@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/delivery-access.js

@@ -0,0 +1,123 @@
+import { randomUUID } from "node:crypto";
+import { types } from "node:util";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { resolveDeliveryBinding } from "./delivery-policy.js";
+import { executeDeliveryStep } from "./delivery-execution.js";
+const dimensions = ["identity", "authority", "target"];
+const freshnessMs = 30000;
+const record = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function refuse(reason) {
+    throw new AppError("delivery_access_required", "Delivery access is not established for the selected operation; do not login or change context automatically", 2, { reason, effect: "no_effect" });
+}
+function identity(context, input) {
+    return hybridDigest({ home: context.ddFlowHome, project_id: input.projectId, run_id: input.runId,
+        operation_id: input.operationId, workspace: input.workspace, binding: input.binding });
+}
+/** Private same-process observation, not serialized publication authority.
+ * The owning Stage still establishes project-policy/readback safety and checks
+ * separate scoped approval, artifact custody and retained operation intent. */
+export class PreparedDeliveryAccess {
+    #scope;
+    #pid = process.pid;
+    #expires;
+    #consumed = false;
+    #report;
+    constructor(context, input, observed, report) {
+        this.#scope = identity(context, input);
+        this.#expires = observed + freshnessMs;
+        this.#report = structuredClone(report);
+    }
+    static async observe(context, raw) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("observation_outside_writer_required");
+        const binding = resolveDeliveryBinding({ schema_id: "dd-flow/delivery-policy@1", bindings: [raw.binding] }, raw.binding.selector);
+        const input = { ...raw, binding }, times = new Map(), processes = [];
+        const assertCurrent = () => {
+            const result = raw.assertCurrent();
+            if (types.isPromise(result)) {
+                void result.catch(() => { });
+                refuse("synchronous_owner_fence_required");
+            }
+        };
+        assertCurrent();
+        if (binding.access.applicability === "required") {
+            const access = binding.access, procedure = binding.procedures.access_readback, deadline = Date.now() + procedure.timeout_ms;
+            // The project-owned procedure is the structured extractor. Each step
+            // emits only this public-context envelope (possibly partial/empty).
+            for (const step of procedure.procedure_steps) {
+                const remaining = deadline - Date.now();
+                if (remaining <= 0)
+                    refuse("readback_failed");
+                let malformed = false;
+                try {
+                    const result = await executeDeliveryStep(context, { projectId: input.projectId, runId: input.runId,
+                        operationId: `access-${randomUUID()}`, stepId: step.id, workspace: input.workspace, procedure, deadlineAt: deadline,
+                        assertCurrent, admit() { }, consumeOutput(bytes) {
+                            let value;
+                            try {
+                                value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+                            }
+                            catch {
+                                malformed = true;
+                                return;
+                            }
+                            if (!record(value) || value.schema_id !== "dd-flow/delivery-access-observation@1"
+                                || Object.keys(value).some(key => !["schema_id", ...dimensions].includes(key))) {
+                                malformed = true;
+                                return;
+                            }
+                            for (const dimension of dimensions) {
+                                if (!Object.hasOwn(value, dimension))
+                                    continue;
+                                const expected = access[dimension], observed = value[dimension];
+                                if (expected === "not_required") {
+                                    if (observed !== "not_required") {
+                                        malformed = true;
+                                        return;
+                                    }
+                                }
+                                else if (!record(observed) || Object.keys(observed).sort().join() !== "id,kind"
+                                    || observed.kind !== expected.kind || observed.id !== expected.id) {
+                                    malformed = true;
+                                    return;
+                                }
+                                times.set(dimension, Date.parse(context.now()));
+                            }
+                        } });
+                    processes.push(result.process_id);
+                    if (Date.now() >= deadline)
+                        refuse("readback_failed");
+                }
+                catch {
+                    refuse("readback_failed");
+                }
+                if (malformed)
+                    refuse("context_mismatch_or_unsafe_output");
+            }
+            if (!times.has("identity") || !times.has("target") || access.authority !== "not_required" && !times.has("authority"))
+                refuse("required_context_not_observable");
+        }
+        assertCurrent();
+        const now = Date.parse(context.now());
+        if (!Number.isFinite(now) || [...times.values()].some(time => !Number.isFinite(time) || time > now))
+            refuse("observation_clock_invalid");
+        const observed = times.size ? Math.min(...times.values()) : now;
+        const prepared = new PreparedDeliveryAccess(context, input, observed, { schema_id: "dd-flow/delivery-access@1",
+            operation_id: input.operationId, binding_id: binding.id, observed_at: new Date(observed).toISOString(),
+            applicability: binding.access.applicability === "required" ? "verified" : "not_required",
+            identity: binding.access.applicability === "required" ? "verified" : "not_required",
+            authority: binding.access.applicability === "required" && binding.access.authority !== "not_required" ? "verified" : "not_required",
+            target: binding.access.applicability === "required" ? "verified" : "not_required", expected: binding.access, processes });
+        prepared.assertFresh(context, input);
+        return prepared;
+    }
+    value() { return structuredClone(this.#report); }
+    assertFresh(context, input) {
+        const now = Date.parse(context.now());
+        if (this.#pid !== process.pid || this.#consumed || identity(context, input) !== this.#scope
+            || !Number.isFinite(now) || now < Date.parse(this.#report.observed_at) || now >= this.#expires)
+            refuse("fresh_same_process_readback_required");
+    }
+    consume(context, input) { this.assertFresh(context, input); this.#consumed = true; }
+}

package/dist/services/delivery-approval.js

@@ -0,0 +1,68 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readPreparedMemoryFlowUserInputs } from "./memory-flow-user-inputs.js";
+import { resolveDeliveryBinding } from "./delivery-policy.js";
+const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const record = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+const keys = (value, names) => Object.keys(value).sort().join() === [...names].sort().join();
+const text = (value) => typeof value === "string" && Boolean(value.trim()) && value.length <= 4096 && !value.includes("\0");
+function refuse(reason) {
+    throw new AppError("delivery_approval_invalid", "Delivery needs current user approval for the exact selected operation", 2, { reason, effect: "no_effect" });
+}
+/** Public decision scope, not observed artifact bytes, account access or grant.
+ * The Stage owner supplies its retained artifact/target selection and freezes
+ * the same scope in the operation intent before execution. */
+export function deliveryApprovalScope(scope, bundle, selection) {
+    const flow = bundle.manifest.flow_id;
+    if (flow !== "release" && flow !== "deploy" && flow !== "publish")
+        refuse("delivery_bundle_required");
+    const binding = resolveDeliveryBinding({ schema_id: "dd-flow/delivery-policy@1", bindings: [selection.binding] }, selection.binding.selector);
+    if (binding.selector.operation !== flow || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(selection.operationId)
+        || !record(selection.artifact) || !keys(selection.artifact, ["subject_ref", "version", "sha256"])
+        || selection.artifact.subject_ref !== binding.selector.subject_ref || !text(selection.artifact.version) || !digest(selection.artifact.sha256))
+        refuse("exact_operation_scope_required");
+    const request = bundle.execution.snapshot().scope.requestId;
+    if (!text(request) || !digest(bundle.sha256))
+        refuse("original_request_required");
+    return { schema_id: "dd-flow/delivery-approval-scope@1", project_id: scope.projectId, run_id: scope.runId,
+        request_id: request, bundle_sha256: bundle.sha256, operation_id: selection.operationId, flow_id: flow,
+        binding_id: binding.id, binding_sha256: hybridDigest(binding), selector: binding.selector, artifact: structuredClone(selection.artifact) };
+}
+/** Custody and exact scope only: interpreting whether the cited user really
+ * approves this operation remains the owning agent/review's responsibility.
+ * Flow startup, a question or successful login never becomes approval here.
+ * This prepared value is not a publication token or dispatch authority. */
+export function prepareDeliveryApproval(context, scope, bundle, selection, proposal) {
+    if (!record(proposal) || !keys(proposal, ["scope_sha256", "user_inputs_sha256", "basis", "expires_at", "reason"])
+        || !digest(proposal.scope_sha256) || !digest(proposal.user_inputs_sha256) || !text(proposal.reason)
+        || !text(proposal.expires_at) || !record(proposal.basis) || !keys(proposal.basis, ["role", "event_id", "sha256"])
+        || !["request", "answer"].includes(proposal.basis.role) || !Number.isSafeInteger(proposal.basis.event_id)
+        || proposal.basis.event_id < 0 || !digest(proposal.basis.sha256))
+        refuse("invalid_approval_proposal");
+    const selected = deliveryApprovalScope(scope, bundle, selection), flow = selected.flow_id;
+    const users = readPreparedMemoryFlowUserInputs(context, scope, flow, bundle), inputsHash = hybridDigest(users);
+    if (proposal.scope_sha256 !== hybridDigest(selected))
+        refuse("approval_scope_mismatch");
+    if (proposal.user_inputs_sha256 !== inputsHash)
+        refuse("current_user_input_required");
+    const source = users.sources.find(item => item.role === proposal.basis.role && item.event_id === proposal.basis.event_id && item.sha256 === proposal.basis.sha256);
+    if (!source || proposal.basis.role === "request" && proposal.basis.event_id !== 0)
+        refuse("delivered_approval_basis_required");
+    const expiry = Date.parse(proposal.expires_at), approvedAt = context.now();
+    if (!Number.isFinite(expiry) || !Number.isFinite(Date.parse(approvedAt)) || expiry <= Date.parse(approvedAt))
+        refuse("approval_expired");
+    const value = { schema_id: "dd-flow/delivery-approval@1", scope: selected, scope_sha256: hybridDigest(selected),
+        user_inputs_sha256: inputsHash, approver: "delivered_user", basis: structuredClone(proposal.basis),
+        approved_at: approvedAt, expires_at: new Date(expiry).toISOString(), interpretation: proposal.reason };
+    return {
+        value: () => structuredClone(value),
+        /** SQL/data-only fence. A later answer (including revocation) invalidates
+         * the interpretation until the owning Stage reassesses the full input set. */
+        assertCustody(writer) {
+            if (hybridDigest(readPreparedMemoryFlowUserInputs(writer, scope, flow, bundle)) !== inputsHash)
+                refuse("approval_inputs_changed");
+            if (!Number.isFinite(Date.parse(writer.now())) || Date.parse(writer.now()) >= expiry)
+                refuse("approval_expired");
+        }
+    };
+}

package/dist/services/delivery-artifact.js

@@ -0,0 +1,86 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+function refuse(reason) {
+    throw new AppError("delivery_artifact_invalid", "Delivery requires the exact accepted artifact bytes", 2, { reason, phase: "prepare", effect: "no_effect", recoverable: true });
+}
+function observe(workspace, logicalPath) {
+    if (!path.isAbsolute(workspace) || typeof logicalPath !== "string" || !logicalPath || logicalPath.length > 4096
+        || logicalPath.includes("\\") || logicalPath.includes("\0") || path.isAbsolute(logicalPath)
+        || logicalPath.split("/").some(part => !part || part === "." || part === ".." || part === ".git"))
+        refuse("contained_artifact_required");
+    try {
+        if (fs.realpathSync(workspace) !== workspace || !fs.lstatSync(workspace).isDirectory())
+            refuse("canonical_workspace_required");
+        let file = workspace;
+        for (const part of logicalPath.split("/").slice(0, -1)) {
+            file = path.join(file, part);
+            if (!fs.lstatSync(file).isDirectory())
+                refuse("contained_artifact_required");
+        }
+        file = path.join(workspace, logicalPath);
+        if (!fs.lstatSync(file).isFile())
+            refuse("regular_artifact_required");
+        const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+        try {
+            const before = fs.fstatSync(fd, { bigint: true }), digest = createHash("sha256"), buffer = Buffer.allocUnsafe(256 * 1024);
+            if (!before.isFile())
+                refuse("regular_artifact_required");
+            let length = 0n;
+            for (;;) {
+                const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+                if (!count)
+                    break;
+                digest.update(buffer.subarray(0, count));
+                length += BigInt(count);
+            }
+            const after = fs.fstatSync(fd, { bigint: true }), named = fs.lstatSync(file, { bigint: true });
+            if (length !== before.size || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs
+                || !named.isFile() || named.dev !== before.dev || named.ino !== before.ino || fs.realpathSync(file) !== file)
+                refuse("artifact_changed_during_observation");
+            return { sha256: digest.digest("hex"), bytes: length.toString() };
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("artifact_unavailable");
+    }
+}
+/** Exact file/archive bytes, or a project-owned manifest selecting immutable
+ * remote artifacts. A manifest digest alone does not prove its remote objects:
+ * the owning verify Stage must establish those references before approval.
+ * Observation is synchronous and outside SQL writers, immediately before the
+ * managed admission fence; it is not an OS lock against a hostile local writer. */
+export class PreparedDeliveryArtifact {
+    #workspace;
+    #path;
+    #artifact;
+    #bytes;
+    constructor(workspace, logicalPath, artifact, bytes) {
+        this.#workspace = workspace;
+        this.#path = logicalPath;
+        this.#artifact = structuredClone(artifact);
+        this.#bytes = bytes;
+    }
+    static prepare(workspace, logicalPath, artifact) {
+        if (!artifact || Object.keys(artifact).sort().join() !== "sha256,subject_ref,version"
+            || typeof artifact.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(artifact.sha256)
+            || [artifact.subject_ref, artifact.version].some(value => typeof value !== "string" || !value.trim() || value.length > 4096 || value.includes("\0")))
+            refuse("accepted_artifact_required");
+        const actual = observe(workspace, logicalPath);
+        if (actual.sha256 !== artifact.sha256)
+            refuse("accepted_artifact_changed");
+        return new PreparedDeliveryArtifact(workspace, logicalPath, artifact, actual.bytes);
+    }
+    value() { return { schema_id: "dd-flow/delivery-artifact@1", workspace: this.#workspace, path: this.#path, artifact: structuredClone(this.#artifact), bytes: this.#bytes }; }
+    assertCurrent() {
+        const actual = observe(this.#workspace, this.#path);
+        if (actual.sha256 !== this.#artifact.sha256 || actual.bytes !== this.#bytes)
+            refuse("accepted_artifact_changed");
+    }
+}

package/dist/services/delivery-checks.js

@@ -0,0 +1,178 @@
+import { AppError } from "../shared/errors.js";
+import { readDeliveryStageScope } from "./delivery-stage-entry.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { readActiveDescriptorStageCoordinator, readAcceptedDescriptorStageSettlement } from "./descriptor-stage-settlement.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { prepareDeliveryProjectBinding } from "./delivery-policy.js";
+import { PreparedDeliveryArtifact } from "./delivery-artifact.js";
+import { deliveryApprovalScope } from "./delivery-approval.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { codeCheckProfileHash, projectPolicyCheckDeclarations, runCodeChecks, PreparedCheckEvidence, PreparedRetainedCheckEvidence } from "./code-checks.js";
+import { entityReferenceVariants } from "../shared/entity-references.js";
+import { stageLifecycleMatchKey } from "./hooks.js";
+import { assertDiagnosticSessionIndependence } from "./diagnostic-work-collection.js";
+import { memoryCheckEnvironment } from "./memory-verification-checks.js";
+function refuse(reason) {
+    throw new AppError("delivery_checks_invalid", "Delivery verification needs current project checks for the exact selected artifact", 2, { reason, effect: "no_effect" });
+}
+/** Compare actual provider Sessions, not model names or distinct logical IDs.
+ * Accepted generic settlement proves the author; current coordinator custody
+ * proves the verifier. Lifecycle match keys resolve paths before the writer. */
+export function prepareDeliveryVerifierIndependence(context, input) {
+    if (input.stage !== "verify" || context.db.isOwnedWriteTransaction?.())
+        refuse("verification_stage_required");
+    const selected = readDeliveryStageScope(context, input), { scope, bundle } = selected;
+    const stages = selected.flowId === "deploy" ? ["prepare", "deploy"] : ["prepare"];
+    const sources = stages.map(stage => ({ stage, keys: entityReferenceVariants(input.runId)
+            .map(reference => stageLifecycleMatchKey("stage_finish", reference, stage, input.projectRoot)) }));
+    const observe = (reader) => {
+        selected.assertCustody(reader);
+        const physical = (sessionId) => {
+            const session = reader.db.get("SELECT harness,provider_session_id FROM sessions WHERE project_id=? AND run_id=? AND session_id=?", [scope.projectId, scope.runId, sessionId]);
+            if (!session?.harness || !session.provider_session_id)
+                refuse("verification_physical_owner_required");
+            return session;
+        };
+        const verifier = readActiveDescriptorStageCoordinator(reader, scope, bundle);
+        const authors = sources.map(source => readAcceptedDescriptorStageSettlement(reader, { ...scope, stage: source.stage }, bundle, source.keys));
+        const verifierSession = physical(verifier.session_id), authorSessions = authors.map(author => physical(author.binding.sessionId));
+        assertDiagnosticSessionIndependence([verifierSession], authorSessions);
+        return { verifier, authors, verifierSession, authorSessions };
+    };
+    const original = observe(context);
+    return (writer) => {
+        if (hybridDigest(observe(writer)) !== hybridDigest(original))
+            refuse("verification_physical_owner_changed");
+    };
+}
+/** Downstream acceptance reuses the original accepted execution proof, not
+ * today's declarations, invented hashes or a new run of publication checks. */
+export function prepareDeliveryHistoricalChecks(context, input) {
+    if (context.db.isOwnedWriteTransaction?.())
+        refuse("preparation_outside_writer_required");
+    const selected = readDeliveryStageScope(context, input), { scope, bundle } = selected;
+    if (input.sourceStage !== (selected.flowId === "deploy" && input.stage === "deploy" ? "prepare" : "verify"))
+        refuse("accepted_verification_stage_required");
+    const keys = entityReferenceVariants(input.runId).map(reference => stageLifecycleMatchKey("stage_finish", reference, input.sourceStage, input.projectRoot));
+    const read = (reader) => {
+        const accepted = readAcceptedStageData(reader, { ...scope, stage: input.sourceStage });
+        const data = JSON.parse(accepted.bytes.toString("utf8"));
+        const rows = reader.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='delivery.stage_checks' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? LIMIT 2", [scope.projectId, scope.runId, input.sourceStage]);
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 1024 * 1024)
+            refuse("accepted_verification_required");
+        const value = JSON.parse(rows[0].payload_json), receipt = value.receipt;
+        if (data.schema_id !== "dd-flow/delivery-stage-result@1" || data.flow_id !== selected.flowId || data.run_id !== input.runId || data.stage !== input.sourceStage
+            || !receipt || value.sha256 !== hybridDigest(receipt) || value.sha256 !== data.details?.verification_sha256
+            || receipt.schema_id !== "dd-flow/delivery-checks@1" || receipt.run_id !== input.runId || receipt.stage !== input.sourceStage
+            || receipt.bundle_sha256 !== bundle.sha256 || receipt.input_sha256 !== data.input_sha256
+            || receipt.operation_scope_sha256 !== input.operationScopeSha256 || data.details.delivery_scope_sha256 !== input.operationScopeSha256
+            || !Array.isArray(receipt.checks) || !receipt.checks.length)
+            refuse("accepted_verification_changed");
+        return { accepted, value, owner: readAcceptedDescriptorStageSettlement(reader, { ...scope, stage: input.sourceStage }, bundle, keys) };
+    };
+    const original = read(context);
+    const proof = PreparedRetainedCheckEvidence.prepare(context, { ...scope, references: original.value.receipt.checks });
+    return { sha256: original.value.sha256, receipt: structuredClone(original.value.receipt),
+        revalidate() { proof.revalidate(context); },
+        assertCustody(writer) {
+            selected.assertCustody(writer);
+            proof.assertCustody(writer);
+            if (hybridDigest(read(writer)) !== hybridDigest(original))
+                refuse("accepted_verification_changed");
+        }
+    };
+}
+/** Immediately before an external effect, historical success is insufficient:
+ * the existing check owner must still match today's workspace and policy.
+ * This also catches an edited publish/deploy script with unchanged argv. */
+export function prepareDeliveryCurrentAcceptedChecks(context, input) {
+    const historical = prepareDeliveryHistoricalChecks(context, input), selected = readDeliveryStageScope(context, input);
+    if (!selected.run.run_root)
+        refuse("run_root_required");
+    const workspace = selected.bundle.execution.snapshot().scope.workspace;
+    const checks = [...projectPolicyCheckDeclarations(workspace, "code"), ...projectPolicyCheckDeclarations(workspace, "readiness")];
+    const environment = memoryCheckEnvironment(context, selected.scope.projectId, input.runId);
+    const proof = PreparedCheckEvidence.prepare(context, { projectId: selected.scope.projectId, runId: input.runId,
+        runHome: selected.run.run_root, workspaceRoot: workspace, scope: "aggregate", checks,
+        expectedProfileHash: historical.receipt.profile_sha256, evidenceContext: historical.receipt.evidence_context,
+        ...(environment ? { checkEnvironment: environment } : {}) });
+    if (!proof.qualityPassed() || hybridDigest(proof.retainedReferences(context)) !== hybridDigest(historical.receipt.checks))
+        refuse("accepted_verification_changed");
+    return {
+        revalidate() {
+            if (hybridDigest(memoryCheckEnvironment(context, selected.scope.projectId, input.runId) ?? null) !== hybridDigest(environment ?? null))
+                refuse("managed_check_home_changed");
+            historical.revalidate();
+            proof.revalidate(context);
+        },
+        assertCustody(writer) { historical.assertCustody(writer); proof.assertCustody(writer); }
+    };
+}
+/** The existing aggregate runner/check receipts, not model-reported tests.
+ * Declarations come from project policy, never the result being accepted.
+ * Semantic adequacy and independent verification remain Stage responsibilities. */
+export function prepareDeliveryChecks(context, input) {
+    if (context.db.isOwnedWriteTransaction?.() || !["prepare", "verify"].includes(input.stage))
+        refuse("verification_stage_required");
+    if (!input.artifact || typeof input.artifact !== "object" || Array.isArray(input.artifact))
+        refuse("accepted_artifact_selection_required");
+    const selected = readDeliveryStageScope(context, input), { scope, bundle } = selected;
+    const independent = input.stage === "verify" ? prepareDeliveryVerifierIndependence(context, input) : undefined;
+    const packet = readDescriptorStageInput(context, scope, bundle);
+    if (!packet.input.predecessor || !selected.run.run_root)
+        refuse("accepted_predecessor_required");
+    const previousStage = packet.input.predecessor.stage;
+    const previous = readAcceptedStageData(context, { ...scope, stage: previousStage });
+    const prior = JSON.parse(previous.bytes.toString("utf8"));
+    const decision = prior.details.decision;
+    if (!decision || input.stage !== "prepare" && hybridDigest(prior.details.artifact) !== hybridDigest(input.artifact))
+        refuse("accepted_artifact_selection_required");
+    const workspace = bundle.execution.snapshot().scope.workspace;
+    const policy = prepareDeliveryProjectBinding(workspace, decision.policy, decision.binding.selector);
+    if (hybridDigest(policy.binding) !== hybridDigest(decision.binding))
+        refuse("accepted_policy_changed");
+    const artifact = PreparedDeliveryArtifact.prepare(workspace, input.artifact.path, { subject_ref: input.artifact.subject_ref, version: input.artifact.version, sha256: input.artifact.sha256 });
+    if (input.artifact.version !== decision.version)
+        refuse("accepted_version_required");
+    const operation = deliveryApprovalScope(scope, bundle, { operationId: decision.operation_id, binding: policy.binding,
+        artifact: { subject_ref: input.artifact.subject_ref, version: input.artifact.version, sha256: input.artifact.sha256 } });
+    const checks = [...projectPolicyCheckDeclarations(workspace, "code"), ...projectPolicyCheckDeclarations(workspace, "readiness")];
+    if (!checks.length)
+        refuse("project_verification_checks_required");
+    const owner = readActiveDescriptorStageCoordinator(context, scope, bundle), profile = codeCheckProfileHash(workspace, checks);
+    const environment = memoryCheckEnvironment(context, scope.projectId, input.runId);
+    const evidenceContext = `delivery:${hybridDigest({ operation, stage: input.stage, input: packet.inputSha256, users: selected.userInputsSha256 })}`;
+    const command = { projectId: scope.projectId, runId: scope.runId, runHome: selected.run.run_root, workspaceRoot: workspace,
+        scope: "aggregate", checks, expectedProfileHash: profile, evidenceContext,
+        ...(environment ? { checkEnvironment: environment } : {}) };
+    const assertCustody = (writer) => {
+        selected.assertCustody(writer);
+        independent?.(writer);
+        if (hybridDigest(readDescriptorStageInput(writer, scope, bundle)) !== hybridDigest(packet)
+            || hybridDigest(readAcceptedStageData(writer, { ...scope, stage: previousStage })) !== hybridDigest(previous)
+            || hybridDigest(readActiveDescriptorStageCoordinator(writer, scope, bundle)) !== hybridDigest(owner))
+            refuse("verification_owner_or_inputs_changed");
+    };
+    const revalidate = () => {
+        assertCustody(context);
+        policy.assertCurrent();
+        artifact.assertCurrent();
+        if (hybridDigest(memoryCheckEnvironment(context, scope.projectId, input.runId) ?? null) !== hybridDigest(environment ?? null))
+            refuse("managed_check_home_changed");
+        if (codeCheckProfileHash(workspace, checks) !== profile)
+            refuse("verification_policy_changed");
+    };
+    revalidate();
+    return { operation: structuredClone(operation), artifact: structuredClone(input.artifact), assertCustody, revalidate,
+        async run() { revalidate(); const result = await runCodeChecks(context, command); revalidate(); return result; },
+        evidence() {
+            revalidate();
+            const proof = PreparedCheckEvidence.prepare(context, command);
+            if (!proof.qualityPassed())
+                refuse("verification_checks_failed");
+            return { proof, receipt: { schema_id: "dd-flow/delivery-checks@1", run_id: scope.runId, stage: input.stage,
+                    bundle_sha256: bundle.sha256, input_sha256: packet.inputSha256, operation_scope_sha256: hybridDigest(operation),
+                    evidence_context: evidenceContext, profile_sha256: profile, checks: proof.retainedReferences(context) } };
+        }
+    };
+}

package/dist/services/delivery-execution.js

@@ -0,0 +1,181 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { types } from "node:util";
+import { AppError } from "../shared/errors.js";
+import { prepareDeliveryProcedure } from "./delivery-procedures.js";
+import { managedLeaseMonitor } from "./managed-lease-monitor.js";
+import { physicalStartup } from "./physical-startup.js";
+import { registerManagedProcess, confirmManagedProcess, renewManagedProcess, finishManagedProcess, assertManagedProcessLease, processTreeIsAlive } from "./managed-processes.js";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
+const id = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+/** One step of an already retained delivery intent, not a public launcher or
+ * approval/retry policy. Reuse the ordinary process registry/lease/stop owners.
+ * No raw command output, environment values or argv enter logs or the registry. */
+export async function executeDeliveryStep(context, input) {
+    const procedure = prepareDeliveryProcedure(input.procedure, "execute"), step = procedure.procedure_steps.find(item => item.id === input.stepId);
+    if (context.db.isOwnedWriteTransaction?.() || !step || ![input.projectId, input.runId, input.operationId, input.stepId].every(id)
+        || typeof input.workspace !== "string" || !path.isAbsolute(input.workspace) || typeof input.assertCurrent !== "function" || typeof input.admit !== "function"
+        || typeof input.consumeOutput !== "function")
+        throw new AppError("delivery_execution_invalid", "Delivery execution requires its retained operation and owner fence", 2, { effect: "no_effect" });
+    if (input.deadlineAt !== undefined && (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now())) {
+        throw new AppError("delivery_execution_invalid", "The original procedure deadline has expired", 2, { effect: "no_effect" });
+    }
+    const assertCurrent = () => {
+        const value = input.assertCurrent();
+        if (types.isPromise(value)) {
+            void value.catch(() => { });
+            throw new AppError("delivery_execution_invalid", "Delivery owner fences must complete synchronously", 2, { effect: "no_effect" });
+        }
+    };
+    try {
+        assertCurrent();
+    }
+    catch {
+        throw new AppError("delivery_execution_invalid", "Delivery owner fence refused before process allocation", 2, { effect: "no_effect" });
+    }
+    let record = registerManagedProcess(context, { kind: "delivery", ownerId: input.operationId, projectId: input.projectId,
+        runId: input.runId, operationId: `${input.operationId}:${input.stepId}`, ownerPid: process.pid, uniqueActiveOperation: true });
+    const lease = managedLeaseMonitor(attemptMs => renewManagedProcess({ ...context, databaseDeadlineAt: Date.now() + attemptMs }, { id: record.id, leaseToken: record.lease_token }), record.lease_expires_at);
+    let admitted = false, completed = false, settled = false, frame, outputSize = 0, publicBytes = 0, publicText = "";
+    const chunks = [];
+    const internalFailures = new WeakSet();
+    let interrupt;
+    const interrupted = new Promise((_resolve, reject) => { interrupt = reject; });
+    void interrupted.catch(() => { });
+    const failure = (reason) => {
+        const error = new AppError("delivery_execution_failed", "Delivery command requires original-operation reconciliation", 1, { reason, process_id: record.id, operation_id: input.operationId, step_id: input.stepId,
+            effect: admitted && procedure.side_effect === "mutation" && !(settled && frame?.started === false && frame.error === "spawn_failed") ? "unknown" : "no_effect" });
+        internalFailures.add(error);
+        return error;
+    };
+    let ready;
+    const readiness = new Promise(resolve => { ready = resolve; });
+    const child = spawn(process.execPath, [fileURLToPath(new URL("../harness-runtime/lib/delivery-command.mjs", import.meta.url))], { cwd: input.workspace, env: {}, detached: process.platform !== "win32", windowsHide: true, stdio: ["pipe", "pipe", "pipe", "pipe", "pipe"] });
+    child.once("error", () => interrupt(failure("wrapper_spawn_failed")));
+    const closed = new Promise(resolve => child.once("close", () => { if (!completed)
+        interrupt(failure("wrapper_closed_before_result")); resolve(); }));
+    for (const stream of child.stdio)
+        stream?.on("error", () => interrupt(failure("transport_unavailable")));
+    child.stderr.resume();
+    child.stdout.on("data", bytes => {
+        publicBytes += bytes.length;
+        if (publicBytes > 8192) {
+            interrupt(failure("unbounded_transport_frame"));
+            return;
+        }
+        publicText += bytes.toString("utf8");
+        while (publicText.includes("\n")) {
+            const end = publicText.indexOf("\n"), line = publicText.slice(0, end);
+            publicText = publicText.slice(end + 1);
+            try {
+                const value = JSON.parse(line);
+                if (value.operation_id !== input.operationId || value.step_id !== input.stepId)
+                    throw new Error();
+                if (value.schema_id === "dd-flow/delivery-command-ready@1" && !admitted && !completed)
+                    ready();
+                else if (value.schema_id === "dd-flow/delivery-command-result@1" && !completed) {
+                    frame = value;
+                    completed = true;
+                }
+                else
+                    throw new Error();
+            }
+            catch {
+                interrupt(failure("invalid_transport_frame"));
+            }
+        }
+    });
+    child.stdio[4].on("data", (bytes) => {
+        outputSize += bytes.length;
+        if (outputSize > 1024 * 1024) {
+            interrupt(failure("unbounded_private_output"));
+            return;
+        }
+        chunks.push(Buffer.from(bytes));
+    });
+    const deadline = Math.min(Date.now() + procedure.timeout_ms, input.deadlineAt ?? Infinity);
+    const timeout = setTimeout(() => interrupt(failure("timeout")), Math.max(1, deadline - Date.now()));
+    const heartbeat = setInterval(() => lease.background(assertCurrent, () => interrupt(failure("owner_unconfirmed"))), 5000);
+    let terminalError;
+    try {
+        child.stdio[3].end(JSON.stringify({ schema_id: "dd-flow/delivery-command@1", operation_id: input.operationId,
+            step_id: input.stepId, argv: step.argv, permitted_environment_variables: procedure.permitted_environment_variables,
+            environment: Object.fromEntries(procedure.permitted_environment_variables.filter(name => context.env[name] !== undefined).map(name => [name, context.env[name]])) }));
+        await Promise.race([readiness, interrupted]);
+        record = await physicalStartup(Math.min(deadline, context.databaseDeadlineAt ?? deadline)).observe(() => confirmManagedProcess(context, { id: record.id, leaseToken: record.lease_token, pid: child.pid,
+            ...(process.platform === "win32" ? {} : { processGroupId: child.pid }), ownerPid: process.pid }), () => { assertCurrent(); if (child.exitCode !== null || child.signalCode !== null)
+            throw failure("wrapper_closed_before_result"); }, record.lease_expires_at);
+        await Promise.race([lease.ensureConfirmed(assertCurrent), interrupted]);
+        assertCurrent();
+        assertManagedProcessLease(context, { id: record.id, leaseToken: record.lease_token, pid: child.pid });
+        const admission = input.admit(record);
+        if (types.isPromise(admission)) {
+            void admission.catch(() => { });
+            throw failure("asynchronous_admission_refused");
+        }
+        lease.assertNoRenewal();
+        assertCurrent();
+        if (Date.now() >= deadline)
+            throw failure("timeout");
+        admitted = true;
+        child.stdin.end("admitted\n");
+        await Promise.race([closed, interrupted]);
+        if (frame?.admitted === true && frame.started === false && frame.error === "spawn_failed")
+            throw failure("command_spawn_failed");
+        if (!frame || frame.admitted !== true || frame.started !== true || frame.error !== null || frame.exit_code !== 0
+            || frame.signal !== null || frame.output_available !== true || frame.stdout_truncated !== false)
+            throw failure("command_unsuccessful");
+    }
+    catch (error) {
+        terminalError = error;
+    }
+    finally {
+        clearTimeout(timeout);
+        clearInterval(heartbeat);
+        lease.close();
+        try {
+            await stopProcessGroup(child, 1000, { detached: process.platform !== "win32" });
+            if (processTreeIsAlive(record))
+                terminalError = failure("process_tree_unsettled");
+            else if (!finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped",
+                reason: terminalError ? "delivery_command_failed" : "delivery_command_exited" }))
+                terminalError = failure("process_owner_changed");
+            else
+                settled = true;
+        }
+        catch {
+            terminalError = failure("process_tree_unsettled");
+        }
+    }
+    if (terminalError) {
+        chunks.length = 0;
+        throw failure(terminalError instanceof AppError && internalFailures.has(terminalError)
+            ? String(terminalError.details.reason) : "owner_or_execution_failed");
+    }
+    try {
+        assertCurrent();
+    }
+    catch {
+        chunks.length = 0;
+        throw failure("owner_or_execution_failed");
+    }
+    const bytes = Buffer.concat(chunks);
+    chunks.length = 0;
+    try {
+        const projection = input.consumeOutput(bytes);
+        if (types.isPromise(projection)) {
+            void projection.catch(() => { });
+            throw failure("output_projection_failed");
+        }
+    }
+    catch {
+        throw failure("output_projection_failed");
+    }
+    finally {
+        bytes.fill(0);
+    }
+    return { process_id: record.id, operation_id: input.operationId, step_id: input.stepId, outcome: "command_succeeded",
+        // Exit zero is not publication/deployment readback or permission to repeat.
+        effect: procedure.side_effect === "mutation" ? "unknown" : "no_effect" };
+}