@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.150

package/dist/services/memory-historical-repair-registration.js

@@ -0,0 +1,105 @@
+import { assertMemorySqlCustody } from "./memory-custody-snapshot.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedHistoricalOriginalMemoryReview } from "./memory-historical-original-review.js";
+import { readRetainedMemoryRepairRegistration, assertRetainedMemoryRepairAllocation, memoryRepairBatch, memoryRepairWorkerSchema } from "./memory-repair-registration.js";
+import { validateMemoryReviewCorrectionPlan, memoryRepairCanonicalPaths } from "./memory-review-correction-plan.js";
+import { memoryReviewWaveProjection } from "./memory-review-acceptance.js";
+const token = Symbol("historical-memory-repair-registration");
+function refuse(reason) {
+    throw new AppError("memory_historical_repair_registration_invalid", "Closed review lacks retained repair graph custody", 2, { reason, effect: "no_effect" });
+}
+function selected(context, original) {
+    original.assertCustody(context);
+    const registration = original.registration(), receipt = readRetainedMemoryRepairRegistration(context, registration.scope);
+    const results = original.results(), bundle = original.bundle();
+    if (receipt.original_registration_sha256 !== hybridDigest(registration) || receipt.review_sha256 !== original.reviewSha256()
+        || results.some(result => result.outcome === "blocked"))
+        refuse("historical_original_review_changed");
+    const engine = bundle.engine();
+    const plan = validateMemoryReviewCorrectionPlan(Buffer.from(receipt.plan_base64, "base64"), engine, {
+        runId: registration.run_id, wave: 1, reviewSha256: original.reviewSha256(), units: registration.view.unit_inventory,
+        canonicalPaths: memoryRepairCanonicalPaths(context, bundle),
+        findings: memoryReviewWaveProjection(results, registration.view.diagnostic_findings).findings
+    });
+    for (const item of plan.works)
+        bundle.execution.work("review", item.profile_id ?? undefined);
+    if (JSON.parse(engine.schema("memory-repair-work-result").toString("utf8")).$id !== memoryRepairWorkerSchema)
+        refuse("frozen_repair_schema_required");
+    const batch = memoryRepairBatch({ scope: registration.scope, plan, planSha256: receipt.plan_sha256,
+        originalRegistrationSha256: hybridDigest(registration), references: [...registration.view.run_inputs,
+            ...original.references().map(ref => ({ root: "run", ...ref.result }))], findings: memoryReviewWaveProjection(results, registration.view.diagnostic_findings).findings });
+    assertRetainedMemoryRepairAllocation(context, receipt, batch);
+    return { receipt, batch };
+}
+/** Closed-Stage repair graph only. Deliberately a distinct private-branded
+ * type: fresh repair baseline/copy/start/allocation APIs do not accept it.
+ * Settled-history validation may consume it without requiring live review. */
+export class PreparedHistoricalMemoryRepairRegistration {
+    #custodyKey = {};
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #original in value;
+    }
+    sha256;
+    #original;
+    #receipt;
+    #batch;
+    constructor(key, original, value) {
+        if (key !== token)
+            refuse("historical_registration_token_required");
+        this.#original = original;
+        this.#receipt = structuredClone(value.receipt);
+        this.#batch = structuredClone(value.batch);
+        this.sha256 = hybridDigest(value.receipt);
+        Object.freeze(this);
+    }
+    static prepare(context, original) {
+        if (!PreparedHistoricalOriginalMemoryReview.isPrepared(original))
+            refuse("historical_original_owner_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        original.revalidate(context);
+        const value = context.db.readSnapshot(() => selected(context, original));
+        const prepared = new PreparedHistoricalMemoryRepairRegistration(token, original, value);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    receipt() { return structuredClone(this.#receipt); }
+    batch() { return structuredClone(this.#batch); }
+    review() { return { original: () => this.#original }; }
+    completedWorkOrder(context) {
+        this.assertCustody(context);
+        const receipt = this.#receipt, scope = receipt.scope, batch = this.#batch;
+        const all = context.db.all("SELECT id,json_extract(payload_json,'$.work_id') AS work_id FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_settlement' AND json_extract(payload_json,'$.run_id')=? ORDER BY id LIMIT 257", [scope.project_id, scope.run_id]);
+        if (all.length > 256)
+            refuse("unbounded_historical_settlements");
+        const ids = new Set(Object.values(receipt.work_ids)), rows = all.filter(row => ids.has(row.work_id));
+        if (rows.length !== batch.works.length || new Set(rows.map(row => row.work_id)).size !== batch.works.length
+            || rows.some(row => !Number.isSafeInteger(row.id) || row.id <= 0))
+            refuse("historical_settlement_coverage_changed");
+        const order = new Map(rows.map((row, index) => [row.work_id, index]));
+        for (const item of batch.works) {
+            const workId = receipt.work_ids[item.key];
+            const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=? AND parent_work_id=?", [scope.project_id, scope.run_id, workId, scope.parent_work_id]);
+            if (work?.status !== "completed" || item.depends_on.some(key => {
+                const dependency = receipt.work_ids[key];
+                return !dependency || order.get(dependency) >= order.get(workId);
+            }))
+                refuse("historical_dependency_order_changed");
+        }
+        return rows.map(row => row.work_id);
+    }
+    assertCustody(context) {
+        const original = this.#original;
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            original.assertCustody(context);
+            const receipt = readRetainedMemoryRepairRegistration(context, this.#receipt.scope);
+            if (hybridDigest(receipt) !== this.sha256)
+                refuse("historical_repair_registration_changed");
+            // The immutable plan/batch was admitted by prepare. Custody checks reread
+            // scoped SQL allocation, not the same frozen engine and plan again.
+            assertRetainedMemoryRepairAllocation(context, receipt, this.#batch);
+        });
+    }
+    revalidate(context) { this.#original.revalidate(context); this.assertCustody(context); }
+}

package/dist/services/memory-historical-second-review.js

@@ -0,0 +1,147 @@
+import { assertMemorySqlCustody } from "./memory-custody-snapshot.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedHistoricalSecondMemoryCorrectionWave } from "./memory-completed-correction-wave.js";
+import { assertHistoricalMemoryReviewSources } from "./memory-historical-corrected-review.js";
+import { readRetainedSecondCorrectedMemoryReviewRegistration } from "./memory-corrected-review-registration.js";
+import { PreparedRetainedMemoryCorrectionChecks } from "./memory-correction-check-receipt.js";
+import { secondCorrectedMemoryReviewAssignments, secondCorrectedMemoryReviewReferences } from "./memory-second-corrected-review-inputs.js";
+import { memoryCorrectedReviewBatch } from "./memory-corrected-review-batch.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { readMemoryReviewWorkSettlement } from "./memory-review-acceptance.js";
+import { validateMemoryReviewWorkResult } from "./memory-review-work-results.js";
+import { assertSelectiveMemoryReviewCoverage } from "./memory-corrected-review-acceptance.js";
+import { correctedMemoryReviewUnits } from "./memory-corrected-review-projection.js";
+import { correctedMemoryReviewFindings } from "./memory-corrected-review-findings.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+const token = Symbol("historical-second-memory-review");
+function refuse(reason) {
+    throw new AppError("memory_historical_second_review_invalid", "Closed final review lacks independent second-wave custody", 2, { reason, effect: "no_effect" });
+}
+/** Reconstructs closed wave-two fan-in from retained proofs. Expected hashes
+ * come from an independently accepted receipt, not current workspace policy.
+ * This owner alone neither accepts a Stage nor admits another correction. */
+export class PreparedHistoricalSecondMemoryReview {
+    #custodyKey = {};
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #wave in value;
+    }
+    #wave;
+    #registration;
+    #checks;
+    #workers;
+    #previous;
+    #projection;
+    #observed;
+    constructor(key, wave, registration, checks, workers, previous, projection, observed) {
+        if (key !== token)
+            refuse("historical_second_review_token_required");
+        this.#wave = wave;
+        this.#registration = structuredClone(registration);
+        this.#checks = checks;
+        this.#workers = workers;
+        this.#previous = structuredClone(previous);
+        this.#projection = structuredClone(projection);
+        this.#observed = observed;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const wave = PreparedHistoricalSecondMemoryCorrectionWave.prepare(context, input), repairs = wave.repairResults();
+        const retained = wave.registration(), first = retained.initialInputView(), receipt = retained.receipt();
+        const registration = context.db.readSnapshot(() => readRetainedSecondCorrectedMemoryReviewRegistration(context, first.scope, input.correctedInputSha256, input.checkReceiptSha256));
+        if (!registration)
+            refuse("historical_second_registration_required");
+        const view = registration.view, paths = [...new Set(retained.plan().works.flatMap(work => work.write_paths))].sort();
+        assertHistoricalMemoryReviewSources(wave.histories(), paths, view.run_inputs, retained.initialDocumentBaseline());
+        const files = view.run_inputs.filter(ref => ref.root === "workspace");
+        const projected = secondCorrectedMemoryReviewAssignments({ first, affected: wave.affectedUnitIds(), files, repairs });
+        const runInputs = secondCorrectedMemoryReviewReferences({ firstInputs: first.run_inputs,
+            firstWorkers: retained.firstReviewProof(context).workers, repairs, files });
+        if (view.schema_id !== "dd-flow/memory-corrected-review-inputs@2" || view.wave !== 2
+            || view.original_review_sha256 !== receipt.review_sha256 || view.base !== first.base || view.source_policy !== first.source_policy
+            || view.first_review_input_sha256 !== receipt.first_review_input_sha256
+            || view.first_check_receipt_sha256 !== receipt.first_check_receipt_sha256
+            || view.first_review_registration_sha256 !== receipt.first_review_registration_sha256
+            || hybridDigest(view.instruction) !== hybridDigest(first.instruction)
+            || hybridDigest([view.upgrade_baseline, view.preservation_invariants]) !== hybridDigest([first.upgrade_baseline, first.preservation_invariants])
+            || hybridDigest(view.unit_inventory) !== hybridDigest(projected.units)
+            || hybridDigest(view.assignments) !== hybridDigest(projected.assignments)
+            || hybridDigest(view.affected_unit_ids) !== hybridDigest(wave.affectedUnitIds())
+            || hybridDigest(view.run_inputs) !== hybridDigest(runInputs)
+            || hybridDigest(view.repairs) !== hybridDigest(repairs.map(repair => ({ work_id: repair.work_id,
+                authority_sha256: repair.authority_sha256, result: repair.reference }))))
+            refuse("historical_second_input_projection_changed");
+        const checks = PreparedRetainedMemoryCorrectionChecks.prepareSecond(context, { ...input.scope,
+            correctedInputSha256: registration.input_sha256, receiptSha256: registration.check_receipt_sha256 });
+        if (checks.value(context).completed_correction_sha256 !== view.completed_correction_sha256)
+            refuse("historical_second_check_wave_changed");
+        const batch = memoryCorrectedReviewBatch(view), harness = runtimeHarness(input.bundle.execution.work("review").worker);
+        const workers = context.db.readSnapshot(() => batch.works.map(item => readMemoryReviewWorkSettlement(context, registration, registration.work_ids[item.key], harness)));
+        const results = workers.map((worker, index) => validateMemoryReviewWorkResult(worker.bytes, input.bundle.engine(), {
+            workId: worker.workId, packet: batch.works[index].payload.memory_review, references: view.run_inputs
+        }));
+        assertSelectiveMemoryReviewCoverage(view.affected_unit_ids, results);
+        const references = workers.map((worker, index) => ({ reviewer_work_id: worker.workId, input_sha256: registration.input_sha256,
+            result: worker.result, unit_ids: [results[index].unit_id] }));
+        const previous = retained.firstEffectiveReviewProof(context);
+        const coverage = correctedMemoryReviewUnits({ view, original: previous.results, current: results,
+            originalReferences: previous.references, currentReferences: references, repairWorkIds: repairs.map(repair => repair.work_id) });
+        const findings = correctedMemoryReviewFindings({ original: previous.results, current: results, affected: view.affected_unit_ids,
+            originalReferences: previous.references, currentReferences: references, findingHistory: previous.projection.findings, repairs });
+        const projection = { ...coverage, ...findings, outcome: findings.outcome === "accepted" ? "accepted" : "blocked" };
+        const observed = ObservedMemorySources.capture({ run: workers[0].root }, workers.map(worker => ({ root: "run", path: worker.result.path })));
+        const hashes = observed.hashes();
+        if (workers.some(worker => hashes.get(memorySourceKey("run", worker.result.path)) !== worker.result.sha256))
+            refuse("historical_second_reviewer_artifact_changed");
+        const prepared = new PreparedHistoricalSecondMemoryReview(token, wave, registration, checks, workers, previous, projection, observed);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    projection() { return structuredClone(this.#projection); }
+    settledDocumentBaseline() {
+        const registration = this.#wave.registration();
+        const paths = [...new Set(registration.plan().works.flatMap(work => work.write_paths))].sort();
+        let baseline = registration.initialDocumentBaseline().withWritePaths(paths);
+        const prefixes = new Set([hybridDigest(baseline.entries())]);
+        for (const history of this.#wave.histories()) {
+            if (!prefixes.has(hybridDigest(history.before().entries())))
+                refuse("historical_input_prefix_changed");
+            baseline = baseline.composeSettledDelta(history.before(), history.after(), history.result().outcome);
+            prefixes.add(hybridDigest(baseline.entries()));
+        }
+        return baseline;
+    }
+    retainedInputView() { return structuredClone(this.#registration.view); }
+    finalChecks(context) { this.assertCustody(context); return this.#checks.value(context).checks; }
+    settlementProof(context) {
+        this.assertCustody(context);
+        return { registration_scope: structuredClone(this.#registration.scope), registration_sha256: hybridDigest(this.#registration), wave: 2,
+            check_receipt_sha256: this.#registration.check_receipt_sha256, first_review_proof_sha256: hybridDigest(this.#previous),
+            workers: this.#workers.map(worker => ({ work_id: worker.workId, authority_sha256: worker.authority, result: { ...worker.result } })) };
+    }
+    assertCustody(context) {
+        const wave = this.#wave;
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            wave.assertCustody(context);
+            this.#checks.assertCustody(context);
+            const receipt = this.#registration;
+            if (hybridDigest(readRetainedSecondCorrectedMemoryReviewRegistration(context, receipt.scope, receipt.input_sha256, receipt.check_receipt_sha256)) !== hybridDigest(receipt))
+                refuse("historical_second_registration_changed");
+            if (hybridDigest(this.#wave.registration().firstEffectiveReviewProof(context)) !== hybridDigest(this.#previous))
+                refuse("first_review_history_changed");
+            const harness = runtimeHarness(this.#wave.registration().bundle().execution.work("review").worker);
+            for (const worker of this.#workers)
+                if (readMemoryReviewWorkSettlement(context, receipt, worker.workId, harness).authority !== worker.authority)
+                    refuse("historical_second_reviewer_settlement_changed");
+        });
+    }
+    revalidate(context) {
+        this.#wave.revalidate(context);
+        this.#checks.revalidate(context);
+        this.#observed.revalidate();
+        this.assertCustody(context);
+    }
+}

package/dist/services/memory-init-bootstrap-readiness.js

@@ -0,0 +1,210 @@
+import { createHash } from "node:crypto";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { appendAudit } from "./audit.js";
+import { AdmittedFrozenEngine } from "./frozen-engine.js";
+import { hybridDigest, validateHybridContract } from "./hybrid-contracts.js";
+import { PreparedMemoryInitProjectBootstrap, readMemoryInitProjectBootstrap, readMemoryInitProjectBootstrapEngineAdmission, readMemoryInitReleaseSelection } from "./memory-init-project-bootstrap.js";
+const receiptEvent = "memory.bootstrap_ready", intentEvent = "memory.bootstrap_readiness_intent";
+const bytes = (value) => Buffer.from(JSON.stringify(value));
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+function refuse(reason) {
+    throw new AppError("memory_init_bootstrap_readiness_invalid", "Bootstrap readiness lacks exact independently accepted custody", 1, { reason, effect: "no_effect", next_action: "reconcile_exact_request" });
+}
+function decoded(base64, sha256) {
+    if (typeof base64 !== "string" || base64.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(sha256))
+        refuse("invalid_manifest_binding");
+    const content = Buffer.from(base64, "base64");
+    if (!content.length || content.length > 1024 * 1024 || content.toString("base64") !== base64 || hash(content) !== sha256)
+        refuse("changed_manifest_bytes");
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(content));
+}
+/** Exact selected contract support, before invoking bootstrap publication. The
+ * public dispatcher must call this before its first project effect, not discover
+ * an unsupported engine after installing drafts. No provider operation occurs.
+ */
+export function prepareMemoryInitBootstrapSchema(engine) {
+    if (!(engine instanceof AdmittedFrozenEngine))
+        refuse("selected_engine_not_admitted");
+    const manifest = engine.manifest(), id = "dd-flow/memory-bootstrap-receipt@2";
+    const entries = manifest.schema_registry?.entries.filter(entry => entry.id === id) ?? [];
+    if (!Object.values(manifest.supports_contracts).flat().includes(id) || entries.length !== 1)
+        refuse("bootstrap_contract_not_supported");
+    return new Ajv2020({ strict: true, validateFormats: false }).compile(JSON.parse(engine.schema(entries[0].name).toString("utf8")));
+}
+/** Pure receipt construction from the prepared selection and accepted SQL
+ * dependencies. It is also used by writers/readers; no filesystem/schema IO.
+ */
+function material(context, binding) {
+    const scope = binding.scope, registered = readMemoryInitProjectBootstrap(context, scope);
+    const accepted = readMemoryInitProjectBootstrapEngineAdmission(context, scope);
+    const selection = readMemoryInitReleaseSelection(context, scope);
+    if (!registered || !accepted || registered.receipt.schema_id !== "dd-flow/memory-init-project-bootstrap@4"
+        || accepted.bootstrap_sha256 !== registered.sha256
+        || registered.receipt.target_sha256 !== hybridDigest(binding.target)
+        || registered.receipt.execution_sha256 !== binding.execution_sha256
+        || binding.target.request_id !== scope.requestId || binding.target.project_root !== scope.projectRoot
+        || binding.target.workspace_root !== scope.workspaceRoot
+        || binding.git_policy_sha256 !== accepted.git_policy_sha256
+        || !/^[a-f0-9]{64}$/.test(binding.pack_sha256))
+        refuse("changed_bootstrap_dependencies");
+    if (!selection || selection.bootstrap_identity !== registered.receipt.identity
+        || selection.execution_sha256 !== binding.execution_sha256 || selection.pack_sha256 !== binding.pack_sha256
+        || selection.installation_manifest_sha256 !== binding.installation_manifest_sha256
+        || selection.installation_manifest_base64 !== binding.installation_manifest_base64)
+        refuse("changed_release_selection");
+    if (!context.db.get("SELECT 1 FROM projects WHERE id=? AND root=? AND status='active'", [registered.receipt.project_id, scope.projectRoot]))
+        refuse("project_not_active");
+    const release = decoded(binding.installation_manifest_base64, binding.installation_manifest_sha256);
+    const engine = decoded(binding.engine_manifest_base64, accepted.proof.engine_manifest_sha256);
+    const engineSha256 = accepted.proof.engine_sha256;
+    if (typeof engineSha256 !== "string" || !/^[a-f0-9]{64}$/.test(engineSha256))
+        refuse("invalid_engine_identity");
+    if (release.engine.package !== engine.package_name || release.engine.version !== engine.package_version
+        || engine.integrity.checksum !== accepted.proof.engine_sha256)
+        refuse("foreign_selected_engine");
+    const fact = { requestId: scope.requestId, projectRoot: scope.projectRoot, workspace: scope.workspaceRoot };
+    const evidence = [
+        { kind: "storage-compatibility", path: "receipts/storage-compatibility.json", value: { schema_id: "dd-flow/memory-init-storage-evidence@1", scope, admission_identity: accepted.identity, proof: accepted.proof } },
+        { kind: "scaffold", path: "receipts/scaffold.json", value: { schema_id: "dd-flow/memory-init-scaffold-evidence@1", scope, bootstrap_sha256: registered.sha256, receipt: registered.receipt } },
+        { kind: "pack-install", path: "receipts/pack-install.json", value: { schema_id: "dd-flow/memory-init-pack-evidence@1", scope, bootstrap_sha256: registered.sha256, layer_sha256: registered.receipt.layer_sha256, pack_sha256: binding.pack_sha256, installation_sha256: binding.installation_manifest_sha256 } }
+    ].map(entry => ({ kind: entry.kind, path: entry.path, sha256: hash(bytes(entry.value)), base64: bytes(entry.value).toString("base64") }));
+    const reference = (index) => ({ path: evidence[index].path, sha256: evidence[index].sha256 });
+    const receipt = { schema_id: "dd-flow/memory-bootstrap-receipt@2", request_id: scope.requestId, flow_id: "mb-init",
+        project_root: scope.projectRoot, workspace: { path: scope.workspaceRoot, repository: binding.target.repository,
+            branch: binding.target.branch, commit: binding.target.head, git_state: binding.target.head === null ? "unborn" : "committed" },
+        baseline_sha256: registered.receipt.target_sha256, project_current: null,
+        upgrade_target: { canon_version: release.canon.version, pack_sha256: binding.pack_sha256 },
+        effective_execution: { engine_sha256: engineSha256, canon_sha256: release.canon.archive.sha256 },
+        readiness: "ready", storage: { route: "verified-no-op", outcome: "no-op", compatibility_receipt: reference(0),
+            drain_receipt: null, backup_receipt: null, plan_receipt: null, apply_receipt: null, verification_receipt: null },
+        effects: [{ kind: "scaffold", receipt: reference(1) }, { kind: "pack-install", receipt: reference(2) }] };
+    const admission = { receipts: new Map(evidence.map(entry => [entry.sha256, { kind: entry.kind, ...fact }])),
+        bootstrapIdentity: { ...fact, baselineSha256: registered.receipt.target_sha256,
+            engineSha256, canonSha256: release.canon.archive.sha256,
+            workspaceGit: { repository: binding.target.repository, branch: binding.target.branch, commit: binding.target.head } } };
+    const authority = { schema_id: "dd-flow/memory-bootstrap-authority@1", request_id: scope.requestId, project_root: scope.projectRoot,
+        workspace_root: scope.workspaceRoot, flow_id: "mb-init", readiness: "ready", model_access: "unknown",
+        bootstrap_sha256: hash(bytes(receipt)), project_bootstrap_sha256: registered.sha256,
+        engine_admission_identity: accepted.identity, binding, receipt, evidence };
+    return { authority, admission, projectId: registered.receipt.project_id };
+}
+function row(context, scope, event) {
+    const rows = context.db.all("SELECT project_id,payload_json FROM audit_events WHERE event_type=? AND json_extract(payload_json,'$.request_id')=? AND json_extract(payload_json,'$.project_root')=? AND json_extract(payload_json,'$.workspace_root')=? LIMIT 2", [event, scope.requestId, scope.projectRoot, scope.workspaceRoot]);
+    if (rows.length > 1)
+        refuse("ambiguous_readiness_custody");
+    if (!rows.length)
+        return null;
+    if (Buffer.byteLength(rows[0].payload_json) > 4 * 1024 * 1024)
+        refuse("unbounded_readiness_custody");
+    return { ...rows[0], value: JSON.parse(rows[0].payload_json) };
+}
+/** Historical readiness custody only. Current physical admission belongs to
+ * prepare/apply. Loss of either independent record cannot republish authority.
+ */
+export function readMemoryInitBootstrapReadiness(context, scope) {
+    try {
+        return context.db.readSnapshot(() => {
+            const retained = row(context, scope, receiptEvent), intent = row(context, scope, intentEvent);
+            if (!retained && !intent)
+                return null;
+            if (!retained || !intent)
+                refuse("readiness_custody_missing");
+            const binding = retained.value.binding;
+            if (!binding || hybridDigest(binding.scope) !== hybridDigest(scope)
+                || (Object.hasOwn(binding, "git_policy_sha256") && (typeof binding.git_policy_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(binding.git_policy_sha256)))
+                || Object.keys(binding).sort().join() !== (Object.hasOwn(binding, "git_policy_sha256")
+                    ? "engine_manifest_base64,execution_sha256,git_policy_sha256,installation_manifest_base64,installation_manifest_sha256,pack_sha256,scope,target"
+                    : "engine_manifest_base64,execution_sha256,installation_manifest_base64,installation_manifest_sha256,pack_sha256,scope,target"))
+                refuse("invalid_readiness_binding");
+            const selected = material(context, binding), expected = { schema_id: "dd-flow/memory-bootstrap-readiness-intent@1", request_id: scope.requestId,
+                project_root: scope.projectRoot, workspace_root: scope.workspaceRoot, authority_sha256: hybridDigest(selected.authority) };
+            if (retained.project_id !== selected.projectId || intent.project_id !== selected.projectId
+                || hybridDigest(retained.value) !== hybridDigest(selected.authority) || hybridDigest(intent.value) !== hybridDigest(expected))
+                refuse("changed_readiness_custody");
+            return { ...selected, authority: structuredClone(selected.authority) };
+        });
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("invalid_readiness_custody");
+    }
+}
+/** Request-owned runtime readiness, not semantic memory acceptance or account
+ * qualification. Provider failures after this receipt keep a partial bootstrap;
+ * no hidden model turn is dispatched to obtain the receipt.
+ */
+export class PreparedMemoryInitBootstrapReadiness {
+    #bootstrap;
+    #engine;
+    #binding;
+    #material;
+    constructor(bootstrap, engine, binding, selected) {
+        this.#bootstrap = bootstrap;
+        this.#engine = engine;
+        this.#binding = structuredClone(binding);
+        this.#material = selected;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (!(input.bootstrap instanceof PreparedMemoryInitProjectBootstrap))
+            refuse("unprepared_project_bootstrap");
+        const validate = prepareMemoryInitBootstrapSchema(input.engine);
+        const { registered: _registered, accepted: _accepted, ...binding } = input.bootstrap.prepareReadiness(context, input.engine);
+        void _registered;
+        void _accepted;
+        const selected = context.db.readSnapshot(() => material(context, binding));
+        if (!validate(selected.authority.receipt) || validateHybridContract("memory-bootstrap-receipt", selected.authority.receipt, selected.admission).length)
+            refuse("invalid_bootstrap_contract");
+        const prior = readMemoryInitBootstrapReadiness(context, binding.scope);
+        if (prior && hybridDigest(prior.authority) !== hybridDigest(selected.authority))
+            refuse("changed_readiness_request");
+        return new PreparedMemoryInitBootstrapReadiness(input.bootstrap, input.engine, binding, selected);
+    }
+    apply(context) {
+        const { registered: _registered, accepted: _accepted, ...current } = this.#bootstrap.prepareReadiness(context, this.#engine);
+        void _registered;
+        void _accepted;
+        if (hybridDigest(current) !== hybridDigest(this.#binding))
+            refuse("readiness_changed_after_preparation");
+        return context.db.writeTransaction(() => {
+            const selected = material(context, this.#binding);
+            if (hybridDigest(selected.authority) !== hybridDigest(this.#material.authority))
+                refuse("changed_bootstrap_dependencies");
+            const prior = readMemoryInitBootstrapReadiness(context, this.#binding.scope);
+            if (prior) {
+                if (hybridDigest(prior.authority) !== hybridDigest(selected.authority))
+                    refuse("changed_readiness_request");
+                return { ...prior, changed: false };
+            }
+            const scope = this.#binding.scope;
+            appendAudit(context, { projectId: selected.projectId, eventType: intentEvent,
+                payload: { schema_id: "dd-flow/memory-bootstrap-readiness-intent@1", request_id: scope.requestId, project_root: scope.projectRoot,
+                    workspace_root: scope.workspaceRoot, authority_sha256: hybridDigest(selected.authority) } });
+            appendAudit(context, { projectId: selected.projectId, eventType: receiptEvent, payload: selected.authority });
+            const accepted = readMemoryInitBootstrapReadiness(context, scope);
+            if (!accepted)
+                refuse("readiness_not_committed");
+            return { ...accepted, changed: true };
+        }, "memoryInit.bootstrapReadiness");
+    }
+}
+/** Productive bootstrap entry: contract admission precedes all project effects.
+ * A failure after draft publication is explicitly partial and resumes the same
+ * request; it never substitutes fresh initialization or a paid route probe.
+ */
+export function bootstrapMemoryInit(context, input, checkpoint) {
+    if (!(input.bootstrap instanceof PreparedMemoryInitProjectBootstrap))
+        refuse("unprepared_project_bootstrap");
+    prepareMemoryInitBootstrapSchema(input.engine);
+    const registered = input.bootstrap.applyWithEngine(context, input.engine, checkpoint);
+    try {
+        return PreparedMemoryInitBootstrapReadiness.prepare(context, input).apply(context);
+    }
+    catch (error) {
+        throw new AppError("memory_init_bootstrap_readiness_failed", "Project drafts are retained but bootstrap readiness is incomplete", 1, { effect: "partial", project_bootstrap_sha256: registered.sha256,
+            reason: error instanceof AppError ? error.details.reason ?? error.code : "readiness_operation_failed",
+            next_action: "reconcile_exact_request" });
+    }
+}

package/dist/services/memory-init-contexts.js

@@ -0,0 +1,131 @@
+import path from "node:path";
+import fs from "node:fs";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { readMemoryInitStartupInput } from "./memory-init-startup-custody.js";
+import { readUpgradeStorageReadiness } from "./memory-upgrade-storage-readiness.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { readDiagnosticRequest } from "./diagnostic-start.js";
+export function prepareDiagnosticContextsFromRequest(context, bundle, directory) {
+    const scope = bundle.execution.snapshot().scope, flowId = bundle.manifest.flow_id;
+    if (!isDiagnosticFlow(flowId))
+        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    const request = readDiagnosticRequest(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId });
+    if (!request || request.execution_sha256 !== bundle.execution.sha256)
+        throw new AppError("diagnostic_context_invalid", "Original diagnostic objective required", 2, { effect: "no_effect" });
+    return { ...prepareMemoryContexts(bundle, request.objective, directory, flowId), objective: request.objective };
+}
+export function publishDiagnosticContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    if (!isDiagnosticFlow(bundle.manifest.flow_id))
+        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, bundle.manifest.flow_id);
+}
+/** Original upgrade intake comes from the independently retained storage
+ * selection, including after project publication changes the old tree. */
+export function prepareMemoryUpgradeContextsFromStartup(context, bundle, directory) {
+    if (!(bundle instanceof RetainedExecutionBundle) || bundle.manifest.flow_id !== "mb-upgrade") {
+        throw new AppError("memory_upgrade_context_invalid", "Upgrade contexts require a retained upgrade bundle", 2, { effect: "no_effect" });
+    }
+    const scope = bundle.execution.snapshot().scope;
+    const retained = readUpgradeStorageReadiness(context, { requestId: scope.requestId, projectRoot: scope.projectRoot, workspaceRoot: scope.workspace });
+    if (!retained?.receipt.selection || !retained.selection
+        || retained.selection.payload.execution.sha256 !== bundle.execution.sha256
+        || retained.selection.payload.engine.manifest_sha256 !== bundle.manifest.engine_manifest.sha256) {
+        throw new AppError("memory_upgrade_context_invalid", "Upgrade contexts require the original request selection", 1, { effect: "no_effect" });
+    }
+    const objective = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(Buffer.from(retained.receipt.selection.request_input.intake_base64, "base64"));
+    return { ...prepareMemoryContexts(bundle, objective, directory, "mb-upgrade"), objective };
+}
+/** Public init consumes the independently retained intake, never a newly
+ * inferred objective. Historical v1 SDK requests must not invent one. */
+export function prepareMemoryInitContextsFromStartup(context, bundle, directory) {
+    if (!(bundle instanceof RetainedExecutionBundle) || bundle.manifest.flow_id !== "mb-init") {
+        throw new AppError("memory_init_context_invalid", "Init contexts require a retained memory bundle", 2, { effect: "no_effect" });
+    }
+    const scope = bundle.execution.snapshot().scope;
+    const retained = readMemoryInitStartupInput(context, { requestId: scope.requestId, projectRoot: scope.projectRoot, workspaceRoot: scope.workspace });
+    if (!retained || !["dd-flow/memory-init-startup-input@2", "dd-flow/memory-init-startup-input@3"].includes(retained.payload.schema_id)
+        || retained.payload.objective === undefined || retained.payload.execution.sha256 !== bundle.execution.sha256
+        || retained.payload.engine.manifest_sha256 !== bundle.manifest.engine_manifest.sha256) {
+        throw new AppError("memory_init_context_invalid", "Init contexts require the exact retained objective and execution selection", 1, { effect: "no_effect" });
+    }
+    return { ...prepareMemoryInitContexts(bundle, retained.payload.objective, directory), objective: retained.payload.objective };
+}
+/** Prepare bytes only. Immutable publication and the controller retain their
+ * existing ownership; this does not create directories, Sessions or RUNs. */
+export function prepareMemoryInitContexts(bundle, objective, directory) {
+    return prepareMemoryContexts(bundle, objective, directory, "mb-init");
+}
+function prepareMemoryContexts(bundle, objective, directory, flowId) {
+    if (!(bundle instanceof RetainedExecutionBundle) || bundle.manifest.flow_id !== flowId
+        || typeof objective !== "string" || !objective.trim() || Buffer.byteLength(objective) > 64 * 1024
+        || !path.isAbsolute(directory) || path.resolve(directory) !== directory) {
+        throw new AppError("memory_init_context_invalid", "Init contexts require a retained memory bundle, bounded objective and absolute directory", 2, { effect: "no_effect" });
+    }
+    const files = new Map(), stages = Object.create(null);
+    const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+    for (const stage of bundle.descriptor.descriptor.stages) {
+        const file = path.join(directory, `${stage.id}.json`);
+        const bytes = Buffer.from(JSON.stringify({ schema_id: "dd-flow/stage-context@1", stage: stage.id, objective }));
+        files.set(file, bytes);
+        stages[stage.id] = { file, sha256: hash(bytes) };
+    }
+    const file = path.join(directory, "managed-context.json"), bytes = Buffer.from(JSON.stringify({ schema_id: "dd-flow/managed-context@1", stages }));
+    files.set(file, bytes);
+    return { file, sha256: hash(bytes), files };
+}
+/** Publish candidates only; an existing controller SQL receipt still owns
+ * their execution authority. The caller supplies an already owned directory
+ * and independently retained package digest. Never replaces conflicting files. */
+export function publishMemoryInitContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, "mb-init");
+}
+export function publishMemoryUpgradeContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, "mb-upgrade");
+}
+function publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, flowId) {
+    const prepared = prepareMemoryContexts(bundle, objective, directory, flowId);
+    if (prepared.sha256 !== expectedSha256)
+        throw new AppError("memory_init_context_invalid", "Context package selection changed", 1, { effect: "no_effect" });
+    const owner = fs.lstatSync(directory);
+    if (expectedOwner && (owner.dev !== expectedOwner.dev || owner.ino !== expectedOwner.ino)) {
+        throw new AppError("memory_init_context_invalid", "Context directory differs from its retained owner", 1, { effect: "no_effect" });
+    }
+    const assertOwner = () => {
+        const current = fs.lstatSync(directory);
+        if (!current.isDirectory() || current.dev !== owner.dev || current.ino !== owner.ino || fs.realpathSync(directory) !== directory) {
+            throw new AppError("memory_init_context_invalid", "Context directory owner changed", 1, { effect: "no_effect" });
+        }
+    };
+    assertOwner();
+    // Reject any known collision before creating the first candidate.
+    for (const [file, bytes] of prepared.files) {
+        try {
+            fs.lstatSync(file);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        if (!readBoundedReleaseFile(file, bytes.length).equals(bytes))
+            throw new AppError("memory_init_context_invalid", "Existing context bytes differ", 1, { effect: "no_effect", path: file });
+    }
+    let attempted = false;
+    try {
+        for (const [file, bytes] of prepared.files) {
+            assertOwner();
+            attempted = true;
+            publishImmutableInput(file, bytes, "memory_init_context_invalid");
+        }
+        assertOwner();
+        return { file: prepared.file, sha256: prepared.sha256 };
+    }
+    catch (error) {
+        throw new AppError("memory_init_context_publication_incomplete", "Context candidates require exact-request reconciliation", 1, { effect: attempted ? "partial" : "no_effect", directory, expected_sha256: expectedSha256,
+            reason: error instanceof AppError ? error.code : "context_publication_failed" });
+    }
+}