@gate-forge/core 0.6.0 → 0.6.2

package/dist/index.js

@@ -168,6 +168,13 @@ export { CauseCodeSchema, CAUSE_NEXT_ACTIONS } from './schemas/verdict.js';
  * feature off (opt-in); agent edits never self-approve a disposition.
  */
 export { COVERAGE_OPERATIONS, CoverageOperationSchema, CoveragePolicySchema, CoverageTableSchema, CoverageDispositionSchema, } from './schemas/coverage-policy.js';
+/**
+ * Staged-runtime configuration (plan 2026-09-21 witnessed pre-commit):
+ * the owner-reviewed `.gateforge/runtime.yml` — dependency preparation,
+ * sanctioned dependency reuse, and candidate-owned services with
+ * readiness probes. Security-sensitive: trusted-policy digest input.
+ */
+export { RuntimeConfigSchema, RuntimeServiceSchema, RuntimeReadinessSchema, isNormalizedRepoRelativePath, SERVICE_PORT_PLACEHOLDER, SERVICE_URL_PLACEHOLDER, DEFAULT_PREPARE_TIMEOUT_SECONDS, DEFAULT_READY_TIMEOUT_SECONDS, } from './schemas/runtime-config.js';
 /**
  * Behavior policy / catalog / evidence (plan 2026-09-19): owner-approved
  * complete-behavior cases. Absence of the document preserves basic
@@ -308,10 +315,11 @@ export { ClassificationSignalSchema, signalId, SignalTargetSchema, SignalDimensi
 /**
  * ClassificationPolicy: the `classification-policy.yml` document —
  * scan roots, trusted internal entry-point categories, organization
- * internal rules (certificate inputs, never overrides), supported
- * declaration syntax, and volatile fields.
+ * internal rules (certificate inputs, never overrides), exact owner
+ * lifecycle rules (closed-world disables), supported declaration syntax,
+ * and volatile fields.
  */
-export { ClassificationPolicySchema, InternalEntryPointCategorySchema, InternalRuleSchema, InternalRuleMatchSchema, } from './schemas/classification-policy.js';
+export { ClassificationPolicySchema, InternalEntryPointCategorySchema, InternalRuleSchema, InternalRuleMatchSchema, LifecycleRuleMatchSchema, LifecycleRuleSchema, LifecycleRulesSchema, LIFECYCLE_OPERATIONS, sortLifecycleRules, } from './schemas/classification-policy.js';
 /**
  * The deterministic conservative classifier (ADR 0003 D2):
  * `classifyResources()` resolves signals into effective classifications

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAuB,MAAM,iBAAiB,CAAC;AAElE;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE7D;;;;;;;;GAQG;AACH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,sDAAsD;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,qDAAqD;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,gEAAgE;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAQ9G;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQvF;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMrE;;;;GAIG;AACH,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAM/B;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMtE;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7E;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMxG;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI3E;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAStC;;;;;GAKG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAc5B;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAI9D;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAoCnC;;;GAGG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;2EAC2E;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAI7D,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAQvG;;;;GAIG;AACH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAOnF,wEAAwE;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;GAIG;AACH,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,8EAA8E;AAC9E,gEAAgE;AAChE,oEAAoE;AACpE,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAIxD,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpI,oDAAoD;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAI/D,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,8DAA8D;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAIzD,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AASlF,6DAA6D;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAM1F,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,sEAAsE;AACtE,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAIlM;;;;;GAKG;AACH,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAI5C;;;;;GAKG;AACH,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,EAC7B,iCAAiC,EACjC,6BAA6B,EAC7B,WAAW,EACX,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAe/B,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,iEAAiE;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI1D,0EAA0E;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAIjE,4EAA4E;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAU3D;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAM3B;;;;;;;GAOG;AACH,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIxG,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,oBAAoB,GAKrB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACb,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE/F;;;GAGG;AACH,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GAKtB,MAAM,oBAAoB,CAAC;AAE5B,uEAAuE;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,mEAAmE;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI9F;;;;;;;GAOG;AACH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAYvC;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI/G;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAarG,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAElE,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAM1D,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,kEAAkE;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,qEAAqE;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,gEAAgE;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,0EAA0E;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAG7F,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACvF,yEAAyE;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D;;;;;GAKG;AACH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAElG,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,uEAAuE;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUhD,8EAA8E;AAC9E,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI5E;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAItD;;;;;GAKG;AACH,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,GACR,MAAM,oBAAoB,CAAC;AAI5B;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAW5B;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAY9C;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAuB,MAAM,iBAAiB,CAAC;AAElE;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE7D;;;;;;;;GAQG;AACH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,sDAAsD;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,qDAAqD;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,gEAAgE;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAQ9G;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQvF;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMrE;;;;GAIG;AACH,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAM/B;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMtE;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7E;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMxG;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI3E;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAStC;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAIrC;;;;;GAKG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAc5B;;;GAGG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAI9D;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAoCnC;;;GAGG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;2EAC2E;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAI7D,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAQvG;;;;GAIG;AACH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAOnF,wEAAwE;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;GAIG;AACH,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,8EAA8E;AAC9E,gEAAgE;AAChE,oEAAoE;AACpE,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAItD;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAIxD,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpI,oDAAoD;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAI/D,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,8DAA8D;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAIzD,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AASlF,6DAA6D;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAM1F,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,sEAAsE;AACtE,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAIlM;;;;;;GAMG;AACH,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAY5C;;;;;GAKG;AACH,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,EAC7B,iCAAiC,EACjC,6BAA6B,EAC7B,WAAW,EACX,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAe/B,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,iEAAiE;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI1D,0EAA0E;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAIjE,4EAA4E;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAU3D;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAM3B;;;;;;;GAOG;AACH,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIxG,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,wEAAwE;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,oBAAoB,GAKrB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACb,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE/F;;;GAGG;AACH,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GAKtB,MAAM,oBAAoB,CAAC;AAE5B,uEAAuE;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,mEAAmE;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI9F;;;;;;;GAOG;AACH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAYvC;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI/G;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAarG,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAElE,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAM1D,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,kEAAkE;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,qEAAqE;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,gEAAgE;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,0EAA0E;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAG7F,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACvF,yEAAyE;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D;;;;;GAKG;AACH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAElG,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,uEAAuE;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUhD,8EAA8E;AAC9E,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI5E;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAItD;;;;;GAKG;AACH,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,GACR,MAAM,oBAAoB,CAAC;AAI5B;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAW5B;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAY9C;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC"}

package/dist/policy/evaluate.d.ts

@@ -95,6 +95,8 @@ export declare const BlockingEntrySchema: z.ZodObject<{
         OBSERVATION_SCOPE_INCOMPLETE: "OBSERVATION_SCOPE_INCOMPLETE";
         BEHAVIOR_UNEXPECTED_EFFECT: "BEHAVIOR_UNEXPECTED_EFFECT";
         ENFORCEMENT_BOUNDARY_UNVERIFIED: "ENFORCEMENT_BOUNDARY_UNVERIFIED";
+        RUNTIME_PREPARATION_FAILED: "RUNTIME_PREPARATION_FAILED";
+        RUNTIME_READINESS_FAILED: "RUNTIME_READINESS_FAILED";
     }>>>;
     nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strict>;
@@ -215,6 +217,8 @@ export declare const PolicyEvaluationResultSchema: z.ZodObject<{
             OBSERVATION_SCOPE_INCOMPLETE: "OBSERVATION_SCOPE_INCOMPLETE";
             BEHAVIOR_UNEXPECTED_EFFECT: "BEHAVIOR_UNEXPECTED_EFFECT";
             ENFORCEMENT_BOUNDARY_UNVERIFIED: "ENFORCEMENT_BOUNDARY_UNVERIFIED";
+            RUNTIME_PREPARATION_FAILED: "RUNTIME_PREPARATION_FAILED";
+            RUNTIME_READINESS_FAILED: "RUNTIME_READINESS_FAILED";
         }>>>;
         nextAction: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strict>>;

package/dist/policy/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAmErF"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAmErF"}

package/dist/schemas/classification-policy.d.ts

@@ -32,6 +32,46 @@ export declare const InternalRuleSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** Inferred internal-rule shape. */
 export type InternalRule = z.infer<typeof InternalRuleSchema>;
+/** Lifecycle operations an owner may explicitly disable for one resource. */
+export declare const LIFECYCLE_OPERATIONS: readonly ["create", "read", "update", "delete"];
+/** Union of owner lifecycle operation names. */
+export type LifecycleOperation = (typeof LIFECYCLE_OPERATIONS)[number];
+/** Exact resource match for an owner lifecycle rule. */
+export declare const LifecycleRuleMatchSchema: z.ZodObject<{
+    resourceId: z.ZodString;
+}, z.core.$strict>;
+/** Inferred lifecycle-rule match shape. */
+export type LifecycleRuleMatch = z.infer<typeof LifecycleRuleMatchSchema>;
+/** One owner policy rule disabling selected operations for one exact resource. */
+export declare const LifecycleRuleSchema: z.ZodObject<{
+    match: z.ZodObject<{
+        resourceId: z.ZodString;
+    }, z.core.$strict>;
+    disable: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        read: "read";
+        update: "update";
+        delete: "delete";
+    }>>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+/** Inferred lifecycle-rule shape. */
+export type LifecycleRule = z.infer<typeof LifecycleRuleSchema>;
+/** Lifecycle rules with duplicate exact identities rejected as ambiguous. */
+export declare const LifecycleRulesSchema: z.ZodArray<z.ZodObject<{
+    match: z.ZodObject<{
+        resourceId: z.ZodString;
+    }, z.core.$strict>;
+    disable: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        read: "read";
+        update: "update";
+        delete: "delete";
+    }>>;
+    reason: z.ZodString;
+}, z.core.$strict>>;
+/** Deterministic rule ordering for authority minting and explanations. */
+export declare function sortLifecycleRules(rules: readonly LifecycleRule[]): LifecycleRule[];
 /**
  * One coverage requirement (red-team round 3): the named detector must
  * report examining every applicable file for a scan to count as COMPLETE.
@@ -70,6 +110,18 @@ export declare const ClassificationPolicySchema: z.ZodObject<{
         }, z.core.$strict>;
         reason: z.ZodString;
     }, z.core.$strict>>;
+    lifecycleRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        match: z.ZodObject<{
+            resourceId: z.ZodString;
+        }, z.core.$strict>;
+        disable: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            read: "read";
+            update: "update";
+            delete: "delete";
+        }>>;
+        reason: z.ZodString;
+    }, z.core.$strict>>>;
     coverage: z.ZodOptional<z.ZodArray<z.ZodObject<{
         capability: z.ZodString;
         detector: z.ZodString;

package/dist/schemas/classification-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification-policy.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,wEAAwE;AACxE,eAAO,MAAM,gCAAgC;;;;kBAmBlC,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;kBAUhC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB;;;;;;kBAOpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAyBpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;kBAmC5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"classification-policy.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,wEAAwE;AACxE,eAAO,MAAM,gCAAgC;;;;kBAmBlC,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;kBAUhC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB;;;;;;kBAOpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,iDAAkD,CAAC;AAEpF,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAiBvE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB;;kBAK1B,CAAC;AAEZ,2CAA2C;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,kFAAkF;AAClF,eAAO,MAAM,mBAAmB;;;;;;;;;;;kBAkCrB,CAAC;AAEZ,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;mBAoB7B,CAAC;AAEL,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAQnF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAyBpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqC5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/classification-policy.js

@@ -7,6 +7,7 @@
  * NEVER proves internality, ADR 0003 D2 exposure rule 3).
  */
 import { z } from 'zod';
+import { compareStrings } from '../graph/util.js';
 import { SchemaVersionField } from './common.js';
 /** One trusted internal entry-point category (worker, migration, …). */
 export const InternalEntryPointCategorySchema = z
@@ -50,6 +51,96 @@ export const InternalRuleSchema = z
     reason: z.string().min(1),
 })
     .strict();
+/** Lifecycle operations an owner may explicitly disable for one resource. */
+export const LIFECYCLE_OPERATIONS = ['create', 'read', 'update', 'delete'];
+/** Exact plane-qualified resource identity used by lifecycle policy rules. */
+const ExactResourceIdSchema = z
+    .string()
+    .min(1, 'resourceId must not be empty')
+    .refine((value) => value === value.trim(), {
+    message: 'resourceId must not have leading or trailing whitespace',
+})
+    .regex(/^(?:tenant|master|global)\.[^.:/\\\s]+$/, "resourceId must be an exact '<plane>.<resource>' identity without wildcards, paths, or delimiters")
+    .refine((value) => !/[?*\[\]{}]/.test(value), {
+    message: 'resourceId must not contain wildcard or pattern characters',
+});
+/** Exact resource match for an owner lifecycle rule. */
+export const LifecycleRuleMatchSchema = z
+    .object({
+    /** Plane-qualified resource id; globs and bare names are unsafe here. */
+    resourceId: ExactResourceIdSchema,
+})
+    .strict();
+/** One owner policy rule disabling selected operations for one exact resource. */
+export const LifecycleRuleSchema = z
+    .object({
+    /** Exact resource identity this rule applies to. */
+    match: LifecycleRuleMatchSchema,
+    /** Operations that are structurally unavailable for the matched resource. */
+    disable: z
+        .array(z.enum(LIFECYCLE_OPERATIONS))
+        .min(1, 'disable must list at least one lifecycle operation')
+        .superRefine((operations, ctx) => {
+        const seen = new Set();
+        for (let index = 0; index < operations.length; index += 1) {
+            const operation = operations[index];
+            if (operation === undefined)
+                continue;
+            if (seen.has(operation)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [index],
+                    message: `duplicate disabled lifecycle operation '${operation}'`,
+                });
+            }
+            seen.add(operation);
+        }
+    }),
+    /** Owner explanation rendered in classifier traces and diagnostics. */
+    reason: z
+        .string()
+        .min(1, 'reason must not be empty')
+        .refine((value) => value === value.trim(), {
+        message: 'reason must not have leading or trailing whitespace',
+    })
+        .refine((value) => !/[\u0000-\u001f\u007f]/.test(value), {
+        message: 'reason must not contain control characters',
+    }),
+})
+    .strict();
+/** Lifecycle rules with duplicate exact identities rejected as ambiguous. */
+export const LifecycleRulesSchema = z
+    .array(LifecycleRuleSchema)
+    .superRefine((rules, ctx) => {
+    const seen = new Map();
+    for (let index = 0; index < rules.length; index += 1) {
+        const resourceId = rules[index]?.match.resourceId;
+        if (resourceId === undefined)
+            continue;
+        const first = seen.get(resourceId);
+        if (first !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [index, 'match', 'resourceId'],
+                message: `duplicate lifecycle rule for '${resourceId}' (already declared at index ${first}); ` +
+                    'one exact identity must have one unambiguous rule',
+            });
+        }
+        else {
+            seen.set(resourceId, index);
+        }
+    }
+});
+/** Deterministic rule ordering for authority minting and explanations. */
+export function sortLifecycleRules(rules) {
+    const order = new Map(LIFECYCLE_OPERATIONS.map((operation, index) => [operation, index]));
+    return [...rules]
+        .map((rule) => ({
+        ...rule,
+        disable: [...rule.disable].sort((a, b) => (order.get(a) ?? 0) - (order.get(b) ?? 0)),
+    }))
+        .sort((a, b) => compareStrings(a.match.resourceId, b.match.resourceId));
+}
 /**
  * One coverage requirement (red-team round 3): the named detector must
  * report examining every applicable file for a scan to count as COMPLETE.
@@ -105,6 +196,8 @@ export const ClassificationPolicySchema = z
     trustedInternalEntryPoints: z.array(InternalEntryPointCategorySchema),
     /** Organization internal rules — certificate inputs, never overrides. */
     internalRules: z.array(InternalRuleSchema),
+    /** Exact owner lifecycle disables; suppressive effects require scan proof. */
+    lifecycleRules: LifecycleRulesSchema.optional(),
     /**
      * Coverage requirements for COMPLETE-scan proofs (ADR 0003 D4). A
      * closed-world attestation holds only when every rule's detector is

package/dist/schemas/classification-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAKpF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;KACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,yDAAyD;CACnE,CAAC;KACD,KAAK,CACJ,yCAAyC,EACzC,mGAAmG,CACpG;KACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,wDAAwD;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,yEAAyE;IACzE,UAAU,EAAE,qBAAqB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,oDAAoD;IACpD,KAAK,EAAE,wBAAwB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,EAAE,oDAAoD,CAAC;SAC5D,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C,SAAS,GAAG;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACJ,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,KAAK,CAAC,mBAAmB,CAAC;KAC1B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;gBACpC,OAAO,EACL,iCAAiC,UAAU,gCAAgC,KAAK,KAAK;oBACrF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA+B;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAiB,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/runtime-config.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Staged-runtime configuration schema (plan 2026-09-21 witnessed
+ * pre-commit): the OWNER-REVIEWED document describing how a materialized
+ * staged candidate becomes a runnable runtime — dependency preparation,
+ * dependency reuse, and candidate-owned application/database/worker
+ * services with readiness probes. The document is security-sensitive:
+ * it participates in the trusted policy digest and the authenticated
+ * input snapshot, so a candidate that edits its own runtime commands
+ * cannot approve the edit in the same commit (a provisioned pin rejects
+ * the self-approved revision before any test runs).
+ */
+import { z } from 'zod';
+/**
+ * Checks that a runtime reuse path is a canonical repository-relative POSIX
+ * path. Backslashes are rejected so the same document has one meaning on
+ * POSIX and Windows hosts.
+ *
+ * Args:
+ *   value: the configured reuse path.
+ *
+ * Returns:
+ *   boolean: true when the path has no traversal, empty, or dot segments.
+ */
+export declare function isNormalizedRepoRelativePath(value: string): boolean;
+/** Placeholder referencing a supervisor-assigned service port. */
+export declare const SERVICE_PORT_PLACEHOLDER = "${service:<id>:port}";
+/** Placeholder referencing a supervisor-assigned service base URL. */
+export declare const SERVICE_URL_PLACEHOLDER = "${service:<id>:url}";
+/** Default budget for one preparation command, in seconds. */
+export declare const DEFAULT_PREPARE_TIMEOUT_SECONDS = 600;
+/** Default budget for one service readiness probe, in seconds. */
+export declare const DEFAULT_READY_TIMEOUT_SECONDS = 60;
+/**
+ * One service readiness probe: a log line matching `log` (regex source
+ * over the captured stdout+stderr) OR an `http` GET returning 2xx.
+ * Exactly one kind must be declared.
+ */
+export declare const RuntimeReadinessSchema: z.ZodObject<{
+    log: z.ZodOptional<z.ZodString>;
+    http: z.ZodOptional<z.ZodString>;
+    timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+/** Inferred readiness shape. */
+export type RuntimeReadiness = z.infer<typeof RuntimeReadinessSchema>;
+/**
+ * One candidate-owned service (application, database, worker). The
+ * supervisor assigns a free loopback port per service and exposes it to
+ * commands through `${service:<id>:port}` / `${service:<id>:url}`
+ * placeholders (substituted into `command`, `env` values, and readiness
+ * URLs BEFORE spawn). `attested` fronts the service with the gate's
+ * loopback attestation proxy and REQUIRES `fingerprint` — the
+ * environment marker the proxy stamps and reviewed adapters must
+ * declare (GF-13). `target` marks the attested service whose proxy URL
+ * becomes the run's attested target (at most one per document).
+ */
+export declare const RuntimeServiceSchema: z.ZodObject<{
+    id: z.ZodString;
+    command: z.ZodString;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    attested: z.ZodOptional<z.ZodBoolean>;
+    fingerprint: z.ZodOptional<z.ZodString>;
+    target: z.ZodOptional<z.ZodBoolean>;
+    ready: z.ZodObject<{
+        log: z.ZodOptional<z.ZodString>;
+        http: z.ZodOptional<z.ZodString>;
+        timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Inferred service shape. */
+export type RuntimeService = z.infer<typeof RuntimeServiceSchema>;
+/**
+ * The `.gateforge/runtime.yml` document. ABSENT means the owner has not
+ * declared a staged runtime: pre-commit then runs with NO dependency
+ * bridge and NO services (fail closed — discovery needing installed
+ * dependencies blocks honestly instead of silently reusing the
+ * worktree's environment).
+ */
+export declare const RuntimeConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    prepare: z.ZodOptional<z.ZodObject<{
+        command: z.ZodOptional<z.ZodString>;
+        reuse: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    services: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        command: z.ZodString;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        attested: z.ZodOptional<z.ZodBoolean>;
+        fingerprint: z.ZodOptional<z.ZodString>;
+        target: z.ZodOptional<z.ZodBoolean>;
+        ready: z.ZodObject<{
+            log: z.ZodOptional<z.ZodString>;
+            http: z.ZodOptional<z.ZodString>;
+            timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
+    envAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    executionTimeoutSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+/** Inferred runtime document shape. */
+export type RuntimeConfig = z.infer<typeof RuntimeConfigSchema>;
+//# sourceMappingURL=runtime-config.d.ts.map

package/dist/schemas/runtime-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-config.d.ts","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMnE;AAUD,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;kBAgB/B,CAAC;AAEL,gCAAgC;AAChC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;kBA0B7B,CAAC;AAEL,8BAA8B;AAC9B,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;kBAiD5B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/runtime-config.js

@@ -0,0 +1,168 @@
+/**
+ * Staged-runtime configuration schema (plan 2026-09-21 witnessed
+ * pre-commit): the OWNER-REVIEWED document describing how a materialized
+ * staged candidate becomes a runnable runtime — dependency preparation,
+ * dependency reuse, and candidate-owned application/database/worker
+ * services with readiness probes. The document is security-sensitive:
+ * it participates in the trusted policy digest and the authenticated
+ * input snapshot, so a candidate that edits its own runtime commands
+ * cannot approve the edit in the same commit (a provisioned pin rejects
+ * the self-approved revision before any test runs).
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+/**
+ * Checks that a runtime reuse path is a canonical repository-relative POSIX
+ * path. Backslashes are rejected so the same document has one meaning on
+ * POSIX and Windows hosts.
+ *
+ * Args:
+ *   value: the configured reuse path.
+ *
+ * Returns:
+ *   boolean: true when the path has no traversal, empty, or dot segments.
+ */
+export function isNormalizedRepoRelativePath(value) {
+    if (value.length === 0 || value.includes('\\') || value.includes('\0'))
+        return false;
+    if (value.startsWith('/') || /^[A-Za-z]:/.test(value))
+        return false;
+    const segments = value.split('/');
+    if (segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..'))
+        return false;
+    return segments.join('/') === value;
+}
+/** Schema for one dependency directory explicitly reused by a staged run. */
+const RuntimeReusePathSchema = z
+    .string()
+    .min(1)
+    .refine(isNormalizedRepoRelativePath, {
+    message: 'reuse path must be a normalized repository-relative path without traversal',
+});
+/** Placeholder referencing a supervisor-assigned service port. */
+export const SERVICE_PORT_PLACEHOLDER = '${service:<id>:port}';
+/** Placeholder referencing a supervisor-assigned service base URL. */
+export const SERVICE_URL_PLACEHOLDER = '${service:<id>:url}';
+/** Default budget for one preparation command, in seconds. */
+export const DEFAULT_PREPARE_TIMEOUT_SECONDS = 600;
+/** Default budget for one service readiness probe, in seconds. */
+export const DEFAULT_READY_TIMEOUT_SECONDS = 60;
+/**
+ * One service readiness probe: a log line matching `log` (regex source
+ * over the captured stdout+stderr) OR an `http` GET returning 2xx.
+ * Exactly one kind must be declared.
+ */
+export const RuntimeReadinessSchema = z
+    .object({
+    log: z.string().min(1).optional(),
+    http: z.string().min(1).optional(),
+    timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+})
+    .strict()
+    .superRefine((ready, ctx) => {
+    const kinds = [ready.log !== undefined, ready.http !== undefined].filter(Boolean).length;
+    if (kinds !== 1) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['log'],
+            message: "readiness requires exactly one of 'log' (regex source) or 'http' (2xx GET url)",
+        });
+    }
+});
+/**
+ * One candidate-owned service (application, database, worker). The
+ * supervisor assigns a free loopback port per service and exposes it to
+ * commands through `${service:<id>:port}` / `${service:<id>:url}`
+ * placeholders (substituted into `command`, `env` values, and readiness
+ * URLs BEFORE spawn). `attested` fronts the service with the gate's
+ * loopback attestation proxy and REQUIRES `fingerprint` — the
+ * environment marker the proxy stamps and reviewed adapters must
+ * declare (GF-13). `target` marks the attested service whose proxy URL
+ * becomes the run's attested target (at most one per document).
+ */
+export const RuntimeServiceSchema = z
+    .object({
+    id: z.string().regex(/^[a-z][a-z0-9-]*$/, 'service id must be lowercase kebab-case'),
+    command: z.string().min(1),
+    env: z.record(z.string(), z.string()).optional(),
+    attested: z.boolean().optional(),
+    fingerprint: z.string().min(1).optional(),
+    target: z.boolean().optional(),
+    ready: RuntimeReadinessSchema,
+})
+    .strict()
+    .superRefine((service, ctx) => {
+    if (service.attested === true && service.fingerprint === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['fingerprint'],
+            message: `attested service '${service.id}' requires 'fingerprint' (the GF-13 environment marker the proxy stamps)`,
+        });
+    }
+    if (service.target === true && service.attested !== true) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['target'],
+            message: `service '${service.id}' marks target: true — only an attested service can be the attested target`,
+        });
+    }
+});
+/**
+ * The `.gateforge/runtime.yml` document. ABSENT means the owner has not
+ * declared a staged runtime: pre-commit then runs with NO dependency
+ * bridge and NO services (fail closed — discovery needing installed
+ * dependencies blocks honestly instead of silently reusing the
+ * worktree's environment).
+ */
+export const RuntimeConfigSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Preparation executed INSIDE the materialized candidate checkout. */
+    prepare: z
+        .object({
+        /** Command to run in the checkout (package-manager install, build). */
+        command: z.string().min(1).optional(),
+        /**
+         * Repo-relative dependency directories explicitly allowed to be
+         * reused from the user repository (linked, never copied as
+         * candidate source). The ONLY sanctioned dependency bridge.
+         */
+        reuse: z.array(RuntimeReusePathSchema).optional(),
+        timeoutSeconds: z.number().int().min(1).max(3600).optional(),
+    })
+        .strict()
+        .optional(),
+    /** Candidate-owned services to start, probe, and clean up. */
+    services: z.array(RuntimeServiceSchema).optional(),
+    /** Operator environment variable names allowed through to commands/services. */
+    envAllowlist: z.array(z.string().min(1)).optional(),
+    /** Whole-run execution budget handed to the supervised gate. */
+    executionTimeoutSeconds: z.number().int().min(1).max(3600).optional(),
+})
+    .strict()
+    .superRefine((runtime, ctx) => {
+    const services = runtime.services ?? [];
+    const seen = new Set();
+    for (let index = 0; index < services.length; index += 1) {
+        const service = services[index];
+        if (service === undefined)
+            continue;
+        if (seen.has(service.id)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['services', index, 'id'],
+                message: `duplicate service id '${service.id}' — service addressing must be unambiguous`,
+            });
+        }
+        seen.add(service.id);
+    }
+    const targets = services.filter((service) => service.target === true);
+    if (targets.length > 1) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['services'],
+            message: `at most one service may mark target: true (got ${String(targets.length)})`,
+        });
+    }
+});
+//# sourceMappingURL=runtime-config.js.map

package/dist/schemas/runtime-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-config.js","sourceRoot":"","sources":["../../src/schemas/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1G,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,4BAA4B,EAAE;IACpC,OAAO,EAAE,4EAA4E;CACtF,CAAC,CAAC;AAEL,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,gFAAgF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,sBAAsB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,EAAE,0EAA0E;SACnH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,YAAY,OAAO,CAAC,EAAE,4EAA4E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uEAAuE;IACvE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,uEAAuE;QACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC;;;;WAIG;QACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC7D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAClD,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,gEAAgE;IAChE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC/B,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,4CAA4C;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,kDAAkD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;SACrF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/verdict.d.ts

@@ -70,6 +70,8 @@ export declare const CauseCodeSchema: z.ZodEnum<{
     OBSERVATION_SCOPE_INCOMPLETE: "OBSERVATION_SCOPE_INCOMPLETE";
     BEHAVIOR_UNEXPECTED_EFFECT: "BEHAVIOR_UNEXPECTED_EFFECT";
     ENFORCEMENT_BOUNDARY_UNVERIFIED: "ENFORCEMENT_BOUNDARY_UNVERIFIED";
+    RUNTIME_PREPARATION_FAILED: "RUNTIME_PREPARATION_FAILED";
+    RUNTIME_READINESS_FAILED: "RUNTIME_READINESS_FAILED";
 }>;
 /** Inferred cause-code union. */
 export type CauseCode = z.infer<typeof CauseCodeSchema>;

package/dist/schemas/verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8B1B,CAAC;AAEH,iCAAiC;AACjC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CA2CjE,CAAC"}
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgC1B,CAAC;AAEH,iCAAiC;AACjC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAiDjE,CAAC"}

package/dist/schemas/verdict.js

@@ -68,6 +68,8 @@ export const CauseCodeSchema = z.enum([
     'OBSERVATION_SCOPE_INCOMPLETE',
     'BEHAVIOR_UNEXPECTED_EFFECT',
     'ENFORCEMENT_BOUNDARY_UNVERIFIED',
+    'RUNTIME_PREPARATION_FAILED',
+    'RUNTIME_READINESS_FAILED',
 ]);
 /**
  * The plan §5.4 next action per cause code. Text, JSON, and SARIF
@@ -109,5 +111,9 @@ export const CAUSE_NEXT_ACTIONS = Object.freeze({
     OBSERVATION_SCOPE_INCOMPLETE: 'Supply a working trusted observer or fix collection',
     BEHAVIOR_UNEXPECTED_EFFECT: 'Fix application side effect',
     ENFORCEMENT_BOUNDARY_UNVERIFIED: 'Owner provisions/verifies runtime',
+    RUNTIME_PREPARATION_FAILED: 'Repair the tracked `runtime.prepare` command (its failure log is under run state `runtime/`) — ' +
+        'the candidate runtime must build or install before the gate can execute',
+    RUNTIME_READINESS_FAILED: 'Repair the tracked `runtime.services` command or readiness probe — the candidate ' +
+        'runtime must become ready before evidence is trusted',
 });
 //# sourceMappingURL=verdict.js.map