@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/migrations.js

@@ -1,20 +1,29 @@
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
+import semver from "semver";
 import { AppError } from "../shared/errors.js";
 import { requireProjectByRoot } from "./projects.js";
 import { getProjectVersionStatus, resolveStatusProjectRoot } from "./version-status.js";
 import { resolveCanonRoot } from "./canon.js";
 import { getDatabase } from "../storage/database.js";
+import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { classifyCliOperation } from "./cli-operation-classifier.js";
 import { compatibilityContexts, selectEngine } from "./engines.js";
 import { getCliBuildInfo } from "./build-info.js";
+import { prepareJsonFile } from "../cli/input-preparation.js";
+import { validateSchema } from "./schema-validation.js";
+import { PreparedMemoryInitRuntimeStorage } from "./memory-init-storage.js";
+import { PreparedMemoryInitResourceStorage } from "./memory-init-resource-storage.js";
+import { AdmittedFrozenEngine } from "./frozen-engine.js";
+import { resourceHome } from "./managed-processes.js";
 export function assessMigrationImpact(context, input) {
     const root = resolveStatusProjectRoot({ requestedRoot: input.projectRoot, cwd: process.cwd() });
     if (!root.root)
         throw new AppError("not_found", `Project root does not exist: ${input.projectRoot}`, 1);
-    const canon = resolveCanonRoot(context);
+    const canon = upgradeCanon(context);
     if (!canon.ok || !canon.canon)
         throw new AppError("canon_unavailable", "Cannot resolve canonical Memory Bank for upgrade impact assessment", 1, { blockers: canon.blockers, bootstrap: canon.bootstrap });
     const status = getProjectVersionStatus({ projectRoot: root.root, rootSource: root.root_source, canon: { root: canon.canon.root, metadata: canon.canon.metadata } });
@@ -22,53 +31,65 @@ export function assessMigrationImpact(context, input) {
     const to = input.targetVersion ?? canon.canon.version;
     const forced = input.mode === "full_migration";
     const impacts = readImpacts(path.join(canon.canon.memorybank_root, "release-impact"));
-    const chain = [];
+    const resolved = from && to ? adjacentMigrationChain(from, to, impacts) : null;
+    const chain = resolved?.status === "ok"
+        ? resolved.steps.map(step => impacts.find(item => item.from_version === step.from && item.to_version === step.to))
+        : [];
     const domains = new Set();
     const blockers = [];
     let mode = "patch";
     if (!from || !to)
         blockers.push("project or canonical Memory Bank version is unavailable");
-    let current = from;
-    while (current && to && current !== to) {
-        const impact = impacts.find((item) => item.from_version === current);
-        if (!impact) {
-            blockers.push(`missing adjacent release impact from ${current}`);
-            break;
-        }
-        chain.push(impact);
+    if (to !== canon.canon.version)
+        blockers.push("requested target version does not match the selected canon");
+    if (resolved?.status === "unsupported")
+        blockers.push(resolved.reason ?? "release impact chain is unsupported");
+    for (const impact of chain) {
         for (const domain of impact.domains)
             domains.add(domain);
         mode = stricterMode(mode, impact.minimum_upgrade_mode);
         if (impact.path_migration || impact.runtime_migration)
             mode = "full_migration";
-        current = impact.to_version;
     }
-    if (current && to && current !== to)
-        blockers.push(`release impact chain does not reach ${to}`);
-    if (status?.flow_pack.status !== "present" && from !== to)
+    if (status?.flow_pack.status !== "present")
         blockers.push("project flow-pack provenance is not present");
+    else {
+        try {
+            const file = path.resolve(root.root, status.flow_pack.manifest_path);
+            const prepared = prepareJsonFile(file, "Project flow-pack provenance");
+            validateSchema({ schemaName: "project-flow-pack-manifest", file, data: prepared.value,
+                schemaDir: fileURLToPath(new URL("../schemas/", import.meta.url)) });
+            if (!/^[a-f0-9]{40}$/.test(status.flow_pack.source_commit ?? "")
+                || status.flow_pack.canon_version_at_source_commit !== from)
+                blockers.push("project flow-pack provenance does not match its declared current version and commit");
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || !["schema_validation", "invalid_json", "validation"].includes(error.code)
+                && !error.code.startsWith("input_file_"))
+                throw error;
+            blockers.push("project flow-pack provenance is invalid");
+        }
+    }
     if (blockers.length > 0)
         mode = "full_migration";
     if (forced)
         mode = "full_migration";
     return { ok: true, schema_id: "dd-flow/mb-upgrade-impact-assessment@1", project_root: root.root, source_version: from, target_version: to, mode, forced_full_migration: forced, chain, domains: [...domains].sort(), blockers, required_checks: [...new Set(chain.flatMap((item) => item.required_checks))], next_action: mode === "full_migration" ? "run full mb-upgrade contour" : "run selected mb-upgrade contour" };
 }
-function readImpacts(dir) {
+export function readImpacts(dir) {
     if (!fs.existsSync(dir))
         return [];
-    return fs.readdirSync(dir).filter((file) => file.endsWith(".json")).flatMap((file) => {
+    return fs.readdirSync(dir).filter(file => file.endsWith(".json")).sort().map(file => {
+        const source = path.join(dir, file);
         try {
-            const value = JSON.parse(fs.readFileSync(path.join(dir, file), "utf8"));
-            if (value.schema_id !== "dd-flow/release-impact@1")
-                return [];
-            if (typeof value.from_version !== "string" || typeof value.to_version !== "string" || !Array.isArray(value.domains) || !Array.isArray(value.required_checks))
-                return [];
-            if (!["patch", "targeted_minor", "full_migration"].includes(String(value.minimum_upgrade_mode)))
-                return [];
-            return [{ from_version: value.from_version, to_version: value.to_version, minimum_upgrade_mode: value.minimum_upgrade_mode, domains: value.domains.filter((item) => typeof item === "string"), path_migration: value.path_migration === true, runtime_migration: value.runtime_migration === true, required_checks: value.required_checks.filter((item) => typeof item === "string") }];
+            const prepared = prepareJsonFile(source, "Canonical release impact");
+            validateSchema({ schemaName: "release-impact", file: prepared.file, data: prepared.value,
+                schemaDir: fileURLToPath(new URL("../schemas/", import.meta.url)) });
+            return { ...prepared.value, source_reference: { path: prepared.file,
+                    sha256: crypto.createHash("sha256").update(prepared.text).digest("hex") } };
         }
-        catch {
-            return [];
+        catch (error) {
+            throw new AppError("release_impact_invalid", "Canonical release impact is invalid; it cannot authorize a lightweight upgrade", 1, { file: source, effect: "no_effect", cause: error instanceof AppError ? error.code : "unreadable_release_impact" });
         }
     });
 }
@@ -147,7 +168,7 @@ export function planMigration(context, input) {
         }
     };
 }
-export function applyMigration(context, input) {
+export function prepareMigrationApply(context, input) {
     const classification = input.classification ?? classifyCliOperation(["migration", "apply"], context.env);
     if (classification.mode !== "mb_upgrade") {
         throw new AppError("upgrade_authorization_required", "Migration apply requires explicit mb-upgrade authorization", 1, {
@@ -197,7 +218,33 @@ export function applyMigration(context, input) {
         });
     }
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const current = activeStateSummary(context, project.id);
+    if (activeStateBlockers(current).length)
+        throw new AppError("migration_active_state", "Migration apply requires a quiescent shared home", 1, { active_state: current });
+    return { project, sourceVersion, targetVersion, verifiedBackup, reportEngine, chain };
+}
+export function applyMigration(context, input, prepared = prepareMigrationApply(context, input)) {
     const writeDb = getDatabase(context.ddFlowHome, "migrate");
+    let result, primary, failed = false;
+    try {
+        result = applyPreparedMigration(context, prepared, writeDb);
+    }
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    const cleanup = cleanupScopeWriters([{ name: writeDb.path, db: writeDb, rollback: false, close: "always" }]);
+    if (failed) {
+        if (primary instanceof AppError && cleanup.length)
+            primary.details.migration_cleanup_errors = cleanup;
+        throw primary;
+    }
+    if (cleanup.length)
+        throw new AppError("migration_cleanup_failed", "Migration receipt is available but its connection could not be closed", 1, { effect: result?.changed ? "committed" : "no_effect", migration_cleanup_errors: cleanup });
+    return result;
+}
+function applyPreparedMigration(context, prepared, writeDb) {
+    const { project, sourceVersion, targetVersion, verifiedBackup, reportEngine, chain } = prepared;
     const already = writeDb.get("SELECT value_json FROM runtime_config WHERE key = ?", [applyKey(project.id, sourceVersion, targetVersion)]);
     if (already) {
         return { ok: true, schema_id: "dd-flow/mb-upgrade-migration-apply@1", status: "verified_noop", changed: false, backup: verifiedBackup, recovery: JSON.parse(already.value_json) };
@@ -217,15 +264,14 @@ export function applyMigration(context, input) {
         chain: chain.steps.map((step) => ({ ...step, status: "applied" }))
     };
     try {
-        writeDb.exec("BEGIN IMMEDIATE");
-        writeDb.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at) VALUES (?, ?, ?, ?)`, [applyKey(project.id, sourceVersion, targetVersion), JSON.stringify(result), context.now(), context.now()]);
-        writeDb.exec("COMMIT");
+        writeDb.writeTransaction(() => {
+            const current = activeStateSummary({ ...context, db: writeDb }, project.id);
+            if (activeStateBlockers(current).length)
+                throw new AppError("migration_active_state", "Migration apply requires a quiescent shared home", 1, { active_state: current });
+            writeDb.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at) VALUES (?, ?, ?, ?)`, [applyKey(project.id, sourceVersion, targetVersion), JSON.stringify(result), context.now(), context.now()]);
+        });
     }
     catch (error) {
-        try {
-            writeDb.exec("ROLLBACK");
-        }
-        catch { /* preserve the original failure */ }
         throw new AppError("migration_apply_failed", "Migration apply failed before upgrade RUN creation or canon sync", 1, {
             recovery: {
                 status: "required",
@@ -235,12 +281,12 @@ export function applyMigration(context, input) {
                 rollback_route: "restore the verified backup before retrying mb-upgrade apply",
                 next_action: "inspect the failed apply and retry only with the same pinned target contract"
             },
-            cause: String(error)
+            cause: error instanceof AppError ? { code: error.code, message: error.message, details: error.details } : String(error)
         });
     }
     return { ok: true, schema_id: "dd-flow/mb-upgrade-migration-apply@1", status: "applied", changed: true, backup: verifiedBackup, recovery: result };
 }
-export function assertUpgradeRunStorageReady(context, projectRoot) {
+export function assertUpgradeRunStorageReady(context, projectRoot, engine) {
     const project = context.db.get("SELECT id FROM projects WHERE root = ?", [resolveProjectRoot(projectRoot)]);
     if (!project)
         throw new AppError("migration_not_applied", "mb-upgrade RUN requires a registered project with explicit migration apply", 1);
@@ -250,12 +296,57 @@ export function assertUpgradeRunStorageReady(context, projectRoot) {
     if (!source || !target)
         throw new AppError("migration_not_applied", "mb-upgrade RUN requires source and target Memory Bank versions", 1);
     const applied = context.db.get("SELECT value_json FROM runtime_config WHERE key = ?", [applyKey(project.id, source, target)]);
-    if (!applied)
+    if (!applied || engine !== undefined) {
+        const assessment = assessMigrationImpact(context, { projectRoot });
+        const blockers = assessment.blockers;
+        const chain = assessment.chain;
+        if (!blockers.length && (engine !== undefined || chain.every(step => !step.runtime_migration))) {
+            const canon = upgradeCanon(context).canon;
+            const contract = prepareJsonFile(path.join(canon.flow_root, "flow-contract.json"), "Target flow contract");
+            let selectedEngineStorage;
+            if (engine !== undefined) {
+                if (!(engine instanceof AdmittedFrozenEngine))
+                    throw new AppError("upgrade_storage_incompatible", "Upgrade requires an admitted selected engine", 1, { effect: "no_effect" });
+                const compatibility = prepareJsonFile(path.join(canon.flow_root, "compatibility.json"), "Target engine compatibility");
+                validateSchema({ schemaName: "compatibility", file: compatibility.file, data: compatibility.value,
+                    schemaDir: fileURLToPath(new URL("../schemas/", import.meta.url)) });
+                const manifest = engine.manifest();
+                if (compatibility.value.memory_bank_version !== target || compatibility.value.dd_flow_cli.flow_contract !== contract.value.id
+                    || manifest.package_name !== compatibility.value.dd_flow_cli.package_name || !semver.valid(compatibility.value.dd_flow_cli.min_version)
+                    || semver.lt(manifest.package_version, compatibility.value.dd_flow_cli.min_version)
+                    || manifest.package_name !== compatibility.value.engine.package_name
+                    || !semver.satisfies(manifest.package_version, compatibility.value.engine.version_range, { includePrerelease: true }))
+                    throw new AppError("upgrade_storage_incompatible", "Selected engine is incompatible with target canon", 1, { effect: "no_effect" });
+                selectedEngineStorage = engine.admitMemoryUpgradeStorage(context.ddFlowHome, resourceHome(context));
+            }
+            // Reuse the executing CLI's physical compatibility checks, not version text
+            // or a synthetic apply marker. This does not authorize storage migration.
+            const runOwner = fs.lstatSync(context.db.path);
+            if (!runOwner.isFile() || runOwner.nlink !== 1)
+                throw new AppError("upgrade_storage_incompatible", "Upgrade requires a regular single-linked runtime store", 1, { effect: "no_effect" });
+            const run = PreparedMemoryInitRuntimeStorage.prepareUpgrade(context);
+            const resource = PreparedMemoryInitResourceStorage.prepare(context);
+            const currentOwner = fs.lstatSync(context.db.path);
+            if (currentOwner.dev !== runOwner.dev || currentOwner.ino !== runOwner.ino)
+                throw new AppError("upgrade_storage_changed", "Runtime store changed during upgrade admission", 1, { effect: "no_effect" });
+            const manifest = prepareJsonFile(path.resolve(projectRoot, status.flow_pack.manifest_path), "Current flow-pack provenance");
+            return { schema_id: "dd-flow/mb-upgrade-storage-readiness@1", route: "verified-no-op",
+                source_version: source, target_version: target, chain,
+                current_provenance: { path: manifest.file, sha256: crypto.createHash("sha256").update(manifest.text).digest("hex") },
+                target: { root: canon.root, commit: canon.commit, contract_sha256: crypto.createHash("sha256").update(contract.text).digest("hex") },
+                ...(selectedEngineStorage ? { selected_engine_storage: selectedEngineStorage } : {}),
+                stores: [{ ...run.facts(), store_dev: runOwner.dev, store_ino: runOwner.ino }, resource.facts()].map(store => ({ store_kind: store.store_kind,
+                    store_dev: store.store_dev, store_ino: store.store_ino,
+                    store_path: store.store_path, schema_sha256: store.schema_sha256,
+                    executing_writer_version: store.executing_writer_version })) };
+        }
         throw new AppError("migration_not_applied", "mb-upgrade RUN requires explicit migration apply before RUN creation", 1, {
             source_version: source,
             target_version: target,
+            blockers,
             next_action: "run migration plan, verify and explicit migration apply first"
         });
+    }
     const value = recordValue(parseJsonValue(applied.value_json));
     if (!value || !["applied", "verified_noop"].includes(stringValue(value.status) ?? "")) {
         throw new AppError("migration_not_applied", "mb-upgrade RUN has no successful explicit migration apply evidence", 1, {
@@ -263,6 +354,8 @@ export function assertUpgradeRunStorageReady(context, projectRoot) {
             target_version: target
         });
     }
+    return { schema_id: "dd-flow/mb-upgrade-storage-readiness@1", route: "existing-apply",
+        source_version: source, target_version: target, apply: value };
 }
 export function verifyMigrationReport(_context, input) {
     const filePath = path.resolve(input.file);
@@ -425,61 +518,45 @@ function hasActiveState(active) {
 function applyKey(projectId, source, target) {
     return `mb-upgrade.apply.${projectId}.${source}.${target}`;
 }
-function adjacentMigrationChain(source, target, impacts = []) {
-    if (source === target)
-        return { status: "ok", steps: [] };
-    const sourceParts = parseSemver(source);
-    const targetParts = parseSemver(target);
-    if (!sourceParts || !targetParts) {
+export function adjacentMigrationChain(source, target, impacts = []) {
+    if (semver.valid(source) !== source || semver.valid(target) !== target) {
         return { status: "unsupported", reason: "source or target version is not semver", steps: [] };
     }
-    if (impacts.length > 0) {
-        const steps = [];
-        const visited = new Set();
-        let current = source;
-        while (current !== target) {
-            if (visited.has(current))
-                return { status: "unsupported", reason: "release impact chain contains a cycle", steps: [] };
-            visited.add(current);
-            const impact = impacts.find((item) => item.from_version === current);
-            if (!impact)
-                return { status: "unsupported", reason: `missing adjacent release impact from ${current}`, steps: [] };
-            steps.push({
-                id: `${impact.from_version}-to-${impact.to_version}`,
-                from: impact.from_version,
-                to: impact.to_version,
-                status: "planned",
-                minimum_upgrade_mode: impact.minimum_upgrade_mode,
-                domains: impact.domains,
-                path_migration: impact.path_migration,
-                runtime_migration: impact.runtime_migration,
-                required_checks: impact.required_checks
-            });
-            current = impact.to_version;
-            const next = parseSemver(current);
-            if (!next || compareParts(next, targetParts) > 0) {
-                return { status: "unsupported", reason: `release impact chain overshoots target ${target}`, steps: [] };
-            }
-        }
-        return { status: "ok", steps };
-    }
-    if (sourceParts.major !== targetParts.major) {
-        return { status: "unsupported", reason: "major version migration requires canonical release-impact units", steps: [] };
-    }
-    if (targetParts.minor < sourceParts.minor || (targetParts.minor === sourceParts.minor && targetParts.patch < sourceParts.patch)) {
+    if (semver.gt(source, target))
         return { status: "unsupported", reason: "downgrade migrations are not supported", steps: [] };
-    }
+    if (source === target)
+        return { status: "ok", steps: [] };
     const steps = [];
-    let current = { ...sourceParts };
-    while (compareParts(current, targetParts) < 0) {
-        const next = nextAdjacent(current, targetParts);
+    const visited = new Set();
+    let current = source;
+    while (current !== target) {
+        if (visited.has(current))
+            return { status: "unsupported", reason: "release impact chain contains a cycle", steps: [] };
+        visited.add(current);
+        const matches = impacts.filter(item => item.from_version === current);
+        if (matches.length > 1)
+            return { status: "unsupported", reason: `ambiguous adjacent release impacts from ${current}`, steps: [] };
+        const impact = matches[0];
+        if (!impact)
+            return { status: "unsupported", reason: `missing adjacent release impact from ${current}`, steps: [] };
+        if (semver.valid(impact.to_version) !== impact.to_version || !semver.gt(impact.to_version, current)) {
+            return { status: "unsupported", reason: "release impact chain must advance through valid versions", steps: [] };
+        }
+        if (semver.gt(impact.to_version, target))
+            return { status: "unsupported", reason: `release impact chain overshoots target ${target}`, steps: [] };
         steps.push({
-            id: `${formatParts(current)}-to-${formatParts(next)}`,
-            from: formatParts(current),
-            to: formatParts(next),
-            status: "planned"
+            id: `${impact.from_version}-to-${impact.to_version}`,
+            from: impact.from_version,
+            to: impact.to_version,
+            status: "planned",
+            minimum_upgrade_mode: impact.minimum_upgrade_mode,
+            domains: impact.domains,
+            path_migration: impact.path_migration,
+            runtime_migration: impact.runtime_migration,
+            required_checks: impact.required_checks,
+            ...(impact.source_reference ? { source_reference: impact.source_reference } : {})
         });
-        current = next;
+        current = impact.to_version;
     }
     return { status: "ok", steps };
 }
@@ -513,13 +590,7 @@ function activeStateBlockers(active) {
     return blockers;
 }
 function readJsonObject(filePath) {
-    let parsed;
-    try {
-        parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-    }
-    catch (error) {
-        throw new AppError("invalid_json", `Cannot read migration report: ${filePath}`, 2, { cause: String(error) });
-    }
+    const { value: parsed } = prepareJsonFile(filePath, "Migration report");
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new AppError("validation", "Migration report must be a JSON object", 2, { file: filePath });
     }
@@ -535,24 +606,3 @@ function recordValue(value) {
 function stringValue(value) {
     return typeof value === "string" && value.length > 0 ? value : null;
 }
-function parseSemver(value) {
-    const match = value.match(/^([0-9]+)\.([0-9]+)\.([0-9]+)/);
-    if (!match?.[1] || !match[2] || !match[3])
-        return null;
-    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) };
-}
-function compareParts(left, right) {
-    if (left.major !== right.major)
-        return left.major - right.major;
-    if (left.minor !== right.minor)
-        return left.minor - right.minor;
-    return left.patch - right.patch;
-}
-function nextAdjacent(current, target) {
-    if (current.minor < target.minor)
-        return { major: current.major, minor: current.minor + 1, patch: 0 };
-    return { major: current.major, minor: current.minor, patch: Math.min(current.patch + 1, target.patch) };
-}
-function formatParts(parts) {
-    return `${parts.major}.${parts.minor}.${parts.patch}`;
-}

package/dist/services/model-catalog.js

@@ -0,0 +1,109 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+import { mergeModelListing } from "./model-discovery.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+// Reviewed adapter fallbacks and retained eval configurations, not vendor
+// availability promises or recommended defaults. Missing facts stay unknown;
+// historical eval qualification/capacity claims are deliberately not imported.
+const seed = {
+    schema_id: "dd-flow/model-catalog@1", version: "1.1.0",
+    entries: [{ harness: "agy", provider: "google", model: "gemini-3.1-pro-high",
+            settings: { reasoning: ["unknown"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-agy.mjs#L7",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "grok", provider: "xai", model: "grok-4.6",
+            settings: { reasoning: ["high"], mode: ["bypassPermissions"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-grok.mjs#L48",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "codex", provider: "unknown", model: "gpt-6.1-sol",
+            settings: { reasoning: ["high"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/codex-desktop-gpt-6-1-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "zcode", provider: "builtin:zai-coding-plan", model: "GLM-5.3",
+            settings: { reasoning: ["high"], mode: ["yolo"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/zcode-acp-zai-glm-5-3-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "opencode", provider: "opencode", model: "big-pickle",
+            settings: { reasoning: ["default"], mode: ["build"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/opencode-server-opencode-big-pickle-default.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "droid", provider: "openai", model: "gpt-5.6-sol",
+            settings: { reasoning: ["high"], mode: ["auto-high"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/droid-cli-openai-gpt-5-6-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } }]
+};
+const families = ["codex", "zcode", "agy", "opencode", "grok", "droid"];
+const identifier = (value, max = 128) => typeof value === "string" && value.length <= max && /^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/.test(value);
+const providerId = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+function invalid() {
+    throw new AppError("model_catalog_input", "Model catalog input requires reviewed seed data and an explicit observation scope; see dd-flow models --help", 2, { effect: "no_effect", help: "models" });
+}
+function readJson(file) {
+    let bytes;
+    try {
+        bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
+    }
+    catch {
+        throw new AppError("model_input_unavailable", "Model input must be a bounded readable regular file; see dd-flow models --help", 1, { effect: "no_effect", help: "models" });
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+export function readModelSeed(file) {
+    const input = file === undefined ? structuredClone(seed) : readJson(file);
+    if (validateHybridContract("model-catalog", input).length)
+        invalid();
+    const catalog = input;
+    if (catalog.entries.length > 10_000 || catalog.entries.some(entry => {
+        let source;
+        try {
+            source = new URL(entry.provenance.source);
+        }
+        catch {
+            return true;
+        }
+        const reviewed = entry.provenance.reviewed_at;
+        return entry.qualification.scope !== "seed-only" || !providerId(entry.provider) || !identifier(entry.model, 256)
+            || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(reviewed) || !Number.isFinite(Date.parse(reviewed))
+            || new Date(reviewed).toISOString() !== reviewed.replace(/Z$/, reviewed.includes(".") ? "Z" : ".000Z")
+            || source.protocol !== "https:" || source.username !== "" || source.password !== "" || source.search !== ""
+            || entry.provenance.source.length > 2048
+            || [...entry.settings.reasoning, ...entry.settings.mode].some(value => !identifier(value, 64));
+    }))
+        invalid();
+    return structuredClone(catalog);
+}
+/** Offline reader only. A supplied snapshot is an observation, not account authorization. */
+export function listOperatorModels(input) {
+    if (input.harness !== undefined && !families.includes(input.harness) || input.provider !== undefined && !providerId(input.provider)
+        || input.model !== undefined && !identifier(input.model, 256)
+        || input.accountSha256 !== undefined && !/^[a-f0-9]{64}$/.test(input.accountSha256)
+        || (input.accountSha256 !== undefined || input.observationFile !== undefined) && (!input.harness || !input.provider || !input.accountSha256))
+        invalid();
+    // Validate all selectors before opening operator files.
+    const catalog = readModelSeed(input.seedFile);
+    let entries, reason, observedAt = null;
+    if (input.accountSha256) {
+        const scope = { harness: input.harness, provider: input.provider, account_sha256: input.accountSha256 };
+        const observation = input.observationFile === undefined ? undefined : readJson(input.observationFile);
+        const merged = mergeModelListing(catalog, scope, observation);
+        entries = merged.entries.map(entry => ({ harness: scope.harness, provider: scope.provider, ...entry }));
+        reason = merged.reason;
+        observedAt = merged.observed_at;
+    }
+    else {
+        entries = catalog.entries.filter(entry => (!input.harness || entry.harness === input.harness) && (!input.provider || entry.provider === input.provider))
+            .map(entry => ({ harness: entry.harness, provider: entry.provider, model: entry.model, seed: structuredClone(entry),
+            availability: "unknown", account_access: "unknown", qualified: "unknown" }));
+        reason = "account_scope_not_selected";
+    }
+    if (input.model)
+        entries = entries.filter(entry => entry.model === input.model);
+    return { catalog_version: catalog.version, observed_at: observedAt, reason, entries,
+        families: families.map(harness => ({ harness, seed_status: catalog.entries.some(entry => entry.harness === harness) ? "reviewed_entries" : "not_curated",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/model-discovery.js

@@ -0,0 +1,46 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+const invalid = () => new AppError("model_discovery_input", "Model discovery input does not match its scoped contract", 2, { effect: "no_effect" });
+export function validateModelScope(scope) {
+    if (!scope || typeof scope !== "object" || Array.isArray(scope)
+        || ["harness", "provider", "account_sha256"].some(key => !Object.hasOwn(scope, key))
+        || Object.keys(scope).some(key => !["harness", "provider", "account_sha256"].includes(key))
+        || !["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(scope.harness)
+        || typeof scope.provider !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(scope.provider)
+        || typeof scope.account_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(scope.account_sha256))
+        throw invalid();
+}
+/** Merge only a matching account/provider snapshot. Listed is not authorized or qualified. */
+export function mergeModelListing(seed, scope, observation) {
+    validateModelScope(scope);
+    if (validateHybridContract("model-catalog", seed).length)
+        throw invalid();
+    if (observation !== undefined) {
+        if (!observation || typeof observation !== "object" || Array.isArray(observation)
+            || ["scope", "observed_at", "status", "complete", "models"].some(key => !Object.hasOwn(observation, key)))
+            throw invalid();
+        validateModelScope(observation.scope);
+        if (Object.keys(observation).some(key => !["scope", "observed_at", "status", "complete", "models"].includes(key))
+            || typeof observation.observed_at !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(observation.observed_at)
+            || !Number.isFinite(Date.parse(observation.observed_at))
+            || new Date(observation.observed_at).toISOString() !== observation.observed_at.replace(/Z$/, observation.observed_at.includes(".") ? "Z" : ".000Z")
+            || !["listed", "unavailable"].includes(observation.status)
+            || typeof observation.complete !== "boolean" || !Array.isArray(observation.models)
+            || observation.models.length > 10_000 || observation.models.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(model))
+            || new Set(observation.models).size !== observation.models.length
+            || observation.status === "unavailable" && (observation.models.length > 0 || observation.complete))
+            throw invalid();
+    }
+    const matches = observation && observation.scope.harness === scope.harness && observation.scope.provider === scope.provider
+        && observation.scope.account_sha256 === scope.account_sha256;
+    const listing = matches && observation.status === "listed" ? observation : undefined;
+    const entries = seed.entries.filter(entry => entry.harness === scope.harness && entry.provider === scope.provider);
+    const seeded = new Map(entries.map(entry => [entry.model, entry]));
+    const names = new Set([...seeded.keys(), ...(listing?.models ?? [])]);
+    return { scope: { ...scope }, observed_at: matches ? observation.observed_at : null,
+        reason: !observation ? "not_observed" : !matches ? "foreign_scope_ignored" : !listing ? "listing_unavailable" : "scoped_listing",
+        entries: [...names].sort().map(model => ({ model,
+            seed: seeded.has(model) ? structuredClone(seeded.get(model)) : null,
+            availability: listing?.models.includes(model) ? "listed" : listing?.complete ? "not_listed" : "unknown",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/native-daemon-history.js

@@ -0,0 +1,50 @@
+import crypto from "node:crypto";
+import { nativeShutdownConfirmed } from "../harness-runtime/lib/native-children.mjs";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { managedProcessBinding, managedProcessStatus, processTreeIsAlive, resourceHome, retainedResourceHomeMatches } from "./managed-processes.js";
+import { retainedDaemonOperations } from "./run-control.js";
+import { managedProviderBelongsToDaemon } from "./managed-daemon-binding.js";
+/** A replaced daemon is a settled resource, never another Session to resume. */
+export function historicalDaemonSettlement(context, scopeId, record) {
+    const metadata = JSON.parse(record.metadata_json);
+    if (!record.kind.endsWith("-daemon") || !metadata.state_dir || !path.isAbsolute(metadata.state_dir))
+        throw new AppError("runtime_scope_owner_unknown", "Native history requires an absolute daemon directory", 1);
+    const current = JSON.parse(fs.readFileSync(path.join(metadata.state_dir, "daemon.json"), "utf8"));
+    if (current.resource_process?.id === record.id)
+        return null;
+    if (record.state !== "stopped" || record.termination_reason !== "daemon_stopped" || !record.pid || !record.pid_started_at || processTreeIsAlive(record))
+        throw new AppError("runtime_scope_owner_unknown", "Previous daemon has no physical completion proof", 1);
+    const directory = path.join(metadata.state_dir, "daemon-history");
+    const matches = fs.readdirSync(directory).filter(name => /^[a-zA-Z0-9-]+\.json$/.test(name)).map(name => {
+        const file = path.join(directory, name);
+        if (!fs.lstatSync(file).isFile())
+            throw new AppError("runtime_scope_owner_unknown", "Daemon history must contain regular receipts", 1);
+        const bytes = fs.readFileSync(file, "utf8");
+        return { file, bytes, state: JSON.parse(bytes) };
+    }).filter(candidate => candidate.state.resource_process?.id === record.id);
+    if (matches.length !== 1)
+        throw new AppError("runtime_scope_owner_unknown", "Previous daemon has no unique retained receipt", 1);
+    const { file, bytes, state } = matches[0], owner = state.config?.runtime_owner;
+    if (!state.daemon_id || path.basename(file) !== `${state.daemon_id}.json` || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || owner.dd_flow_home !== metadata.dd_flow_home || !retainedResourceHomeMatches(context, owner.resource_home) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.lease_token !== record.lease_token || state.pid !== record.pid)
+        throw new AppError("runtime_scope_owner_unknown", "Archived daemon does not match its registration", 1);
+    const closed = state.shutdown_state === "clean" && state.active_tree === false
+        ? retainedDaemonOperations(metadata.state_dir).find(operation => operation.daemon_id === state.daemon_id && operation.operation === "daemon.stop" && operation.state === "completed" && operation.result?.stopped === true && nativeShutdownConfirmed(operation.result, { daemonId: state.daemon_id ?? "" })) : undefined;
+    const fresh = managedProcessStatus(context).find(item => item.id === record.id);
+    if (!closed || !fresh || fresh.lease_token !== record.lease_token || fresh.pid !== record.pid || fresh.pid_started_at !== record.pid_started_at || fresh.metadata_json !== record.metadata_json || fresh.state !== "stopped" || fresh.termination_reason !== "daemon_stopped" || processTreeIsAlive(fresh) || fs.readFileSync(file, "utf8") !== bytes)
+        throw new AppError("runtime_scope_outcome_unknown", "Previous daemon lacks stable clean shutdown evidence", 1);
+    const providers = managedProcessStatus(context).filter(item => managedProviderBelongsToDaemon(item, fresh, state));
+    if (state.provider_process && (providers.length !== 1 || providers[0].state !== "stopped" || providers[0].termination_reason !== "daemon_stopped" || !providers[0].operation_id?.startsWith(`${owner.operation_id}:`) || processTreeIsAlive(providers[0])))
+        throw new AppError("runtime_scope_outcome_unknown", "Archived provider lacks its exact physical completion proof", 1);
+    return { historical: true, process_id: record.id, role: metadata.role, state_dir: metadata.state_dir, daemon_id: state.daemon_id,
+        processes: providers.map(item => ({ process_id: item.id, native_settled: true, binding: managedProcessBinding(item, resourceHome(context)) })),
+        settled: true, native_settled: true, operation_id: String(closed.operation_id), owner_operation_id: owner.operation_id,
+        inventory_version: crypto.createHash("sha256").update(JSON.stringify([bytes, closed])).digest("hex") };
+}
+export function assertHistoricalDaemonSettlement(context, scopeId, proof) {
+    const record = managedProcessStatus(context).find(item => item.id === proof.process_id);
+    const fresh = record && historicalDaemonSettlement(context, scopeId, record);
+    if (!fresh || proof.historical !== true || proof.native_settled !== true || fresh.inventory_version !== proof.inventory_version)
+        throw new AppError("runtime_scope_inventory_changed", "Archived daemon settlement changed after observation", 1);
+}