@holoscript/holosystem 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HoloScript ecosystem (Joseph, founder).
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,105 @@
+# @holoscript/holosystem
+
+Create and inspect a portable HoloSystem consumer configuration from public npm
+and PyPI package contracts. The package is for external founders, agent
+operators, and cold consumers who need a small bootstrap contract without a
+private workspace or machine-specific defaults.
+
+```bash
+npm install @holoscript/holosystem
+npx holosystem create --id acme-founder --workspace acme --json
+npx holosystem inspect holosystem.config.json --json
+```
+
+## What It Creates
+
+The default configuration pins public contracts for:
+
+- `@holoscript/agent-runtime` for provider-neutral agent execution;
+- `@holoscript/memory` for caller-owned memory;
+- `@holoscript/holorepo` for JavaScript repository, database, and knowledge custody;
+- `holoscript-holorepo` for the matching Python custody surface.
+
+It also names caller-owned environment bindings for storage, memory, knowledge,
+and authority. Only environment key names are stored. Credential values,
+connection details, and private operator state are never configuration fields.
+
+## API
+
+```js
+import { createHoloSystemConfig, inspectHoloSystemConfig } from '@holoscript/holosystem';
+
+const config = createHoloSystemConfig({
+  consumerId: 'acme-founder',
+  workspace: 'acme',
+});
+
+const report = inspectHoloSystemConfig(config);
+if (!report.ready) {
+  console.error(report.errors);
+  process.exitCode = 2;
+}
+```
+
+`createHoloSystemConfig(options?)` returns deterministic JSON data. Callers may
+supply their own exact public package contracts and caller-owned binding map.
+The function fails closed when its result does not pass inspection.
+
+`inspectHoloSystemConfig(config)` is pure and secret-safe. It reports named
+checks for schema, identity, public contracts, caller bindings, portability,
+bounded operations, and fresh receipt policy. Reports summarize package names,
+versions, roles, and environment key names; they do not echo unknown config
+values.
+
+## CLI
+
+```bash
+# Write holosystem.config.json. Existing files require explicit --force.
+npx holosystem create --id acme-founder --workspace acme
+
+# Send the config to another agent without writing a file.
+npx holosystem create --stdout
+
+# Human-readable gate output.
+npx holosystem inspect holosystem.config.json
+
+# Machine-readable receipt. Exit code 2 means the config failed inspection.
+npx holosystem inspect holosystem.config.json --json
+
+# Pipeline input is supported.
+npx holosystem create --stdout | npx holosystem inspect - --json
+```
+
+Creation never installs packages, connects to storage, acquires credentials, or
+mutates services. Those actions belong to the selected public packages and the
+operator's own adapters. The CLI only writes the requested configuration file;
+inspection is read-only.
+
+## Consumption Contract
+
+Consumers bring their own configuration, credentials, Postgres storage,
+knowledge and authority adapters, receipt sink, and runtime host. Environment
+variables reference that caller-owned state. The package does not ship or
+assume founder-local paths, private repositories, private process, a specific
+machine, or a hosted provider.
+
+The portability gate rejects:
+
+- local, Git, URL, or floating package specs instead of pinned registry releases;
+- missing npm or PyPI custody roles;
+- absolute receipt paths or parent traversal;
+- embedded password, secret, token, private-key, or connection-string fields;
+- non-caller binding ownership;
+- unbounded autonomy, missing stop conditions, or stale receipt policy.
+
+Agent-operable evidence is the `inspect --json` receipt. Before release, run the
+package check, an npm pack dry run, and the repository public-consumption gate.
+
+## Release Boundary
+
+Release lane: `v0-preview`. Supported behavior is deterministic config creation
+and static, secret-safe portability inspection for the documented v1 schema.
+Known limitations: this package does not verify registry availability, install
+dependencies, test live credentials, bootstrap databases, or authorize agent
+work. Roll back by pinning the previous package version and retaining the
+consumer-owned config and receipts.

package/bin/holosystem.mjs

@@ -0,0 +1,173 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { createHoloSystemConfig, inspectHoloSystemConfig } from '../src/index.mjs';
+
+const CLI_RECEIPT_SCHEMA = 'holoscript.holosystem.cli-receipt.v1';
+const HELP = `holosystem - create or inspect a portable HoloSystem consumer config
+
+Usage:
+  holosystem create [--id <id>] [--workspace <id>] [--output <file>] [--force] [--json]
+  holosystem create --stdout
+  holosystem inspect [file|-] [--json]
+  holosystem --help
+  holosystem --version
+
+Defaults:
+  create writes holosystem.config.json and never overwrites it without --force.
+  inspect reads holosystem.config.json. Use - to read JSON from stdin.
+`;
+
+function die(message, { json = false, code = 1 } = {}) {
+  if (json) {
+    process.stderr.write(
+      `${JSON.stringify({ schema: CLI_RECEIPT_SCHEMA, ok: false, error: message }, null, 2)}\n`
+    );
+  } else {
+    process.stderr.write(`[holosystem] ${message}\n`);
+  }
+  process.exit(code);
+}
+
+function parseArguments(args, specification) {
+  const options = {};
+  const positionals = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const item = args[index];
+    if (!item.startsWith('--')) {
+      positionals.push(item);
+      continue;
+    }
+    const equals = item.indexOf('=');
+    const name = item.slice(2, equals === -1 ? undefined : equals);
+    const type = specification[name];
+    if (!type) throw new Error(`Unknown option --${name}.`);
+    if (type === 'boolean') {
+      if (equals !== -1) throw new Error(`Option --${name} does not accept a value.`);
+      options[name] = true;
+      continue;
+    }
+    const value = equals === -1 ? args[index + 1] : item.slice(equals + 1);
+    if (!value || value.startsWith('--')) throw new Error(`Option --${name} requires a value.`);
+    options[name] = value;
+    if (equals === -1) index += 1;
+  }
+  return { options, positionals };
+}
+
+function receipt(operation, fields) {
+  return {
+    schema: CLI_RECEIPT_SCHEMA,
+    generatedAt: new Date().toISOString(),
+    operation,
+    ...fields,
+  };
+}
+
+function outputJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function runCreate(args) {
+  let parsed;
+  try {
+    parsed = parseArguments(args, {
+      id: 'value',
+      workspace: 'value',
+      output: 'value',
+      force: 'boolean',
+      stdout: 'boolean',
+      json: 'boolean',
+    });
+  } catch (error) {
+    die(error.message, { json: args.includes('--json') });
+  }
+  const { options, positionals } = parsed;
+  if (positionals.length > 0)
+    die('create does not accept positional arguments.', { json: options.json });
+  if (options.stdout && options.output) {
+    die('--stdout and --output cannot be combined.', { json: options.json });
+  }
+  if (options.stdout && options.json) {
+    die('--stdout already emits JSON config and cannot be combined with --json.', { json: true });
+  }
+
+  let config;
+  try {
+    config = createHoloSystemConfig({
+      consumerId: options.id || 'external-founder',
+      workspace: options.workspace || 'default',
+    });
+  } catch (error) {
+    die(error.message, { json: options.json, code: 2 });
+  }
+
+  if (options.stdout) {
+    outputJson(config);
+    return;
+  }
+
+  const output = options.output || 'holosystem.config.json';
+  const absoluteOutput = resolve(process.cwd(), output);
+  if (existsSync(absoluteOutput) && !options.force) {
+    die(`${output} already exists; use --force to replace it.`, { json: options.json });
+  }
+  writeFileSync(absoluteOutput, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+  const report = inspectHoloSystemConfig(config);
+  const result = receipt('create', { ok: report.ready, output, report });
+  if (options.json) outputJson(result);
+  else process.stdout.write(`Created ${output}\nPortable: ${report.portable ? 'yes' : 'no'}\n`);
+}
+
+function readStdin() {
+  return readFileSync(0, 'utf8');
+}
+
+function runInspect(args) {
+  let parsed;
+  try {
+    parsed = parseArguments(args, { json: 'boolean' });
+  } catch (error) {
+    die(error.message, { json: args.includes('--json') });
+  }
+  const { options, positionals } = parsed;
+  if (positionals.length > 1) die('inspect accepts at most one file.', { json: options.json });
+  const input = positionals[0] || 'holosystem.config.json';
+  let config;
+  try {
+    const source =
+      input === '-' ? readStdin() : readFileSync(resolve(process.cwd(), input), 'utf8');
+    config = JSON.parse(source.replace(/^\uFEFF/u, ''));
+  } catch (error) {
+    die(`Cannot read ${input}: ${error.message}`, { json: options.json });
+  }
+
+  const report = inspectHoloSystemConfig(config);
+  if (options.json) outputJson(receipt('inspect', { ok: report.ready, input, report }));
+  else {
+    process.stdout.write(
+      `Ready: ${report.ready ? 'yes' : 'no'}\nPortable: ${report.portable ? 'yes' : 'no'}\n`
+    );
+    for (const check of report.checks) {
+      process.stdout.write(`${check.ok ? 'PASS' : 'FAIL'} ${check.id}\n`);
+    }
+    for (const error of report.errors) process.stdout.write(`  ${error.path}: ${error.message}\n`);
+  }
+  if (!report.ready) process.exitCode = 2;
+}
+
+const argv = process.argv.slice(2);
+const command = argv[0];
+if (!command || command === '--help' || command === '-h' || command === 'help') {
+  process.stdout.write(HELP);
+} else if (command === '--version' || command === '-v') {
+  const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+  process.stdout.write(`${manifest.version}\n`);
+} else if (command === 'create') {
+  runCreate(argv.slice(1));
+} else if (command === 'inspect') {
+  runInspect(argv.slice(1));
+} else {
+  die(`Unknown command ${command}. Run holosystem --help.`);
+}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@holoscript/holosystem",
+  "version": "0.1.0",
+  "description": "Portable public-package bootstrap and inspection contract for HoloSystem consumers.",
+  "releaseLane": "v0-preview",
+  "keywords": [
+    "holoscript",
+    "holosystem",
+    "agent-runtime",
+    "sovereign",
+    "bootstrap",
+    "portable-config"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/brianonbased-dev/HoloScript.git",
+    "directory": "packages/holosystem"
+  },
+  "homepage": "https://github.com/brianonbased-dev/HoloScript/tree/main/packages/holosystem",
+  "bugs": {
+    "url": "https://github.com/brianonbased-dev/HoloScript/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.mjs"
+  },
+  "bin": {
+    "holosystem": "./bin/holosystem.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "node --check src/index.mjs && node --check bin/holosystem.mjs",
+    "test": "node --test test/holosystem.test.mjs test/cli.test.mjs",
+    "smoke": "node bin/holosystem.mjs --help",
+    "check": "pnpm run build && pnpm run test && pnpm run smoke",
+    "prepublishOnly": "pnpm run check"
+  },
+  "holorepo": {
+    "releaseLane": "v0-preview",
+    "pypiCompanion": "holoscript-holorepo",
+    "publicConsumption": {
+      "coreRule": "Cold consumers create and inspect a HoloSystem configuration from public registry contracts and caller-owned bindings.",
+      "localBoundary": "Machine paths, credentials, private repositories, and operator state are caller inputs, never package defaults.",
+      "supportBoundary": "Configuration creation and static portability inspection are supported; installation, credential acquisition, service mutation, and publishing are outside this package."
+    }
+  }
+}

package/src/index.mjs

@@ -0,0 +1,574 @@
+export const HOLOSYSTEM_CONFIG_SCHEMA = 'holoscript.holosystem.consumer.v1';
+export const HOLOSYSTEM_INSPECTION_SCHEMA = 'holoscript.holosystem.inspection.v1';
+
+const REQUIRED_CONTRACTS = [
+  { registry: 'npm', role: 'agent-runtime' },
+  { registry: 'npm', role: 'memory' },
+  { registry: 'npm', role: 'repo-custody' },
+  { registry: 'pypi', role: 'repo-custody' },
+];
+
+const REQUIRED_BINDINGS = ['storage', 'memory', 'knowledge', 'authority'];
+const REQUIRED_STOP_CONDITIONS = ['authority-required', 'validation-failed', 'lease-expired'];
+const KNOWN_TOP_LEVEL_KEYS = new Set(['schema', 'consumer', 'contracts', 'bindings', 'operations']);
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  Object.freeze(value);
+  for (const child of Object.values(value)) deepFreeze(child);
+  return value;
+}
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+export const DEFAULT_PUBLIC_PACKAGE_CONTRACTS = deepFreeze([
+  {
+    registry: 'npm',
+    name: '@holoscript/agent-runtime',
+    version: '0.6.1',
+    role: 'agent-runtime',
+  },
+  {
+    registry: 'npm',
+    name: '@holoscript/memory',
+    version: '0.3.0',
+    role: 'memory',
+  },
+  {
+    registry: 'npm',
+    name: '@holoscript/holorepo',
+    version: '0.3.7',
+    role: 'repo-custody',
+  },
+  {
+    registry: 'pypi',
+    name: 'holoscript-holorepo',
+    version: '0.3.7',
+    role: 'repo-custody',
+  },
+]);
+
+export const DEFAULT_CALLER_BINDINGS = deepFreeze({
+  storage: { owner: 'caller', env: 'HOLOREPO_DATABASE_URL' },
+  memory: { owner: 'caller', env: 'MEMORY_DATABASE_URL' },
+  knowledge: { owner: 'caller', env: 'HOLOREPO_DATABASE_URL' },
+  authority: { owner: 'caller', env: 'HOLOSYSTEM_AUTHORITY_REF' },
+});
+
+const DEFAULT_OPERATIONS = deepFreeze({
+  autonomy: {
+    mode: 'bounded',
+    maxAttempts: 3,
+    leaseSeconds: 300,
+    stopConditions: REQUIRED_STOP_CONDITIONS,
+  },
+  receipts: {
+    directory: '.holosystem/receipts',
+    format: 'json',
+    maxAgeSeconds: 900,
+  },
+});
+
+function issue(list, check, code, path, message) {
+  list.push({ check, code, path, message });
+}
+
+function checkKnownKeys(value, allowed, path, check, errors) {
+  if (!isRecord(value)) return;
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) {
+      issue(
+        errors,
+        check,
+        'unknown-field',
+        path ? `${path}.${key}` : key,
+        `Field ${key} is not part of the v1 consumer contract.`
+      );
+    }
+  }
+}
+
+function isRecord(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function validId(value) {
+  return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,63}$/iu.test(value);
+}
+
+function validEnvName(value) {
+  return typeof value === 'string' && /^[A-Z][A-Z0-9_]*$/u.test(value);
+}
+
+function validPackageName(registry, value) {
+  if (typeof value !== 'string') return false;
+  if (registry === 'npm') {
+    return /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(value);
+  }
+  return registry === 'pypi' && /^[a-z0-9]+(?:[-_.][a-z0-9]+)*$/iu.test(value);
+}
+
+function validPinnedVersion(value) {
+  return (
+    typeof value === 'string' &&
+    /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value) &&
+    !/^(?:workspace|file|link|portal|git|https?):/iu.test(value)
+  );
+}
+
+function isPortablePath(value) {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    !/^[A-Za-z]:[\\/]/u.test(value) &&
+    !/^(?:[\\/]{2}|\/|~[\\/])/u.test(value) &&
+    !/(?:^|[\\/])\.\.(?:[\\/]|$)/u.test(value)
+  );
+}
+
+function inspectSensitiveValues(value, path, errors) {
+  if (Array.isArray(value)) {
+    value.forEach((child, index) => inspectSensitiveValues(child, `${path}[${index}]`, errors));
+    return;
+  }
+  if (!isRecord(value)) return;
+
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = path ? `${path}.${key}` : key;
+    if (/(?:password|secret|token|apiKey|privateKey|connectionString)$/iu.test(key)) {
+      issue(
+        errors,
+        'portable-inputs',
+        'embedded-sensitive-field',
+        childPath,
+        'Credential values are not configuration fields; reference a caller-owned environment key.'
+      );
+    }
+    inspectSensitiveValues(child, childPath, errors);
+  }
+}
+
+function checkSchema(config, errors) {
+  if (config.schema !== HOLOSYSTEM_CONFIG_SCHEMA) {
+    issue(errors, 'schema', 'schema-mismatch', 'schema', `Expected ${HOLOSYSTEM_CONFIG_SCHEMA}.`);
+  }
+}
+
+function checkConsumer(config, errors) {
+  if (!isRecord(config.consumer)) {
+    issue(errors, 'consumer', 'consumer-missing', 'consumer', 'Consumer identity is required.');
+    return;
+  }
+  checkKnownKeys(config.consumer, new Set(['id', 'workspace']), 'consumer', 'consumer', errors);
+  if (!validId(config.consumer.id)) {
+    issue(
+      errors,
+      'consumer',
+      'consumer-id-invalid',
+      'consumer.id',
+      'Consumer id must be a portable identifier of 1 to 64 characters.'
+    );
+  }
+  if (!validId(config.consumer.workspace)) {
+    issue(
+      errors,
+      'consumer',
+      'workspace-id-invalid',
+      'consumer.workspace',
+      'Workspace must be a portable identifier of 1 to 64 characters.'
+    );
+  }
+}
+
+function checkContracts(config, errors) {
+  if (!Array.isArray(config.contracts)) {
+    issue(
+      errors,
+      'public-contracts',
+      'contracts-missing',
+      'contracts',
+      'Public package contracts must be an array.'
+    );
+    return [];
+  }
+
+  const contracts = [];
+  const identities = new Set();
+  config.contracts.forEach((contract, index) => {
+    const path = `contracts[${index}]`;
+    if (!isRecord(contract)) {
+      issue(errors, 'public-contracts', 'contract-invalid', path, 'Contract must be an object.');
+      return;
+    }
+    checkKnownKeys(
+      contract,
+      new Set(['registry', 'name', 'version', 'role']),
+      path,
+      'public-contracts',
+      errors
+    );
+    const registry = contract.registry;
+    if (registry !== 'npm' && registry !== 'pypi') {
+      issue(
+        errors,
+        'public-contracts',
+        'registry-invalid',
+        `${path}.registry`,
+        'Registry must be npm or pypi.'
+      );
+    }
+    if (!validPackageName(registry, contract.name)) {
+      issue(
+        errors,
+        'public-contracts',
+        'package-name-invalid',
+        `${path}.name`,
+        'Package name is invalid for its public registry.'
+      );
+    }
+    if (!validPinnedVersion(contract.version)) {
+      issue(
+        errors,
+        'public-contracts',
+        'version-not-pinned',
+        `${path}.version`,
+        'Version must be an exact public release, not a local, remote, or floating spec.'
+      );
+    }
+    if (!validId(contract.role)) {
+      issue(
+        errors,
+        'public-contracts',
+        'role-invalid',
+        `${path}.role`,
+        'Role must be a portable identifier.'
+      );
+    }
+    const identity = `${registry}:${String(contract.name).toLowerCase()}`;
+    if (identities.has(identity)) {
+      issue(
+        errors,
+        'public-contracts',
+        'contract-duplicate',
+        path,
+        `Duplicate public package contract ${identity}.`
+      );
+    }
+    identities.add(identity);
+    contracts.push({
+      registry,
+      name: typeof contract.name === 'string' ? contract.name : null,
+      version: typeof contract.version === 'string' ? contract.version : null,
+      role: typeof contract.role === 'string' ? contract.role : null,
+    });
+  });
+
+  for (const required of REQUIRED_CONTRACTS) {
+    if (
+      !contracts.some(
+        (contract) => contract.registry === required.registry && contract.role === required.role
+      )
+    ) {
+      issue(
+        errors,
+        'public-contracts',
+        'required-contract-missing',
+        'contracts',
+        `Missing ${required.registry} contract for role ${required.role}.`
+      );
+    }
+  }
+  return contracts;
+}
+
+function checkBindings(config, errors) {
+  if (!isRecord(config.bindings)) {
+    issue(
+      errors,
+      'caller-bindings',
+      'bindings-missing',
+      'bindings',
+      'Caller-owned bindings are required.'
+    );
+    return [];
+  }
+
+  const bindings = [];
+  for (const id of REQUIRED_BINDINGS) {
+    if (!isRecord(config.bindings[id])) {
+      issue(
+        errors,
+        'caller-bindings',
+        'binding-missing',
+        `bindings.${id}`,
+        `Missing ${id} binding.`
+      );
+    }
+  }
+
+  for (const [id, binding] of Object.entries(config.bindings)) {
+    const path = `bindings.${id}`;
+    if (!validId(id)) {
+      issue(
+        errors,
+        'caller-bindings',
+        'binding-id-invalid',
+        path,
+        'Binding id must be a portable identifier.'
+      );
+    }
+    if (!isRecord(binding)) {
+      issue(errors, 'caller-bindings', 'binding-invalid', path, 'Binding must be an object.');
+      continue;
+    }
+    checkKnownKeys(binding, new Set(['owner', 'env']), path, 'caller-bindings', errors);
+    if (binding.owner !== 'caller') {
+      issue(
+        errors,
+        'caller-bindings',
+        'binding-owner-invalid',
+        `${path}.owner`,
+        'Binding ownership must remain with the caller.'
+      );
+    }
+    if (!validEnvName(binding.env)) {
+      issue(
+        errors,
+        'caller-bindings',
+        'binding-env-invalid',
+        `${path}.env`,
+        'Binding must name an environment key without embedding its value.'
+      );
+    }
+    bindings.push({ id, owner: binding.owner, env: binding.env });
+  }
+  return bindings;
+}
+
+function checkOperations(config, errors) {
+  const operations = config.operations;
+  if (!isRecord(operations)) {
+    issue(
+      errors,
+      'bounded-operations',
+      'operations-missing',
+      'operations',
+      'Bounded autonomy and receipt policy are required.'
+    );
+    return;
+  }
+  checkKnownKeys(
+    operations,
+    new Set(['autonomy', 'receipts']),
+    'operations',
+    'bounded-operations',
+    errors
+  );
+
+  const autonomy = operations.autonomy;
+  if (!isRecord(autonomy)) {
+    issue(
+      errors,
+      'bounded-operations',
+      'autonomy-missing',
+      'operations.autonomy',
+      'Autonomy policy is required.'
+    );
+  } else {
+    checkKnownKeys(
+      autonomy,
+      new Set(['mode', 'maxAttempts', 'leaseSeconds', 'stopConditions']),
+      'operations.autonomy',
+      'bounded-operations',
+      errors
+    );
+    if (autonomy.mode !== 'bounded') {
+      issue(
+        errors,
+        'bounded-operations',
+        'autonomy-unbounded',
+        'operations.autonomy.mode',
+        'Autonomy mode must be bounded.'
+      );
+    }
+    if (!Number.isInteger(autonomy.maxAttempts) || autonomy.maxAttempts < 1) {
+      issue(
+        errors,
+        'bounded-operations',
+        'max-attempts-invalid',
+        'operations.autonomy.maxAttempts',
+        'maxAttempts must be a positive integer.'
+      );
+    }
+    if (!Number.isInteger(autonomy.leaseSeconds) || autonomy.leaseSeconds < 1) {
+      issue(
+        errors,
+        'bounded-operations',
+        'lease-invalid',
+        'operations.autonomy.leaseSeconds',
+        'leaseSeconds must be a positive integer.'
+      );
+    }
+    const stops = Array.isArray(autonomy.stopConditions) ? autonomy.stopConditions : [];
+    for (const stop of REQUIRED_STOP_CONDITIONS) {
+      if (!stops.includes(stop)) {
+        issue(
+          errors,
+          'bounded-operations',
+          'stop-condition-missing',
+          'operations.autonomy.stopConditions',
+          `Missing stop condition ${stop}.`
+        );
+      }
+    }
+  }
+
+  const receipts = operations.receipts;
+  if (!isRecord(receipts)) {
+    issue(
+      errors,
+      'bounded-operations',
+      'receipts-missing',
+      'operations.receipts',
+      'Receipt policy is required.'
+    );
+    return;
+  }
+  checkKnownKeys(
+    receipts,
+    new Set(['directory', 'format', 'maxAgeSeconds']),
+    'operations.receipts',
+    'bounded-operations',
+    errors
+  );
+  if (!isPortablePath(receipts.directory)) {
+    issue(
+      errors,
+      'portable-inputs',
+      'receipt-path-not-portable',
+      'operations.receipts.directory',
+      'Receipt directory must be a relative path without parent traversal.'
+    );
+  }
+  if (receipts.format !== 'json') {
+    issue(
+      errors,
+      'bounded-operations',
+      'receipt-format-invalid',
+      'operations.receipts.format',
+      'Receipt format must be json.'
+    );
+  }
+  if (!Number.isInteger(receipts.maxAgeSeconds) || receipts.maxAgeSeconds < 1) {
+    issue(
+      errors,
+      'bounded-operations',
+      'receipt-freshness-invalid',
+      'operations.receipts.maxAgeSeconds',
+      'maxAgeSeconds must be a positive integer.'
+    );
+  }
+}
+
+export function inspectHoloSystemConfig(config) {
+  const errors = [];
+  const warnings = [];
+  if (!isRecord(config)) {
+    issue(errors, 'schema', 'config-invalid', '$', 'Configuration must be a JSON object.');
+    return {
+      schema: HOLOSYSTEM_INSPECTION_SCHEMA,
+      ready: false,
+      portable: false,
+      checks: [{ id: 'schema', ok: false, errorCount: 1 }],
+      errors,
+      warnings,
+      summary: { consumer: null, packages: [], bindings: [] },
+    };
+  }
+
+  checkSchema(config, errors);
+  checkConsumer(config, errors);
+  const packages = checkContracts(config, errors);
+  const bindings = checkBindings(config, errors);
+  checkOperations(config, errors);
+  inspectSensitiveValues(config, '', errors);
+  checkKnownKeys(config, KNOWN_TOP_LEVEL_KEYS, '', 'schema', errors);
+
+  const checkIds = [
+    'schema',
+    'consumer',
+    'public-contracts',
+    'caller-bindings',
+    'portable-inputs',
+    'bounded-operations',
+  ];
+  const checks = checkIds.map((id) => {
+    const errorCount = errors.filter((error) => error.check === id).length;
+    return { id, ok: errorCount === 0, errorCount };
+  });
+
+  return {
+    schema: HOLOSYSTEM_INSPECTION_SCHEMA,
+    ready: errors.length === 0,
+    portable: errors.every(
+      (error) =>
+        !['schema', 'consumer', 'public-contracts', 'caller-bindings', 'portable-inputs'].includes(
+          error.check
+        )
+    ),
+    checks,
+    errors,
+    warnings,
+    summary: {
+      consumer: {
+        id: typeof config.consumer?.id === 'string' ? config.consumer.id : null,
+        workspace:
+          typeof config.consumer?.workspace === 'string' ? config.consumer.workspace : null,
+      },
+      packages,
+      bindings,
+    },
+  };
+}
+
+export function createHoloSystemConfig({
+  consumerId = 'external-founder',
+  workspace = 'default',
+  contracts = DEFAULT_PUBLIC_PACKAGE_CONTRACTS,
+  bindings = DEFAULT_CALLER_BINDINGS,
+  receiptDirectory = DEFAULT_OPERATIONS.receipts.directory,
+  maxAttempts = DEFAULT_OPERATIONS.autonomy.maxAttempts,
+  leaseSeconds = DEFAULT_OPERATIONS.autonomy.leaseSeconds,
+  receiptMaxAgeSeconds = DEFAULT_OPERATIONS.receipts.maxAgeSeconds,
+} = {}) {
+  const config = {
+    schema: HOLOSYSTEM_CONFIG_SCHEMA,
+    consumer: { id: consumerId, workspace },
+    contracts: clone(contracts),
+    bindings: clone(bindings),
+    operations: {
+      autonomy: {
+        mode: 'bounded',
+        maxAttempts,
+        leaseSeconds,
+        stopConditions: clone(REQUIRED_STOP_CONDITIONS),
+      },
+      receipts: {
+        directory: receiptDirectory,
+        format: 'json',
+        maxAgeSeconds: receiptMaxAgeSeconds,
+      },
+    },
+  };
+  const report = inspectHoloSystemConfig(config);
+  if (!report.ready) {
+    const error = new TypeError(
+      `Cannot create HoloSystem config: ${report.errors.map((item) => item.code).join(', ')}`
+    );
+    error.report = report;
+    throw error;
+  }
+  return config;
+}