@dsh-enhanced/plugin-control-plane 0.1.65 → 0.1.67

package/lib/creation-capability-empty-handoff.js

@@ -0,0 +1,147 @@
+import { encode, freeze, handoffPrimitives, hash } from './creation-capability-handoff-common.js';
+const PROTOCOL = 'dsh-empty-creation-adoption-handoff/v1';
+const AUDIT = 'creation_empty_authority_handoff';
+const AUDIT_SQL = `CREATE TABLE ${AUDIT} (singleton INTEGER PRIMARY KEY CHECK(singleton=1), proof_json TEXT NOT NULL, proof_digest TEXT NOT NULL CHECK(length(proof_digest)=64)) STRICT`;
+const NO_UPDATE = `CREATE TRIGGER creation_empty_handoff_no_update BEFORE UPDATE ON ${AUDIT} BEGIN SELECT RAISE(ABORT,'immutable empty authority handoff'); END`;
+const NO_DELETE = `CREATE TRIGGER creation_empty_handoff_no_delete BEFORE DELETE ON ${AUDIT} BEGIN SELECT RAISE(ABORT,'immutable empty authority handoff'); END`;
+function fail(message) { throw new Error(`empty adoption authority handoff: ${message}`); }
+const common = handoffPrimitives(fail);
+const { identity, bytes, identities, textRows, authority, empty, openExisting, exact } = common;
+const AUDIT_SCHEMA = { table: AUDIT, statements: [AUDIT_SQL, NO_UPDATE, NO_DELETE] };
+const schema = (db, audited) => common.schema(db, AUDIT_SCHEMA, audited);
+function planBody(plan) { const { digest: _digest, ...body } = plan; return body; }
+function validatePlan(plan) {
+    exact(plan, ['protocol', 'transactionId', 'hostAnchor', 'physicalPath', 'oldIdentity', 'nextIdentity', 'snapshot', 'createdAt', 'expiresAt', 'digest']);
+    for (const identity of [plan.oldIdentity, plan.nextIdentity])
+        exact(identity, ['logicalPath', 'config', 'authorityDigest', 'publicKey', 'keyFingerprint']);
+    if (plan.physicalPath === plan.oldIdentity.logicalPath)
+        fail('staged copy must be separate from logical source');
+    exact(plan.snapshot, ['identity', 'bytes', 'digest']);
+    exact(plan.snapshot.identity, ['dev', 'ino', 'uid', 'gid', 'mode', 'nlink']);
+    if (!plan || plan.protocol !== PROTOCOL || plan.digest !== hash(planBody(plan))
+        || !/^[a-f0-9]{64}$/u.test(plan.hostAnchor) || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/u.test(plan.transactionId)
+        || !Number.isSafeInteger(plan.createdAt) || !Number.isSafeInteger(plan.expiresAt)
+        || plan.createdAt < 1 || plan.expiresAt <= plan.createdAt || plan.expiresAt - plan.createdAt > 300_000
+        || plan.expiresAt > Math.min(plan.oldIdentity.config.expiresAt, plan.nextIdentity.config.expiresAt, plan.oldIdentity.config.runner.expiresAt, plan.nextIdentity.config.runner.expiresAt))
+        fail('invalid plan');
+    const actual = identities(plan.oldIdentity.logicalPath, plan.oldIdentity.config, plan.nextIdentity.config);
+    if (encode(actual) !== encode({ oldIdentity: plan.oldIdentity, nextIdentity: plan.nextIdentity }))
+        fail('public identity changed');
+}
+export function planEmptyAdoptionHandoff(scope) {
+    const pair = identities(scope.logicalPath, scope.oldConfig, scope.nextConfig);
+    const body = { protocol: PROTOCOL, transactionId: scope.transactionId, hostAnchor: scope.hostAnchor,
+        physicalPath: scope.physicalPath, ...pair, snapshot: bytes(scope.physicalPath, 64 * 1024 * 1024), createdAt: scope.now, expiresAt: scope.expiresAt };
+    const plan = { ...body, digest: hash(body) };
+    validatePlan(plan);
+    if (scope.now >= Math.min(scope.oldConfig.expiresAt, scope.nextConfig.expiresAt, scope.oldConfig.runner.expiresAt, scope.nextConfig.runner.expiresAt) || scope.expiresAt > Math.min(scope.oldConfig.expiresAt, scope.nextConfig.expiresAt, scope.oldConfig.runner.expiresAt, scope.nextConfig.runner.expiresAt))
+        fail('expired grant or plan');
+    openExisting(scope.physicalPath, db => {
+        db.exec('BEGIN');
+        try {
+            schema(db, false);
+            authority(db, pair.oldIdentity);
+            empty(db);
+            if (encode(bytes(scope.physicalPath, 64 * 1024 * 1024)) !== encode(plan.snapshot))
+                fail('plan snapshot drift');
+        }
+        finally {
+            db.exec('ROLLBACK');
+        }
+    });
+    return freeze(plan);
+}
+function storedProof(db, plan) {
+    schema(db, true);
+    const rows = textRows(db, AUDIT, ['proof_json', 'proof_digest']);
+    if (rows.length !== 1 || typeof rows[0].proof_json !== 'string')
+        fail('missing immutable proof');
+    const proof = JSON.parse(rows[0].proof_json);
+    exact(proof, ['protocol', 'plan', 'fileIdentity', 'emptyBusiness', 'digest']);
+    exact(proof.fileIdentity, ['dev', 'ino', 'uid', 'gid', 'mode', 'nlink']);
+    exact(proof.emptyBusiness, ['adoptions', 'calls', 'sourceArchives']);
+    if (encode(proof) !== rows[0].proof_json)
+        fail('noncanonical proof JSON');
+    const { digest: _digest, ...body } = proof;
+    if (proof.protocol !== PROTOCOL || proof.digest !== hash(body) || proof.digest !== rows[0].proof_digest
+        || encode(proof.plan) !== encode(plan) || encode(proof.fileIdentity) !== encode(plan.snapshot.identity)
+        || encode(proof.emptyBusiness) !== encode({ adoptions: 0, calls: 0, sourceArchives: 0 }))
+        fail('proof mismatch');
+    authority(db, plan.nextIdentity);
+    return proof;
+}
+export function applyEmptyAdoptionHandoff(plan, input) {
+    validatePlan(plan);
+    if (plan.digest !== input.expectedPlanDigest || plan.hostAnchor !== input.expectedHostAnchor)
+        fail('external plan anchor mismatch');
+    const now = input.now;
+    if (!Number.isSafeInteger(now) || now < plan.createdAt)
+        fail('invalid apply time');
+    return openExisting(plan.physicalPath, db => {
+        db.exec('PRAGMA synchronous=FULL; BEGIN IMMEDIATE');
+        try {
+            if (db.prepare('SELECT name FROM sqlite_master WHERE name=?').get(AUDIT)) {
+                const proof = storedProof(db, plan);
+                empty(db); // stopped empty acknowledgement only, never a new handoff
+                if (encode(identity(plan.physicalPath)) !== encode(proof.fileIdentity))
+                    fail('retry file identity mismatch');
+                db.exec('ROLLBACK');
+                return freeze(proof);
+            }
+            if (!Number.isSafeInteger(now) || now < plan.createdAt || now > plan.expiresAt)
+                fail('stale plan');
+            schema(db, false);
+            authority(db, plan.oldIdentity);
+            empty(db);
+            if (encode(bytes(plan.physicalPath, 64 * 1024 * 1024)) !== encode(plan.snapshot))
+                fail('apply snapshot drift');
+            const result = db.prepare('UPDATE authority SET authority_digest=?,config_json=? WHERE authority_id=? AND authority_digest=? AND key_id=? AND public_key=? AND config_json=?')
+                .run(plan.nextIdentity.authorityDigest, encode(plan.nextIdentity.config), plan.oldIdentity.config.authorityId, plan.oldIdentity.authorityDigest, plan.oldIdentity.config.keyId, plan.oldIdentity.publicKey, encode(plan.oldIdentity.config));
+            if (result.changes !== 1)
+                fail('authority compare-and-swap failed');
+            if (encode(identity(plan.physicalPath)) !== encode(plan.snapshot.identity))
+                fail('apply file identity drift');
+            const body = { protocol: PROTOCOL, plan: structuredClone(plan), fileIdentity: identity(plan.physicalPath),
+                emptyBusiness: { adoptions: 0, calls: 0, sourceArchives: 0 } };
+            const proof = { ...body, digest: hash(body) };
+            db.exec(`${AUDIT_SQL};${NO_UPDATE};${NO_DELETE};`);
+            db.prepare(`INSERT INTO ${AUDIT} VALUES (1,?,?)`).run(encode(proof), proof.digest);
+            schema(db, true);
+            authority(db, plan.nextIdentity);
+            empty(db);
+            if (encode(identity(plan.physicalPath)) !== encode(plan.snapshot.identity))
+                fail('commit file identity drift');
+            db.exec('COMMIT');
+            return freeze(proof);
+        }
+        catch (error) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }, true);
+}
+/** Stopped-stage / post-cutover BEFORE START acceptance only: prove current emptiness again.
+ * Do not call this after ordinary Host work begins. Later legitimate business is governed by
+ * the normal constructor; a general historical proof reader is outside this empty-only API.
+ * Rename on the same inode is allowed; copying needs a separate authorized contract. */
+export function verifyEmptyAdoptionHandoff(input) {
+    validatePlan(input.plan);
+    return openExisting(input.physicalPath, db => {
+        db.exec('BEGIN');
+        try {
+            const proof = storedProof(db, input.plan);
+            empty(db);
+            if (proof.digest !== input.expectedProofDigest || !/^[a-f0-9]{64}$/u.test(input.expectedProofDigest)
+                || encode(identity(input.physicalPath)) !== encode(proof.fileIdentity))
+                fail('external anchor or file identity mismatch');
+            return freeze(proof);
+        }
+        finally {
+            db.exec('ROLLBACK');
+        }
+    });
+}
+//# sourceMappingURL=creation-capability-empty-handoff.js.map

package/lib/creation-capability-empty-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"creation-capability-empty-handoff.js","sourceRoot":"","sources":["../src/creation-capability-empty-handoff.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAC3B,MAAM,yCAAyC,CAAA;AAGpE,MAAM,QAAQ,GAAG,wCAAiD,CAAA;AAClE,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,SAAS,GAAG,gBAAgB,KAAK,iJAAiJ,CAAA;AACxL,MAAM,SAAS,GAAG,oEAAoE,KAAK,qEAAqE,CAAA;AAChK,MAAM,SAAS,GAAG,oEAAoE,KAAK,qEAAqE,CAAA;AAChK,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AACzG,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;AACtC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;AAC/F,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAA;AACpF,MAAM,MAAM,GAAG,CAAC,EAAgB,EAAE,OAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAA;AAkC/F,SAAS,QAAQ,CAAC,IAAuB,IAAI,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAA,CAAC,CAAC;AACrG,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAC,eAAe,EAAC,YAAY,EAAC,cAAc,EAAC,aAAa,EAAC,cAAc,EAAC,UAAU,EAAC,WAAW,EAAC,WAAW,EAAC,QAAQ,CAAC,CAAC,CAAA;IAC9I,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAC,QAAQ,EAAC,iBAAiB,EAAC,WAAW,EAAC,gBAAgB,CAAC,CAAC,CAAA;IACtJ,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,WAAW,CAAC,WAAW;QAAE,IAAI,CAAC,kDAAkD,CAAC,CAAA;IAChH,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,CAAA;IACnD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WAC1E,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WAC5G,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;WAC9E,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO;WACnG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAChG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9G,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC1G,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;AACpI,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,KAAyB;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QACjG,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;IACtJ,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACnF,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EAC7E,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EACtJ,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACvG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;QACpC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChB,IAAI,CAAC;YAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACjE,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAChH,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;IACnC,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;AACrB,CAAC;AACD,SAAS,WAAW,CAAC,EAAgB,EAAE,IAAuB;IAC5D,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAA;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAW,CAAuB,CAAA;IACpE,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAC,MAAM,EAAC,cAAc,EAAC,eAAe,EAAC,QAAQ,CAAC,CAAC,CAAA;IACzE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IACnE,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,WAAW,EAAC,OAAO,EAAC,gBAAgB,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAC1E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,YAAY;WACnG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACpG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAClH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IAChC,OAAO,KAAK,CAAA;AACd,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,IAAuB,EAAE,KAA8E;IAC/I,YAAY,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACnI,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAClF,OAAO,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;QAC1C,EAAE,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;gBACnC,KAAK,CAAC,EAAE,CAAC,CAAA,CAAC,0DAA0D;gBACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;gBAC5G,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAClG,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;YAC9G,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,mJAAmJ,CAAC;iBAC3K,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,EAC3G,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;YACjI,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;YACnE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAC7G,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;gBACvG,aAAa,EAAE,EAAE,SAAS,EAAE,CAAU,EAAE,KAAK,EAAE,CAAU,EAAE,cAAc,EAAE,CAAU,EAAE,EAAE,CAAA;YAC3F,MAAM,KAAK,GAAuB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;YACjE,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,SAAS,GAAG,CAAC,CAAA;YAClD,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,iBAAiB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAClF,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;YAC9G,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACjB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAAC,MAAM,KAAK,CAAA;QAAC,CAAC;IACtE,CAAC,EAAE,IAAI,CAAC,CAAA;AACV,CAAC;AACD;;;wFAGwF;AACxF,MAAM,UAAU,0BAA0B,CAAC,KAAqF;IAC9H,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;QAC3C,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,KAAK,CAAC,EAAE,CAAC,CAAA;YACT,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;mBAC/F,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;gBAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;YAC3H,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/creation-capability-execution.d.ts

@@ -0,0 +1,13 @@
+import { type PluginCreationVerificationCertificate, type PluginRevisionVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
+import type { CreationCapabilityConfig } from './creation-capability-types.js';
+export declare function validateLinuxCreationCapabilityRunner(value: unknown): void;
+/** Exact protocol/backend identity; build provenance is separately read below. */
+export declare function creationCapabilityExecutionMatches(certificate: PluginCreationVerificationCertificate, runner: CreationCapabilityConfig['runner']): boolean;
+/** Exact protocol/backend identity of an independently verified revision artifact. */
+export declare function revisionCapabilityExecutionMatches(certificate: PluginCreationVerificationCertificate | PluginRevisionVerificationCertificate, runner: CreationCapabilityConfig['runner']): boolean;
+/** Read-only proof that a revision artifact still matches its fixed execution boundary. */
+export declare function verifyRevisionCapabilityExecution(certificate: PluginRevisionVerificationCertificate, runner: CreationCapabilityConfig['runner'], signal: AbortSignal): Promise<void>;
+/** Read-only proof for adoption, restore and each invocation. It cannot rebuild
+ * the original source or acquire/refund any execution or adoption grant. */
+export declare function verifyCreationCapabilityExecution(certificate: PluginCreationVerificationCertificate, runner: CreationCapabilityConfig['runner'], signal: AbortSignal): Promise<void>;
+//# sourceMappingURL=creation-capability-execution.d.ts.map

package/lib/creation-capability-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creation-capability-execution.d.ts","sourceRoot":"","sources":["../src/creation-capability-execution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,qCAAqC,EACtE,KAAK,qCAAqC,EAAE,MAAM,yCAAyC,CAAA;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAS9E,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAS1E;AAED,kFAAkF;AAClF,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,qCAAqC,EACnG,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAarD;AAED,sFAAsF;AACtF,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,qCAAqC,GAAG,qCAAqC,EAC3I,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAQrD;AAED,2FAA2F;AAC3F,wBAAsB,iCAAiC,CAAC,WAAW,EAAE,qCAAqC,EACxG,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhF;AAED;4EAC4E;AAC5E,wBAAsB,iCAAiC,CAAC,WAAW,EAAE,qCAAqC,EACxG,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhF"}

package/lib/creation-capability-execution.js

@@ -0,0 +1,112 @@
+import { createRequire } from 'node:module';
+import { nativeMacRuntimeDigest } from '@dsh-enhanced/assistant-isolation';
+import { canonicalGrowthJson } from '@dsh-enhanced/assistant-growth-contract';
+// Verifier is optional for a plain Control Plane deployment. Only explicit
+// Linux adoption loads these synchronous, resource-free validation modules.
+// The supported Node baseline can require ESM without top-level await.
+const requireVerifier = createRequire(import.meta.url);
+const linuxRuntimeModule = () => requireVerifier('@dsh-enhanced/assistant-verifier/linux-behavior-runtime');
+export function validateLinuxCreationCapabilityRunner(value) {
+    if (!value || typeof value !== 'object' || Object.getOwnPropertyDescriptor(value, 'backend')?.value !== 'linux-native') {
+        throw new Error('created capability requires explicit Linux runner configuration');
+    }
+    const { validateCreationBehaviorDeploymentConfig } = requireVerifier('@dsh-enhanced/assistant-verifier/plugin-behavior-config');
+    const checked = validateCreationBehaviorDeploymentConfig(value);
+    if (!('backend' in checked) || checked.backend !== 'linux-native')
+        throw new Error('created capability Linux runner changed');
+    linuxRuntimeModule().validateLinuxPluginBehaviorRuntime(checked.runtime);
+}
+/** Exact protocol/backend identity; build provenance is separately read below. */
+export function creationCapabilityExecutionMatches(certificate, runner) {
+    try {
+        if (certificate.protocol === 'assistant-growth/creation-verification/v1')
+            return !('backend' in runner);
+        if (certificate.protocol === 'assistant-growth/creation-verification/v2') {
+            return 'backend' in runner && runner.backend === 'macos-seatbelt'
+                && certificate.execution?.boundary === 'macos-seatbelt-single-process-v1'
+                && certificate.execution.runtimeDigest === nativeMacRuntimeDigest(runner.runtime);
+        }
+        return certificate.protocol === 'assistant-growth/creation-verification/v3'
+            && 'backend' in runner && runner.backend === 'linux-native'
+            && certificate.execution?.boundary === 'linux-native-process-seccomp-v1'
+            && certificate.execution.runtimeDigest === linuxRuntimeModule().linuxPluginBehaviorRuntimeDigest(runner.runtime);
+    }
+    catch {
+        return false;
+    }
+}
+/** Exact protocol/backend identity of an independently verified revision artifact. */
+export function revisionCapabilityExecutionMatches(certificate, runner) {
+    try {
+        if (certificate.protocol === 'assistant-growth/revision-verification/v1')
+            return !('backend' in runner);
+        return certificate.protocol === 'assistant-growth/revision-verification/v2'
+            && 'backend' in runner && runner.backend === 'linux-native'
+            && certificate.execution?.boundary === 'linux-native-process-seccomp-v1'
+            && certificate.execution.runtimeDigest === linuxRuntimeModule().linuxPluginBehaviorRuntimeDigest(runner.runtime);
+    }
+    catch {
+        return false;
+    }
+}
+/** Read-only proof that a revision artifact still matches its fixed execution boundary. */
+export async function verifyRevisionCapabilityExecution(certificate, runner, signal) {
+    signal.throwIfAborted();
+    if (!revisionCapabilityExecutionMatches(certificate, runner))
+        throw new Error('revision capability verification runtime changed');
+    if (!('backend' in runner) || runner.backend !== 'linux-native')
+        return;
+    const snapshot = canonicalGrowthJson({ certificate, runner });
+    const pinnedCertificate = structuredClone(certificate), pinnedRunner = structuredClone(runner);
+    if (canonicalGrowthJson({ certificate: pinnedCertificate, runner: pinnedRunner }) !== snapshot)
+        throw new Error('revision capability Linux inputs changed during snapshot');
+    if (pinnedCertificate.execution?.boundary !== 'linux-native-process-seccomp-v1')
+        throw new Error('revision capability Linux provenance unavailable');
+    const remaining = pinnedRunner.expiresAt - Date.now();
+    if (remaining <= 0)
+        throw new Error('revision capability Linux runner expired');
+    const bounded = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, Math.min(120_000, remaining)))]);
+    const { verifyLinuxPluginBehaviorAdoptionRuntime } = await import('@dsh-enhanced/assistant-verifier/linux-behavior-runtime');
+    bounded.throwIfAborted();
+    await verifyLinuxPluginBehaviorAdoptionRuntime({ runtime: pinnedRunner.runtime,
+        buildRuntimeDigest: pinnedCertificate.execution.buildRuntimeDigest,
+        preparationDigest: pinnedCertificate.execution.observerPreparationDigest, signal: bounded });
+    bounded.throwIfAborted();
+    if (Date.now() >= pinnedRunner.expiresAt || canonicalGrowthJson({ certificate, runner }) !== snapshot
+        || !revisionCapabilityExecutionMatches(certificate, runner)) {
+        throw new Error('revision capability Linux runtime authority changed');
+    }
+}
+/** Read-only proof for adoption, restore and each invocation. It cannot rebuild
+ * the original source or acquire/refund any execution or adoption grant. */
+export async function verifyCreationCapabilityExecution(certificate, runner, signal) {
+    signal.throwIfAborted();
+    if (!creationCapabilityExecutionMatches(certificate, runner))
+        throw new Error('created capability verification runtime changed');
+    if (!('backend' in runner) || runner.backend !== 'linux-native')
+        return;
+    // Keep both the complete signed input and deployment authority stable across
+    // import/file/hash awaits. Clone without sorting keys: runtime digests retain
+    // the descriptor's validated JSON property order.
+    const snapshot = canonicalGrowthJson({ certificate, runner });
+    const pinnedCertificate = structuredClone(certificate), pinnedRunner = structuredClone(runner);
+    if (canonicalGrowthJson({ certificate: pinnedCertificate, runner: pinnedRunner }) !== snapshot)
+        throw new Error('created capability Linux inputs changed during snapshot');
+    if (pinnedCertificate.execution?.boundary !== 'linux-native-process-seccomp-v1')
+        throw new Error('created capability Linux provenance unavailable');
+    const remaining = pinnedRunner.expiresAt - Date.now();
+    if (remaining <= 0)
+        throw new Error('created capability Linux runner expired');
+    const bounded = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, Math.min(120_000, remaining)))]);
+    const { verifyLinuxPluginBehaviorAdoptionRuntime } = await import('@dsh-enhanced/assistant-verifier/linux-behavior-runtime');
+    bounded.throwIfAborted();
+    await verifyLinuxPluginBehaviorAdoptionRuntime({ runtime: pinnedRunner.runtime,
+        buildRuntimeDigest: pinnedCertificate.execution.buildRuntimeDigest,
+        preparationDigest: pinnedCertificate.execution.observerPreparationDigest, signal: bounded });
+    bounded.throwIfAborted();
+    if (Date.now() >= pinnedRunner.expiresAt || canonicalGrowthJson({ certificate, runner }) !== snapshot
+        || !creationCapabilityExecutionMatches(certificate, runner)) {
+        throw new Error('created capability Linux runtime authority changed');
+    }
+}
+//# sourceMappingURL=creation-capability-execution.js.map

package/lib/creation-capability-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"creation-capability-execution.js","sourceRoot":"","sources":["../src/creation-capability-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EACkB,MAAM,yCAAyC,CAAA;AAG7F,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACtD,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,yDAAyD,CAChC,CAAA;AAE1E,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,KAAK,cAAc,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,EAAE,wCAAwC,EAAE,GAAG,eAAe,CAAC,yDAAyD,CACpD,CAAA;IAC1E,MAAM,OAAO,GAAG,wCAAwC,CAAC,KAAK,CAAC,CAAA;IAC/D,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC7H,kBAAkB,EAAE,CAAC,kCAAkC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC1E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kCAAkC,CAAC,WAAkD,EACnG,MAA0C;IAC1C,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,QAAQ,KAAK,2CAA2C;YAAE,OAAO,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;QACvG,IAAI,WAAW,CAAC,QAAQ,KAAK,2CAA2C,EAAE,CAAC;YACzE,OAAO,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,gBAAgB;mBAC5D,WAAW,CAAC,SAAS,EAAE,QAAQ,KAAK,kCAAkC;mBACtE,WAAW,CAAC,SAAS,CAAC,aAAa,KAAK,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,KAAK,2CAA2C;eACtE,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;eACxD,WAAW,CAAC,SAAS,EAAE,QAAQ,KAAK,iCAAiC;eACrE,WAAW,CAAC,SAAS,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC,gCAAgC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kCAAkC,CAAC,WAA0F,EAC3I,MAA0C;IAC1C,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,QAAQ,KAAK,2CAA2C;YAAE,OAAO,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;QACvG,OAAO,WAAW,CAAC,QAAQ,KAAK,2CAA2C;eACtE,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;eACxD,WAAW,CAAC,SAAS,EAAE,QAAQ,KAAK,iCAAiC;eACrE,WAAW,CAAC,SAAS,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC,gCAAgC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,WAAkD,EACxG,MAA0C,EAAE,MAAmB;IAC/D,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,CAAC,kCAAkC,CAAC,WAAW,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACjI,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;QAAE,OAAM;IACvE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7D,MAAM,iBAAiB,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9F,IAAI,mBAAmB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,KAAK,QAAQ;QAC5F,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,KAAK,iCAAiC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACpJ,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACrD,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzG,MAAM,EAAE,wCAAwC,EAAE,GAAG,MAAM,MAAM,CAAC,yDAAyD,CAAC,CAAA;IAC5H,OAAO,CAAC,cAAc,EAAE,CAAA;IACxB,MAAM,wCAAwC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO;QAC5E,kBAAkB,EAAE,iBAAiB,CAAC,SAAS,CAAC,kBAAkB;QAClE,iBAAiB,EAAE,iBAAiB,CAAC,SAAS,CAAC,yBAAyB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9F,OAAO,CAAC,cAAc,EAAE,CAAA;IACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,QAAQ;WAChG,CAAC,kCAAkC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,WAAkD,EACxG,MAA0C,EAAE,MAAmB;IAC/D,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,CAAC,kCAAkC,CAAC,WAAW,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAChI,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;QAAE,OAAM;IACvE,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7D,MAAM,iBAAiB,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9F,IAAI,mBAAmB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,KAAK,QAAQ;QAC5F,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,KAAK,iCAAiC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACnJ,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACrD,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzG,MAAM,EAAE,wCAAwC,EAAE,GAAG,MAAM,MAAM,CAAC,yDAAyD,CAAC,CAAA;IAC5H,OAAO,CAAC,cAAc,EAAE,CAAA;IACxB,MAAM,wCAAwC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO;QAC5E,kBAAkB,EAAE,iBAAiB,CAAC,SAAS,CAAC,kBAAkB;QAClE,iBAAiB,EAAE,iBAAiB,CAAC,SAAS,CAAC,yBAAyB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9F,OAAO,CAAC,cAAc,EAAE,CAAA;IACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,QAAQ;WAChG,CAAC,kCAAkC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/lib/creation-capability-feedback.d.ts

@@ -1,6 +1,6 @@
 import type { AssistantDeliveryService } from '@dsh-enhanced/assistant-delivery';
 import type { AssistantEvaluationService, EvaluationCanonicalLearningEvidenceTuple } from '@dsh-enhanced/assistant-evaluation';
-import type { CreationCapabilityCallEvidence, CreationCapabilityOwner, CreationCapabilityRecord, CreationCapabilityTaskAssociation } from './creation-capability-types.js';
+import type { CreationCapabilityAvailabilityAttribution, CreationCapabilityCallEvidence, CreationCapabilityOrdinaryUseReport, CreationCapabilityOrdinaryUseTrend, CreationCapabilityOwner, CreationCapabilityRecord, CreationCapabilityTaskAssociation } from './creation-capability-types.js';
 type Evaluation = Pick<AssistantEvaluationService, 'canonicalHostScope' | 'getTrustedForegroundLearningProjection' | 'withTrustedCanonicalTaskWriterFence'>;
 type Delivery = Pick<AssistantDeliveryService, 'inspectOwnerForegroundLearningTask' | 'inspectOwnerForegroundTaskSource'>;
 export interface CreationCapabilityFeedbackInput {
@@ -17,7 +17,64 @@ export interface CreationCapabilityFeedbackInput {
     };
     now?: number;
 }
+/** Below this many samples a measure is marked insufficient; latency percentiles are withheld, quality counts stay exact. */
+export declare const DEFAULT_MINIMUM_SAMPLES = 5;
 /** No cache: every result is checked against the current canonical writer and owner route. */
 export declare function inspectCreationCapabilityTaskAssociations(input: CreationCapabilityFeedbackInput): readonly CreationCapabilityTaskAssociation[];
+/**
+ * Descriptive, non-causal counts over the same fenced current associations: one latest-revision quality sample per
+ * Inbox, strata by frozen task model only. Undefined only for a missing receipt, a failed fence or a throw.
+ */
+export declare function inspectCreationCapabilityOrdinaryUseReport(input: CreationCapabilityFeedbackInput & {
+    minimumSamples?: number;
+}): CreationCapabilityOrdinaryUseReport | undefined;
+type AttributionEvaluation = Evaluation & Pick<AssistantEvaluationService, 'listTrustedTaskLearningProjections' | 'withTrustedCanonicalScopeWriterFence'>;
+export interface CreationCapabilityAttributionInput extends CreationCapabilityFeedbackInput {
+    evaluation: AttributionEvaluation;
+    /** Adoption times of every other journal record with a receipt; only counted as a concurrent-change flag. */
+    otherAdoptedAt?: readonly number[];
+    minimumSamples?: number;
+    /** Equal arm length; defaults to and is clamped by the elapsed signed use window. */
+    windowMs?: number;
+    /** Fail closed above this many current canonical heads in the owner scope. */
+    maxScannedHeads?: number;
+}
+export declare const DEFAULT_MAX_SCANNED_HEADS = 5000;
+/**
+ * Intention-to-treat before/after attribution of one adoption: every certified current owner foreground task (one
+ * latest-revision head per Inbox; corrections replace, withdrawals retract) in equal windows around adoption, by
+ * frozen task model. Read once, then reread under an unchanged Evaluation scope watermark. Undefined for a missing
+ * receipt, an oversized scope, a changed source, scope or fence, or a throw. Observational, never causal.
+ */
+export declare function inspectCreationCapabilityAvailabilityAttribution(input: CreationCapabilityAttributionInput): CreationCapabilityAvailabilityAttribution | undefined;
+export declare const TREND_DEFAULT_WINDOW_MS: number;
+export declare const TREND_WINDOW_MS_BOUNDS: {
+    readonly min: number;
+    readonly max: number;
+};
+export declare const TREND_DEFAULT_PRE_WINDOWS = 4;
+export declare const TREND_DEFAULT_MAX_POST_WINDOWS = 12;
+export declare const TREND_WINDOW_COUNT_MAX = 52;
+export declare const TREND_DEFAULT_PARALLEL_TREND_THRESHOLD = 0.2;
+/** Fixed, machine-readable statement of what the estimate assumes; it is never a causal claim. */
+export declare const TREND_ASSUMPTIONS: readonly string[];
+export interface CreationCapabilityTrendInput extends CreationCapabilityAttributionInput {
+    /** Window length, default 7 days, bounded to [1 hour, 90 days]. */
+    windowMs?: number;
+    /** Windows before adoption, default 4, bounded to [2, 52]. */
+    preWindows?: number;
+    /** Cap on windows after adoption, default 12, bounded to [1, 52]; later tasks are outside every window. */
+    maxPostWindows?: number;
+    /** Absolute pre-adoption gap drift above which the parallel-trend assumption is flagged, in (0, 1]. */
+    parallelTrendThreshold?: number;
+}
+/**
+ * Longitudinal ordinary-use series of one adoption in fixed windows around adoption, by frozen task model, with a
+ * same-scope session-cohort control and a pooled difference-in-differences estimate. Every certified current owner
+ * foreground task counts once by its latest revision (corrections replace, withdrawals retract). Read once, then
+ * reread under an unchanged Evaluation scope watermark. Undefined for a missing receipt, an oversized scope, a changed
+ * source, scope or fence, or a throw. Pure read; observational, never causal.
+ */
+export declare function inspectCreationCapabilityOrdinaryUseTrend(input: CreationCapabilityTrendInput): CreationCapabilityOrdinaryUseTrend | undefined;
 export {};
 //# sourceMappingURL=creation-capability-feedback.d.ts.map

package/lib/creation-capability-feedback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"creation-capability-feedback.d.ts","sourceRoot":"","sources":["../src/creation-capability-feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAA+B,MAAM,kCAAkC,CAAA;AAC7G,OAAO,KAAK,EAAE,0BAA0B,EAAE,wCAAwC,EAAE,MAAM,oCAAoC,CAAA;AAE9H,OAAO,KAAK,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,wBAAwB,EAC7F,iCAAiC,EAAE,MAAM,gCAAgC,CAAA;AAE3E,KAAK,UAAU,GAAG,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,GAAG,wCAAwC,GAC9G,qCAAqC,CAAC,CAAA;AAC1C,KAAK,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oCAAoC,GAAG,kCAAkC,CAAC,CAAA;AAEzH,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,wBAAwB,CAAA;IAChC,KAAK,EAAE,SAAS,8BAA8B,EAAE,CAAA;IAChD,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,oHAAoH;IACpH,iBAAiB,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,wCAAwC,CAAA;KAAE,CAAA;IACrG,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AA0BD,8FAA8F;AAC9F,wBAAgB,yCAAyC,CAAC,KAAK,EAAE,+BAA+B,GAAG,SAAS,iCAAiC,EAAE,CA4F9I"}
+{"version":3,"file":"creation-capability-feedback.d.ts","sourceRoot":"","sources":["../src/creation-capability-feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAA+B,MAAM,kCAAkC,CAAA;AAC7G,OAAO,KAAK,EAAE,0BAA0B,EAAE,wCAAwC,EAC1C,MAAM,oCAAoC,CAAA;AAElF,OAAO,KAAK,EACV,yCAAyC,EAAE,8BAA8B,EACrC,mCAAmC,EACjC,kCAAkC,EAAE,uBAAuB,EAAE,wBAAwB,EAC3H,iCAAiC,EAEF,MAAM,gCAAgC,CAAA;AAEvE,KAAK,UAAU,GAAG,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,GAAG,wCAAwC,GAC9G,qCAAqC,CAAC,CAAA;AAC1C,KAAK,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oCAAoC,GAAG,kCAAkC,CAAC,CAAA;AAEzH,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,wBAAwB,CAAA;IAChC,KAAK,EAAE,SAAS,8BAA8B,EAAE,CAAA;IAChD,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,uBAAuB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,oHAAoH;IACpH,iBAAiB,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,wCAAwC,CAAA;KAAE,CAAA;IACrG,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,6HAA6H;AAC7H,eAAO,MAAM,uBAAuB,IAAI,CAAA;AA4KxC,8FAA8F;AAC9F,wBAAgB,yCAAyC,CAAC,KAAK,EAAE,+BAA+B,GAAG,SAAS,iCAAiC,EAAE,CAM9I;AA6BD;;;GAGG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,+BAA+B,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/H,mCAAmC,GAAG,SAAS,CA0B9C;AAED,KAAK,qBAAqB,GAAG,UAAU,GAAG,IAAI,CAAC,0BAA0B,EAAE,oCAAoC,GAC3G,sCAAsC,CAAC,CAAA;AAE3C,MAAM,WAAW,kCAAmC,SAAQ,+BAA+B;IACzF,UAAU,EAAE,qBAAqB,CAAA;IACjC,6GAA6G;IAC7G,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAmD9C;;;;;GAKG;AACH,wBAAgB,gDAAgD,CAAC,KAAK,EAAE,kCAAkC,GAC1G,yCAAyC,GAAG,SAAS,CAqGpD;AAED,eAAO,MAAM,uBAAuB,QAA0B,CAAA;AAC9D,eAAO,MAAM,sBAAsB;;;CAAkE,CAAA;AACrG,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,8BAA8B,KAAK,CAAA;AAChD,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,eAAO,MAAM,sCAAsC,MAAM,CAAA;AAEzD,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAEF,MAAM,WAAW,4BAA6B,SAAQ,kCAAkC;IACtF,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uGAAuG;IACvG,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAuDD;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CAAC,KAAK,EAAE,4BAA4B,GAC7F,kCAAkC,GAAG,SAAS,CA4H7C"}