@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.150

package/dist/services/memory-init-project-bootstrap.js

@@ -0,0 +1,599 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import semver from "semver";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { FrozenGenericExecution } from "./generic-execution.js";
+import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
+import { PreparedMemoryInitRuntimeStorage } from "./memory-init-storage.js";
+import { PreparedMemoryLayer } from "./memory-layer.js";
+import { publishMemoryInitDraftIdentity, readRetainedMemoryLayer, restorePublishedMemoryLayer } from "./memory-layer-publication.js";
+import { PreparedProjectRegistration, registerPreparedProject } from "./projects.js";
+import { resolveHarnessCommand } from "./harness-config.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { appendAudit } from "./audit.js";
+import { PreparedMemoryInitLintCapability, isMemoryInitLintCapabilityFacts } from "./memory-init-lint-capability.js";
+import { PreparedMemoryInitWorktrunkCapability, isMemoryInitWorktrunkCapabilityFacts } from "./memory-init-worktrunk-capability.js";
+import { PreparedMemoryInitResourceStorage, isMemoryInitResourceStorageFacts } from "./memory-init-resource-storage.js";
+import { AdmittedFrozenEngine } from "./frozen-engine.js";
+import { resourceHome } from "./managed-processes.js";
+import { readSetupStatus } from "./setup.js";
+import { readMemoryInitGitPolicy } from "./memory-init-git-policy.js";
+const intentEvent = "memory.init_project_bootstrap_intent", receiptEvent = "memory.init_project_bootstrap";
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+function refuse(reason, effect = "no_effect") {
+    throw new AppError("memory_init_project_bootstrap_invalid", "Project bootstrap cannot proceed without its exact request custody", 1, { reason, effect, next_action: "reconcile_exact_request" });
+}
+function row(context, scope, event) {
+    if (!scope || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId)
+        || !path.isAbsolute(scope.projectRoot) || !path.isAbsolute(scope.workspaceRoot)
+        || Object.keys(scope).some(key => !["requestId", "projectRoot", "workspaceRoot"].includes(key)))
+        refuse("invalid_request_scope");
+    const rows = context.db.all("SELECT id, project_id, payload_json FROM audit_events WHERE event_type = ? AND json_extract(payload_json, '$.scope.requestId') = ? AND json_extract(payload_json, '$.scope.projectRoot') = ? AND json_extract(payload_json, '$.scope.workspaceRoot') = ? LIMIT 2", [event, scope.requestId, scope.projectRoot, scope.workspaceRoot]);
+    if (rows.length > 1)
+        refuse("ambiguous_request_custody");
+    const selected = rows[0];
+    if (!selected)
+        return null;
+    try {
+        if (Buffer.byteLength(selected.payload_json) > 1024 * 1024)
+            refuse("unbounded_request_custody");
+        return { ...selected, value: JSON.parse(selected.payload_json) };
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("invalid_request_custody");
+    }
+}
+/** SQL-only prepublication release selection. Current setup defaults are not a
+ * restart source, and old draft receipts do not fabricate this missing proof.
+ */
+export function readMemoryInitReleaseSelection(context, scope) {
+    const retained = row(context, scope, "memory.init_release_selection");
+    if (!retained)
+        return null;
+    const value = retained.value;
+    if (value.schema_id !== "dd-flow/memory-init-release-selection@1" || hybridDigest(value.scope) !== hybridDigest(scope)
+        || Object.keys(value).sort().join() !== "bootstrap_identity,execution_sha256,installation_manifest_base64,installation_manifest_sha256,pack_sha256,schema_id,scope"
+        || [value.bootstrap_identity, value.execution_sha256, value.pack_sha256, value.installation_manifest_sha256].some(sha => typeof sha !== "string" || !/^[a-f0-9]{64}$/.test(sha))
+        || typeof value.installation_manifest_base64 !== "string" || value.installation_manifest_base64.length > 1024 * 1024)
+        refuse("release_selection_custody_changed");
+    const bytes = Buffer.from(value.installation_manifest_base64, "base64");
+    if (!bytes.length || bytes.toString("base64") !== value.installation_manifest_base64
+        || digest(bytes) !== value.installation_manifest_sha256)
+        refuse("release_selection_custody_changed");
+    return structuredClone(value);
+}
+function readIntent(context, scope) {
+    const selected = row(context, scope, intentEvent);
+    if (!selected)
+        return null;
+    const value = selected.value;
+    if (!["dd-flow/memory-init-project-bootstrap-intent@1", "dd-flow/memory-init-project-bootstrap-intent@2", "dd-flow/memory-init-project-bootstrap-intent@3", "dd-flow/memory-init-project-bootstrap-intent@4"].includes(value.schema_id) || hybridDigest(value.scope) !== hybridDigest(scope)
+        || !/^[a-f0-9]{64}$/.test(value.identity) || !["prepared", "registered"].includes(value.status)
+        || Object.keys(value).some(key => !["schema_id", "scope", "identity", "expected_project", "status", "receipt_sha256", "lint_capability", "worktrunk_capability", "resource_storage"].includes(key))
+        || (value.schema_id !== "dd-flow/memory-init-project-bootstrap-intent@1" ? !isMemoryInitLintCapabilityFacts(value.lint_capability) : value.lint_capability !== undefined)
+        || (["dd-flow/memory-init-project-bootstrap-intent@3", "dd-flow/memory-init-project-bootstrap-intent@4"].includes(value.schema_id) ? !isMemoryInitWorktrunkCapabilityFacts(value.worktrunk_capability) : value.worktrunk_capability !== undefined)
+        || (value.schema_id === "dd-flow/memory-init-project-bootstrap-intent@4" ? !isMemoryInitResourceStorageFacts(value.resource_storage) : value.resource_storage !== undefined)
+        || value.expected_project !== null && (!value.expected_project || typeof value.expected_project.id !== "string"
+            || value.expected_project.root !== scope.projectRoot || value.expected_project.status !== "active"
+            || Object.keys(value.expected_project).some(key => !["id", "root", "status"].includes(key)))
+        || (value.status === "prepared" ? value.receipt_sha256 !== null : typeof value.receipt_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.receipt_sha256)))
+        refuse("invalid_request_intent");
+    return { ...selected, intent: value };
+}
+/** One consistent SQL snapshot of historical custody, not current files/readiness. */
+export function readMemoryInitProjectBootstrap(context, scope) {
+    return context.db.readSnapshot(() => readProjectBootstrapSnapshot(context, scope));
+}
+function readProjectBootstrapSnapshot(context, scope) {
+    const intent = readIntent(context, scope), selected = row(context, scope, receiptEvent);
+    if (!intent) {
+        if (selected)
+            refuse("bootstrap_intent_missing");
+        return null;
+    }
+    if (intent.intent.status === "prepared") {
+        if (selected)
+            refuse("uncommitted_bootstrap_receipt");
+        return null;
+    }
+    if (!selected)
+        refuse("bootstrap_receipt_missing");
+    const payload = selected.value, receipt = payload.receipt;
+    if (!receipt || !["dd-flow/memory-init-project-bootstrap@1", "dd-flow/memory-init-project-bootstrap@2", "dd-flow/memory-init-project-bootstrap@3", "dd-flow/memory-init-project-bootstrap@4"].includes(receipt.schema_id) || hybridDigest(receipt.scope) !== hybridDigest(scope)
+        || Object.keys(payload).some(key => !["scope", "identity", "sha256", "receipt"].includes(key))
+        || Object.keys(receipt).some(key => !["schema_id", "scope", "identity", "project_id", "target_sha256", "layer_sha256", "execution_sha256", "storage_sha256", "layer_publication_sha256", "draft_identity_sha256", "lint_capability_sha256", "worktrunk_capability_sha256", "resource_storage_sha256", "semantic_status", "created_at"].includes(key))
+        || intent.intent.schema_id !== receipt.schema_id.replace("project-bootstrap@", "project-bootstrap-intent@")
+        || (receipt.schema_id !== "dd-flow/memory-init-project-bootstrap@1" ? receipt.lint_capability_sha256 !== hybridDigest(intent.intent.lint_capability) : receipt.lint_capability_sha256 !== undefined)
+        || (["dd-flow/memory-init-project-bootstrap@3", "dd-flow/memory-init-project-bootstrap@4"].includes(receipt.schema_id) ? receipt.worktrunk_capability_sha256 !== hybridDigest(intent.intent.worktrunk_capability) : receipt.worktrunk_capability_sha256 !== undefined)
+        || (receipt.schema_id === "dd-flow/memory-init-project-bootstrap@4" ? receipt.resource_storage_sha256 !== hybridDigest(intent.intent.resource_storage) : receipt.resource_storage_sha256 !== undefined)
+        || typeof receipt.project_id !== "string" || !receipt.project_id
+        || receipt.identity !== intent.intent.identity || payload.identity !== receipt.identity || payload.sha256 !== hybridDigest(receipt)
+        || payload.sha256 !== intent.intent.receipt_sha256 || selected.project_id !== receipt.project_id
+        || receipt.semantic_status !== "draft_not_accepted" || typeof receipt.created_at !== "string" || !Number.isFinite(Date.parse(receipt.created_at))
+        || [receipt.target_sha256, receipt.layer_sha256, receipt.execution_sha256, receipt.storage_sha256,
+            receipt.layer_publication_sha256, receipt.draft_identity_sha256].some(value => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)))
+        refuse("bootstrap_receipt_changed");
+    if (!context.db.get("SELECT 1 FROM projects WHERE id = ? AND root = ?", [receipt.project_id, scope.projectRoot]))
+        refuse("registered_project_identity_changed");
+    return { receipt: structuredClone(receipt), sha256: payload.sha256 };
+}
+/** Independent SQL proof lookup; historical v1 never gains new qualification. */
+export function readMemoryInitProjectBootstrapLintCapability(context, scope) {
+    const registered = readMemoryInitProjectBootstrap(context, scope);
+    if (!registered || registered.receipt.schema_id === "dd-flow/memory-init-project-bootstrap@1")
+        return null;
+    const facts = readIntent(context, scope)?.intent.lint_capability;
+    if (!isMemoryInitLintCapabilityFacts(facts) || hybridDigest(facts) !== registered.receipt.lint_capability_sha256)
+        refuse("lint_capability_custody_changed");
+    return { facts: structuredClone(facts), sha256: registered.receipt.lint_capability_sha256 };
+}
+/** Independently retained functional proof; historical @1/@2 never gain it. */
+export function readMemoryInitProjectBootstrapWorktrunkCapability(context, scope) {
+    const registered = readMemoryInitProjectBootstrap(context, scope);
+    if (!registered || !["dd-flow/memory-init-project-bootstrap@3", "dd-flow/memory-init-project-bootstrap@4"].includes(registered.receipt.schema_id))
+        return null;
+    const facts = readIntent(context, scope)?.intent.worktrunk_capability;
+    if (!isMemoryInitWorktrunkCapabilityFacts(facts) || hybridDigest(facts) !== registered.receipt.worktrunk_capability_sha256)
+        refuse("worktrunk_capability_custody_changed");
+    return { facts: structuredClone(facts), sha256: registered.receipt.worktrunk_capability_sha256 };
+}
+/** Independent retained storage proof; historical @1/@2/@3 never gain it. */
+export function readMemoryInitProjectBootstrapResourceStorage(context, scope) {
+    const registered = readMemoryInitProjectBootstrap(context, scope);
+    if (!registered || registered.receipt.schema_id !== "dd-flow/memory-init-project-bootstrap@4")
+        return null;
+    const facts = readIntent(context, scope)?.intent.resource_storage;
+    if (!isMemoryInitResourceStorageFacts(facts) || hybridDigest(facts) !== registered.receipt.resource_storage_sha256)
+        refuse("resource_storage_custody_changed");
+    return { facts: structuredClone(facts), sha256: registered.receipt.resource_storage_sha256 };
+}
+/** Historical registration alone cannot attest engine-bound draft bootstrap. */
+export function readMemoryInitProjectBootstrapEngineAdmission(context, scope) {
+    return context.db.readSnapshot(() => {
+        const accepted = row(context, scope, "memory.init_engine_bootstrap");
+        if (!accepted) {
+            if (row(context, scope, "memory.init_engine_admission")?.value.status === "accepted")
+                refuse("engine_bootstrap_custody_missing");
+            return null;
+        }
+        const registered = readMemoryInitProjectBootstrap(context, scope), admission = row(context, scope, "memory.init_engine_admission");
+        if (!registered || !admission)
+            refuse("engine_bootstrap_custody_missing");
+        const value = admission.value, proof = value.proof;
+        const policyBound = value.schema_id === "dd-flow/memory-init-engine-admission@2";
+        const policy = policyBound ? readMemoryInitGitPolicy(context, scope) : null;
+        const policyBinding = policyBound ? { git_policy_sha256: value.git_policy_sha256 } : {};
+        if (policyBound && (!policy || policy.target_sha256 !== registered.receipt.target_sha256
+            || hybridDigest(policy) !== value.git_policy_sha256))
+            refuse("git_policy_custody_changed");
+        if (Object.keys(value).sort().join() !== (policyBound
+            ? "acceptance_sha256,bootstrap_identity,execution_sha256,git_policy_sha256,identity,proof,schema_id,scope,status"
+            : "acceptance_sha256,bootstrap_identity,execution_sha256,identity,proof,schema_id,scope,status")
+            || value.status !== "accepted" || value.acceptance_sha256 !== hybridDigest(accepted.value)
+            || !["dd-flow/memory-init-engine-admission@1", "dd-flow/memory-init-engine-admission@2"].includes(value.schema_id) || hybridDigest(value.scope) !== hybridDigest(scope)
+            || value.bootstrap_identity !== registered.receipt.identity || value.execution_sha256 !== registered.receipt.execution_sha256
+            || !proof || Object.keys(proof).sort().join() !== "engine_manifest_sha256,engine_sha256,facts,sha256"
+            || !proof.facts || typeof proof.facts !== "object" || Array.isArray(proof.facts)
+            || [proof.engine_manifest_sha256, proof.engine_sha256, proof.sha256].some(hash => typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash))
+            || hybridDigest(proof.facts) !== proof.sha256
+            || value.identity !== hybridDigest({ scope, bootstrap_identity: value.bootstrap_identity, execution_sha256: value.execution_sha256, proof, ...policyBinding }))
+            refuse("engine_admission_custody_changed");
+        const expected = { schema_id: "dd-flow/memory-init-engine-bootstrap@1", scope,
+            admission_identity: value.identity, bootstrap_sha256: registered.sha256, project_id: registered.receipt.project_id };
+        if (accepted.project_id !== registered.receipt.project_id || hybridDigest(accepted.value) !== hybridDigest(expected))
+            refuse("engine_bootstrap_custody_changed");
+        return { identity: value.identity, proof: structuredClone(proof), bootstrap_sha256: registered.sha256,
+            ...(policyBound ? { git_policy_sha256: value.git_policy_sha256 } : {}) };
+    });
+}
+function project(context, root) {
+    return context.db.get("SELECT id, root, status FROM projects WHERE root = ?", [root]) ?? null;
+}
+/** Static selected command/permission admission, usable before runtime stores.
+ * No diagnostic, provider process or credential read is performed. Bootstrap
+ * still captures and revalidates these same command identities independently. */
+export function prepareMemoryInitHarnessCommands(context, execution) {
+    return execution.snapshot().profiles.map(({ id, profile }) => {
+        if (profile.permission !== "allow")
+            refuse("profile_permission_denied");
+        const inspect = (kind) => {
+            try {
+                const configured = resolveHarnessCommand(context.ddFlowHome, profile.harness, kind), resolved = fs.realpathSync(configured);
+                fs.accessSync(resolved, fs.constants.X_OK);
+                return { configured, resolved, sha256: digest(readBoundedReleaseFile(resolved, 256 * 1024 * 1024)) };
+            }
+            catch {
+                return refuse(`harness_command_unavailable:${profile.harness}:${kind}`);
+            }
+        };
+        return { profile_id: id, harness: profile.harness, adapter: inspect("adapter"), runtime: inspect("runtime") };
+    });
+}
+/** Productive project/draft registration, not a complete memory-bootstrap-receipt.
+ * Static command availability, frozen permission/routes, declared mb-lint minimum
+ * and executing run-store admission are checked before project effects. Selected
+ * mb-lint also passes isolated JSON/YAML/required-field/link behavior probes.
+ * Worktrunk passes an isolated actual Git-worktree creation probe before project
+ * effects. The executing CLI also admits the selected existing shared registry
+ * without initialization/migration. Frozen-engine/provider readiness and
+ * productive workspace custody still precede public dispatch.
+ */
+export class PreparedMemoryInitProjectBootstrap {
+    identity;
+    #scope;
+    #target;
+    #layer;
+    #execution;
+    #storage;
+    #project;
+    #commands;
+    #lint;
+    #worktrunk;
+    #resource;
+    #installationManifestBase64;
+    constructor(context, target, layer, execution, storage) {
+        const facts = target.facts();
+        this.#scope = { requestId: facts.request_id, projectRoot: facts.project_root, workspaceRoot: facts.workspace_root };
+        this.#target = target;
+        this.#layer = layer;
+        this.#execution = execution;
+        this.#storage = storage;
+        const retainedSelection = readMemoryInitReleaseSelection(context, this.#scope);
+        if (retainedSelection) {
+            if (retainedSelection.installation_manifest_sha256 !== layer.installationSha256)
+                refuse("bootstrap_installation_changed");
+            this.#installationManifestBase64 = retainedSelection.installation_manifest_base64;
+        }
+        else {
+            // Historical draft registration remains resumable without a current setup
+            // selection. Only productive readiness requires retained release proof.
+            const selection = readSetupStatus(context.ddFlowHome);
+            this.#installationManifestBase64 = selection.installation_readiness === "installed"
+                && selection.installation?.manifest_sha256 === layer.installationSha256 ? selection.installation.manifest_bytes_base64 : null;
+        }
+        this.#project = PreparedProjectRegistration.prepare({ root: facts.project_root });
+        this.#resource = PreparedMemoryInitResourceStorage.prepare(context);
+        this.#commands = prepareMemoryInitHarnessCommands(context, execution);
+        this.#lint = PreparedMemoryInitLintCapability.prepare(target, context.env);
+        this.#worktrunk = PreparedMemoryInitWorktrunkCapability.prepare(target, context.env);
+        this.identity = hybridDigest({ scope: this.#scope, target: target.sha256, layer: layer.sha256,
+            execution: execution.sha256, storage: storage.sha256, resource: this.#resource.sha256, commands: this.#commands, lint: this.#lint.sha256, worktrunk: this.#worktrunk.sha256 });
+        Object.freeze(this);
+    }
+    /** Copied prepared release material; only the request owner may retain it.
+     * This is not engine, storage, provider or RUN readiness. */
+    releaseSelection() {
+        if (!this.#installationManifestBase64)
+            refuse("selected_release_manifest_unavailable");
+        return structuredClone({ schema_id: "dd-flow/memory-init-release-selection@1", scope: this.#scope,
+            bootstrap_identity: this.identity, execution_sha256: this.#execution.sha256, pack_sha256: this.#layer.packSha256,
+            installation_manifest_sha256: this.#layer.installationSha256, installation_manifest_base64: this.#installationManifestBase64 });
+    }
+    retainReadinessSelection(context) {
+        const value = this.releaseSelection();
+        context.db.writeTransaction(() => {
+            this.#storage.assertCompatibility(context);
+            const retained = readMemoryInitReleaseSelection(context, this.#scope);
+            if (retained) {
+                if (hybridDigest(retained) !== hybridDigest(value))
+                    refuse("release_selection_custody_changed");
+                return;
+            }
+            if (readMemoryInitProjectBootstrap(context, this.#scope))
+                refuse("historical_bootstrap_has_no_release_selection");
+            appendAudit(context, { eventType: "memory.init_release_selection", payload: value });
+        }, "memoryInit.retainReleaseSelection");
+    }
+    static prepare(context, input) {
+        if (!(input.target instanceof PreparedMemoryInitTarget) || !(input.layer instanceof PreparedMemoryLayer)
+            || !(input.execution instanceof FrozenGenericExecution))
+            refuse("unprepared_bootstrap_input");
+        const facts = input.target.facts(), scope = input.execution.snapshot().scope;
+        if (input.execution.settings.flow_id !== "mb-init" || scope.requestId !== facts.request_id
+            || scope.projectRoot !== facts.project_root || scope.workspace !== facts.workspace_root)
+            refuse("foreign_execution_scope");
+        const current = project(context, facts.project_root);
+        if (current && current.status !== "active")
+            refuse("project_not_active");
+        let minimum;
+        try {
+            const compatibility = JSON.parse(input.layer.files().get("dd-flow/compatibility.json").toString("utf8"));
+            if (typeof compatibility.mb_lint?.min_version !== "string")
+                refuse("mb_lint_minimum_not_admitted");
+            minimum = compatibility.mb_lint.min_version;
+        }
+        catch {
+            return refuse("mb_lint_minimum_not_admitted");
+        }
+        if (!facts.tool_probes || !semver.valid(minimum) || !semver.valid(facts.tool_probes["mb-lint"].version)
+            || semver.lt(facts.tool_probes["mb-lint"].version, minimum))
+            refuse("mb_lint_minimum_not_admitted");
+        const prepared = new PreparedMemoryInitProjectBootstrap(context, input.target, input.layer, input.execution, PreparedMemoryInitRuntimeStorage.prepare(context));
+        const intent = readIntent(context, prepared.#scope);
+        if (intent && intent.intent.identity !== prepared.identity)
+            refuse("request_identity_changed");
+        if (intent && hybridDigest(intent.intent.lint_capability) !== prepared.#lint.sha256)
+            refuse("lint_capability_custody_changed");
+        if (intent && hybridDigest(intent.intent.worktrunk_capability) !== prepared.#worktrunk.sha256)
+            refuse("worktrunk_capability_custody_changed");
+        if (intent && hybridDigest(intent.intent.resource_storage) !== prepared.#resource.sha256)
+            refuse("resource_storage_custody_changed");
+        if (row(context, prepared.#scope, receiptEvent))
+            readMemoryInitProjectBootstrap(context, prepared.#scope);
+        if (!intent && fs.existsSync(path.join(facts.workspace_root, ".memory-bank")))
+            refuse("bootstrap_intent_missing");
+        prepared.revalidatePhysical(context, false);
+        return prepared;
+    }
+    /** Reconstruct an accepted bootstrap from request-local custody only. No
+     * cached caller target, current global installation or publication fallback
+     * can supply lost evidence. Tool/storage/command admission is repeated before
+     * returning; readiness still requires the independently selected engine.
+     */
+    static restore(context, execution) {
+        if (!(execution instanceof FrozenGenericExecution) || execution.settings.flow_id !== "mb-init")
+            refuse("unprepared_bootstrap_execution");
+        const frozen = execution.snapshot(), scope = { requestId: frozen.scope.requestId,
+            projectRoot: frozen.scope.projectRoot, workspaceRoot: frozen.scope.workspace };
+        const retained = context.db.readSnapshot(() => {
+            const registered = readMemoryInitProjectBootstrap(context, scope), selection = readMemoryInitReleaseSelection(context, scope);
+            if (!registered || registered.receipt.schema_id !== "dd-flow/memory-init-project-bootstrap@4" || !selection
+                || registered.receipt.execution_sha256 !== execution.sha256 || selection.execution_sha256 !== execution.sha256
+                || selection.bootstrap_identity !== registered.receipt.identity)
+                refuse("accepted_bootstrap_required");
+            return { registered, selection };
+        });
+        const restored = restorePublishedMemoryLayer(context.ddFlowHome, { ...scope,
+            targetSha256: retained.registered.receipt.target_sha256, layerSha256: retained.registered.receipt.layer_sha256,
+            installationSha256: retained.selection.installation_manifest_sha256 }, retained.registered.receipt.layer_publication_sha256, context.env, retained.registered.receipt.draft_identity_sha256);
+        if (restored.layer.packSha256 !== retained.selection.pack_sha256)
+            refuse("retained_pack_changed");
+        return PreparedMemoryInitProjectBootstrap.prepare(context, { target: restored.target, layer: restored.layer, execution });
+    }
+    revalidatePhysical(context, qualifyTools = true) {
+        const facts = this.#target.facts();
+        if (fs.existsSync(path.join(facts.workspace_root, ".memory-bank"))) {
+            const retained = readRetainedMemoryLayer(context.ddFlowHome, { projectRoot: facts.project_root,
+                workspaceRoot: facts.workspace_root, requestId: facts.request_id, targetSha256: this.#target.sha256,
+                layerSha256: this.#layer.sha256, installationSha256: this.#layer.installationSha256 });
+            if (retained.sha256 !== this.#layer.sha256)
+                refuse("retained_layer_changed");
+            PreparedMemoryInitTarget.revalidateOwnedPublication(facts, this.#target.sha256, context.env);
+        }
+        else
+            this.#target.revalidate();
+        if (hybridDigest(prepareMemoryInitHarnessCommands(context, this.#execution)) !== hybridDigest(this.#commands))
+            refuse("harness_commands_changed");
+        this.#resource.revalidate(context);
+        if (qualifyTools) {
+            this.#lint.revalidate(this.#target, context.env);
+            this.#worktrunk.revalidate(this.#target, context.env);
+        }
+    }
+    /** Independently observed input for the productive bootstrap receipt. This
+     * does not launch a provider or promote account/model access from unknown.
+     * Callers cannot replace the target, execution, release or accepted proof.
+     */
+    prepareReadiness(context, engine) {
+        if (!(engine instanceof AdmittedFrozenEngine))
+            refuse("selected_engine_not_admitted");
+        this.revalidatePhysical(context, false);
+        this.#storage.assertCompatibility(context);
+        const registered = readMemoryInitProjectBootstrap(context, this.#scope);
+        const accepted = readMemoryInitProjectBootstrapEngineAdmission(context, this.#scope);
+        const release = readMemoryInitReleaseSelection(context, this.#scope);
+        if (!registered || registered.receipt.identity !== this.identity || !accepted
+            || accepted.bootstrap_sha256 !== registered.sha256 || !release
+            || release.bootstrap_identity !== this.identity || release.execution_sha256 !== this.#execution.sha256
+            || release.pack_sha256 !== this.#layer.packSha256 || release.installation_manifest_sha256 !== this.#layer.installationSha256
+            || release.installation_manifest_base64 !== this.#installationManifestBase64)
+            refuse("accepted_engine_bootstrap_required");
+        const proof = engine.admitMemoryInitStorage(context.ddFlowHome, resourceHome(context));
+        if (hybridDigest(proof) !== hybridDigest(accepted.proof))
+            refuse("engine_storage_changed_after_bootstrap");
+        const manifest = engine.manifest(), installation = JSON.parse(Buffer.from(release.installation_manifest_base64, "base64").toString("utf8"));
+        if (installation.engine.package !== manifest.package_name
+            || installation.engine.version !== manifest.package_version)
+            refuse("readiness_installation_changed");
+        // Read exactly the admitted installed inventory, not a repository scan. A
+        // completed journal alone cannot qualify deleted/replaced installed files.
+        const memoryRoot = path.join(this.#scope.workspaceRoot, ".memory-bank"), rootOwner = fs.lstatSync(memoryRoot);
+        const marker = path.join(memoryRoot, ".dd-flow-layer-owner.json");
+        const publicationBytes = readBoundedReleaseFile(marker, 1024 * 1024);
+        const publication = JSON.parse(publicationBytes.toString("utf8"));
+        if (!rootOwner.isDirectory() || fs.lstatSync(marker).nlink !== 1
+            || digest(publicationBytes) !== registered.receipt.layer_publication_sha256
+            || publication.root_device !== rootOwner.dev || publication.root_inode !== rootOwner.ino)
+            refuse("readiness_layer_owner_changed");
+        for (const [logical, bytes] of this.#layer.files()) {
+            const file = path.join(this.#scope.workspaceRoot, ".memory-bank", logical);
+            let parent = path.join(this.#scope.workspaceRoot, ".memory-bank");
+            if (!fs.lstatSync(parent).isDirectory())
+                refuse("readiness_layer_changed");
+            for (const segment of logical.split("/").slice(0, -1)) {
+                parent = path.join(parent, segment);
+                if (!fs.lstatSync(parent).isDirectory())
+                    refuse("readiness_layer_changed");
+            }
+            if (fs.lstatSync(file).nlink !== 1 || !readBoundedReleaseFile(file, 1024 * 1024).equals(bytes))
+                refuse("readiness_layer_changed");
+        }
+        return { scope: { ...this.#scope }, target: this.#target.facts(), execution_sha256: this.#execution.sha256,
+            pack_sha256: this.#layer.packSha256, installation_manifest_sha256: this.#layer.installationSha256,
+            installation_manifest_base64: release.installation_manifest_base64,
+            engine_manifest_base64: engine.manifestBytes().toString("base64"),
+            ...(accepted.git_policy_sha256 ? { git_policy_sha256: accepted.git_policy_sha256 } : {}), registered, accepted };
+    }
+    /** Productive engine-bound path. Historical draft receipts do not acquire this
+     * qualification: the independent gate must exist before project publication.
+     * This still does not assert provider or final normal-flow readiness.
+     */
+    applyWithEngine(context, engine, onCheckpoint) {
+        if (!(engine instanceof AdmittedFrozenEngine))
+            refuse("selected_engine_not_admitted");
+        const event = "memory.init_engine_admission";
+        // Old admission remains historical; a new request must freeze explicit
+        // policy before its first storage/bootstrap effect, never infer it here.
+        const legacy = row(context, this.#scope, event)?.value.schema_id === "dd-flow/memory-init-engine-admission@1";
+        const policy = legacy ? null : readMemoryInitGitPolicy(context, this.#scope);
+        if (!legacy && (!policy || policy.target_sha256 !== this.#target.sha256))
+            refuse("explicit_git_policy_required");
+        const policyBinding = policy ? { git_policy_sha256: hybridDigest(policy) } : {};
+        const proof = engine.admitMemoryInitStorage(context.ddFlowHome, resourceHome(context));
+        const identity = hybridDigest({ scope: this.#scope, bootstrap_identity: this.identity, execution_sha256: this.#execution.sha256, proof, ...policyBinding });
+        const expected = { schema_id: legacy ? "dd-flow/memory-init-engine-admission@1" : "dd-flow/memory-init-engine-admission@2", scope: this.#scope,
+            bootstrap_identity: this.identity, execution_sha256: this.#execution.sha256, identity, proof, ...policyBinding, status: "prepared", acceptance_sha256: null };
+        const assertReceipt = () => {
+            if (policy && hybridDigest(readMemoryInitGitPolicy(context, this.#scope)) !== policyBinding.git_policy_sha256)
+                refuse("git_policy_custody_changed");
+            const prior = row(context, this.#scope, event);
+            if (!prior || !["prepared", "accepted"].includes(prior.value.status)
+                || (prior.value.status === "prepared" ? prior.value.acceptance_sha256 !== null : typeof prior.value.acceptance_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(prior.value.acceptance_sha256))
+                || hybridDigest({ ...prior.value, status: "prepared", acceptance_sha256: null }) !== hybridDigest(expected))
+                refuse("engine_admission_custody_changed");
+            return prior;
+        };
+        const revalidate = () => {
+            if (hybridDigest(engine.admitMemoryInitStorage(context.ddFlowHome, resourceHome(context))) !== hybridDigest(proof))
+                refuse("engine_storage_changed_after_preparation");
+            assertReceipt();
+        };
+        const alreadyPublished = fs.existsSync(path.join(this.#scope.workspaceRoot, ".memory-bank"));
+        context.db.writeTransaction(() => {
+            this.#storage.assertCompatibility(context);
+            const prior = row(context, this.#scope, event);
+            if (prior) {
+                assertReceipt();
+                return;
+            }
+            if (readMemoryInitProjectBootstrap(context, this.#scope))
+                refuse("historical_bootstrap_has_no_engine_admission");
+            // Existing draft intent is allowed only before any publication; do not
+            // retroactively qualify already installed bytes from the legacy path.
+            if (alreadyPublished)
+                refuse("engine_admission_after_publication");
+            appendAudit(context, { eventType: event, payload: expected });
+        }, "memoryInit.engineAdmission");
+        try {
+            this.retainReadinessSelection(context);
+            revalidate();
+            const registered = this.apply(context, phase => {
+                onCheckpoint?.(phase);
+                revalidate();
+            });
+            revalidate();
+            const acceptance = { schema_id: "dd-flow/memory-init-engine-bootstrap@1", scope: this.#scope,
+                admission_identity: identity, bootstrap_sha256: registered.sha256, project_id: registered.receipt.project_id };
+            context.db.writeTransaction(() => {
+                const admission = assertReceipt();
+                if (readMemoryInitProjectBootstrap(context, this.#scope)?.sha256 !== registered.sha256)
+                    refuse("bootstrap_custody_changed");
+                const prior = row(context, this.#scope, "memory.init_engine_bootstrap");
+                if (prior) {
+                    if (admission.value.status !== "accepted" || admission.value.acceptance_sha256 !== hybridDigest(acceptance) || hybridDigest(prior.value) !== hybridDigest(acceptance))
+                        refuse("engine_bootstrap_custody_changed");
+                    return;
+                }
+                if (admission.value.status === "accepted")
+                    refuse("engine_bootstrap_custody_missing");
+                appendAudit(context, { projectId: registered.receipt.project_id, eventType: "memory.init_engine_bootstrap", payload: acceptance });
+                const updated = context.db.run("UPDATE audit_events SET payload_json=? WHERE id=? AND payload_json=?", [JSON.stringify({ ...admission.value, status: "accepted", acceptance_sha256: hybridDigest(acceptance) }), admission.id, admission.payload_json]);
+                if (updated.changes !== 1)
+                    refuse("engine_admission_custody_changed");
+            }, "memoryInit.acceptEngineBootstrap");
+            return { ...registered, engine_admission_identity: identity };
+        }
+        catch (error) {
+            throw new AppError("memory_init_engine_bootstrap_failed", "Engine-bound bootstrap retained an incomplete request outcome", 1, { reason: error instanceof AppError ? error.details.reason ?? error.code : "engine_bootstrap_operation_failed",
+                effect: "partial", next_action: "reconcile_exact_request", cause: errorRecord(error) });
+        }
+    }
+    apply(context, onCheckpoint) {
+        const completed = readMemoryInitProjectBootstrap(context, this.#scope);
+        if (completed) {
+            if (completed.receipt.identity !== this.identity || project(context, this.#scope.projectRoot)?.status !== "active")
+                refuse("request_identity_changed");
+            return { ...completed, changed: false };
+        }
+        this.revalidatePhysical(context);
+        const fresh = !fs.existsSync(path.join(this.#scope.workspaceRoot, ".memory-bank"));
+        let retained = false;
+        try {
+            const intent = context.db.writeTransaction(() => {
+                this.#storage.assertCompatibility(context);
+                const prior = readIntent(context, this.#scope);
+                if (prior) {
+                    if (prior.intent.identity !== this.identity)
+                        refuse("request_identity_changed");
+                    if (hybridDigest(prior.intent.lint_capability) !== this.#lint.sha256)
+                        refuse("lint_capability_custody_changed");
+                    if (hybridDigest(prior.intent.worktrunk_capability) !== this.#worktrunk.sha256)
+                        refuse("worktrunk_capability_custody_changed");
+                    if (hybridDigest(prior.intent.resource_storage) !== this.#resource.sha256)
+                        refuse("resource_storage_custody_changed");
+                    return prior.intent;
+                }
+                if (!fresh)
+                    refuse("bootstrap_intent_missing");
+                const expected = project(context, this.#scope.projectRoot);
+                if (expected && expected.status !== "active")
+                    refuse("project_not_active");
+                const value = { schema_id: "dd-flow/memory-init-project-bootstrap-intent@4", scope: this.#scope,
+                    identity: this.identity, expected_project: expected, status: "prepared", receipt_sha256: null, lint_capability: this.#lint.facts(), worktrunk_capability: this.#worktrunk.facts(), resource_storage: this.#resource.facts() };
+                appendAudit(context, { eventType: intentEvent, payload: value });
+                return value;
+            }, "memoryInit.projectBootstrapIntent");
+            retained = true;
+            onCheckpoint?.("intent_retained");
+            this.revalidatePhysical(context);
+            const drafts = publishMemoryInitDraftIdentity(context.ddFlowHome, this.#target, this.#layer, context.env);
+            onCheckpoint?.("drafts_published");
+            this.revalidatePhysical(context);
+            const result = context.db.writeTransaction(() => {
+                this.#storage.assertCompatibility(context);
+                const replay = readMemoryInitProjectBootstrap(context, this.#scope);
+                if (replay) {
+                    if (replay.receipt.identity !== this.identity)
+                        refuse("request_identity_changed");
+                    return { ...replay, changed: false };
+                }
+                const current = readIntent(context, this.#scope);
+                if (!current || hybridDigest(current.intent) !== hybridDigest(intent))
+                    refuse("request_intent_changed");
+                const existing = project(context, this.#scope.projectRoot);
+                if (hybridDigest(existing) !== hybridDigest(intent.expected_project))
+                    refuse("project_identity_changed");
+                if (!existing)
+                    registerPreparedProject(context, this.#project);
+                const registered = project(context, this.#scope.projectRoot);
+                if (!registered || registered.status !== "active")
+                    refuse("project_registration_failed");
+                const receipt = { schema_id: "dd-flow/memory-init-project-bootstrap@4",
+                    scope: this.#scope, identity: this.identity, project_id: registered.id, target_sha256: this.#target.sha256,
+                    layer_sha256: this.#layer.sha256, execution_sha256: this.#execution.sha256, storage_sha256: this.#storage.sha256,
+                    layer_publication_sha256: drafts.receipt.layer_publication_sha256, draft_identity_sha256: drafts.sha256,
+                    lint_capability_sha256: this.#lint.sha256,
+                    worktrunk_capability_sha256: this.#worktrunk.sha256,
+                    resource_storage_sha256: this.#resource.sha256,
+                    semantic_status: "draft_not_accepted", created_at: context.now() };
+                const sha256 = hybridDigest(receipt);
+                appendAudit(context, { projectId: registered.id, eventType: receiptEvent, payload: { scope: this.#scope, identity: this.identity, sha256, receipt } });
+                context.db.run("UPDATE audit_events SET payload_json = ? WHERE id = ? AND payload_json = ?", [JSON.stringify({ ...intent, status: "registered", receipt_sha256: sha256 }), current.id, current.payload_json]);
+                const accepted = readMemoryInitProjectBootstrap(context, this.#scope);
+                if (!accepted)
+                    refuse("bootstrap_receipt_not_committed");
+                return { ...accepted, changed: true };
+            }, "memoryInit.registerProjectBootstrap");
+            onCheckpoint?.("registered");
+            return result;
+        }
+        catch (error) {
+            throw new AppError("memory_init_project_bootstrap_failed", "Project bootstrap retained an incomplete request outcome", 1, { reason: error instanceof AppError ? error.details?.reason ?? error.code : "bootstrap_operation_failed",
+                effect: retained ? "partial" : "no_effect", next_action: "reconcile_exact_request", cause: errorRecord(error) });
+        }
+    }
+}