@evoclock/pi-agentic-driver 0.4.3

package/PROVENANCE.md

@@ -0,0 +1,69 @@
+# Provenance
+
+This repository is the public package source for `@evoclock/pi-agentic-driver`.
+
+- Release 0.1.1 content originates from the reviewed private development
+  repository, qualified through the acceptance environment (fixtures,
+  native tests, live-session checks, and independent model review) before
+  publication. Tarball sha256 for the qualified 0.1.1 artifact:
+  `5ac35b7873d7fa8cd45e718d900d562302f9fbe0fd4bdcbe067718a637f9c946`.
+- This initial public commit adds SPDX headers, the project README, this
+  provenance note, and the package licence metadata; behaviour is unchanged
+  from the qualified artifact. Future releases are built from this
+  repository so each tag matches its tarball exactly.
+- No third-party code is bundled. Concept credit for the cognitive-
+  complexity signals is recorded in the README and the extension
+  description; no code was copied from credited sources.
+- Release 0.2.0 adds the existing reviewed Linux microVM closure. Native
+  qualification on 5 September 2026 used fixture
+  `microvm-220fc33307638cda1d9fd4c6` on `ubuntu-backend` and returned
+  `VERIFIED`. The retained probe marker hash is
+  `043d2846707b67eb4a1e4e577ff070346da881d713b91d0f905da96ea68b4844`;
+  the fixture script hash is
+  `05e9071c027a128c7cd2e20d126fbdd7915d093c9f91047d6fe67d26e01849b1`;
+  and the initramfs hash is
+  `721de3392f8d975cd0c1f46190ee266c7e0cb3c50e93c4af3bc5d411bc8ab523`.
+  The transient domain was checked absent, the initramfs entry was removed,
+  and ACL before/after hashes were equal
+  (`31de5110ae73bbece4c86ea49b0338c2f933ed372a409abc9d8108b3d0f61ebd`).
+  No disk, host share, credentials, GPU, network, authority, or persistent
+  runtime was created. The native macOS Container runtime was separately
+  qualified with local image digest
+  `sha256:0019eef4a42554b1ad94d7c42203a1c58f964714eac60e7d9559742ee3ad494f`;
+  its fixed read-only `/workspace`, no-network `/bin/pwd` probe returned
+  `/workspace` and `--rm` removal was verified. A native macOS Pi adapter is
+  not claimed by this release yet.
+- Release 0.2.1 corrects the isolation mode boundary: microVM/container
+  runtime activation is reserved for planned or automated execution paths and
+  is not ordinary ad-hoc work. The shipped microVM closure remains qualified
+  but activation is deferred until the planned isolation execution path is
+  enabled; the adapter now fails closed when that activation flag is absent.
+- Release 0.3.0 adds AI;DR, a read-only writing-review extension. Its profile
+  is based on the four stated principles of clarity, simplicity, brevity, and
+  humanity, with optional plain-language, analogy, and bullet-structure
+  guidance. It captures the last assistant response for review, preserves
+  code/frontmatter by excluding fenced prose from analysis, and never edits a
+  file automatically; normal confirmed Pi editing remains the write boundary.
+- Release 0.4.0 adds an explicit AI;DR file-apply action and an
+  ASD-STE100-informed advisory profile. The profile checks a bounded set of
+  controlled-English risks; it does not reproduce the licensed approved-word
+  dictionary or certify conformance. ASD-STE100 remains the external
+  controlled-language source; no licensed dictionary text is bundled. For file edits, a caller supplies the
+  proposed replacement; AI;DR shows a bounded diff preview, requires native
+  confirmation, revalidates that the file has not drifted, writes only the
+  exact confirmed replacement, and returns before/after hashes. Last-response
+  and supplied-text reviews remain read-only.
+- Release 0.4.1 hardens Herdr communication for independent concurrent
+  exchanges and repeated terminal history. The transport keeps fixed argv,
+  `shell: false`, trusted repository and role checks, exact-once exchange
+  semantics, bounded process diagnostics, non-authorizing receipts, and
+  strict role-specific report extraction around echoed prompt markers.
+- Release 0.4.2 hardens AI;DR file replacement. Reviews and replacements stay
+  bounded. The write path uses a same-directory temporary file, an atomic
+  rename, drift revalidation, exact byte verification, and cleanup. Apply is
+  available only for files and remains behind native confirmation.
+- Release 0.4.3 removes legacy lifecycle-mode files from the shipped public
+  package. The Linux isolation and Herdr lifecycle interfaces share a small
+  native-TUI predicate and remain fail-closed. This release also adds the
+  portable `templates/AGENTS.md` repository contract. The release artifact is
+  built from this repository revision.

package/README.md

@@ -0,0 +1,325 @@
+# pi-agentic-driver v0.4.3
+
+<p align="center">
+  <img src="assets/Yamagane-origami.png" alt="pi-agentic-driver — Yamagane origami mark" width="140"/>
+</p>
+
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-AGPL%20v3-blue?style=flat" alt="License: AGPL v3"/></a>
+  <img src="https://img.shields.io/badge/version-0.4.3-blue?style=flat" alt="Version 0.4.3"/>
+  <img src="https://img.shields.io/badge/status-active%20development%20%26%20testing-orange?style=flat" alt="Status"/>
+  <img src="https://img.shields.io/badge/JavaScript-F7DF1E?style=flat&logo=javascript&logoColor=black" alt="JavaScript"/>
+  <img src="https://img.shields.io/badge/TypeScript-3178C6?style=flat&logo=typescript&logoColor=white" alt="TypeScript"/>
+  <img src="https://img.shields.io/badge/Python-3776AB?style=flat&logo=python&logoColor=white" alt="Python"/>
+</p>
+
+Without guardrails, an agent can rewrite code that an existing abstraction
+already covers. It can ship to the wrong remote, lose context, or report
+success without evidence. Pi is an excellent agent harness. I need these
+guardrails for the way I work.
+
+**pi-agentic-driver adds these guardrails as Pi extensions. The agent does the
+work. Each extension makes the work verifiable and bounded.** Review happens
+before the agent writes code. Communication carries reports, not authority.
+Isolation proofs verify their own cleanup. Sessions survive compaction and
+handover. Git operations stay exact, confirmed, and protected.
+
+Each capability passes fixture-based acceptance, native tests, live-session
+checks, and independent model review before release. We document each
+extension's restrictions before release.
+
+Extensions for [Pi](https://github.com/earendil-works/pi-coding-agent):
+advisory code review, bounded role communication, and governed isolation
+proofs for agentic workflows.
+
+**Status: active development and testing.** Each extension ships only after
+it passes fixture-based acceptance, native tests, live-session checks, and
+independent model review. You can install released components. This README
+lists pending components for transparency; pending components are not packaged.
+
+## Keeping work bounded
+
+*Extensions that review, route, and bound what an agent does.*
+
+<details>
+<summary><strong>code-phage — advisory code review</strong> <em>(released, 0.1.1)</em></summary>
+
+`code_phage` reviews a proposed change against a stated goal before the agent
+writes or commits code. Given a goal, candidate files, accepted requirements,
+and test paths, it:
+
+- **Finds prior art structurally** — matches exported symbols, function
+  signatures, and dependency imports against a repository inventory, so an
+  agent reuses an existing abstraction instead of writing a parallel version.
+  Word overlap alone never counts. The implementation requires credit (source,
+  version, license) whenever prior art informs it.
+- **Binds an implementation budget** — goal, accepted requirements, write
+  set, and tests become one reviewable budget, with coverage checks that
+  flag unbound requirements and uncovered tests.
+- **Measures diagnostic signals** — per-function cognitive and cyclomatic
+  complexity, line counts, duplication, module-level mutable state,
+  dependency lists, test burden, and a rollback proxy. These are signals
+  for human judgment, never rejection thresholds.
+- **Redirects scope drift** — it names and excludes files that support no
+  accepted requirement, then recommends the smallest coherent write set. The
+  deletion test ("what fails if we remove this?") guards justified complexity
+  from false-positive flagging.
+- **Stays advisory** — it never mutates files, creates tasks, grants
+  authority, or blocks work; every result states `advisoryOnly: true`.
+
+Concept credit: Matty Stratton, "Cognitive Complexity" (2024-09-20, concept
+only, no code copied); `flake8-cognitive-complexity` 0.1.0, MIT (concept
+only, not a runtime dependency).
+
+</details>
+
+**Under development in this theme:**
+
+- **prompted planning lifecycle** — natural-language goals derived into
+  complete semantic proposals with parent/scope choices at native
+  boundaries; no retry loops, no model-supplied identifiers.
+- **native assignment selection** — planned assignments chosen through a
+  native UI over derived candidates, never by model-supplied targets.
+- **inventory refresh** — Git-aware codebase inventory regeneration with
+  verification receipts, so prior-art matching stays honest.
+
+## Communicating without granting authority
+
+*Extensions for bounded coordination between agents and boards.*
+
+<details>
+<summary><strong>herdr-communication — bounded role communication</strong> <em>(released, 0.2.1)</em></summary>
+
+`agentic_herdr_communication` exchanges bounded, marked reports with
+configured Pi worker roles running under [Herdr](https://herdr.dev/)
+0.8.2. Each operation:
+
+- **Lists and observes** worker roles (`list`, `get`) filtered to trusted
+  repositories only — a checked-in registry plus canonical-path validation;
+  the extension denies unlisted or symlink-escaped repositories.
+- **Prompts exactly once** (`prompt`): re-observes the role, sends one
+  bounded prompt with a role-specific report contract, waits for terminal
+  settlement (`idle`/`done`/`blocked`), and reads exactly one latest
+  complete marked report. No retry, no target substitution, no resend on
+  timeout.
+- **Waits and reads** (`wait`, `read`) with the same trust checks for
+  partial journeys.
+- **Grants nothing** — fixed argv with `shell: false`, a pinned executable,
+  the coordinator role class denied, and returns results as untrusted
+  evidence (`nonAuthorizing: true`). It cannot control panes, start agents,
+  run shells, or create authority.
+
+- **Scales to many workers** — the trusted registry accepts up to 32
+  worker repositories, and any dynamic non-coordinator role within them
+  is eligible; `list` observes every live agent in one call. Fan-out is
+  sequential by design: one role per prompt, one complete exchange, no
+  broadcast primitive.
+
+</details>
+
+<details>
+<summary><strong>herdr-lifecycle — role-labelled worker dispatch</strong> <em>(released, 0.2.1)</em></summary>
+
+`agentic_herdr_spawn_worker` turns one natural-language request into Herdr's
+native documented lifecycle. Select `right`, `below`, or `tab`; give the
+worker a safe role label; choose a model from the active Pi model roster; and
+name a trusted repository. The extension:
+
+- creates a right/down split pane or an individual labelled tab;
+- starts exactly one Pi agent in the returned shell pane;
+- verifies the role, model arguments, pane identity and canonical repository;
+- requires native confirmation before changing layout or starting a process;
+- uses fixed argv with `shell: false`, with no arbitrary Herdr or shell surface;
+- returns explicit `pane_created`, `tab_created`, or `agent_started` partial
+  states when only part of the operation succeeds; and
+- never retries, moves, closes, or deletes created state automatically.
+
+![A role-labelled worker spawned in a right-hand pane](assets/spawn-right-pane.png)
+
+The same request can place a worker below the coordinator or retain it in an
+individual tab:
+
+<p>
+  <img src="assets/spawn-below-pane.png" alt="A role-labelled worker spawned below the coordinator" width="49%">
+  <img src="assets/spawn-worker-tab.png" alt="A role-labelled worker spawned in an individual tab" width="49%">
+</p>
+
+See [Dispatching a Multi-Model Workforce from Anywhere](https://evoclock.github.io/fieldnotes/articles/herdr-natural-language-agent-automation.html)
+for the wider task/model-routing and remote-session workflow.
+
+</details>
+
+**Under development in this theme:**
+
+- **project status and state review** — read-only projections of workspace
+  Git state, formal records, and task-state health (`/agentic-status`
+  family).
+- **role-lane routing and warm sessions** — smart model routing sends work
+  to the right model for the job. Separate lanes handle implementation,
+  planning, and review. The router prefers a warm session when a lane already
+  has an established agent, so context and cache survive across tasks. Route
+  affinity is an optimisation, never authority: an incompatible or
+  unavailable lane yields an explicit review-required result, never silent
+  model substitution. Routing grants no dispatch or shell authority.
+- **worker pulse** — liveness observation and dispatch-eligibility
+  observation across role lanes: which agents are alive, what state they
+  are in, and what is ready for work. This observation grants no authority;
+  the system cannot dispatch planned work without it.
+- **task-ledger integration for planned work** — agents read and act
+  within the task ledger's card states (what is dispatchable, in progress,
+  blocked) without owning board authority: no admission, completion,
+  reconciliation, or migration by the agent itself.
+
+## Writing clearly
+
+*AI;DR (AI; Didn't Read) keeps technical writing clear without flattening the writer's voice.*
+
+<details>
+<summary><strong>AI;DR — writing review</strong> <em>(released, 0.4.2)</em></summary>
+
+`agentic_aidr` reviews the last assistant response, supplied prose, or a
+Markdown/documentation file. It checks four principles:
+
+- **Clarity:** keep each sentence focused on one useful idea.
+- **Simplicity:** remove clutter, pompous phrases, and needless jargon.
+- **Brevity:** use fewer words when they carry the same meaning.
+- **Humanity:** keep an authentic human voice.
+
+The `simple` and `ste` modes also run an ASD-STE100-informed profile. The
+profile checks sentence length, direct word choice, precise verbs, and clear
+requirements, permissions, abilities, and conditions. It uses a 20-word target
+for procedural text and a 25-word target for descriptive text. It returns the
+rule and an example for each finding.
+
+Use `simple` for the four principles plus the profile. Use `ste` for a
+profile-focused report. The profile is advisory. It does not include the
+licensed ASD-STE100 approved-word dictionary. It does not certify conformance.
+Check final text against the licensed specification and your project
+terminology list.
+
+AI;DR also flags dense paragraphs, suggests bullets when they reduce working
+memory load, and supports plain-language and analogy modes. Review is
+read-only. An explicit file apply action shows a bounded diff and writes the
+exact proposed replacement only after native confirmation. Release 0.4.2 adds
+bounded inputs, atomic replacement, drift checks, and exact write verification.
+
+</details>
+
+## Executing in isolation
+
+*Extensions that prove automation ran — and stopped — exactly as declared.*
+
+**In development:**
+
+<details>
+<summary><strong>microVM-isolation proof</strong> <em>(qualified, activation deferred)</em></summary>
+
+`agentic_linux_microvm_cutover` is the reviewed native proof for a transient
+QEMU/KVM guest on `linux-backend`. It returns a non-authorizing receipt with
+the marker, hashes, isolation context, checked domain teardown, and ACL
+restoration. The live qualification returned `VERIFIED`.
+
+The system reserves runtime isolation for planned and automated execution
+paths. It excludes runtime isolation from ordinary ad-hoc work. Public
+activation remains deferred until the system enables those paths.
+
+</details>
+
+**Under development in this theme:**
+
+- **native macOS container proof** — the native Apple Container runtime has
+  passed a fixed local `/bin/pwd` isolation qualification. The probe used a
+  read-only repository mount, no network, and automatic removal. The native Pi
+  adapter remains under development and is not yet part of the released
+  package.
+
+- **attended-authority guard** — the safety net between an agent and your
+  shell: when a model tries to delete, overwrite, or push, the guard
+  stops it before execution and asks you. Safe commands (reads, builds,
+  tests) pass through untouched. If you deny, you get a clear reason and
+  the session continues, and the agent does not retry behind your back. In
+  headless runs where no human can confirm, the system refuses destructive
+  commands rather than silently allowing them.
+
+## Managing context pressure, compaction, and avoiding lossy handover
+
+*Extensions for session continuity when context runs out or a session ends.*
+
+**In development:**
+
+- **context-pressure handling** — pressure detection, non-lossy handover,
+  compaction completion without cancellation loops, and continuation of
+  the latest user goal. Development-only until the full live journey
+  passes.
+- **lossless session-reference compaction** — selective, lossless retrieval
+  of exact pre-compaction content, addressing factual degradation across
+  repeated compactions; designed as an optional add-on, not yet
+  implemented.
+
+**Planned in this theme:**
+
+- **handover, checkpoint, and recovery** — durable repository-local
+  handover notes, governed checkpoint mutation, watchdog handoff, and
+  fresh-session resumption that identifies goal, changed files, checks,
+  and next step without executing anything.
+- **evidence ledger** — deterministic evidence indexing, lossless source
+  projection, universal checkpoint produce/store/recover, and run-ledger
+  records with crash and corruption vectors tested.
+- **offline multihost evidence** — record run evidence on each host while
+  disconnected and reconcile it deterministically on reconnection, with no
+  host as sole authority.
+
+## Working with Git safely
+
+*Extensions that keep routine Git low-friction and consequential Git guarded.*
+
+**In development:**
+
+- **git workflow safeguards** — design only. The package contains no Git
+  extension yet. The planned capability covers exact-file staging, native
+  confirmation, post-confirmation drift checks, and protected-operation
+  boundaries.
+- **assignment-aware Git journeys** — merge and protected-push flows bound
+  to a verified assignment, so consequential Git operations carry their
+  own recorded provenance.
+
+## Trust in the extension set itself
+
+*Extensions that keep the installed set honest and the record bounded.*
+
+- **security and integrity scanning** — static scanning of MCP configs,
+  agent skills, and extension packages for hardcoded secrets, prompt and
+  shell injection, data-exfiltration endpoints, untrusted integrations,
+  PII leakage, and OWASP/MCP threat families, with accept/redact/reject
+  decisions. Built on the agent-scanner approach proven in
+  Hillstar Orchestrator and Testudo.
+- **checkpoint storage lifecycle** — compression, deduplication, retention,
+  and purging rules for capsule/index stores once a product ships, so
+  session evidence has a managed lifetime instead of growing without
+  bound.
+- **product knowledge graph** — semantic graph projection of a shipped
+  product's checkpoints, decisions, and artifacts, so the record of what
+  was built stays queryable after active development ends.
+
+Each item lands here as its own extension when its scenario passes
+acceptance with all prohibited effects absent.
+
+### Portable repository contract
+
+`templates/AGENTS.md` is a portable starting contract for repositories that
+use Pi agents. It keeps routine work low-friction, requires bounded tasks and
+realistic tests, and treats reports as non-authorizing evidence. It does not
+overwrite repository-specific instructions or create a second authority store.
+
+## Install
+
+```sh
+pi install <tarball-or-npm-package>
+```
+
+Released extensions load standalone; neither requires the other.
+
+## License
+
+AGPL-3.0-or-later with author-attribution additional terms (Section 7(b));
+see [LICENSE](LICENSE). A commercial licence is available on request.

package/config/herdr-worker-repositories.v1.json

@@ -0,0 +1,9 @@
+{
+  "schema": "agentic-driver.herdr-worker-repositories.v1",
+  "repositories": [
+    "manuscript-reproducibility-coordination",
+    "manuscript-orchestration",
+    "agentic-driver",
+    "pi-agentic-driver"
+  ]
+}

package/extensions/aidr.ts

@@ -0,0 +1,5 @@
+import { registerAidrInterface } from "../scripts/aidr_writing_review.js";
+
+export default function registerAidr(pi: any) {
+  return registerAidrInterface(pi);
+}

package/extensions/code-phage.js

@@ -0,0 +1,144 @@
+// SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {
+  analyzeCodePhage,
+  assessScopeDrift,
+  compareCodePhagePlan,
+} from "../lib/code-phage-core.mjs";
+
+export const CODE_PHAGE_TOOL = "code_phage";
+export const CODE_PHAGE_PARAMETERS = Object.freeze({
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    goal: { type: "string", minLength: 1, maxLength: 4_000 },
+    candidatePaths: {
+      type: "array",
+      maxItems: 64,
+      items: { type: "string", minLength: 1, maxLength: 1_024 },
+    },
+    acceptedRequirements: {
+      type: "array",
+      maxItems: 64,
+      items: { type: "string", minLength: 1, maxLength: 4_000 },
+    },
+    testPaths: {
+      type: "array",
+      maxItems: 64,
+      items: { type: "string", minLength: 1, maxLength: 4_000 },
+    },
+    phase: { type: "string", enum: ["plan", "review"] },
+    credits: {
+      type: "array",
+      maxItems: 64,
+      items: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          source: { type: "string" },
+          version: { type: "string" },
+          license: { type: "string" },
+          accessed: { type: "string" },
+        },
+        required: ["source", "version", "license", "accessed"],
+      },
+    },
+  },
+  required: ["goal"],
+});
+
+function resultText(value) {
+  return JSON.stringify(value, null, 2);
+}
+
+function toolResult(value) {
+  return {
+    content: [{ type: "text", text: resultText(value) }],
+    details: value,
+  };
+}
+
+function pathFromToolCall(event) {
+  const input = event?.input;
+  if (!input || typeof input !== "object") return undefined;
+  const path = input.path ?? input.file_path;
+  return typeof path === "string" ? path : undefined;
+}
+
+export default function codePhage(pi) {
+  const active = {
+    goal: undefined,
+    candidatePaths: [],
+    plan: undefined,
+  };
+
+  pi.on?.("session_start", () => {
+    active.goal = undefined;
+    active.candidatePaths = [];
+    active.plan = undefined;
+  });
+
+  pi.on?.("tool_call", (event, ctx) => {
+    if (!active.goal) return undefined;
+    if (!["write", "edit", "apply_patch", "Write", "Edit"].includes(event?.toolName)) return undefined;
+    const path = pathFromToolCall(event);
+    if (!path) return undefined;
+    let warning;
+    try {
+      warning = assessScopeDrift(active.goal, active.candidatePaths, path);
+    } catch {
+      warning = { status: "possible-drift", path, reason: "the proposed path could not be safely classified" };
+    }
+    if (!warning) return undefined;
+    ctx?.ui?.notify?.(
+      `code-phage: possible scope drift for ${path}. ${warning.reason}. Recheck the accepted goal and deletion test; no action was blocked.`,
+      "warning",
+    );
+    return undefined;
+  });
+
+  pi.registerTool({
+    name: CODE_PHAGE_TOOL,
+    label: "Code Phage",
+    description: "Advisory code-bloat and scope-alignment review. It checks prior art, measures diagnostic complexity signals, compares candidate scope with the stated goal, and never mutates or blocks work.",
+    promptSnippet: "Use before and after bounded implementation work to check prior art, complexity, deletion justification, and scope drift.",
+    promptGuidelines: [
+      "Provide the structural goal, not approval records, leases, hashes, commands, or authority mechanics.",
+      "Treat cognitive complexity, cyclomatic complexity, line count, and duplication as diagnostic signals, not universal rejection thresholds.",
+      "Use the possible scope-drift warning to return to the accepted goal; this tool never blocks or mutates work.",
+    ],
+    parameters: CODE_PHAGE_PARAMETERS,
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      try {
+        const value = analyzeCodePhage({
+          root: ctx?.cwd || process.cwd(),
+          goal: params?.goal,
+          candidatePaths: params?.candidatePaths,
+          phase: params?.phase || "plan",
+          credits: params?.credits,
+          acceptedRequirements: params?.acceptedRequirements,
+          testPaths: params?.testPaths,
+        });
+        if (value.phase === "plan") {
+          active.plan = value;
+        } else {
+          value.comparison = compareCodePhagePlan(active.plan, value);
+        }
+        active.goal = value.goal;
+        active.candidatePaths = value.budget.candidateFiles;
+        return toolResult(value);
+      } catch (error) {
+        return toolResult({
+          schema: "agentic-driver.code-phage.v1",
+          status: "advisory-error",
+          advisoryOnly: true,
+          authorityCreated: false,
+          mutated: false,
+          error: error instanceof Error ? error.message : String(error),
+          nextAction: "Correct the structural goal or repository context; no source mutation was performed.",
+        });
+      }
+    },
+  });
+}

package/extensions/herdr-communication.ts

@@ -0,0 +1,7 @@
+// SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+export default async function herdrCommunicationPi(pi) {
+  const module = await import(new URL("../scripts/enforcement/herdr_communication_pi.js", import.meta.url).href);
+  return module.registerHerdrCommunicationInterface(pi);
+}

package/extensions/herdr-lifecycle.ts

@@ -0,0 +1,7 @@
+// SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+export default async function herdrLifecyclePi(pi) {
+  const module = await import(new URL("../scripts/enforcement/herdr_lifecycle_pi.js", import.meta.url).href);
+  return module.registerHerdrLifecycleInterface(pi);
+}

package/extensions/linux-microvm.ts

@@ -0,0 +1,10 @@
+import { registerLinuxMicroVMCutoverInterface } from "../scripts/enforcement/linux_microvm_cutover_pi.js";
+
+export default function registerLinuxMicroVMCutover(pi: any) {
+  // Registration is limited to the activation-deferred cutover interface:
+  // native confirmation, trusted facts, and fixed boundaries are preserved by
+  // the interface itself; the transient runtime is local to this
+  // registration and only carries adapter state it observes at cutover time.
+  const runtime: { workMode?: string; workContext?: unknown; isolationEnabled?: boolean } = {};
+  return registerLinuxMicroVMCutoverInterface(pi, { runtime });
+}