@dzhechkov/harness-core 0.8.46 → 0.8.47

package/src/operations.ts

@@ -18,12 +18,14 @@ import {
   buildCodexHookManifest,
   codexHooksPaths,
   diffCodexHooks,
+  looksLikeDzEntry,
   parseCodexHookManifest,
   planCodexHooks,
   removeCodexHooks,
   selectOwnHookMetadata,
   upsertTrustBlock,
   type CodexHooksPaths,
+  type CodexRegistry,
   type HooksListHookMetadata,
   type ManagedEntry,
 } from './codex-hooks.js';
@@ -1922,6 +1924,12 @@ export interface CodexHooksSyncOptions {
   readonly probeModel?: string;
   /** Test seam: replace the live probe. Production runs {@link runCodexVetoProbe}. */
   readonly probe?: (options: CodexVetoProbeOptions) => CodexVetoProbeRun;
+  /**
+   * Test seam (codex-hooks-remove-never-orphans, review r1 item 1): how a helper body reaches disk.
+   * Production writes atomically; a test injects a failing writer (ENOSPC) to prove the section-2
+   * restore fails CLOSED. Nothing else in the operation goes through it.
+   */
+  readonly writeHelperFile?: (path: string, body: string) => void;
 }
 
 export interface CodexHooksSyncReport {
@@ -2204,24 +2212,44 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
       // 2 deleted them after the lock was released, so a concurrent installer could observe (and
       // rebuild against) a registry that had already been emptied — or leave a manifest describing
       // entries that no longer exist. One decision, one critical section.
-      if (planned.ok) {
-        for (const p of [paths.vetoHelper, paths.recallHelper, paths.manifest]) rmSync(p, { force: true });
-      }
-      return planned;
+      //
+      // codex-hooks-remove-never-orphans (ADR-001): the helpers go ONLY when nothing left in the
+      // registry still points at them. Keyed on the OBSERVED fact — dz-like entries surviving this
+      // plan — not on a flag: an installer between its two sections (no manifest yet), or a manifest
+      // deleted by hand, leaves entries we cannot attribute; deleting their helpers anyway turned the
+      // entry into `exit 127`, which Codex reads as ALLOW. A dead reference is worse than a stray file.
+      //
+      // Review r1 item 3: "nothing left points at them" is measured on the registry AS IT WILL BE
+      // WRITTEN — every surviving handler, attributed-and-salvaged or not. `unattributable` counts
+      // whole unattributed entries only; a handler salvaged from an attributed matcher group (another
+      // interpreter sharing these helpers) would slip past it and lose its helper.
+      if (!planned.ok) return { planned, references: 0 };
+      const references = dzHelperReferences(planned.result.registry);
+      const doomed = references > 0 ? [paths.manifest] : [paths.vetoHelper, paths.recallHelper, paths.manifest];
+      for (const p of doomed) rmSync(p, { force: true });
+      return { planned, references };
     });
-    if (!removal.ok) return { ...base, codexVersion, exitCode: 1, warnings, errors: [removal.error] };
+    const planned = removal.planned;
+    if (!planned.ok) return { ...base, codexVersion, exitCode: 1, warnings, errors: [planned.error] };
+    // A remove that leaves dz references in the registry did not remove dz — it must not say it did.
+    const kept = removal.references;
     return {
       ...base,
       codexVersion,
-      written: removal.result.changed,
-      removed: removal.result.removed,
-      unattributable: removal.result.unattributable,
-      exitCode: 0,
-      warnings:
-        removal.result.unattributable > 0
-          ? [`${removal.result.unattributable} entr(ies) resemble dz hooks but are not manifest-attributed — KEPT, remove them by hand if you want them gone`]
-          : warnings,
-      errors,
+      written: planned.result.changed,
+      removed: planned.result.removed,
+      unattributable: planned.result.unattributable,
+      exitCode: kept > 0 ? 1 : 0,
+      warnings,
+      errors:
+        kept > 0
+          ? [
+              `remove-unattributed-entries-kept: ${kept} handler(s) in ${paths.registry} still reference the dz helpers but are ` +
+                'not manifest-attributed, so they were KEPT — and the helper files they reference were KEPT with them ' +
+                '(deleting a referenced helper makes the hook exit 127, which Codex treats as ALLOW). An install may be ' +
+                'in flight: let it finish and re-run `--remove`; otherwise delete those entries by hand, then re-run.',
+            ]
+          : errors,
       writes,
     };
   }
@@ -2305,8 +2333,8 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
     if (!plan.ok) return { plan, wrote: false as const, freshText };
     mkdirSync(paths.helperDir, { recursive: true, mode: 0o700 });
     const helpers = generateCodexHelpers();
-    writeHelperIfChanged(paths.vetoHelper, helpers.veto, writes);
-    writeHelperIfChanged(paths.recallHelper, helpers.recall, writes);
+    writeHelperIfChanged(paths.vetoHelper, helpers.veto, writes, options.writeHelperFile);
+    writeHelperIfChanged(paths.recallHelper, helpers.recall, writes, options.writeHelperFile);
     if (plan.plan.changed) {
       backupRegistry(paths, freshText, now, writes);
       atomicWrite(paths.registry, plan.plan.text);
@@ -2368,13 +2396,58 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
     const nowText = existsSync(paths.registry) ? readFileSync(paths.registry, 'utf8') : undefined;
     const nowDrift = diffCodexHooks(nowText, entries, undefined);
     if (!nowDrift.installed) {
-      return { wrote: false, drift: nowDrift };
+      return { wrote: false, drift: nowDrift, restored: false, restoreFailure: null };
     }
+    // codex-hooks-remove-never-orphans (ADR-001): the entries are ours and present — so are their
+    // helpers, or the registry points into nothing (exit 127 = ALLOW). Something that ignores the lock
+    // (an older dz's `--remove`, a hand) may have deleted or altered them since section one. Re-assert
+    // them HERE, under the lock, before the manifest calls this install complete. Two small writes,
+    // no probe: the section stays a short transaction.
+    const before = writes.length;
+    try {
+      mkdirSync(paths.helperDir, { recursive: true, mode: 0o700 });
+      const helpers = generateCodexHelpers();
+      writeHelperIfChanged(paths.vetoHelper, helpers.veto, writes, options.writeHelperFile);
+      writeHelperIfChanged(paths.recallHelper, helpers.recall, writes, options.writeHelperFile);
+    } catch (err) {
+      // Review r1 item 1: the restore FAILED (ENOSPC, a file where the helper dir should be, …). The
+      // entries this install wrote now point at helpers that may not exist — fail CLOSED on the
+      // invariant: take OUR entries back out of the registry (same lock, same transaction), write no
+      // manifest, and let the report say why. Foreign entries are untouched by construction:
+      // `removeCodexHooks` attributes by the hashes of the commands this very run emitted.
+      return {
+        wrote: false,
+        drift: nowDrift,
+        restored: false,
+        restoreFailure: rollBackOwnEntries(paths, entries, nowText, manifestText, `${now}-rollback`, writes, String((err as Error)?.message ?? err)),
+      };
+    }
+    const restored = writes.length > before;
     atomicWrite(paths.manifest, manifestText);
     writes.push(paths.manifest);
-    return { wrote: true, drift: nowDrift };
+    return { wrote: true, drift: nowDrift, restored, restoreFailure: null };
   });
-  if (!manifestOutcome.wrote) {
+  if (manifestOutcome.restoreFailure !== null) {
+    const f = manifestOutcome.restoreFailure;
+    errors.push(
+      `helpers-restore-failed: the helper files were missing or altered after the registry transaction and could not be ` +
+        `rewritten (${f.cause}). ` +
+        (f.rolledBack
+          ? 'This install\u2019s own entries were REMOVED from the registry again, so none of THEM references a missing helper (exit 127 = ALLOW); no manifest was written.'
+          : `Rolling this install\u2019s entries back ALSO failed (${f.rollbackError ?? 'unknown'}) — ${paths.registry} may reference a missing helper: fix the disk and re-run, or run \`--remove\`.`) +
+        (f.missing.length > 0
+          ? ` Missing helper path(s): ${f.missing.join(', ')}. Handlers not written by this run that reference these paths were left untouched and will exit 127 (Codex reads that as ALLOW) — run \`dz hooks-sync --target codex --check\` and repair.`
+          : ''),
+    );
+  }
+  if (manifestOutcome.restored) {
+    warnings.push(
+      'helpers-restored: the helper files were missing or altered between the registry transaction and the manifest ' +
+      'write (an older dz `--remove`, or a process that ignores the codex-hooks lock) — they were rewritten under the lock so the ' +
+      'registry never references a helper that does not exist.',
+    );
+  }
+  if (!manifestOutcome.wrote && manifestOutcome.restoreFailure === null) {
     warnings.push(
       'the registry no longer carries this install\u2019s entries — a concurrent remover won the window between the ' +
       'registry transaction and the manifest write, so NO manifest was written (a manifest describing entries that are ' +
@@ -2382,7 +2455,7 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
     );
   }
 
-  const drift = manifestOutcome.drift;
+  const drift = manifestOutcome.restoreFailure !== null ? manifestOutcome.restoreFailure.drift : manifestOutcome.drift;
   const installed = drift.installed;
   const armedState = installed && executable && trustResult.trust === 'trusted';
   // The install is not finished when the file is written — it is finished when the guard has been
@@ -2615,13 +2688,95 @@ function atomicWrite(path: string, text: string): void {
 }
 
 /** 0600: the helpers are invoked as `node <path>`, never executed directly (AM-35c). */
-function writeHelperIfChanged(path: string, body: string, writes: string[]): void {
+function writeHelperIfChanged(
+  path: string,
+  body: string,
+  writes: string[],
+  write: (path: string, body: string) => void = atomicWrite,
+): void {
   const current = existsSync(path) ? readFileSync(path, 'utf8') : undefined;
   if (current === body) return; // byte-idempotence: no change ⇒ no write ⇒ trust survives (FR-2)
-  atomicWrite(path, body);
+  write(path, body);
   writes.push(path);
 }
 
+/**
+ * Handlers in a registry that reference the dz helper files (codex-hooks-remove-never-orphans).
+ * Counted per HANDLER, over every surviving entry — so a foreign-looking handler salvaged from an
+ * attributed matcher group still counts as a reference.
+ */
+function dzHelperReferences(registry: CodexRegistry): number {
+  let n = 0;
+  for (const list of Object.values(registry.hooks)) {
+    for (const entry of list) {
+      const e = entry as { hooks?: unknown };
+      const handlers = Array.isArray(e?.hooks) ? (e.hooks as unknown[]) : [entry];
+      for (const h of handlers) if (looksLikeDzEntry(h)) n += 1;
+    }
+  }
+  return n;
+}
+
+interface HelperRestoreFailure {
+  readonly cause: string;
+  readonly rolledBack: boolean;
+  readonly rollbackError: string | null;
+  /** Helper paths of this home that are absent on disk after the failed restore. */
+  readonly missing: readonly string[];
+  readonly drift: ReturnType<typeof diffCodexHooks>;
+}
+
+/**
+ * Section-2 fail-closed path: remove exactly the entries THIS run emitted (attributed by the hashes
+ * in the manifest it was about to write) and any stale manifest, under the caller's lock.
+ */
+function rollBackOwnEntries(
+  paths: CodexHooksPaths,
+  entries: readonly ManagedEntry[],
+  registryText: string | undefined,
+  manifestText: string,
+  backupStamp: string,
+  writes: string[],
+  cause: string,
+): HelperRestoreFailure {
+  const ours = parseCodexHookManifest(manifestText);
+  const planned = removeCodexHooks(registryText, ours);
+  let rolledBack = false;
+  let rollbackError: string | null = null;
+  let finalText = registryText;
+  if (!planned.ok) {
+    rollbackError = planned.error;
+  } else {
+    try {
+      if (planned.result.changed) {
+        backupRegistry(paths, registryText, backupStamp, writes);
+        atomicWrite(paths.registry, planned.result.text);
+        writes.push(paths.registry);
+      }
+      finalText = planned.result.text;
+      rolledBack = true;
+    } catch (err) {
+      rollbackError = String((err as Error)?.message ?? err);
+    }
+  }
+  // A stale manifest from an earlier install would now describe entries that are gone.
+  try {
+    rmSync(paths.manifest, { force: true });
+  } catch { /* the helper dir may itself be the obstacle (a file) — nothing to describe there */ }
+  // Named, never pruned (AM-6, review r3): a handler this run did not write is left untouched even if
+  // it references a missing helper. Deciding "does this shell command execute our helper?" needs a
+  // shell parser; a substring match misfired BOTH ways (removed a valid foreign guard that merely
+  // mentioned the path; missed an escaped path). Detection is `--check`'s job.
+  const missing = [paths.vetoHelper, paths.recallHelper].filter((p) => !existsSync(p));
+  return {
+    cause,
+    rolledBack,
+    rollbackError,
+    missing,
+    drift: diffCodexHooks(finalText, entries, undefined),
+  };
+}
+
 function backupRegistry(paths: CodexHooksPaths, currentText: string | undefined, now: string, writes: string[]): void {
   if (currentText === undefined) return;
   const backup = `${paths.registry}.bak-${now.replace(/[:.]/g, '-')}`;

package/src/pack-inventory.ts

@@ -253,7 +253,12 @@ export function listPublishInventory(packageRoot: string, opts: ListPublishInven
   packageRoot = resolve(packageRoot);
   const packer = opts.packer ?? 'npm';
   const exec = opts.exec ?? defaultExec;
-  const timeoutMs = opts.timeoutMs ?? 15_000;
+  // Default packer ceiling = 3 × the max `npm pack --dry-run --json` measured UNDER LOAD, rounded up to 1 000 ms.
+  // MEASURED 2026-09-26 (features/secret-scan-tails/07_code_changes/packer-timing-under-load.md): two sweeps over
+  // all 56 non-private packages/@dzhechkov/* while `npx vitest run` of harness-core ran (load1 2.38–7.73, 8 CPUs):
+  // max 5 358 ms (@dzhechkov/harness-core), p95 2 692 ms over 112 calls ⇒ 3 × 5 358 = 16 074 > 15 000 ⇒ 17 000.
+  // Supersedes the UNLOADED 15 000 ms (max 3 994 ms, parent AM-2). Reproducer: that file's measure script.
+  const timeoutMs = opts.timeoutMs ?? 17_000;
   let version: string | null = null;
   const fallback = (reason: string): PublishInventory => {
     const files = listPackFiles(packageRoot);

package/src/parity.ts

@@ -397,7 +397,10 @@ export const PARITY_FEATURES: readonly ParityFeature[] = [
   {
     id: 'statusline-gates',
     title: 'Live 🚦 gates status line',
-    forms: [{ form: 'statusline integration', requires: ['statusline'], level: 'full' }],
+    forms: [
+      { form: 'statusline integration', requires: ['statusline'], level: 'full' },
+      { form: 'dz statusline --watch (adjacent terminal)', requires: ['shell'], level: 'manual' },
+    ],
   },
   {
     id: 'project-guards',

package/src/publish-sibling-drift.ts

@@ -26,9 +26,12 @@
  * @packageDocumentation
  */
 
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync, lstatSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, relative, isAbsolute } from 'node:path';
+import { judgeReleaseCohortAudit } from './release-package-audit.js';
+import { rewriteWorkspaceSpecs } from './pack-artifact.js';
+import { hashPackBytes, verifyManifest, isSafeManifestPath, type SignedManifest } from './sign.js';
 
 export type SiblingDriftStatus = 'same' | 'drift' | 'unavailable';
 
@@ -54,7 +57,7 @@ export interface SiblingDriftResult {
   readonly changedFiles: readonly string[];
   /** Export names the workspace's dist/index.js declares that the published one lacks (А2, secondary signal). */
   readonly missingExports: readonly string[];
-  /** Present only when status === 'unavailable'. */
+  /** Unavailable reason or diagnostic for a verified/declined owner-branding comparison. */
   readonly reason?: string;
   /**
    * AM-6: named per-result (not merely per-call) because `detectSiblingDrift` short-circuits to
@@ -62,6 +65,8 @@ export interface SiblingDriftResult {
    * source that WOULD have been used, so a reader never has to guess.
    */
   readonly inventorySource: InventorySource;
+  /** Verified directional policy class; SAME here does not mean byte-identical. */
+  readonly classification?: 'owner-branding-only' | 'retained-registered-binding';
 }
 
 export interface FetchedPublished {
@@ -100,18 +105,46 @@ export interface DetectSiblingDriftOptions {
   readonly localInventory?: LocalInventory;
   /** Label for the injected provider (default 'npm-pack'); CLI uses 'pack-artifact'. */
   readonly localInventorySource?: InventorySource;
+  /** Repository trust root, supplied externally; never read from either artifact. */
+  readonly trustedPublicKeyPem?: string;
+  /** Structural validation seam only; normal CLI additionally requires its completed invocation-owned object. */
+  readonly retainedBindingProof?: {
+    readonly version: 1; readonly phase: 'preview' | 'final'; readonly batch: readonly string[];
+    readonly head: string; readonly refs: readonly { ref: string; oid: string }[];
+    readonly workspaceVersions: readonly (readonly [string, string])[];
+    readonly adapters: Readonly<Record<string, {
+      sourceSha256: string; localTreeSha256: string; registryTreeSha256: string; registryIntegrity: string;
+      version: string; localFloor: string; registeredFloor: string; creation: string;
+      history: readonly { oid: string; blob: string | null; literal: string | null; boundary: boolean }[];
+    }>>;
+    readonly baseline: { roots: Parameters<typeof judgeReleaseCohortAudit>[0]; evidence: unknown };
+    readonly candidate: { roots: Parameters<typeof judgeReleaseCohortAudit>[0]; evidence: unknown };
+    readonly digest: string;
+  };
+
 }
 
-function listFilesRecursive(root: string, dir: string): string[] {
-  if (!existsSync(dir)) return [];
-  const out: string[] = [];
-  for (const entry of readdirSync(dir).sort()) {
-    const abs = join(dir, entry);
-    const st = statSync(abs);
-    if (st.isDirectory()) out.push(...listFilesRecursive(root, abs));
-    else out.push(relative(root, abs));
+function listFilesRecursive(root: string, dir: string, strictPacked = false): string[] {
+  try {
+    if (!existsSync(dir)) { if (strictPacked) throw new InventoryListingError('missing packed tree'); return []; }
+    if (strictPacked && !lstatSync(dir).isDirectory()) throw new InventoryListingError('packed directory is a symlink or unsupported entry');
+    const out: string[] = []; const seen = new Set<string>();
+    for (const entry of readdirSync(dir).sort()) {
+      const abs = join(dir, entry); const path = relative(root, abs);
+      const st = strictPacked ? lstatSync(abs) : statSync(abs);
+      if (strictPacked) {
+        if (!isSafeManifestPath(path) || seen.has(path.toLowerCase())) throw new InventoryListingError('noncanonical or aliased packed path: ' + path);
+        seen.add(path.toLowerCase());
+        if (!st.isDirectory() && !st.isFile()) throw new InventoryListingError('symlink or special packed entry: ' + path);
+      }
+      if (st.isDirectory()) out.push(...listFilesRecursive(root, abs, strictPacked));
+      else out.push(path);
+    }
+    return out;
+  } catch (error) {
+    if (strictPacked && !(error instanceof InventoryListingError)) throw new InventoryListingError('physical packed inventory unreadable: ' + String(error));
+    throw error;
   }
-  return out;
 }
 
 function sha256(data: string | Buffer): string {
@@ -251,6 +284,140 @@ function readManifest(dir: string): Record<string, unknown> | null {
   }
 }
 
+/** Readonly exception for two original, fully verified artifact trees. Every other delta refuses. */
+function classifyOwnerBrandingDelta(
+  localDir: string, registryDir: string, name: string, version: string,
+  publicKey: string | undefined, declaredPaths: readonly string[] | undefined, retained?: { localFloor: string; registeredFloor: string },
+): { accepted: boolean; coverageVerified: boolean; changedFiles: string[]; reason: string } {
+  let coverageVerified = false;
+  const decline = (detail: string) => ({ accepted: false, coverageVerified, changedFiles: [], reason: 'owner-branding not proven: ' + detail });
+  if (!publicKey) return decline('no trusted external public key');
+  try {
+    for (const dir of [localDir, registryDir]) {
+      for (const path of ['.dz-manifest.json', 'sbom.json', 'package.json', 'README.md']) {
+        if (!lstatSync(join(dir, path)).isFile()) return decline('original metadata is not a regular file');
+      }
+    }
+    const localSignedBytes = readFileSync(join(localDir, '.dz-manifest.json'), 'utf8');
+    const registrySignedBytes = readFileSync(join(registryDir, '.dz-manifest.json'), 'utf8');
+    const localSigned = JSON.parse(localSignedBytes) as SignedManifest;
+    const registrySigned = JSON.parse(registrySignedBytes) as SignedManifest;
+    // No projected/re-signed object reaches the verifier. Both untouched inventories and SBOMs first.
+    if (!verifyManifest(localDir, localSigned, publicKey).ok || !verifyManifest(registryDir, registrySigned, publicKey).ok) return decline('original signature, SBOM or full signed inventory failed verification');
+    for (const [signed, bytes] of [[localSigned, localSignedBytes], [registrySigned, registrySignedBytes]] as const) {
+      const serializations = [JSON.stringify(signed), JSON.stringify(signed, null, 2)];
+      if (!serializations.some(text => bytes === text || bytes === text + '\n')) return decline('manifest serialization has unexplained or ambiguous bytes');
+      if (Buffer.from(signed.signature, 'base64').toString('base64') !== signed.signature) return decline('signature encoding is not canonical');
+    }
+    const paths = listFilesRecursive(localDir, localDir, true).sort();
+    const registryPaths = listFilesRecursive(registryDir, registryDir, true).sort();
+    if (JSON.stringify(paths) !== JSON.stringify(registryPaths)) return decline('artifact file sets differ');
+    if (declaredPaths !== undefined && JSON.stringify([...declaredPaths].sort()) !== JSON.stringify(paths)) return decline('declared packed inventory is incomplete or duplicated');
+    // Installed/source verifier exclusions are not packed-artifact signing coverage.
+    // Every physical regular leaf is authenticated; only the two validated ROOT metadata files self-exempt.
+    for (const [signed, physical] of [[localSigned, paths], [registrySigned, registryPaths]] as const) {
+      const signedPaths = signed.manifest.files.map(entry => entry.path).sort();
+      if (signedPaths.some(path => !isSafeManifestPath(path) || path === '.dz-manifest.json' || path === 'sbom.json')) return decline('invalid signed leaf or generated-root self-reference');
+      const expected = physical.filter(path => path !== '.dz-manifest.json' && path !== 'sbom.json');
+      if (JSON.stringify(signedPaths) !== JSON.stringify(expected)) return decline('physical packed leaves are not fully covered by the signed inventory');
+    }
+    coverageVerified = true;
+    const localPkgBytes = readFileSync(join(localDir, 'package.json'));
+    const registryPkgBytes = readFileSync(join(registryDir, 'package.json'));
+    const localPkg = JSON.parse(localPkgBytes.toString('utf8')) as Record<string, unknown>;
+    const registryPkg = JSON.parse(registryPkgBytes.toString('utf8')) as Record<string, unknown>;
+    if (localPkg['name'] !== name || registryPkg['name'] !== name || localPkg['version'] !== version || registryPkg['version'] !== version) return decline('package identity/version does not bind both artifacts');
+    const source = 'https://github.com/djd1m/dz-harness/tree/main/packages/' + name;
+    if (localPkg['homepage'] !== 'https://aicoding.space' || !['https://aicoding.space', source + '#readme'].includes(String(registryPkg['homepage']))) return decline('homepage is not the exact directional owner policy');
+    const projectedPkg: Record<string, unknown> = { ...localPkg, homepage: registryPkg['homepage'] };
+    if (retained !== undefined) {
+      const left = localPkg['dependencies'] as Record<string, unknown> | undefined;
+      const right = registryPkg['dependencies'] as Record<string, unknown> | undefined;
+      if (!left || !right || left['@dzhechkov/core'] !== retained.localFloor || right['@dzhechkov/core'] !== retained.registeredFloor) return decline('retained exact dependency binding contradicts originals');
+      projectedPkg['dependencies'] = { ...left, '@dzhechkov/core': right['@dzhechkov/core'] };
+    }
+
+    // Existing v3 canonical handling preserves order-sensitive exports/imports; no dependency values omitted.
+    if (hashPackBytes('package.json', Buffer.from(JSON.stringify(projectedPkg))) !== hashPackBytes('package.json', registryPkgBytes)) return decline('packed metadata differs beyond homepage (including dependency values)');
+    const stamp = 'Site: https://aicoding.space · Source: ' + source;
+    const stripTopStamp = (bytes: Buffer, required: boolean): Buffer | undefined => {
+      const text = bytes.toString('utf8'); if (!Buffer.from(text).equals(bytes)) return undefined;
+      const lines = text.split('\n');
+      const stamps = lines.filter(line => line.startsWith('Site: ') || line.includes(' · Source: '));
+      if (stamps.length === 0) return required ? undefined : bytes;
+      if (stamps.length !== 1 || !/^# [^\r\n]+$/.test(lines[0] ?? '') || lines[1] !== '' || lines[2] !== stamp || lines[3] !== '') return undefined;
+      // Remove only the inserted blank/stamp framing; retain every other byte including trailing newlines.
+      return Buffer.from(lines[0] + '\n' + lines.slice(3).join('\n'));
+    };
+    const localReadme = readFileSync(join(localDir, 'README.md'));
+    const registryReadme = readFileSync(join(registryDir, 'README.md'));
+    const localRest = stripTopStamp(localReadme, true), registryRest = stripTopStamp(registryReadme, false);
+    if (!localRest || !registryRest || !localRest.equals(registryRest)) return decline('README differs beyond the one exact top owner stamp');
+    const admitted = new Set<string>();
+    if (!localReadme.equals(registryReadme)) admitted.add('README.md');
+    if (hashPackBytes('package.json', localPkgBytes, localSigned.manifest.version) !== hashPackBytes('package.json', registryPkgBytes, registrySigned.manifest.version)) admitted.add('package.json');
+    if (admitted.size === 0) return decline('no admitted branding leaf changed');
+    const canonical = (value: unknown): string => Array.isArray(value) ? '[' + value.map(canonical).join(',') + ']' : value !== null && typeof value === 'object' ? '{' + Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => JSON.stringify(k) + ':' + canonical(v)).join(',') + '}' : JSON.stringify(value);
+    const projectManifest = (signed: SignedManifest) => ({ ...signed, signature: '<verified-original>', manifest: { ...signed.manifest, files: [...signed.manifest.files].sort((a, b) => a.path.localeCompare(b.path)).map(entry => ({ ...entry, sha256: admitted.has(entry.path) ? '<admitted-digest>' : entry.sha256 })) } });
+    if (canonical(projectManifest(localSigned)) !== canonical(projectManifest(registrySigned))) return decline('unexplained signed-manifest field or digest change');
+    const projectSbom = (dir: string, signed: SignedManifest) => {
+      const sbom = JSON.parse(readFileSync(join(dir, 'sbom.json'), 'utf8'));
+      for (const component of sbom.components) {
+        if (!admitted.has(component.name)) continue;
+        const digest = signed.manifest.files.find(entry => entry.path === component.name)?.sha256;
+        for (const hash of component.hashes ?? []) if (hash.alg === 'SHA-256' && hash.content === digest) hash.content = '<admitted-digest>';
+        for (const prop of component.properties ?? []) if (['dz:canonical-json-sha256-v1', 'dz:canonical-json-sha256-v2'].includes(prop.name) && prop.value === digest) prop.value = '<admitted-digest>';
+      }
+      return sbom;
+    };
+    if (canonical(projectSbom(localDir, localSigned)) !== canonical(projectSbom(registryDir, registrySigned))) return decline('unexplained SBOM field or digest change');
+    const changedFiles: string[] = [];
+    for (const path of paths) {
+      const left = readFileSync(join(localDir, path)), right = readFileSync(join(registryDir, path));
+      if (left.equals(right)) continue;
+      if (!admitted.has(path) && !['.dz-manifest.json', 'sbom.json'].includes(path)) return decline('other shipped bytes changed: ' + path);
+      changedFiles.push(path);
+    }
+    return { accepted: true, coverageVerified, changedFiles, reason: 'owner-branding-only: both original signatures/full inventories verified; exact owner leaves and corresponding manifest/SBOM digests only' };
+  } catch { return decline('artifact proof is missing, unreadable or malformed'); }
+}
+
+function classifyRetainedBindingDelta(opts: DetectSiblingDriftOptions, localDir: string, registryDir: string, sourceDir: string, name: string, version: string, paths: readonly string[] | undefined): ReturnType<typeof classifyOwnerBrandingDelta> | undefined {
+  const proof = opts.retainedBindingProof;
+  if (!proof) return undefined;
+  const decline = (reason: string) => ({ accepted: false, coverageVerified: true, changedFiles: [], reason: 'retained registered binding not proven: ' + reason });
+  try {
+    const roots = ['harness-core', 'harness-cli', 'skills-meta', 'keysarium', 'skills-feature-adr'].map(n => '@dzhechkov/' + n).sort();
+    const adapters = ['adapter-agents-md', 'adapter-claude', 'adapter-codex', 'adapter-copilot', 'adapter-cursor', 'adapter-gemini', 'adapter-hermes', 'adapter-openclaude', 'adapter-opencode', 'adapter-windsurf'].map(n => '@dzhechkov/' + n).sort();
+    if (proof.version !== 1 || !['preview', 'final'].includes(proof.phase) || JSON.stringify([...opts.batch].sort()) !== JSON.stringify(roots) || JSON.stringify([...proof.batch].sort()) !== JSON.stringify(roots) || !adapters.includes(name) || opts.batch.has(name) || JSON.stringify(Object.keys(proof.adapters).sort()) !== JSON.stringify(adapters)) return decline('batch or literal adapter identity differs');
+    const canonical = (v: unknown): string => Array.isArray(v) ? '[' + v.map(canonical).join(',') + ']' : v !== null && typeof v === 'object' ? '{' + Object.entries(v).sort(([a], [b]) => a.localeCompare(b)).map(([k, value]) => JSON.stringify(k) + ':' + canonical(value)).join(',') + '}' : JSON.stringify(v);
+    const { digest, ...payload } = proof; if (sha256(canonical(payload)) !== digest || !/^[a-f0-9]{40,64}$/.test(proof.head) || proof.refs.length === 0 || proof.refs.some(r => !/^[a-f0-9]{40,64}$/.test(r.oid))) return decline('snapshot/digest incomplete');
+    const baselineExecution = proof.baseline.evidence as Record<string, unknown>, candidateExecution = proof.candidate.evidence as Record<string, unknown>;
+    if (canonical(baselineExecution.platform) !== canonical(candidateExecution.platform) || baselineExecution.npmVersion !== candidateExecution.npmVersion) return decline('host/npm identity differs across cohorts');
+    const baseline = judgeReleaseCohortAudit(proof.baseline.roots, proof.baseline.evidence), candidate = judgeReleaseCohortAudit(proof.candidate.roots, proof.candidate.evidence);
+    if (baseline.status !== 'clean' || candidate.status !== 'clean' || !baseline.graph || !candidate.graph) return decline('fresh five-root cohorts are not both clean and complete');
+    for (const adapter of adapters) { const fact = proof.adapters[adapter]; if (!fact || ![baseline.graph, candidate.graph].every(graph => graph.some(node => node.name === adapter && !node.selectedRoot && node.installed && node.version === fact.version && node.integrity === fact.registryIntegrity && node.declarations.dependencies?.['@dzhechkov/core'] === fact.registeredFloor && node.edges.some((edge: any) => edge.table === 'dependencies' && edge.name === '@dzhechkov/core' && graph.some(target => target.path === edge.target && !target.selectedRoot && target.version === fact.registeredFloor))))) return decline('all ten registered adapter bindings must occur in both complete graphs'); }
+    const project = (graph: readonly Record<string, any>[]) => graph.map(node => {
+      if (!node.selectedRoot) return node;
+      const expectedPath = 'node_modules/' + node.name; if (node.path !== expectedPath || !roots.includes(node.name)) throw new Error('selected projection is not a root occurrence');
+      const declarations = Object.fromEntries(Object.entries(node.declarations).map(([table, values]) => [table, Object.fromEntries(Object.entries(values as Record<string, string>).map(([dep, spec]) => [dep, node.edges.some((edge: any) => edge.table === table && edge.name === dep && edge.target === 'node_modules/' + dep && roots.includes(dep)) ? '<selected-root-step>' : spec]))]));
+      return { ...node, version: '<provided-root>', resolved: '<provided-root>', integrity: '<provided-root>', declarations, edges: node.edges.map((edge: any) => ({ ...edge, spec: roots.includes(edge.name) && edge.target === 'node_modules/' + edge.name ? '<selected-root-step>' : edge.spec })) };
+    });
+    if (canonical(project(baseline.graph)) !== canonical(project(candidate.graph)) || canonical(baseline.optionalAbsences) !== canonical(candidate.optionalAbsences)) return decline('unselected graph, occurrence, edge or omission differs');
+    const record = proof.adapters[name]; if (!record) return decline('adapter record missing'); const sourceBytes = readFileSync(join(sourceDir, 'package.json'));
+    hashPackBytes('package.json', sourceBytes); const source = JSON.parse(sourceBytes.toString('utf8'));
+    if (sha256(sourceBytes) !== record.sourceSha256 || source.name !== name || source.version !== version || source.dependencies?.['@dzhechkov/core'] !== 'workspace:*' || record.version !== version || !/^[a-f0-9]{40,64}$/.test(record.creation) || !record.history.some(row => row.oid === record.creation && !row.boundary) || record.history.length === 0 || record.history.length > 2048 || record.history.some(row => !/^[a-f0-9]{40,64}$/.test(row.oid) || (row.boundary ? row.literal !== null || row.blob !== null : row.literal !== 'workspace:*' || !/^[a-f0-9]{40,64}$/.test(row.blob ?? '')))) return decline('current source or complete declaration history differs');
+    if (JSON.stringify([...opts.workspaceVersions].sort()) !== JSON.stringify([...proof.workspaceVersions].sort())) return decline('captured workspace materialization map changed');
+    const expected = JSON.parse(rewriteWorkspaceSpecs(sourceBytes.toString('utf8'), new Map(proof.workspaceVersions))); if (expected.scripts) delete expected.scripts.prepublishOnly;
+    const actual = readFileSync(join(localDir, 'package.json')); if (hashPackBytes('package.json', Buffer.from(JSON.stringify(expected))) !== hashPackBytes('package.json', actual)) return decline('source-to-packed materialization differs');
+    const treeHash = (dir: string) => sha256(canonical(listFilesRecursive(dir, dir, true).sort().map(path => [path, sha256(readFileSync(join(dir, path)))])));
+    if (treeHash(localDir) !== record.localTreeSha256 || treeHash(registryDir) !== record.registryTreeSha256 || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(record.registryIntegrity) || !/^\d+\.\d+\.\d+$/.test(record.registeredFloor) || record.localFloor === record.registeredFloor || expected.dependencies?.['@dzhechkov/core'] !== record.localFloor) return decline('artifact/SRI/exact-floor binding differs');
+    const verified = classifyOwnerBrandingDelta(localDir, registryDir, name, version, opts.trustedPublicKeyPem, paths, { localFloor: record.localFloor, registeredFloor: record.registeredFloor });
+    if (!verified.accepted) return verified;
+    return { ...verified, reason: `retained-registered-binding: registered core ${record.registeredFloor} retained; workspace materializes ${record.localFloor}; fresh cohort/source/artifact proof ${proof.digest}; historical release gitHead not established` };
+  } catch { return decline('source/artifact/graph proof unreadable or inconsistent'); }
+}
+
 /** package.json normalized for comparison: strip fields that legitimately differ (version, gitHead, npm-internal `_*`). */
 function normalizedPackageJsonText(raw: Record<string, unknown>): string {
   // Lead edit after the live dry-run on the hub (2026-09-13 10:40): the packer strips
@@ -409,6 +576,16 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
     // AM-3: a missing/unparseable package.json on EITHER side must not silently drop out of the
     // comparison (the old `hashTree` simply omitted the key, which — with an empty/matching
     // `dist/**` on both sides — could report `same` about an input that was never actually read).
+    if (opts.localInventory !== undefined && inventorySource === 'pack-artifact') {
+      try {
+        listFilesRecursive(fetched.dir, fetched.dir, true);
+        if (!lstatSync(workspaceDir).isDirectory()) throw new InventoryListingError('workspace artifact root is a symlink or unsupported entry');
+        if (!lstatSync(join(fetched.dir, 'package.json')).isFile() || !lstatSync(join(workspaceDir, 'package.json')).isFile()) throw new InventoryListingError('package metadata is not a regular file');
+      } catch (error) {
+        results.push({ name: dep, version, status: 'unavailable', changedFiles: [], missingExports: [], reason: 'physical packed admission failed: ' + String(error), inventorySource });
+        continue;
+      }
+    }
     const publishedManifest = readManifest(fetched.dir);
     const workspaceManifest = readManifest(workspaceDir);
     if (publishedManifest === null || workspaceManifest === null) {
@@ -437,6 +614,8 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
     // pack`) correctly includes them, reading as a false "only in workspace" drift. WITHOUT a
     // provider, core has no way to ask npm on either side, so it degrades to the SAME approximation
     // on BOTH sides (symmetry preserved, just cruder) — a named approximation, never a subprocess.
+    let localPackedDir: string | undefined;
+    let localPackedPaths: readonly string[] | undefined;
     let workspaceHashes: Map<string, string>;
     let publishedHashes: Map<string, string>;
     if (opts.localInventory !== undefined) {
@@ -453,7 +632,12 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
         });
         continue;
       }
+      if ('packedDir' in localResult) { localPackedDir = localResult.packedDir; localPackedPaths = localResult.paths; }
       try {
+        if ('packedDir' in localResult && inventorySource === 'pack-artifact') {
+          const physical = listFilesRecursive(localResult.packedDir, localResult.packedDir, true).sort();
+          if (localResult.paths !== undefined && (!Array.isArray(localResult.paths) || localResult.paths.some(path => !isSafeManifestPath(path)) || JSON.stringify([...localResult.paths].sort()) !== JSON.stringify(physical))) throw new InventoryListingError('declared packed inventory is not the complete canonical physical leaf set');
+        }
         workspaceHashes = 'packedDir' in localResult
           ? localResult.paths !== undefined
             ? hashTreeFromPaths(localResult.packedDir, localResult.paths, workspaceManifest)
@@ -485,6 +669,24 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
     }
     changed.sort();
 
+    const branding = (changed.length > 0 || opts.trustedPublicKeyPem !== undefined) && localPackedDir !== undefined && inventorySource === 'pack-artifact'
+      ? classifyOwnerBrandingDelta(localPackedDir, fetched.dir, dep, version, opts.trustedPublicKeyPem, localPackedPaths)
+      : undefined;
+    const retained = !branding?.accepted && localPackedDir !== undefined && inventorySource === 'pack-artifact'
+      ? classifyRetainedBindingDelta(opts, localPackedDir, fetched.dir, workspaceDir, dep, version, localPackedPaths) : undefined;
+    if (retained?.accepted) {
+      results.push({ name: dep, version, status: 'same', classification: 'retained-registered-binding', changedFiles: retained.changedFiles, missingExports: [], reason: retained.reason, inventorySource });
+      continue;
+    }
+    if (opts.trustedPublicKeyPem !== undefined && branding !== undefined && !branding.coverageVerified) {
+      results.push({ name: dep, version, status: 'unavailable', changedFiles: changed, missingExports: [], reason: branding.reason, inventorySource });
+      continue;
+    }
+    if (branding?.accepted) {
+      results.push({ name: dep, version, status: 'same', classification: 'owner-branding-only', changedFiles: branding.changedFiles, missingExports: [], reason: branding.reason, inventorySource });
+      continue;
+    }
+
     if (changed.length === 0) {
       results.push({ name: dep, version, status: 'same', changedFiles: [], missingExports: [], inventorySource });
     } else {
@@ -493,6 +695,7 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
         version,
         status: 'drift',
         changedFiles: changed,
+        ...(branding !== undefined ? { reason: branding.reason } : {}),
         missingExports: missingExportNames(fetched.dir, workspaceDir),
         inventorySource,
       });

package/src/publish.ts

@@ -415,12 +415,30 @@ export function publishArgv(mode: ProvenanceMode, env: NodeJS.ProcessEnv): strin
   return decideProvenance(mode, env).useProvenance ? base + ' --provenance' : base;
 }
 
-/** Match substrings against package identity and path without including the checkout root. */
+/** Validate exact identities against the unfiltered discovery set before any publish effects. */
+export function validatePublishFilters(
+  filters: readonly string[] | undefined,
+  packages: readonly { name: string }[],
+): void {
+  for (const filter of filters ?? []) {
+    if (!filter.startsWith('=')) continue;
+    const name = filter.slice(1);
+    if (name.length === 0 || /[\s\p{Cc}\p{Cf}=,]/u.test(name)) {
+      throw new Error(`malformed exact --filter token ${JSON.stringify(filter)}: expected =NAME without whitespace, controls, equals or comma`);
+    }
+    if (!packages.some(pkg => pkg.name === name)) {
+      throw new Error(`unknown exact --filter token ${JSON.stringify(filter)}: no discovered package has that name`);
+    }
+  }
+}
+
+/** Match =NAME by literal package identity; other filters retain checkout-relative substrings. */
 export function matchesPublishFilter(
   pkg: { name: string; dir: string },
   filter: string,
   monorepoRoot: string,
 ): boolean {
+  if (filter.startsWith('=')) return pkg.name === filter.slice(1);
   const normalizedFilter = filter.replace(/\\/g, '/');
   const relativeDir = pathRelative(pathResolve(monorepoRoot), pathResolve(pkg.dir));
   // A foreign path must not reintroduce checkout ancestors into the match.
@@ -941,6 +959,7 @@ export function publishPackages(
   }
 
   const packages = discoverPackages(monorepoRoot);
+  validatePublishFilters(opts.filter, packages);
   const results: PublishResult[] = [];
   const registryProbes = new Map<string, RegistryProbe>();
   const matching = opts.filter && opts.filter.length > 0