@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/memory-init-native-capacity.js

@@ -0,0 +1,309 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash } from "node:crypto";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
+import { runHarnessAdapter, adapterSessionId } from "./harness-adapter.js";
+import { renderCapacityInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { normalizeNativeChildren, nativeShutdownConfirmed } from "../harness-runtime/lib/native-children.mjs";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { inspectDaemonOperation } from "../harness-runtime/lib/daemon-operations.mjs";
+import { nativeCommandFingerprint } from "../harness-runtime/lib/native-request-proof.mjs";
+import { validateMemoryInitStartupScope } from "./memory-init-startup-custody.js";
+import { continueProviderCapacity } from "./provider-capacity.js";
+import { RECOVERY_POLICY as CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
+const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason, effect = "no_effect") {
+    throw new AppError("memory_init_native_capacity_required", "Native startup requires its exact qualified probe", 1, { reason, effect, next_action: "reconcile_exact_native_probe" });
+}
+function read(file) {
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.nlink !== 1)
+            refuse("linked_probe_receipt", "unknown");
+        return JSON.parse(readBoundedReleaseFile(file, 1024 * 1024).toString("utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function retain(file, value) {
+    fs.writeFileSync(file, JSON.stringify(value), { flag: "wx", mode: 0o600 });
+}
+function publicReply(result) {
+    const reply = { ok: true, ...result };
+    // The daemon retains this transport-only shutdown marker, but its public
+    // response deliberately omits it (dd-codex-daemon response projection).
+    delete reply._shutdown;
+    return reply;
+}
+/** Technical child probe: no RUN, project registration, lifecycle hooks or
+ * operator profile writes. An unresolved intent never authorizes redispatch. */
+export async function produceMemoryInitNativeCapacity(input) {
+    if (!input.allowLiveProbe || !Number.isInteger(input.maximum) || input.maximum < 1 || input.maximum > 15
+        || !/^[a-f0-9]{64}$/.test(input.requestSha256)
+        || input.nativeConfigHome !== undefined && !path.isAbsolute(input.nativeConfigHome))
+        refuse("explicit_probe_authorization_required");
+    const nativeConfigHome = input.nativeConfigHome ?? input.env.CODEX_HOME ?? path.join(input.env.HOME ?? os.homedir(), ".codex");
+    const executable = resolveHarnessCommand(input.home, input.profile.harness, "adapter");
+    const runtime = resolveHarnessCommand(input.home, input.profile.harness, "runtime");
+    const identity = { schema_id: "dd-flow/memory-native-probe-input@1", scope: input.scope,
+        profile: input.profile, maximum: input.maximum, native_config_home: nativeConfigHome,
+        request_sha256: input.requestSha256, adapter: { path: executable, sha256: sha(readBoundedReleaseFile(executable, 16 * 1024 * 1024)) },
+        runtime: { path: runtime, sha256: sha(readBoundedReleaseFile(runtime, 256 * 1024 * 1024)) } };
+    const root = path.join(input.home, "memory-init-native-probes", hybridDigest(input.scope));
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (fs.realpathSync(root) !== root)
+        refuse("linked_probe_root", "unknown");
+    const lease = acquireInstallationLock(path.join(root, "probe.lock"), hybridDigest(identity));
+    try {
+        const prior = read(path.join(root, "input.json"));
+        if (prior && hybridDigest(prior) !== hybridDigest(identity))
+            refuse("probe_selection_changed", "unknown");
+        if (!prior)
+            retain(path.join(root, "input.json"), identity);
+        const result = read(path.join(root, "capacity.json"));
+        const publish = async (proof) => {
+            const cleanup = proof.cleanup;
+            const start = read(path.join(root, "daemon-start.json"));
+            const rootSessionId = adapterSessionId(read(path.join(root, "session-create.json")));
+            const inspected = read(path.join(root, "session-inspect.json"));
+            const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
+            const promptRoot = `memory-native:${hybridDigest(identity)}:session-prompt`;
+            const intents = fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+            if (intents.length > MAX_OVERLOAD_RETRIES)
+                refuse("probe_capacity_budget_changed", "unknown");
+            const promptPhases = ["session-prompt", ...intents.map(intent => `session-prompt-capacity-${intent.ordinal}`)];
+            for (let index = 0; index < intents.length; index++) {
+                const intent = intents[index];
+                if (intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== promptRoot || intent.session_id !== rootSessionId
+                    || intent.ordinal !== index + 1 || intent.operation_id !== `${promptRoot}:capacity:${index + 1}:session.prompt`
+                    || intent.predecessor !== (index ? intents[index - 1].operation_id : promptRoot))
+                    refuse("probe_capacity_chain_changed", "unknown");
+            }
+            for (const phase of ["daemon-start", "session-create", ...promptPhases, "daemon-stop"]) {
+                const continuation = /^session-prompt-capacity-(\d+)$/.exec(phase);
+                const operationId = continuation ? `${promptRoot}:capacity:${continuation[1]}:session.prompt` : `memory-native:${hybridDigest(identity)}:${phase}`;
+                const observed = await inspectDaemonOperation(path.join(root, "daemon"), operationId).catch(() => null);
+                const fingerprint = read(path.join(root, `${phase}.request-proof.json`));
+                const intent = read(path.join(root, `${phase}.intent.json`));
+                const expected = read(path.join(root, `${phase}.json`));
+                if (!observed || !fingerprint || fingerprint.command_sha256 !== intent?.command_sha256
+                    || observed.invocation_sha256 !== fingerprint.command_sha256 || observed.params_sha256 !== fingerprint.params_sha256
+                    || observed.operation_id !== operationId
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id)
+                    refuse("probe_provider_custody_changed", "unknown");
+                const promptIndex = promptPhases.indexOf(phase);
+                if (promptIndex >= 0 && promptIndex < promptPhases.length - 1) {
+                    const intent = intents[promptIndex];
+                    if (observed.state !== "failed" || !terminalProviderOverload(observed.error, rootSessionId ?? undefined, intent.turn_id)
+                        || intent.refusal?.turn_id !== intent.turn_id || intent.refusal?.session_id !== rootSessionId)
+                        refuse("probe_capacity_predecessor_changed", "unknown");
+                    if (hybridDigest(intent.refusal) !== hybridDigest(refusalObservation(observed.error, promptIndex, intent.refusal.first_observed_at)))
+                        refuse("probe_capacity_refusal_changed", "unknown");
+                }
+                else if (observed.state !== "completed" || hybridDigest(publicReply(observed.result)) !== hybridDigest(expected))
+                    refuse("probe_provider_custody_changed", "unknown");
+            }
+            if (hybridDigest(proof.input) !== hybridDigest(identity) || proof.failure || !rootSessionId
+                || proof.root_session_id !== rootSessionId || hybridDigest(proof.inspected) !== hybridDigest(inspected)
+                || hybridDigest(proof.children) !== hybridDigest(children) || proof.capacity !== children.length
+                || children.length < input.maximum || children.length > input.maximum || new Set(children.map(child => child.session_id)).size !== children.length
+                || children.some(child => child.session_id === rootSessionId || child.parent_session_id !== rootSessionId || child.provenance === "parent_mismatch")
+                || cleanup?.stopped !== true || cleanup.settled !== true || !nativeShutdownConfirmed(cleanup) || cleanup.shutdown_contract !== "dd-flow/daemon-shutdown@2"
+                || typeof start?.daemon_id !== "string" || cleanup.daemon_id !== start.daemon_id
+                || hybridDigest(cleanup) !== hybridDigest(read(path.join(root, "daemon-stop.json"))))
+                refuse("probe_not_qualified", "partial");
+            const bytes = Buffer.from(JSON.stringify(proof)), checksum = sha(bytes);
+            const reference = { path: "execution/native-capacity.json", sha256: checksum };
+            const receipts = new Map([[checksum, { kind: "native-capacity", requestId: input.scope.requestId,
+                        projectRoot: input.scope.projectRoot, workspace: input.scope.workspaceRoot,
+                        harness: input.profile.harness, profileRevision: hybridDigest(input.profile), capacity: Number(proof.capacity) }]]);
+            return { reference, receipts, receiptBytes: new Map([[checksum, bytes]]) };
+        };
+        if (result)
+            return await publish(result);
+        if (input.restoreOnly)
+            refuse("completed_probe_required", "unknown");
+        // An independent bounded technical workspace cannot modify the target.
+        const workspace = path.join(root, "project"), stateDir = path.join(root, "daemon");
+        fs.mkdirSync(workspace, { recursive: true, mode: 0o700 });
+        const common = ["--state-dir", stateDir, "--cwd", workspace, "--journal", path.join(root, "events.jsonl"),
+            "--no-flow", ...harnessRuntimeArguments(input.home, input.profile.harness)];
+        const env = { ...input.env, ...(input.nativeConfigHome !== undefined ? { CODEX_HOME: input.nativeConfigHome } : {}),
+            DD_FLOW_CONFIG_HOME: input.home, DD_FLOW_RESOURCE_HOME: path.join(root, "resources") };
+        delete env.DD_FLOW_HOME;
+        delete env.DD_FLOW_BIN;
+        delete env.DD_FLOW_ENGINE_HOME;
+        const call = async (phase, args, timeoutMs = 120_000, operationId = `memory-native:${hybridDigest(identity)}:${phase}`) => {
+            lease.assertOwnership();
+            const command = nativeCommandFingerprint({ executable, args: [...args, ...common], cwd: workspace, env, operationId });
+            const received = read(path.join(root, `${phase}.json`));
+            const intent = read(path.join(root, `${phase}.intent.json`));
+            if (intent && (intent.operation_id !== operationId || hybridDigest(intent.args) !== hybridDigest(args)
+                || intent.command_sha256 !== command))
+                refuse("phase_request_changed", "unknown");
+            const durable = phase !== "session-inspect";
+            if (received || intent) {
+                if (!durable && received && intent)
+                    return received;
+                // The shared adapter builder retained this before RPC/provider dispatch,
+                // independently of both the eventual reply and the local ACK receipt.
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                if (!witness)
+                    refuse(`unresolved_${phase}`, "unknown");
+                const observed = await inspectDaemonOperation(stateDir, operationId).catch(() => null);
+                const start = read(path.join(root, "daemon-start.json"));
+                if (args[0] === "session" && args[1] === "prompt" && witness.operation_id === operationId
+                    && observed?.operation_id === operationId && observed.operation === "session.prompt"
+                    && witness.command_sha256 === command && observed.invocation_sha256 === command
+                    && observed.params_sha256 === witness.params_sha256 && observed.daemon_id === start?.daemon_id
+                    && observed.state === "failed" && observed.error)
+                    throw observed.error;
+                if (observed?.operation_id !== operationId || observed.operation !== args.slice(0, 2).join(".")
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256 || !/^[a-f0-9]{64}$/.test(String(observed.params_sha256))
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id
+                    || observed.state !== "completed" || !observed.result || typeof observed.result !== "object"
+                    || observed.settlement && !["not_required", "settled"].includes(String(observed.settlement.state)))
+                    refuse(`unresolved_${phase}`, "unknown");
+                const recovered = publicReply(observed.result);
+                if (received) {
+                    if (hybridDigest(received) !== hybridDigest(recovered))
+                        refuse("phase_receipt_changed", "unknown");
+                    return received;
+                }
+                retain(path.join(root, `${phase}.json`), recovered);
+                return recovered;
+            }
+            retain(path.join(root, `${phase}.intent.json`), { operation_id: operationId, args, command_sha256: command });
+            let reply;
+            try {
+                const parent = fs.lstatSync(root);
+                reply = await runHarnessAdapter({ executable, args: [...args, ...common], env: { ...env,
+                        DD_FLOW_NATIVE_REQUEST_PROOF_FILE: path.join(root, `${phase}.request-proof.json`), DD_FLOW_NATIVE_COMMAND_SHA256: command,
+                        DD_FLOW_NATIVE_REQUEST_OPERATION: args.slice(0, 2).join("."), DD_FLOW_NATIVE_REQUEST_PROOF_OWNER: JSON.stringify({ dev: parent.dev, ino: parent.ino }) }, operationId,
+                    harness: input.profile.harness, cwd: workspace, timeoutMs, signal: AbortSignal.timeout(timeoutMs) });
+            }
+            catch (error) {
+                if (!durable)
+                    throw error;
+                // Lost first ACK is observation loss, not permission to launch again.
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                const observed = await inspectDaemonOperation(stateDir, operationId).catch(() => null);
+                const start = read(path.join(root, "daemon-start.json"));
+                if (!witness || witness.operation_id !== operationId || witness.operation !== args.slice(0, 2).join(".")
+                    || observed?.operation_id !== operationId || observed.operation !== witness.operation
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256 || observed.state !== "completed"
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id
+                    || observed.settlement && observed.settlement.state !== "not_required"
+                        && observed.settlement.state !== "settled"
+                    || !observed.result || typeof observed.result !== "object")
+                    throw error;
+                reply = publicReply(observed.result);
+            }
+            if (durable) {
+                const observed = await inspectDaemonOperation(stateDir, operationId);
+                const witness = read(path.join(root, `${phase}.request-proof.json`));
+                if (observed.operation_id !== operationId || observed.state !== "completed" || !witness
+                    || witness.command_sha256 !== command || observed.invocation_sha256 !== command
+                    || observed.params_sha256 !== witness.params_sha256)
+                    refuse(`unresolved_${phase}`, "unknown");
+            }
+            retain(path.join(root, `${phase}.json`), reply);
+            return reply;
+        };
+        let inspected, rootSessionId = null;
+        let failure, cleanup;
+        try {
+            await call("daemon-start", ["daemon", "start"]);
+            const created = await call("session-create", ["session", "create", "--model", input.profile.model, "--reasoning", input.profile.reasoning]);
+            rootSessionId = adapterSessionId(created);
+            if (!rootSessionId)
+                refuse("root_session_identity_missing", "unknown");
+            const promptArgs = (text) => ["session", "prompt", "--session-id", rootSessionId, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--prompt", text];
+            try {
+                await call("session-prompt", promptArgs(renderCapacityInstructions({ harness: input.profile.harness, maximum: input.maximum })), 180_000);
+            }
+            catch (error) {
+                const rootId = `memory-native:${hybridDigest(identity)}:session-prompt`;
+                const retainedIntents = () => fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const retainedFailures = () => fs.readdirSync(root).filter(name => /^capacity-failure-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const resumed = await continueProviderCapacity({ error, sessionId: rootSessionId, operationId: rootId,
+                    continuationText: "Continue the same technical capacity probe in this Session. Inspect existing direct children first; do not launch replacements or a second child wave. Complete only the originally requested capacity markers.",
+                    allowSettledDescendants: true, assertCurrent: () => lease.assertOwnership(),
+                    inspectOperation: async (id) => await inspectDaemonOperation(stateDir, id),
+                    inspectSession: async () => runHarnessAdapter({ executable, args: ["session", "inspect", "--session-id", rootSessionId, ...common], env, harness: input.profile.harness, cwd: workspace, operationId: `${rootId}:capacity-inspect`, timeoutMs: 30_000 }),
+                    retainedIntents, retainedFailures,
+                    retainIntent: intent => retain(path.join(root, `capacity-intent-${intent.ordinal}.json`), intent),
+                    retainFailure: (_id, refusal) => {
+                        const file = path.join(root, `capacity-failure-${refusal.ordinal}.json`);
+                        const prior = read(file);
+                        if (prior && hybridDigest(prior) !== hybridDigest(refusal))
+                            refuse("probe_capacity_failure_changed", "unknown");
+                        if (!prior)
+                            retain(file, refusal);
+                    },
+                    prompt: (id, text, ordinal) => call(`session-prompt-capacity-${ordinal}`, promptArgs(text), 180_000, id) });
+                if (!resumed)
+                    throw error;
+            }
+            inspected = await call("session-inspect", ["session", "inspect", "--session-id", rootSessionId]);
+        }
+        catch (error) {
+            failure = errorRecord(error);
+            // Retain a physical tree observation before owned shutdown, even when the
+            // prompt ACK is unknown. A later exact terminal receipt can then reconcile
+            // without needing to restart the stopped daemon or resend productive work.
+            if (rootSessionId && !read(path.join(root, "session-inspect.intent.json"))) {
+                try {
+                    inspected = await call("session-inspect", ["session", "inspect", "--session-id", rootSessionId]);
+                }
+                catch { /* The unresolved observation remains pending, never fabricated. */ }
+            }
+        }
+        finally {
+            try {
+                const start = read(path.join(root, "daemon-start.json")), daemon = read(path.join(stateDir, "daemon.json"));
+                if (!start || typeof start.daemon_id !== "string" || daemon?.daemon_id !== start.daemon_id)
+                    refuse("cleanup_daemon_incarnation_unknown", "unknown");
+                cleanup = await call("daemon-stop", ["daemon", "stop", "--cancel-tree"]);
+            }
+            catch (error) {
+                failure ??= errorRecord(error);
+            }
+        }
+        const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
+        const qualified = !failure && cleanup?.stopped === true && cleanup.settled === true && nativeShutdownConfirmed(cleanup)
+            && cleanup.shutdown_contract === "dd-flow/daemon-shutdown@2" && typeof cleanup.daemon_id === "string"
+            && children.length === input.maximum && children.length <= 15
+            && children.every(child => child.parent_session_id === rootSessionId && child.session_id !== rootSessionId && child.provenance !== "parent_mismatch");
+        const proof = { schema_id: "dd-flow/memory-native-capacity@1", input: identity, root_session_id: rootSessionId,
+            inspected, cleanup, children, capacity: children.length, qualified, ...(failure ? { failure } : {}) };
+        if (failure) {
+            fs.appendFileSync(path.join(root, "observations.jsonl"), `${JSON.stringify(proof)}\n`, { mode: 0o600 });
+            throw new AppError("memory_init_native_capacity_required", "Native startup probe failed or could not be reconciled", 1, { reason: "probe_operation_unresolved", effect: "unknown", next_action: "reconcile_exact_native_probe", primary_error: failure });
+        }
+        retain(path.join(root, "capacity.json"), proof);
+        return await publish(proof);
+    }
+    finally {
+        lease.release();
+    }
+}
+/** Recover exact completed probe bytes for a retained raw request whose
+ * resolved selection was not published. Never starts or repairs a probe. */
+export async function restoreCompletedMemoryNativeCapacity(input) {
+    validateMemoryInitStartupScope(input.scope);
+    const prior = read(path.join(input.home, "memory-init-native-probes", hybridDigest(input.scope), "input.json"));
+    if (!prior || hybridDigest(prior.scope) !== hybridDigest(input.scope))
+        refuse("original_probe_required", "unknown");
+    return produceMemoryInitNativeCapacity({ ...input, profile: prior.profile, maximum: Number(prior.maximum),
+        nativeConfigHome: String(prior.native_config_home), requestSha256: String(prior.request_sha256), allowLiveProbe: true, restoreOnly: true });
+}

package/dist/services/memory-init-preflight.js

@@ -0,0 +1,334 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { defaultMemoryLintConfiguration, validateMemoryLintConfig } from "./memory-lint-config.js";
+import { runMemoryToolProbe } from "./memory-tool-probe.js";
+function refuse(reason, diagnostics) {
+    throw new AppError("memory_init_preflight_failed", "Memory init prerequisites are not admitted", 1, { reason, phase: "prepare", effect: "no_effect", next_action: reason === "existing_memory_bank" ? "audit_or_upgrade" : "repair_prerequisite_then_retry", ...(diagnostics ? { tool_probe: diagnostics } : {}) });
+}
+function executable(name, env) {
+    for (const directory of (env.PATH ?? "").split(path.delimiter)) {
+        // Relative/empty PATH components must not execute project-owned files.
+        if (!path.isAbsolute(directory))
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            const resolved = fs.realpathSync(candidate);
+            if (fs.statSync(resolved).isFile())
+                return resolved;
+        }
+        catch { /* Continue the bounded, explicit PATH search. */ }
+    }
+    return refuse(`missing_tool:${name}`);
+}
+function root(value) {
+    if (!path.isAbsolute(value))
+        refuse("root_not_absolute");
+    try {
+        const resolved = fs.realpathSync(value);
+        if (!fs.statSync(resolved).isDirectory())
+            refuse("root_not_directory");
+        fs.accessSync(resolved, fs.constants.R_OK | fs.constants.W_OK | fs.constants.X_OK);
+        return resolved;
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("root_access_unavailable");
+    }
+}
+function noMemoryBank(directory) {
+    try {
+        fs.lstatSync(path.join(directory, ".memory-bank"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        return refuse("memory_bank_access_unavailable");
+    }
+    refuse("existing_memory_bank");
+}
+function probeTools(tools, env) {
+    const facts = Object.create(null);
+    const probeEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith("GIT_")));
+    for (const name of Object.keys(tools)) {
+        const diagnostics = { name, executable: tools[name], args: ["--version"], phase: "executable_read" };
+        try {
+            const digest = () => createHash("sha256").update(readBoundedReleaseFile(tools[name], 64 * 1024 * 1024)).digest("hex");
+            const executableSha256 = digest();
+            const { result, diagnostics: observed } = runMemoryToolProbe(tools[name], ["--version"], {
+                cwd: path.dirname(tools[name]), env: probeEnv, maxBuffer: 64 * 1024
+            });
+            Object.assign(diagnostics, observed, { name, phase: "version_probe" });
+            if (result.error || result.signal || result.status !== 0 || !result.stdout || !result.stderr)
+                refuse(`tool_probe_failed:${name}`, diagnostics);
+            const output = new TextDecoder("utf-8", { fatal: true }).decode(result.stdout);
+            const version = output.match(/\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/)?.[1];
+            if (!version)
+                refuse(`tool_probe_failed:${name}`, { ...diagnostics, phase: "version_parse" });
+            if (digest() !== executableSha256)
+                refuse(`tool_probe_failed:${name}`, { ...diagnostics, phase: "executable_drift" });
+            facts[name] = { version, executable_sha256: executableSha256,
+                stdout_sha256: createHash("sha256").update(result.stdout).digest("hex"),
+                stderr_sha256: createHash("sha256").update(result.stderr).digest("hex") };
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_init_preflight_failed")
+                throw error;
+            refuse(`tool_probe_failed:${name}`, { ...diagnostics, error_code: error?.code ?? null });
+        }
+    }
+    return facts;
+}
+/** Shared deterministic executable selection; no project initialization or
+ * tool installation. Upgrade freezes this before content synchronization. */
+export function inspectMemoryLintExecutable(env) {
+    const selected = executable("mb-lint", env);
+    return { executable: selected, probe: probeTools({ "mb-lint": selected }, env)["mb-lint"] };
+}
+export function inspectMemoryGitExecutable(env) {
+    const selected = executable("git", env);
+    return { executable: selected, probe: probeTools({ git: selected }, env).git };
+}
+function inspect(input, env, ownedPublication = false, qualifyTools = true, observe, lintReservation, sourceTools) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(input.requestId))
+        refuse("invalid_request_id");
+    const project = root(input.projectRoot), workspace = root(input.workspaceRoot);
+    const lintFile = path.join(workspace, ".mb-lint.json"), lintBytes = defaultMemoryLintConfiguration();
+    let lintExists = false;
+    try {
+        fs.lstatSync(lintFile);
+        lintExists = true;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            refuse("lint_configuration_unavailable");
+    }
+    if (lintReservation === true && lintExists)
+        validateMemoryLintConfig(readBoundedReleaseFile(lintFile, 1024 * 1024), [".memory-bank/index.md", ".memory-bank/structure.md", ".memory-bank/project-policy.md"]);
+    const generatedLint = lintReservation === true ? (lintExists ? undefined : createHash("sha256").update(lintBytes).digest("hex")) : lintReservation;
+    const lintTemporary = `.dd-flow-write-${createHash("sha256").update(".mb-lint.json").digest("hex")}.tmp`;
+    if (typeof generatedLint === "string") {
+        if (generatedLint !== createHash("sha256").update(lintBytes).digest("hex"))
+            refuse("lint_configuration_reservation_changed");
+        if (lintExists && !readBoundedReleaseFile(lintFile, 1024 * 1024).equals(lintBytes))
+            refuse("generated_lint_configuration_changed");
+        if (ownedPublication) {
+            const temporary = path.join(workspace, lintTemporary);
+            let pending;
+            try {
+                pending = fs.lstatSync(temporary);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    refuse("lint_configuration_unavailable");
+            }
+            if (pending) {
+                if (!pending.isFile() || pending.size > lintBytes.length || ![1, 2].includes(pending.nlink))
+                    refuse("unsafe_lint_configuration_temporary");
+                const content = pending.size ? readBoundedReleaseFile(temporary, lintBytes.length) : Buffer.alloc(0);
+                if (!content.equals(lintBytes.subarray(0, content.length)))
+                    refuse("unsafe_lint_configuration_temporary");
+                if (pending.nlink === 2) {
+                    const destination = lintExists ? fs.lstatSync(lintFile) : undefined;
+                    if (!destination?.isFile() || destination.dev !== pending.dev || destination.ino !== pending.ino || destination.nlink !== 2)
+                        refuse("unsafe_lint_configuration_temporary");
+                }
+            }
+        }
+    }
+    if (!ownedPublication || workspace !== project)
+        noMemoryBank(project);
+    if (!ownedPublication && workspace !== project)
+        noMemoryBank(workspace);
+    const tools = sourceTools ?? { git: executable("git", env), wt: executable("wt", env), "mb-lint": executable("mb-lint", env) };
+    const toolProbes = qualifyTools ? probeTools(tools, env) : undefined;
+    const gitEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith("GIT_")));
+    const git = (directory, args, optional = false) => {
+        const { result, diagnostics } = runMemoryToolProbe(tools.git, ["-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", "-C", directory, ...args], {
+            cwd: directory, env: { ...gitEnv, GIT_OPTIONAL_LOCKS: "0" }, maxBuffer: 1024 * 1024,
+        });
+        if (result.error || result.signal || result.status !== 0 && !optional)
+            refuse("git_observation_failed", { ...diagnostics, phase: "git_observation" });
+        return result.status === 0 ? result.stdout.toString("utf8") : null;
+    };
+    for (const directory of new Set([project, workspace])) {
+        if (git(directory, ["rev-parse", "--is-bare-repository"])?.trim() !== "false"
+            || root(git(directory, ["rev-parse", "--show-toplevel"]).trim()) !== directory)
+            refuse("not_repository_root");
+    }
+    const common = (directory) => root(path.resolve(directory, git(directory, ["rev-parse", "--git-common-dir"]).trim()));
+    const repository = common(project);
+    if (repository !== common(workspace))
+        refuse("foreign_workspace_repository");
+    const branch = git(workspace, ["symbolic-ref", "--quiet", "--short", "HEAD"], true)?.trim();
+    if (!branch)
+        refuse("workspace_branch_unavailable");
+    const head = git(workspace, ["rev-parse", "--verify", "HEAD"], true)?.trim() ?? null;
+    const status = git(workspace, ["status", "--porcelain=v1", "-z", "--untracked-files=normal",
+        ...(ownedPublication ? ["--", ".", ":(top,literal,exclude).memory-bank", ...(generatedLint ? [":(top,literal,exclude).mb-lint.json", `:(top,literal,exclude)${lintTemporary}`] : [])] : [])]);
+    const sourceHash = createHash("sha256");
+    let total = 0;
+    const files = [...new Set(git(workspace, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]).split("\0").filter(logical => logical
+            && (!ownedPublication || logical !== ".memory-bank" && !logical.startsWith(".memory-bank/")
+                && !(generatedLint && [".mb-lint.json", lintTemporary].includes(logical)))))].sort();
+    for (const logical of files) {
+        if (path.isAbsolute(logical) || logical.split("/").some(part => !part || part === "." || part === ".."))
+            refuse("unsafe_source_path");
+        let current = workspace;
+        for (const part of logical.split("/").slice(0, -1)) {
+            current = path.join(current, part);
+            try {
+                if (!fs.lstatSync(current).isDirectory())
+                    refuse("unsafe_source_directory");
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    break;
+                throw error;
+            }
+        }
+        const file = path.join(workspace, logical);
+        sourceHash.update(logical).update("\0");
+        let stat;
+        try {
+            stat = fs.lstatSync(file);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                sourceHash.update("missing\0");
+                observe?.({ path: logical, kind: "missing", sha256: null });
+                continue;
+            }
+            return refuse("source_unavailable");
+        }
+        if (stat.isSymbolicLink()) {
+            const sha256 = hybridDigest(fs.readlinkSync(file));
+            sourceHash.update("link\0").update(sha256).update("\0");
+            observe?.({ path: logical, kind: "link", sha256 });
+        }
+        else if (stat.isDirectory()) {
+            sourceHash.update("gitlink\0");
+            observe?.({ path: logical, kind: "gitlink", sha256: null });
+        }
+        else if (stat.isFile()) {
+            if (stat.size > 16 * 1024 * 1024 || (total += stat.size) > 64 * 1024 * 1024)
+                refuse("source_inventory_exceeds_bound");
+            const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+            try {
+                const bytes = Buffer.alloc(stat.size + 1);
+                let length = 0;
+                while (length < bytes.length) {
+                    const read = fs.readSync(fd, bytes, length, bytes.length - length, length);
+                    if (!read)
+                        break;
+                    length += read;
+                }
+                if (length !== stat.size || fs.fstatSync(fd).size !== stat.size)
+                    refuse("source_changed_during_observation");
+                const sha256 = createHash("sha256").update(bytes.subarray(0, length)).digest("hex");
+                sourceHash.update("file\0").update(sha256).update("\0");
+                observe?.({ path: logical, kind: "file", sha256 });
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        else
+            refuse("unsafe_source_kind");
+    }
+    return { schema_id: "dd-flow/memory-init-target-preflight@1", request_id: input.requestId,
+        project_root: project, workspace_root: workspace, repository, head, branch,
+        dirty: status.length > 0, status_sha256: hybridDigest(status), source_sha256: sourceHash.digest("hex"), tools,
+        ...(generatedLint ? { generated_lint_config_sha256: generatedLint } : {}),
+        ...(toolProbes ? { tool_probes: toolProbes } : {}) };
+}
+/** Check the prepared executable identities, not another version invocation. */
+function reinspect(facts, input, env, ownedPublication, lintReservation) {
+    const tools = { git: executable("git", env), wt: executable("wt", env), "mb-lint": executable("mb-lint", env) };
+    if (facts.tool_probes)
+        for (const name of ["git", "wt", "mb-lint"]) {
+            let checksum;
+            try {
+                checksum = createHash("sha256").update(readBoundedReleaseFile(tools[name], 64 * 1024 * 1024)).digest("hex");
+            }
+            catch {
+                return refuse("target_changed_after_preparation");
+            }
+            if (tools[name] !== facts.tools[name] || checksum !== facts.tool_probes[name]?.executable_sha256)
+                refuse("target_changed_after_preparation");
+        }
+    const current = inspect(input, env, ownedPublication, false, undefined, lintReservation, tools);
+    return facts.tool_probes ? { ...current, tool_probes: facts.tool_probes } : current;
+}
+/** Read-only inventory of the independently selected bootstrap baseline. The
+ * publisher/bootstrap must establish owned-publication custody first. This
+ * changes no legacy target fact/checksum and never follows a source symlink.
+ */
+export function observeMemoryInitSourceInventory(facts, expectedSha256, env) {
+    if (hybridDigest(facts) !== expectedSha256)
+        refuse("target_changed_after_preparation");
+    // Git is used to observe repository/source facts; wt and lint are not used
+    // here. Their accepted bootstrap capability is not a source-preservation test.
+    if (facts.tool_probes && createHash("sha256").update(readBoundedReleaseFile(facts.tools.git, 64 * 1024 * 1024)).digest("hex") !== facts.tool_probes.git.executable_sha256)
+        refuse("selected_git_changed");
+    const entries = [];
+    const current = inspect({ projectRoot: facts.project_root, workspaceRoot: facts.workspace_root, requestId: facts.request_id }, env, true, false, entry => entries.push(entry), facts.generated_lint_config_sha256, facts.tools);
+    const sourceFacts = ({ tools: _tools, tool_probes: _probes, ...source }) => source;
+    if (hybridDigest(sourceFacts(current)) !== hybridDigest(sourceFacts(facts)))
+        refuse("target_changed_after_preparation");
+    return { entries, sha256: hybridDigest(entries) };
+}
+/** Read-only prerequisites, before registration, workspace/scaffold writes or agent launch.
+ * Bounded version probes prove tool entrypoint response only, not full tool
+ * capability, minimum-version compatibility, bootstrap/storage or harness readiness.
+ */
+export class PreparedMemoryInitTarget {
+    sha256;
+    #facts;
+    #input;
+    #env;
+    constructor(facts, input, env) {
+        this.#facts = structuredClone(facts);
+        this.#input = structuredClone(input);
+        this.#env = { ...env };
+        this.sha256 = hybridDigest(facts);
+        Object.freeze(this);
+    }
+    static prepare(input, env) {
+        try {
+            return new PreparedMemoryInitTarget(inspect(input, env, false, true, undefined, true), input, env);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse("source_observation_failed");
+        }
+    }
+    facts() { return structuredClone(this.#facts); }
+    revalidate() {
+        if (hybridDigest(reinspect(this.#facts, this.#input, this.#env, false, this.#facts.generated_lint_config_sha256 ? true : undefined)) !== this.sha256)
+            refuse("target_changed_after_preparation");
+    }
+    /** Only the publisher may use this after independently verifying its CLI-home owner journal.
+     * Excludes published MB and, only for a fresh reservation, the exact generated
+     * lint policy/owned temporary. User sources, scope, HEAD and tools stay pinned.
+     */
+    static revalidateOwnedPublication(facts, expectedSha256, env) {
+        if (hybridDigest(facts) !== expectedSha256 || hybridDigest(reinspect(facts, { projectRoot: facts.project_root,
+            workspaceRoot: facts.workspace_root, requestId: facts.request_id }, env, true, facts.generated_lint_config_sha256)) !== expectedSha256)
+            refuse("target_changed_after_preparation");
+    }
+    /** Restore only after the publication service checks its independent journal and root owner.
+     * This never provides a fresh-init route for an existing Memory Bank.
+     */
+    static restoreOwnedPublication(facts, expectedSha256, env) {
+        PreparedMemoryInitTarget.revalidateOwnedPublication(facts, expectedSha256, env);
+        return new PreparedMemoryInitTarget(facts, { projectRoot: facts.project_root,
+            workspaceRoot: facts.workspace_root, requestId: facts.request_id }, env);
+    }
+}