invocation_sha256 !== fingerprint.command_sha256 || observed.params_sha256 !== fingerprint.params_sha256
+                    || observed.operation_id !== operationId
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id)
+                    refuse("probe_provider_custody_changed", "unknown");
+                const promptIndex = promptPhases.indexOf(phase);
+                if (promptIndex >= 0 && promptIndex < promptPhases.length - 1) {
+                    const intent = intents[promptIndex];
+                    if (observed.state !== "failed" || !terminalProviderOverload(observed.error, rootSessionId ?? undefined, intent.turn_id)
+                        || intent.refusal?.turn_id !== intent.turn_id || intent.refusal?.session_id !== rootSessionId)
+                        refuse("probe_capacity_predecessor_changed", "unknown");
+                    if (hybridDigest(intent.refusal) !== hybridDigest(refusalObservation(observed.error, promptIndex, intent.refusal.first_observed_at)))
+                        refuse("probe_capacity_refusal_changed", "unknown");
+                }
+                else if (observed.state !== "completed" || hybridDigest(publicReply(observed.result)) !== hybridDigest(expected))
+                    refuse("probe_provider_custody_changed", "unknown");
+            }
+            if (hybridDigest(proof.input) !== hybridDigest(identity) || proof.failure || !rootSessionId
+                || proof.root_session_id !== rootSessionId || hybridDigest(proof.inspected) !== hybridDigest(inspected)
+                || hybridDigest(proof.children) !== hybridDigest(children) || proof.capacity !== children.length
+                || children.length < input.maximum || children.length > input.maximum || new Set(children.map(child => child.session_id)).size !== children.length
+                || children.some(child => child.session_id === rootSessionId || child.parent_session_id !== rootSessionId || child.provenance === "parent_mismatch")
+                || cleanup?.stopped !== true || cleanup.settled !== true || cleanup.shutdown_contract !== "dd-flow/daemon-shutdown@1"
+                || typeof start?.daemon_id !== "string" || cleanup.daemon_id !== start.daemon_id
+                || hybridDigest(cleanup) !== hybridDigest(read(path.join(root, "daemon-stop.json"))))
+                refuse("probe_not_qualified", "partial");
+            const bytes = Buffer.from(JSON.stringify(proof)), checksum = sha(bytes);
+            const reference = { path: "execution/native-capacity.json", sha256: checksum };
+            const receipts = new Map([[checksum, { kind: "native-capacity", requestId: input.scope.requestId,
+                        projectRoot: input.scope.projectRoot, workspace: input.scope.workspaceRoot,
+                        harness: input.profile.harness, profileRevision: hybridDigest(input.profile), capacity: Number(proof.capacity) }]]);
+            return { reference, receipts, receiptBytes: new Map([[checksum, bytes]]) };
+        };
+        if (result)
+            return await publish(result);
+        // An independent bounded technical workspace cannot modify the target.
+        const workspace = path.join(root, "project"), stateDir = path.join(root, "daemon");
+        fs.mkdirSync(workspace, { recursive: true, mode: 0o700 });
+        const common = ["--state-dir", stateDir, "--cwd", workspace, "--journal", path.join(root, "events.jsonl"),
+            "--no-flow", ...harnessRuntimeArguments(input.home, input.profile.harness)];
+        const env = { ...input.env, ...(input.nativeConfigHome !== undefined ? { CODEX_HOME: input.nativeConfigHome } : {}),
+            DD_FLOW_CONFIG_HOME: input.home, DD_FLOW_RESOURCE_HOME: path.join(root, "resources") };
+        delete env.DD_FLOW_HOME;
+        delete env.DD_FLOW_BIN;
+        delete env.DD_FLOW_ENGINE_HOME;
+        const call = async (phase, args, timeoutMs = 120_000, operationId = `memory-native:${hybridDigest(identity)}:${phase}`) => {
+            lease.assertOwnership();
+            const command = nativeCommandFingerprint({ executable, args: [...args, ...common], cwd: workspace, env, operationId });
+            const received = read(path.join(root, `${phase}.json`));
+            const intent = read(path.join(root, `${phase}.intent.json`));
+            if (intent && (intent.operation_id !== operationId || hybridDigest(intent.args) !== hybridDigest(args)
+                || intent.command_sha256 !== command))
+                refuse("phase_request_changed", "unknown");
+            const durable = phase !== "session-inspect";
+            if (received || intent) {
+                if (!durable && received && intent)
+                    return received;
+                // The shared adapter builder retained this before RPC/provider dispatch,
+                // independently of both the eventual reply and the local ACK receipt.
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                if (!witness)
+                    refuse(`unresolved_${phase}`, "unknown");
+                const observed = await inspectDaemonOperation(stateDir, operationId).catch(() => null);
+                const start = read(path.join(root, "daemon-start.json"));
+                if (args[0] === "session" && args[1] === "prompt" && witness.operation_id === operationId
+                    && observed?.operation_id === operationId && observed.operation === "session.prompt"
+                    && witness.command_sha256 === command && observed.invocation_sha256 === command
+                    && observed.params_sha256 === witness.params_sha256 && observed.daemon_id === start?.daemon_id
+                    && observed.state === "failed" && observed.error)
+                    throw observed.error;
+                if (observed?.operation_id !== operationId || observed.operation !== args.slice(0, 2).join(".")
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256 || !/^[a-f0-9]{64}$/.test(String(observed.params_sha256))
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id
+                    || observed.state !== "completed" || !observed.result || typeof observed.result !== "object"
+                    || observed.settlement && !["not_required", "settled"].includes(String(observed.settlement.state)))
+                    refuse(`unresolved_${phase}`, "unknown");
+                const recovered = publicReply(observed.result);
+                if (received) {
+                    if (hybridDigest(received) !== hybridDigest(recovered))
+                        refuse("phase_receipt_changed", "unknown");
+                    return received;
+                }
+                retain(path.join(root, `${phase}.json`), recovered);
+                return recovered;
+            }
+            retain(path.join(root, `${phase}.intent.json`), { operation_id: operationId, args, command_sha256: command });
+            let reply;
+            try {
+                const parent = fs.lstatSync(root);
+                reply = await runHarnessAdapter({ executable, args: [...args, ...common], env: { ...env,
+                        DD_FLOW_NATIVE_REQUEST_PROOF_FILE: path.join(root, `${phase}.request-proof.json`), DD_FLOW_NATIVE_COMMAND_SHA256: command,
+                        DD_FLOW_NATIVE_REQUEST_OPERATION: args.slice(0, 2).join("."), DD_FLOW_NATIVE_REQUEST_PROOF_OWNER: JSON.stringify({ dev: parent.dev, ino: parent.ino }) }, operationId,
+                    harness: input.profile.harness, cwd: workspace, timeoutMs, signal: AbortSignal.timeout(timeoutMs) });
+            }
+            catch (error) {
+                if (!durable)
+                    throw error;
+                // Lost first ACK is observation loss, not permission to launch again.
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                const observed = await inspectDaemonOperation(stateDir, operationId).catch(() => null);
+                const start = read(path.join(root, "daemon-start.json"));
+                if (!witness || witness.operation_id !== operationId || witness.operation !== args.slice(0, 2).join(".")
+                    || observed?.operation_id !== operationId || observed.operation !== witness.operation
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256 || observed.state !== "completed"
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id
+                    || observed.settlement && observed.settlement.state !== "not_required"
+                        && observed.settlement.state !== "settled"
+                    || !observed.result || typeof observed.result !== "object")
+                    throw error;
+                reply = publicReply(observed.result);
+            }
+            if (durable) {
+                const observed = await inspectDaemonOperation(stateDir, operationId);
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                if (observed.operation_id !== operationId || observed.state !== "completed" || !witness
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256)
+                    refuse(`unresolved_${phase}`, "unknown");
+            }
+            retain(path.join(root, `${phase}.json`), reply);
+            return reply;
+        };
+        let inspected, rootSessionId = null;
+        let failure, cleanup;
+        try {
+            await call("daemon-start", ["daemon", "start"]);
+            const created = await call("session-create", ["session", "create", "--model", input.profile.model, "--reasoning", input.profile.reasoning]);
+            rootSessionId = adapterSessionId(created);
+            if (!rootSessionId)
+                refuse("root_session_identity_missing", "unknown");
+            const promptArgs = (text) => ["session", "prompt", "--session-id", rootSessionId, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--prompt", text];
+            try {
+                await call("session-prompt", promptArgs(renderCapacityInstructions({ harness: input.profile.harness, maximum: input.maximum })), 180_000);
+            }
+            catch (error) {
+                const rootId = `memory-native:${hybridDigest(identity)}:session-prompt`;
+                const retainedIntents = () => fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const retainedFailures = () => fs.readdirSync(root).filter(name => /^capacity-failure-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const resumed = await continueProviderCapacity({ error, sessionId: rootSessionId, operationId: rootId,
+                    continuationText: "Continue the same technical capacity probe in this Session. Inspect existing direct children first; do not launch replacements or a second child wave. Complete only the originally requested capacity markers.",
+                    allowSettledDescendants: true, assertCurrent: () => lease.assertOwnership(),
+                    inspectOperation: async (id) => await inspectDaemonOperation(stateDir, id),
+                    inspectSession: async () => runHarnessAdapter({ executable, args: ["session", "inspect", "--session-id", rootSessionId, ...common], env, harness: input.profile.harness, cwd: workspace, operationId: `${rootId}:capacity-inspect`, timeoutMs: 30_000 }),
+                    retainedIntents, retainedFailures,
+                    retainIntent: intent => retain(path.join(root, `capacity-intent-${intent.ordinal}.json`), intent),
+                    retainFailure: (_id, refusal) => {
+                        const file = path.join(root, `capacity-failure-${refusal.ordinal}.json`);
+                        const prior = read(file);
+                        if (prior && hybridDigest(prior) !== hybridDigest(refusal))
+                            refuse("probe_capacity_failure_changed", "unknown");
+                        if (!prior)
+                            retain(file, refusal);
+                    },
+                    prompt: (id, text, ordinal) => call(`session-prompt-capacity-${ordinal}`, promptArgs(text), 180_000, id) });
+                if (!resumed)
+                    throw error;
+            }
+            inspected = await call("session-inspect", ["session", "inspect", "--session-id", rootSessionId]);
+        }
+        catch (error) {
+            failure = errorRecord(error);
+            // Retain a physical tree observation before owned shutdown, even when the
+            // prompt ACK is unknown. A later exact terminal receipt can then reconcile
+            // without needing to restart the stopped daemon or resend productive work.
+            if (rootSessionId && !read(path.join(root, "session-inspect.intent.json"))) {
+                try {
+                    inspected = await call("session-inspect", ["session", "inspect", "--session-id", rootSessionId]);
+                }
+                catch { /* The unresolved observation remains pending, never fabricated. */ }
+            }
+        }
+        finally {
+            try {
+                const start = read(path.join(root, "daemon-start.json")), daemon = read(path.join(stateDir, "daemon.json"));
+                if (!start || typeof start.daemon_id !== "string" || daemon?.daemon_id !== start.daemon_id)
+                    refuse("cleanup_daemon_incarnation_unknown", "unknown");
+                cleanup = await call("daemon-stop", ["daemon", "stop", "--cancel-tree"]);
+            }
+            catch (error) {
+                failure ??= errorRecord(error);
+            }
+        }
+        const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
+        const qualified = !failure && cleanup?.stopped === true && cleanup.settled === true
+            && cleanup.shutdown_contract === "dd-flow/daemon-shutdown@1" && typeof cleanup.daemon_id === "string"
+            && children.length === input.maximum && children.length <= 15
+            && children.every(child => child.parent_session_id === rootSessionId && child.session_id !== rootSessionId && child.provenance !== "parent_mismatch");
+        const proof = { schema_id: "dd-flow/memory-native-capacity@1", input: identity, root_session_id: rootSessionId,
+            inspected, cleanup, children, capacity: children.length, qualified, ...(failure ? { failure } : {}) };
+        if (failure) {
+            fs.appendFileSync(path.join(root, "observations.jsonl"), `${JSON.stringify(proof)}\n`, { mode: 0o600 });
+            throw new AppError("memory_init_native_capacity_required", "Native startup probe failed or could not be reconciled", 1, { reason: "probe_operation_unresolved", effect: "unknown", next_action: "reconcile_exact_native_probe", primary_error: failure });
+        }
+        retain(path.join(root, "capacity.json"), proof);
+        return await publish(proof);
+    }
+    finally {
+        lease.release();
+    }
+}