@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/verification-components.json

@@ -0,0 +1,384 @@
+{
+  "schema_id": "dd-flow/verification-components@1",
+  "scope": "technical-matrix-publication-not-native-execution",
+  "matrix": {
+    "roots": [
+      "services/verification-matrix.js",
+      "services/stage-report-renderer.js",
+      "services/accepted-intent.js",
+      "services/check-runner-evidence.js",
+      "services/check-runner-proof.js"
+    ],
+    "runner_proof_contract": "dd-flow/check-runner-proof@1",
+    "files": [
+      "cli/command-inputs.js",
+      "cli/command-metadata.js",
+      "cli/command-option-descriptions.js",
+      "cli/help.js",
+      "cli/input-preparation.js",
+      "cli/native-hook-preparation.js",
+      "domain/contracts.js",
+      "domain/delivery-flows.js",
+      "domain/diagnostic-aspects.js",
+      "domain/diagnostic-flows.js",
+      "domain/distill-flow.js",
+      "domain/entity-ids.js",
+      "domain/flow-contract.js",
+      "domain/interactive-flow.js",
+      "domain/memory-fix-flow.js",
+      "domain/review-fix-flow.js",
+      "domain/session-coverage.js",
+      "domain/source-snapshot-flows.js",
+      "domain/stage-catalog.js",
+      "domain/stage-handler-identities.js",
+      "domain/validation.js",
+      "protocol/local-files.js",
+      "runtime/context.js",
+      "schemas/merge-result.schema.json",
+      "schemas/merge-stage-report-legacy-0.4.2.schema.json",
+      "schemas/merge-stage-report.schema.json",
+      "schemas/plan-aspect-map.schema.json",
+      "schemas/plan-review-decision.schema.json",
+      "schemas/plan-review-result.schema.json",
+      "schemas/plan-stage-report.schema.json",
+      "schemas/protocol-dashboard-data.schema.json",
+      "schemas/protocol-plan.schema.json",
+      "schemas/run-control-receipt.schema.json",
+      "schemas/run-control-request.schema.json",
+      "schemas/run-engine-binding.schema.json",
+      "schemas/stage-finish-input.schema.json",
+      "schemas/stage-prompt.schema.json",
+      "schemas/stage-report.schema.json",
+      "schemas/stage-start-response.schema.json",
+      "services/accepted-intent.js",
+      "services/assigned-lifecycle.js",
+      "services/audit.js",
+      "services/branch-context.js",
+      "services/build-info.js",
+      "services/canon.js",
+      "services/check-environment.js",
+      "services/check-runner-evidence.js",
+      "services/check-runner-proof.js",
+      "services/cli-operation-classifier.js",
+      "services/cli-upgrade-allowlist.js",
+      "services/code-checks.js",
+      "services/command-context.js",
+      "services/config.js",
+      "services/controller-result-authority.js",
+      "services/controller-work-failure.js",
+      "services/delivery-access.js",
+      "services/delivery-approval.js",
+      "services/delivery-artifact.js",
+      "services/delivery-checks.js",
+      "services/delivery-execution.js",
+      "services/delivery-intents.js",
+      "services/delivery-policy.js",
+      "services/delivery-procedures.js",
+      "services/delivery-request.js",
+      "services/delivery-result.js",
+      "services/delivery-stage-entry.js",
+      "services/delivery-stage-handlers.js",
+      "services/delivery-stage-results.js",
+      "services/descriptor-coordinator-session.js",
+      "services/descriptor-root-work.js",
+      "services/descriptor-run-settlement.js",
+      "services/descriptor-run-start.js",
+      "services/descriptor-stage-coordinator.js",
+      "services/descriptor-stage-settlement.js",
+      "services/descriptor-stage-start.js",
+      "services/diagnostic-evidence.js",
+      "services/diagnostic-repair-intake.js",
+      "services/diagnostic-repair-source-intake.js",
+      "services/diagnostic-report-publication.js",
+      "services/diagnostic-report.js",
+      "services/diagnostic-run-bundle.js",
+      "services/diagnostic-snapshot.js",
+      "services/diagnostic-stage-handlers.js",
+      "services/diagnostic-stage-results.js",
+      "services/diagnostic-start.js",
+      "services/diagnostic-work-batch.js",
+      "services/diagnostic-work-collection.js",
+      "services/diagnostic-work-registration.js",
+      "services/diagnostic-work-results.js",
+      "services/distill-document-publication.js",
+      "services/distill-publication-custody.js",
+      "services/distill-stage-handlers.js",
+      "services/distill-stage-results.js",
+      "services/distill-user-inputs.js",
+      "services/distill-work-batch.js",
+      "services/distill-work-collection.js",
+      "services/distill-work-registration.js",
+      "services/distill-work-results.js",
+      "services/engines.js",
+      "services/eval-snapshots.js",
+      "services/execution-bundles.js",
+      "services/execution-policy.js",
+      "services/executor-onboarding.js",
+      "services/external-work-launch.js",
+      "services/flow-descriptors.js",
+      "services/flow-guidance.js",
+      "services/frozen-engine.js",
+      "services/generic-execution.js",
+      "services/hook-memory-routing.js",
+      "services/hook-recovery-guard.js",
+      "services/hook-session-observation.js",
+      "services/hooks.js",
+      "services/hybrid-contracts.js",
+      "services/hybrid-digest.js",
+      "services/ids.js",
+      "services/installation-lock.js",
+      "services/installed-flow-source.js",
+      "services/interactive-attached-session.js",
+      "services/interactive-baseline-custody.js",
+      "services/interactive-before-versions.js",
+      "services/interactive-bundle-data.js",
+      "services/interactive-checks.js",
+      "services/interactive-finish-integration.js",
+      "services/interactive-git-baseline.js",
+      "services/interactive-git-dispatch.js",
+      "services/interactive-mutation-scope.js",
+      "services/interactive-request.js",
+      "services/interactive-run-bundle.js",
+      "services/interactive-stage-entry.js",
+      "services/interactive-stage-handlers.js",
+      "services/interactive-stage-observation.js",
+      "services/interactive-stage-results.js",
+      "services/interactive-user-inputs.js",
+      "services/interactive-work-batch.js",
+      "services/interactive-work-collection.js",
+      "services/interactive-work-completion.js",
+      "services/interactive-work-context.js",
+      "services/interactive-work-history.js",
+      "services/interactive-work-registration.js",
+      "services/interactive-work-results.js",
+      "services/interactive-work-start.js",
+      "services/lanes.js",
+      "services/lifecycle-command.js",
+      "services/lifecycle-contract.js",
+      "services/lifecycle-invocations.js",
+      "services/managed-daemon-binding.js",
+      "services/managed-lease-monitor.js",
+      "services/managed-processes.js",
+      "services/memory-accepted-composition.js",
+      "services/memory-baseline-preservation.js",
+      "services/memory-completed-correction-wave.js",
+      "services/memory-compose-handler.js",
+      "services/memory-composition-acceptance.js",
+      "services/memory-composition-graph.js",
+      "services/memory-composition-registration.js",
+      "services/memory-composition-work-custody.js",
+      "services/memory-composition-work-results.js",
+      "services/memory-corrected-review-acceptance.js",
+      "services/memory-corrected-review-batch.js",
+      "services/memory-corrected-review-findings.js",
+      "services/memory-corrected-review-inputs.js",
+      "services/memory-corrected-review-projection.js",
+      "services/memory-corrected-review-receipt.js",
+      "services/memory-corrected-review-registration.js",
+      "services/memory-correction-check-receipt.js",
+      "services/memory-correction-input-owner.js",
+      "services/memory-custody-snapshot.js",
+      "services/memory-discover-handler.js",
+      "services/memory-finish-evidence.js",
+      "services/memory-finish-handler.js",
+      "services/memory-finish-integration.js",
+      "services/memory-finish-readiness.js",
+      "services/memory-fix-finish-integration.js",
+      "services/memory-fix-intake-custody.js",
+      "services/memory-fix-intake-settlement.js",
+      "services/memory-fix-publication.js",
+      "services/memory-fix-repair-admission.js",
+      "services/memory-fix-request.js",
+      "services/memory-fix-run-bundle.js",
+      "services/memory-fix-scope.js",
+      "services/memory-fix-sources.js",
+      "services/memory-fix-stage-entry.js",
+      "services/memory-fix-stage-handlers.js",
+      "services/memory-fix-stage-results.js",
+      "services/memory-flow-user-inputs.js",
+      "services/memory-git-integration.js",
+      "services/memory-historical-corrected-review.js",
+      "services/memory-historical-original-review.js",
+      "services/memory-historical-repair-registration.js",
+      "services/memory-historical-second-review.js",
+      "services/memory-init-bootstrap-readiness.js",
+      "services/memory-init-engine-release.js",
+      "services/memory-init-git-policy.js",
+      "services/memory-init-lint-capability.js",
+      "services/memory-init-preflight.js",
+      "services/memory-init-project-bootstrap.js",
+      "services/memory-init-request-candidate.js",
+      "services/memory-init-request-input.js",
+      "services/memory-init-resource-storage.js",
+      "services/memory-init-run-allocation.js",
+      "services/memory-init-startup-custody.js",
+      "services/memory-init-storage.js",
+      "services/memory-init-worktrunk-capability.js",
+      "services/memory-layer-publication.js",
+      "services/memory-layer.js",
+      "services/memory-lint-config.js",
+      "services/memory-native-review-copy.js",
+      "services/memory-normal-flow-entry.js",
+      "services/memory-ordinary-defaults.js",
+      "services/memory-permissions.js",
+      "services/memory-preflight-bootstrap-custody.js",
+      "services/memory-preflight-handler.js",
+      "services/memory-repair-current-view.js",
+      "services/memory-repair-document-delta.js",
+      "services/memory-repair-history.js",
+      "services/memory-repair-physical-binding.js",
+      "services/memory-repair-publication-files.js",
+      "services/memory-repair-publication-intent.js",
+      "services/memory-repair-publication-plan.js",
+      "services/memory-repair-publication-source.js",
+      "services/memory-repair-publication.js",
+      "services/memory-repair-registration.js",
+      "services/memory-repair-work-baseline.js",
+      "services/memory-repair-work-completion.js",
+      "services/memory-repair-work-custody.js",
+      "services/memory-repair-work-results.js",
+      "services/memory-repair-workspace.js",
+      "services/memory-repair-writer-copy.js",
+      "services/memory-result-binding.js",
+      "services/memory-retained-review-authority.js",
+      "services/memory-retained-review-results.js",
+      "services/memory-retained-second-baseline.js",
+      "services/memory-retained-second-repairs.js",
+      "services/memory-review-acceptance.js",
+      "services/memory-review-correction-plan.js",
+      "services/memory-review-handler.js",
+      "services/memory-review-inputs.js",
+      "services/memory-review-limits.js",
+      "services/memory-review-receipt.js",
+      "services/memory-review-registration.js",
+      "services/memory-review-work-custody.js",
+      "services/memory-review-work-input.js",
+      "services/memory-review-work-results.js",
+      "services/memory-second-corrected-review-inputs.js",
+      "services/memory-second-correction-plan.js",
+      "services/memory-second-repair-baseline.js",
+      "services/memory-second-repair-launch.js",
+      "services/memory-second-repair-registration.js",
+      "services/memory-second-repair-source.js",
+      "services/memory-second-review-acceptance.js",
+      "services/memory-source-observations.js",
+      "services/memory-stage-dispatch.js",
+      "services/memory-stage-results.js",
+      "services/memory-tool-probe.js",
+      "services/memory-upgrade-analysis-handler.js",
+      "services/memory-upgrade-bootstrap-readiness.js",
+      "services/memory-upgrade-evidence.js",
+      "services/memory-upgrade-inventory.js",
+      "services/memory-upgrade-publication-custody.js",
+      "services/memory-upgrade-publication.js",
+      "services/memory-upgrade-selection.js",
+      "services/memory-upgrade-storage-readiness.js",
+      "services/memory-verification-acceptance.js",
+      "services/memory-verification-checks.js",
+      "services/memory-verification-receipt.js",
+      "services/memory-verify-handler.js",
+      "services/memory-work-result-json.js",
+      "services/memory-work-result-preparation.js",
+      "services/merge-queue.js",
+      "services/migrations.js",
+      "services/native-session-control.js",
+      "services/operator-profiles.js",
+      "services/physical-startup.js",
+      "services/plan-runtime.js",
+      "services/portable-refs.js",
+      "services/project-flow-source.js",
+      "services/project-git-integration.js",
+      "services/project-registry.js",
+      "services/project-summary.js",
+      "services/projects.js",
+      "services/prompt-delivery.js",
+      "services/protocol-lifecycle.js",
+      "services/protocols.js",
+      "services/provider-capacity.js",
+      "services/recovery-snapshot-database.js",
+      "services/release-archive.js",
+      "services/release-cache.js",
+      "services/release-download.js",
+      "services/release-envelope.js",
+      "services/release-manifest.js",
+      "services/release-payload.js",
+      "services/release-source.js",
+      "services/repair-intents.js",
+      "services/repair-receipt.js",
+      "services/review-copy.js",
+      "services/review-deferral.js",
+      "services/review-fix-handoff.js",
+      "services/review-fix-intake-custody.js",
+      "services/review-fix-stage-entry.js",
+      "services/review-fix-stage-handlers.js",
+      "services/review-fix-stage-results.js",
+      "services/run-control-receipt.js",
+      "services/run-control.js",
+      "services/run-controller-state.js",
+      "services/run-engine-bindings.js",
+      "services/run-observations.js",
+      "services/run-projection.js",
+      "services/run-recovery-guard.js",
+      "services/run-recovery.js",
+      "services/run-start-custody.js",
+      "services/run-timeline.js",
+      "services/runs.js",
+      "services/runtime-budget.js",
+      "services/runtime-command.js",
+      "services/schema-validation.js",
+      "services/scope-writer-cleanup.js",
+      "services/session-identity.js",
+      "services/sessions.js",
+      "services/setup.js",
+      "services/stage-blocker.js",
+      "services/stage-context.js",
+      "services/stage-handlers.js",
+      "services/stage-lifecycle.js",
+      "services/stage-pause.js",
+      "services/stage-report-renderer.js",
+      "services/stage-work-graph.js",
+      "services/technical-notes.js",
+      "services/tooling.js",
+      "services/usage.js",
+      "services/verification-matrix.js",
+      "services/version-status.js",
+      "services/vnext-code-review.js",
+      "services/vnext-code.js",
+      "services/vnext-contracts.js",
+      "services/vnext-execution-profile.js",
+      "services/vnext-fanout.js",
+      "services/vnext-merge.js",
+      "services/vnext-plan-review.js",
+      "services/vnext-plan.js",
+      "services/vnext-protocolize.js",
+      "services/vnext-specify.js",
+      "services/vnext-workspace-policy.js",
+      "services/work-registry.js",
+      "services/work-retry-context.js",
+      "services/workspace-bootstrap.js",
+      "services/workspace-files.js",
+      "services/worktrees.js",
+      "shared/entity-references.js",
+      "shared/errors.js",
+      "shared/json.js",
+      "storage/agent-output.js",
+      "storage/database.js",
+      "storage/foreign-key-transaction.js",
+      "storage/immutable-input.js",
+      "storage/import-guard.js",
+      "storage/native-cleanup.js",
+      "storage/paths.js",
+      "storage/projection-lock.js",
+      "storage/work-references.js",
+      "storage/writer-contract.js"
+    ],
+    "dependencies": [
+      "ajv/dist/2020.js",
+      "ajv/dist/ajv.js",
+      "semver",
+      "shell-quote",
+      "smol-toml",
+      "yaml"
+    ]
+  }
+}

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.16",
+  "version": "0.9.0-beta.160",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
+  "packageManager": "pnpm@10.23.0",
   "bin": {
-    "dd-flow": "./dist/cli.js"
+    "dd-flow": "dist/cli.js",
+    "dd-codex": "dist/harness-runtime/bin/dd-codex.mjs",
+    "dd-zcode": "dist/harness-runtime/bin/dd-zcode.mjs",
+    "dd-grok": "dist/harness-runtime/bin/dd-grok.mjs",
+    "dd-opencode": "dist/harness-runtime/bin/dd-opencode.mjs",
+    "dd-agy": "dist/harness-runtime/bin/dd-agy.mjs",
+    "dd-droid": "dist/harness-runtime/bin/dd-droid.mjs"
   },
   "files": [
     "dist",
@@ -16,32 +23,64 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs && node scripts/generate-verification-components.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "node scripts/verification.mjs run",
+    "gate:merge": "node scripts/verification.mjs run",
+    "verify:plan": "node scripts/verification.mjs plan",
+    "test:verification": "node --test --test-concurrency=1 scripts/verification-policy.test.mjs scripts/generate-verification-components.test.mjs scripts/verification-jobs.test.mjs",
+    "test:hybrid": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-contracts.test.mjs",
+    "test:hybrid:canon": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-canon.test.mjs scripts/hybrid-inventory.test.mjs scripts/hybrid-consumers.test.mjs scripts/hybrid-schema-copies.test.mjs scripts/verify-e3-canon.test.mjs",
+    "test:e2": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e2-*.test.mjs",
+    "test:e2:installed": "node --test scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:e3": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e3-*.test.mjs scripts/verify-e3-engine-storage.test.mjs",
+    "test:e4": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e4-*.test.mjs",
+    "test:e5": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e5-*.test.mjs",
+    "test:e3:canon": "node --import ./scripts/source-test-loader.mjs --test scripts/verify-e3-canon.test.mjs",
+    "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --project=release",
+    "test:release:build": "node --test --test-concurrency=1 scripts/verify-release-build.test.mjs scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:integration": "vitest run --project='integration-*'",
+    "test:fast": "vitest run --project=integration-fast",
+    "test:core": "vitest run --project='integration-core-*'",
+    "test:flow": "vitest run --project=integration-flow",
+    "test:runtime-sensitive": "vitest run --project=runtime-sensitive",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release:candidate:pack": "node scripts/release-candidate.mjs pack",
+    "release:candidate:accept": "node scripts/release-candidate.mjs accept",
+    "release:publish": "node scripts/publish-release.mjs",
+    "release:hybrid:produce": "node tools/produce-hybrid-release.mjs",
+    "release:canon:archive": "node tools/create-canon-release.mjs"
+  },
   "devDependencies": {
+    "@bufbuild/protoc-gen-es": "2.16.0",
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
+    "@opencode/client": "2.0.28",
+    "@opencode/plugin": "2.0.28",
     "@types/node": "^24.10.1",
+    "@types/semver": "7.8.0",
     "eslint": "^9.39.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.47.0",
     "vitest": "^4.0.13"
   },
   "dependencies": {
+    "@bufbuild/protobuf": "2.16.0",
+    "@grpc/grpc-js": "1.14.6",
     "ajv": "^8.20.0",
+    "jsonc-parser": "3.3.1",
+    "semver": "7.8.1",
     "shell-quote": "^1.10.0",
     "smol-toml": "^1.6.1",
+    "tree-sitter": "0.25.1",
+    "tree-sitter-bash": "0.25.1",
     "yaml": "^2.9.0"
   },
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish"
-  }
-}
+  "license": "MIT"
+}

package/tools/create-canon-release.mjs

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { createHash, randomUUID } from "node:crypto";
+import { produceCanonArchive } from "../dist/services/release-provenance.js";
+
+const args = process.argv.slice(2), names = ["canon-root", "commit", "output"];
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write("Usage: node tools/create-canon-release.mjs --canon-root <checkout> --commit <40-hex-commit> --output <new-archive.tgz>\nCreates an immutable Git-object archive with reviewed aliases materialized. Does not publish or qualify a release.\n");
+} else {
+  let temporary;
+  let ownsTemporary = false;
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const bytes = produceCanonArchive(options.get("canon-root"), options.get("commit"));
+    const output = path.resolve(options.get("output"));
+    temporary = path.join(path.dirname(output), `.canon-archive-${randomUUID()}.tmp`);
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    ownsTemporary = true;
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.linkSync(temporary, output); // Atomic no-replace publication, including dangling symlink targets.
+    process.stdout.write(`${JSON.stringify({ ok: true, commit: options.get("commit"), output, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") })}\n`);
+  } catch {
+    process.stderr.write("Canonical archive production refused; check committed source and a new output path.\n");
+    process.exitCode = 1;
+  } finally { if (temporary && ownsTemporary) fs.rmSync(temporary, { force: true }); }
+}

package/tools/probe-codex-history.mjs

@@ -0,0 +1,37 @@
+/* global console */
+// Explicit non-generative contract probe. Never uses the operator's Codex home.
+import { mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { CodexBridge, codexReadPhase, readCodexHistory, readCodexRpc } from "../dist/harness-runtime/lib/dd-codex.mjs";
+import { errorRecord } from "../dist/harness-runtime/lib/operation-errors.mjs";
+
+const bin = process.argv[2];
+if (!bin || !path.isAbsolute(bin)) throw new Error("Usage: node tools/probe-codex-history.mjs /absolute/native/codex");
+const home = await mkdtemp(path.join(os.tmpdir(), "dd-codex-history-"));
+await writeFile(path.join(home, "config.toml"), "[features]\nplugins = false\nremote_models = false\n");
+const bridge = new CodexBridge({ bin, cwd: home, journal: path.join(home, "native.jsonl"),
+  env: { ...Object.fromEntries(Object.keys(process.env).map(key => [key, undefined])),
+    PATH: process.env.PATH, HOME: home, CODEX_HOME: home, CODEX_SQLITE_HOME: home, CODEX_LOG_DIR: home } });
+const report = { home, non_generative: true, reads: [] };
+try {
+  await bridge.start();
+  const created = await bridge.request("thread/start", { cwd: home, ephemeral: false, approvalPolicy: "never", sandbox: "read-only" });
+  report.session_id = created.thread.id;
+  report.history_mode = created.thread.historyMode;
+  const phase = codexReadPhase(bridge);
+  const compact = await readCodexRpc(bridge, "thread/read", { threadId: report.session_id, includeTurns: false }, phase);
+  report.compact = { id: compact.thread.id, status: compact.thread.status };
+  for (const method of ["thread/turns/list", "thread/read"]) {
+    const read = await readCodexHistory(bridge, method, { threadId: report.session_id,
+      ...(method === "thread/read" ? { includeTurns: true } : { limit: 20, itemsView: "summary" }) }, phase);
+    report.reads.push({ method, available: read.available, ...(read.error ? { error: read.error } : {}) });
+  }
+} catch (error) { report.error = errorRecord(error); process.exitCode = 1; }
+finally {
+  try { await bridge.close(); }
+  catch (error) { report.cleanup_error = errorRecord(error); process.exitCode = 1; }
+  await writeFile(path.join(home, "result.json"), JSON.stringify(report, null, 2) + "\n");
+}
+console.log(JSON.stringify(report, null, 2));

package/tools/produce-hybrid-release.mjs

@@ -0,0 +1,41 @@
+import { createPrivateKey } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { publishReleaseBundle } from "../dist/services/release-producer.js";
+import { readBoundedReleaseFile } from "../dist/services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../dist/services/release-compatibility.js";
+import { getCliVersionReport } from "../dist/services/build-info.js";
+import { verifyProducerSource, verifyCanonArchiveSource } from "../dist/services/release-provenance.js";
+
+const names = ["payload-file", "canon-root", "canon-archive", "engine-archive", "key-file", "output", "channel"];
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(`Produce an immutable local signed release bundle from existing qualification evidence.\nUsage: node tools/produce-hybrid-release.mjs ${names.map(name => `--${name} <value>`).join(" ")}\nThis does not publish remotely or qualify a route. Private keys never enter the output.\n`);
+} else {
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const compatibility = createReleaseCompatibility({ channel: options.get("channel"), catalogVersions: installedCatalogVersions, routerVersion: getCliVersionReport().cli.version });
+    const payload = JSON.parse(readBoundedReleaseFile(options.get("payload-file"), 16 * 1024 * 1024).toString("utf8"));
+    const manifest = JSON.parse(Buffer.from(payload.manifest_base64, "base64").toString("utf8"));
+    verifyProducerSource(options.get("canon-root"), payload.source, manifest.canon.version);
+    const canonArchive = readBoundedReleaseFile(options.get("canon-archive"), 256 * 1024 * 1024);
+    verifyCanonArchiveSource(options.get("canon-root"), payload.source.commit, manifest.canon.archive, canonArchive);
+    const result = publishReleaseBundle(options.get("output"), {
+      payload,
+      privateKey: createPrivateKey(readBoundedReleaseFile(options.get("key-file"), 64 * 1024)), compatibility,
+      canonArchive,
+      engineArchive: readBoundedReleaseFile(options.get("engine-archive"), 256 * 1024 * 1024)
+    });
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
+  } catch {
+    // Key/parser/network excerpts must never appear in producer diagnostics.
+    process.stderr.write("Release production refused; check explicit inputs and qualification evidence.\n");
+    process.exitCode = 1;
+  }
+}