@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-execution-command.mjs

@@ -0,0 +1,544 @@
+import { runtimeContractSyncOwner } from './runtime-contract-marker-registry.mjs';
+import { createRuntimeExecutionApprovalLifecycleModels } from './runtime-execution-approval-lifecycle-models.mjs';
+import { createRuntimeExecutionPolicyArtifacts } from './runtime-execution-policy-artifacts.mjs';
+import { createRuntimeExecutionStateWriteLifecycleModel } from './runtime-execution-state-write-lifecycle-model.mjs';
+import { createRuntimeExecutionReadonlyArtifacts } from './runtime-execution-readonly-artifacts.mjs';
+import { createRuntimeExecutionSafetyArtifacts } from './runtime-execution-safety-artifacts.mjs';
+import { createRuntimeExecutionPlanArtifacts } from './runtime-execution-plan-artifacts.mjs';
+import { createRuntimeExecutionRunPreflightArtifacts } from './runtime-execution-run-preflight-artifacts.mjs';
+import { createRuntimeExecutionCandidateApprovalArtifacts } from './runtime-execution-candidate-approval-artifacts.mjs';
+import { createRuntimeExecutionPresentation } from './runtime-execution-presentation.mjs';
+import { runBoundedForegroundCommand } from './runtime-bounded-foreground-command-executor-contract.mjs';
+
+export const runtimeExecutionCommandContractSync = runtimeContractSyncOwner('runtime-execution-command');
+
+export const createRuntimeExecutionCommand = function (deps) {
+  const {
+    fs,
+    path,
+    process,
+    crypto,
+    spawnSync,
+    jsonSchemaVersion,
+    stateDirectoryName,
+    executionsDirectoryName,
+    executionCandidatesDirectoryName,
+    executionApprovalsDirectoryName,
+    autoRunLocksDirectoryName,
+    approvalLifecycleDirectoryName,
+    stage11RuntimeActionName,
+    runtimeActionCatalogStage,
+    runtimeActionCatalogVersion,
+    approvalLifecycleStage,
+    approvalLifecycleStates,
+    approvalLifecycleTerminalStates,
+  } = deps;
+  const {
+    stage11ExecutionStaleAfterMs,
+    stage12CandidateStaleAfterMs,
+    stage13ApprovalStaleAfterMs,
+    stage11AllowedExecutionSkills,
+    allowedExecutionStatuses,
+    stage11TerminalStatuses,
+    forbiddenDispatchActions,
+    executionPolicy,
+    autoRunPolicyProfiles,
+    ensureRoot,
+    workflowPath,
+    readWorkflow,
+    tasksFromState,
+    readinessCounts,
+    reviewSummaryStatus,
+    hasActualStopCondition,
+  } = deps;
+  const {
+    writeJsonEnvelope,
+    printList,
+    readJsonArtifact,
+    fileDigest,
+    digestObject,
+    parseIsoTimestamp,
+    validateCommonArtifactSafety,
+    runtimePolicyCatalogSnapshot,
+    runtimePolicyCatalogDigest,
+    validateRuntimePolicyCatalog,
+    executionsDirectory,
+    executionCandidatesDirectory,
+    executionApprovalsDirectory,
+    approvalLifecycleDirectory,
+    autoRunLocksDirectory,
+  } = deps;
+  const {
+    candidateFilePath,
+    approvalFilePath,
+    approvalLifecycleFilePath,
+    autoRunLockFilePath,
+    dispatchEventFilePath,
+    dispatchClaimFilePath,
+    readDispatchEventFile,
+    verifyDispatchEvent,
+    validateDispatchEventOrThrow,
+    dispatchEventDigest,
+    dispatchEventSummary,
+    readDispatchClaimFile,
+    validateDispatchActor,
+    claimSummary,
+    candidateProfileBinding,
+    candidateProfileBindingFailures,
+    approvalProfileBinding,
+    approvalProfileBindingFailures,
+    controlledForegroundBinding,
+    controlledForegroundEnvelopeFailures,
+    foregroundEvidenceDigestPayload,
+    foregroundPreflightGates,
+    foregroundPreflightFailures,
+    buildExecutionEnabledPreflight,
+    buildExecutionProfilePreflightEnvelope,
+    runtimeTestRunProfiles,
+  } = deps;
+  const {
+    runtimeActionCatalogSnapshot,
+    runtimeActionCatalogDigest,
+    runtimeActionById,
+    evaluateRuntimeActionCatalog,
+    validateRuntimeActionCatalog,
+    actionCatalogEnvelope,
+    policyProfileSnapshot,
+    validatePolicySnapshot,
+    policyEvaluationEnvelope,
+    executionPolicySnapshot,
+    policyAuditEnvelope,
+  } = createRuntimeExecutionPolicyArtifacts({
+    path,
+    stateDirectoryName,
+    executionsDirectoryName,
+    stage11RuntimeActionName,
+    runtimeActionCatalogStage,
+    runtimeActionCatalogVersion,
+    executionPolicy,
+    autoRunPolicyProfiles,
+    digestObject,
+    runtimePolicyCatalogSnapshot,
+    validateRuntimePolicyCatalog,
+  });
+
+const { listApprovalFiles, executionFilePath, listExecutionFiles, readExecutionFile, lifecycleSummary, executionAgeMs, executionAuditState, validateExecutionPolicySnapshot, validateRuntimeActionContract, validateTerminalEvidence, validateExecutionEnvelope, executionSummary } = createRuntimeExecutionReadonlyArtifacts({ fs, path, jsonSchemaVersion, stage11RuntimeActionName, stage11ExecutionStaleAfterMs, stage11AllowedExecutionSkills, allowedExecutionStatuses, stage11TerminalStatuses, forbiddenDispatchActions, executionPolicy, autoRunPolicyProfiles, digestObject, parseIsoTimestamp, validatePolicySnapshot, controlledForegroundEnvelopeFailures, executionsDirectory, executionCandidatesDirectory, executionApprovalsDirectory });
+
+const {
+  executionEventPath,
+  ensureExecutionDirectory,
+  writeApprovalLifecycle,
+  assertAutoRunLock,
+  writeExecutionEnvelope,
+  writeExecutionPayload,
+} = createRuntimeExecutionStateWriteLifecycleModel({
+  fs,
+  path,
+  crypto,
+  jsonSchemaVersion,
+  executionsDirectory,
+  approvalLifecycleDirectory,
+  autoRunLocksDirectory,
+  approvalLifecycleFilePath,
+  autoRunLockFilePath,
+});
+
+const { executionSafety, candidateSafety, approvalSafety, autoRunSafety, validateCandidateArtifact, validateApprovalArtifact } = createRuntimeExecutionSafetyArtifacts({ jsonSchemaVersion, stage11RuntimeActionName, runtimeActionCatalogStage, runtimeActionCatalogVersion, executionPolicy, validateCommonArtifactSafety, runtimeActionCatalogDigest, evaluateRuntimeActionCatalog, policyProfileSnapshot, executionPolicySnapshot, validateExecutionPolicySnapshot, candidateProfileBindingFailures, approvalProfileBindingFailures });
+
+const {
+  listApprovalLifecycleFiles,
+  approvalLifecycleDigestPayload,
+  approvalLifecycleEnvelope,
+  validateApprovalLifecycleArtifact,
+  readApprovalLifecycle,
+  validateApprovalLifecycleBinding,
+  approvalLifecycleCurrentState,
+  approvalLifecycleAuditEnvelope,
+} = createRuntimeExecutionApprovalLifecycleModels({
+  fs,
+  path,
+  jsonSchemaVersion,
+  approvalLifecycleStage,
+  approvalLifecycleStates,
+  approvalLifecycleTerminalStates,
+  stage13ApprovalStaleAfterMs,
+  workflowPath,
+  readJsonArtifact,
+  fileDigest,
+  digestObject,
+  parseIsoTimestamp,
+  approvalFilePath,
+  approvalLifecycleFilePath,
+  approvalLifecycleDirectory,
+  validateApprovalArtifact,
+  listApprovalFiles,
+});
+
+const { executionIdempotencyKey, executionPlan, findActiveExecutionByIdempotencyKey, assertNoActiveExecution, activeExecutionCount, readExecutionProfileConfig, executionEnabledPreflight, executionHistorySummary } = createRuntimeExecutionPlanArtifacts({ fs, path, crypto, stateDirectoryName, executionsDirectoryName, stage11RuntimeActionName, runtimeActionCatalogStage, runtimeActionCatalogVersion, stage11AllowedExecutionSkills, forbiddenDispatchActions, stage13ApprovalStaleAfterMs, executionPolicySnapshot, runtimeActionCatalogSnapshot, evaluateRuntimeActionCatalog, policyProfileSnapshot, dispatchEventDigest, workflowPath, executionEnabledProfileBuilder: buildExecutionEnabledPreflight, runtimeTestRunProfiles, listExecutionFiles, readExecutionFile, executionSummary, validateExecutionEnvelope, executionsDirectory, executionAuditState });
+
+const { printApprovalLifecycle, safetyFlag, printExecutionPreflight, printExecutionCandidate, printExecutionApproval, printExecution, printExecutionsAudit, printActionCatalog, printPolicyAudit } = createRuntimeExecutionPresentation({ path, process, printList, lifecycleSummary });
+
+function runApprovals(options) {
+  if (options.write || options.dryRun || options.scan || options.fromDispatch || options.run || options.autoRun) {
+    throw new Error('approvals supports lifecycle audit and explicit confirmed transitions only');
+  }
+  const modes = [options.approvalsList, options.approvalsShow, options.approvalsVerify, options.approvalsTransition].filter(Boolean);
+  if (modes.length !== 1) throw new Error('approvals requires exactly one of --list, --show, --verify, or --transition');
+  ensureRoot(options.root);
+  if (options.approvalsList) {
+    const envelope = approvalLifecycleAuditEnvelope(options.root, 'list');
+    if (options.json) writeJsonEnvelope('approvals', envelope);
+    else printApprovalLifecycle(envelope);
+    return;
+  }
+  if (options.approvalsTransition) {
+    const envelope = approvalLifecycleAuditEnvelope(options.root, 'transition', options.approval, {
+      status: options.approvalLifecycleStatus,
+      actor: options.actor ? validateDispatchActor(options.actor) : '',
+      reason: options.reason || '',
+      confirm: options.confirm,
+    });
+    if (!envelope.verification.ok) throw new Error(`approval lifecycle transition failed: ${envelope.verification.failures.join('; ')}`);
+    if (options.confirm) {
+      const file = writeApprovalLifecycle(options.root, options.approval, envelope.lifecycle);
+      if (options.json) writeJsonEnvelope('approvals', { ...envelope, lifecycle_file: path.basename(file) });
+      else printApprovalLifecycle(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('approvals', envelope);
+    else printApprovalLifecycle(envelope);
+    return;
+  }
+  const mode = options.approvalsVerify ? 'verify' : 'show';
+  const envelope = approvalLifecycleAuditEnvelope(options.root, mode, options.approval);
+  if (mode === 'verify' && !envelope.verification.ok) throw new Error(`approval lifecycle verification failed: ${envelope.verification.failures.join('; ')}`);
+  if (options.json) writeJsonEnvelope('approvals', envelope);
+  else printApprovalLifecycle(envelope);
+}
+
+const { assertExecutionClaimReady, executionPreflightEnvelope, executionEnvelope, supervisedRunBaseEnvelope, terminalSupervisedRunEnvelope, completeSupervisedRunEnvelope, executeProfilePreflightEnvelope } = createRuntimeExecutionRunPreflightArtifacts({ fs, path, stage11RuntimeActionName, runtimeActionCatalogStage, runtimeActionCatalogVersion, stage11AllowedExecutionSkills, forbiddenDispatchActions, dispatchEventFilePath, dispatchClaimFilePath, readDispatchEventFile, verifyDispatchEvent, validateDispatchEventOrThrow, dispatchEventSummary, readDispatchClaimFile, validateDispatchActor, claimSummary, workflowPath, readWorkflow, tasksFromState, readinessCounts, reviewSummaryStatus, hasActualStopCondition, executionPolicySnapshot, runtimeActionCatalogDigest, buildExecutionProfilePreflightEnvelope, foregroundPreflightGates, foregroundPreflightFailures, executionSafety, parseIsoTimestamp, digestObject, foregroundEvidenceDigestPayload, executionPlan, assertNoActiveExecution, executionEnabledPreflight });
+
+const { executionCandidateEnvelope, candidateArtifactPath, writeCandidateArtifact, approvalArtifactPath, executionApprovalEnvelope, writeApprovalArtifact, readApprovalForAutoRun, controlledAutoRunEnvelope } = createRuntimeExecutionCandidateApprovalArtifacts({ fs, path, crypto, jsonSchemaVersion, stateDirectoryName, executionCandidatesDirectoryName, executionsDirectoryName, stage11RuntimeActionName, runtimeActionCatalogStage, runtimeActionCatalogVersion, stage12CandidateStaleAfterMs, stage13ApprovalStaleAfterMs, forbiddenDispatchActions, workflowPath, fileDigest, readJsonArtifact, stateArtifactWriter: deps[['writeState', 'Artifact'].join('')], candidateFilePath, approvalFilePath, executionCandidatesDirectory, executionApprovalsDirectory, executionPreflightEnvelope, supervisedRunBaseEnvelope, executionHistorySummary, executionPolicySnapshot, policyEvaluationEnvelope, policyProfileSnapshot, evaluateRuntimeActionCatalog, runtimeActionCatalogDigest, candidateProfileBinding, approvalProfileBinding, controlledForegroundBinding, executionEnabledPreflight, approvalLifecycleCurrentState, approvalLifecycleEnvelope, writeApprovalLifecycle, assertAutoRunLock, parseIsoTimestamp, validateCandidateArtifact, validateApprovalArtifact, candidateSafety, approvalSafety, autoRunSafety });
+
+function writeRunningThenCompleteExecution(root, eventFile, envelope) {
+  ensureExecutionDirectory(root);
+  const file = executionEventPath(root, eventFile);
+  writeExecutionPayload(file, envelope);
+  const terminal = envelope.mode === 'controlled-auto-run'
+    ? runBoundedForegroundCommand({
+        root,
+        action: runtimeActionById(envelope.execution.runtime_action),
+        spawnSync,
+        digestObject,
+      })
+    : null;
+  const completed = completeSupervisedRunEnvelope(envelope, terminal);
+  writeExecutionPayload(file, completed);
+  if (completed.mode === 'controlled-auto-run' && completed.execution?.approval_file && completed.execution?.status === 'succeeded') {
+    const current = approvalLifecycleCurrentState(root, completed.execution.approval_file);
+    const lifecycle = approvalLifecycleEnvelope(root, completed.execution.approval_file, 'consumed', completed.claim?.actor || 'runtime', `controlled auto-run succeeded: ${path.basename(file)}`, current.lifecycle);
+    writeApprovalLifecycle(root, completed.execution.approval_file, lifecycle);
+  }
+  return { file, envelope: completed };
+}
+
+function runExecute(options) {
+  if (options.write || options.dispatch || options.dispatchIntent) {
+    throw new Error('execute supports only candidate, approval package, dry-run, confirm, run, or controlled auto-run from audited state; --write, --dispatch, and --dispatch-intent are not supported');
+  }
+  if (options.approvalPackage && !options.approval) throw new Error('execute --approval-package requires --approval <candidate-file>');
+  if (!options.preflight && !options.fromDispatch && !options.approvalPackage) throw new Error('execute requires --from-dispatch <event-file>');
+  if (options.preflight && (options.dryRun || options.confirm || options.run || options.candidate || options.approvalPackage || options.autoRun)) throw new Error('execute --preflight cannot be combined with --dry-run, --confirm, --run, --candidate, --approval-package, or --auto-run');
+  if (options.candidate && (options.preflight || options.run || options.approvalPackage || options.autoRun)) throw new Error('execute --candidate cannot be combined with --preflight, --run, --approval-package, or --auto-run');
+  if (options.approvalPackage && (options.preflight || options.run || options.candidate || options.autoRun || options.dryRun)) throw new Error('execute --approval-package cannot be combined with execution modes');
+  if (options.dryRun && options.confirm) throw new Error('execute accepts either --dry-run or --confirm, not both');
+  if (options.autoRun && (!options.confirm || !options.run)) throw new Error('execute --auto-run requires --confirm --run');
+  if (options.run && !options.confirm) throw new Error('execute --run requires --confirm');
+  if (!options.preflight && !options.dryRun && !options.confirm && !options.candidate && !options.approvalPackage) throw new Error('execute requires --preflight, --candidate, --approval-package, --dry-run, or --confirm');
+  ensureRoot(options.root);
+
+  if (options.preflight) {
+    const envelope = options.fromDispatch
+      ? executionPreflightEnvelope(options.root, options.fromDispatch, options.actor)
+      : executeProfilePreflightEnvelope(options.root);
+    if (options.json) {
+      writeJsonEnvelope('execute', envelope);
+      return;
+    }
+    printExecutionPreflight(envelope);
+    return;
+  }
+
+  if (options.candidate) {
+    const envelope = executionCandidateEnvelope(options.root, options.fromDispatch, options.actor, { persist: options.confirm });
+    if (options.confirm) {
+      const file = writeCandidateArtifact(options.root, options.fromDispatch, envelope);
+      if (options.json) {
+        writeJsonEnvelope('execute', { ...envelope, candidate_file: path.basename(file) });
+        return;
+      }
+      printExecutionCandidate(envelope, file);
+      return;
+    }
+    if (options.json) {
+      writeJsonEnvelope('execute', envelope);
+      return;
+    }
+    printExecutionCandidate(envelope);
+    return;
+  }
+
+  if (options.approvalPackage) {
+    const envelope = executionApprovalEnvelope(options.root, options.approval, { persist: options.confirm });
+    if (options.confirm) {
+      const file = writeApprovalArtifact(options.root, options.approval, envelope);
+      if (options.json) {
+        writeJsonEnvelope('execute', { ...envelope, approval_file: path.basename(file) });
+        return;
+      }
+      printExecutionApproval(envelope, file);
+      return;
+    }
+    if (options.json) {
+      writeJsonEnvelope('execute', envelope);
+      return;
+    }
+    printExecutionApproval(envelope);
+    return;
+  }
+
+  if (options.run) {
+    const runningEnvelope = options.autoRun
+      ? controlledAutoRunEnvelope(options.root, options.fromDispatch, options.actor, options.approval)
+      : supervisedRunBaseEnvelope(options.root, options.fromDispatch, options.actor);
+    const { file, envelope } = writeRunningThenCompleteExecution(options.root, options.fromDispatch, runningEnvelope);
+    if (options.json) {
+      writeJsonEnvelope('execute', { ...envelope, execution_file: path.basename(file) });
+      return;
+    }
+    printExecution(envelope, file);
+    return;
+  }
+
+  const envelope = executionEnvelope(options.root, options.fromDispatch, options.actor, options.dryRun ? 'dry-run' : 'confirm');
+  if (options.confirm) {
+    const file = writeExecutionEnvelope(options.root, options.fromDispatch, envelope);
+    if (options.json) {
+      writeJsonEnvelope('execute', { ...envelope, execution_file: path.basename(file) });
+      return;
+    }
+    printExecution(envelope, file);
+    return;
+  }
+
+  if (options.json) {
+    writeJsonEnvelope('execute', envelope);
+    return;
+  }
+  printExecution(envelope);
+};
+
+function executionsAuditEnvelope(root, mode, executionFile = '') {
+  const files = listExecutionFiles(root);
+  if (mode === 'list') {
+    const executions = files.map((fileName) => {
+      try {
+        const execution = readExecutionFile(path.join(executionsDirectory(root), fileName));
+        const verification = validateExecutionEnvelope(execution);
+        return executionSummary(fileName, execution, verification);
+      } catch (error) {
+        return {
+          file: fileName,
+          mode: 'invalid',
+          ok: false,
+          status: 'invalid',
+          lifecycle: 'not recorded',
+          runtime_action: false,
+          skill_execution: false,
+          verification_ok: false,
+          verification_failures: [error.message],
+        };
+      }
+    });
+    return {
+      mode: 'executions-audit-list',
+      ok: true,
+      state_present: fs.existsSync(workflowPath(root)),
+      summary: {
+        executions_present: files.length > 0,
+        count: files.length,
+        verified_count: executions.filter((item) => item.verification_ok).length,
+        failed_count: executions.filter((item) => !item.verification_ok).length,
+        active_count: executions.filter((item) => item.active).length,
+        stale_count: executions.filter((item) => item.stale).length,
+        terminal_count: executions.filter((item) => item.terminal).length,
+      },
+      executions,
+      quality: executions.some((item) => !item.verification_ok) ? ['one or more execution records failed verification'] : [],
+      action: 'read-only execution audit listed execution records. No skill execution, platform API, subagent, MCP, background process, git, worktree, or business source write occurred.',
+    };
+  }
+
+  const file = executionFilePath(root, executionFile);
+  const execution = readExecutionFile(file);
+  const verification = executionFile.endsWith('.candidate.json')
+    ? validateCandidateArtifact(execution)
+    : executionFile.endsWith('.approval.json')
+      ? validateApprovalArtifact(execution)
+      : validateExecutionEnvelope(execution);
+  if (mode === 'verify' && !verification.ok) {
+    throw new Error(`execution verification failed: ${verification.failures.join('; ')}`);
+  }
+
+  return {
+    mode: mode === 'verify' ? 'executions-audit-verify' : 'executions-audit-show',
+    ok: verification.ok,
+    state_present: fs.existsSync(workflowPath(root)),
+    summary: executionFile.endsWith('.candidate.json')
+      ? { file: path.basename(file), mode: execution.mode, status: execution.candidate?.ready_for_simulation ? 'ready' : 'blocked', target_skill: execution.candidate?.target_skill || '', lifecycle: 'candidate', runtime_action: false, skill_execution: false, active: false, stale: false, terminal: false }
+      : executionFile.endsWith('.approval.json')
+        ? { file: path.basename(file), mode: execution.mode, status: execution.approval?.ready_for_auto_run ? 'ready' : 'blocked', target_skill: execution.simulation?.runtime_action || '', lifecycle: 'approval', runtime_action: false, skill_execution: false, active: false, stale: false, terminal: false }
+        : executionSummary(path.basename(file), execution),
+    verification,
+    execution,
+    quality: [],
+    action: 'read-only execution audit inspected an execution record, candidate, or approval artifact. No skill execution, platform API, subagent, MCP, background process, git, worktree, or business source write occurred.',
+  };
+}
+
+function runExecutions(options) {
+  if (options.write || options.dryRun || options.confirm || options.dispatch || options.dispatchIntent || options.fromDispatch || options.actor || options.run) {
+    throw new Error('executions supports read-only audit only; write, execute, dispatch, and actor options are not supported');
+  }
+  const modes = [options.executionsList, options.executionsShow, options.executionsVerify].filter(Boolean);
+  if (modes.length !== 1) throw new Error('executions requires exactly one of --list, --show, or --verify');
+  ensureRoot(options.root);
+  const mode = options.executionsList ? 'list' : options.executionsVerify ? 'verify' : 'show';
+  const envelope = executionsAuditEnvelope(options.root, mode, options.dispatchEvent);
+  if (options.json) {
+    writeJsonEnvelope('executions', envelope);
+    return;
+  }
+  printExecutionsAudit(envelope);
+}
+
+function runActions(options) {
+  if (options.write || options.dryRun || options.confirm || options.scan || options.fromDispatch || options.approval || options.actor || options.run) {
+    throw new Error('actions supports read-only catalog audit only');
+  }
+  const modes = [options.actionsList, options.actionsShow, options.actionsVerify].filter(Boolean);
+  if (modes.length !== 1) throw new Error('actions requires exactly one of --list, --show <action-id>, or --verify <action-id>');
+  ensureRoot(options.root);
+  const mode = options.actionsList ? 'list' : options.actionsVerify ? 'verify' : 'show';
+  const envelope = actionCatalogEnvelope(mode, options.actionId);
+  if (mode === 'verify' && !envelope.verification.ok) throw new Error(`runtime action catalog verification failed: ${envelope.verification.failures.join('; ')}`);
+  if (options.json) {
+    writeJsonEnvelope('actions', envelope);
+    return;
+  }
+  printActionCatalog(envelope);
+}
+
+function runPolicies(options) {
+  if (options.write || options.dryRun || options.confirm || options.scan || options.fromDispatch || options.approval || options.actor || options.run) {
+    throw new Error('policies supports read-only audit only');
+  }
+  const modes = [options.policyCatalog, options.policySummary, options.policyList, options.policyShow].filter(Boolean);
+  if (modes.length !== 1) throw new Error('policies requires exactly one of --catalog, --summary, --list, or --show <profile>');
+  ensureRoot(options.root);
+  const envelope = options.policyCatalog ? policyAuditEnvelope('catalog') : options.policySummary ? policyAuditEnvelope('summary') : options.policyList ? policyAuditEnvelope('list') : policyAuditEnvelope('show', options.profile);
+  if (options.json) {
+    writeJsonEnvelope('policies', envelope);
+    return;
+  }
+  printPolicyAudit(envelope);
+};
+
+function executionCommandExportBoundary() {
+  return true;
+}
+
+  return {
+    listApprovalFiles,
+    listApprovalLifecycleFiles,
+    executionFilePath,
+    listExecutionFiles,
+    readExecutionFile,
+    lifecycleSummary,
+    executionAgeMs,
+    executionAuditState,
+    executionSafety,
+    candidateSafety,
+    approvalSafety,
+    autoRunSafety,
+    validateCandidateArtifact,
+    validateApprovalArtifact,
+    executionIdempotencyKey,
+    runtimeActionCatalogSnapshot,
+    runtimeActionCatalogDigest,
+    runtimeActionById,
+    evaluateRuntimeActionCatalog,
+    validateRuntimeActionCatalog,
+    actionCatalogEnvelope,
+    policyProfileSnapshot,
+    validatePolicySnapshot,
+    policyEvaluationEnvelope,
+    executionPolicySnapshot,
+    validateExecutionPolicySnapshot,
+    validateRuntimeActionContract,
+    validateTerminalEvidence,
+    validateExecutionEnvelope,
+    executionSummary,
+    executionEventPath,
+    executionPlan,
+    findActiveExecutionByIdempotencyKey,
+    assertNoActiveExecution,
+    executionHistorySummary,
+    executionCandidateEnvelope,
+    candidateArtifactPath,
+    writeCandidateArtifact,
+    approvalArtifactPath,
+    executionApprovalEnvelope,
+    writeApprovalArtifact,
+    approvalLifecycleDigestPayload,
+    approvalLifecycleEnvelope,
+    validateApprovalLifecycleArtifact,
+    readApprovalLifecycle,
+    writeApprovalLifecycle,
+    validateApprovalLifecycleBinding,
+    approvalLifecycleCurrentState,
+    approvalLifecycleAuditEnvelope,
+    printApprovalLifecycle,
+    runApprovals,
+    readApprovalForAutoRun,
+    assertAutoRunLock,
+    controlledAutoRunEnvelope,
+    assertExecutionClaimReady,
+    executionPreflightEnvelope,
+    executionEnvelope,
+    supervisedRunBaseEnvelope,
+    terminalSupervisedRunEnvelope,
+    completeSupervisedRunEnvelope,
+    writeExecutionEnvelope,
+    writeExecutionPayload,
+    writeRunningThenCompleteExecution,
+    safetyFlag,
+    printExecutionPreflight,
+    printExecutionCandidate,
+    printExecutionApproval,
+    printExecution,
+    runExecute,
+    executionsAuditEnvelope,
+    printExecutionsAudit,
+    runExecutions,
+    printActionCatalog,
+    runActions,
+    policyAuditEnvelope,
+    printPolicyAudit,
+    runPolicies,
+  };
+
+function executionCommandFactoryEndBoundary() {
+  return true;
+}
+};

package/tools/vibe-runtime/runtime-execution-enabled-bridge-model.mjs

@@ -0,0 +1,113 @@
+import {
+  controlledLocalRuntimePolicyProfileName,
+  executionEnabledProfileName,
+} from './runtime-execution-enabled-profile-contract.mjs';
+
+const bridgeSyncMarker = 'runtime-cli-usage';
+
+function list(...groups) {
+  return groups.flat().filter(Boolean);
+}
+
+function currentCandidateBinding(candidate) {
+  return candidate?.candidate?.profile_binding || {};
+}
+
+function currentApprovalBinding(approval) {
+  return approval?.approval?.profile_binding || {};
+}
+
+export function candidateProfileBinding({ profilePreflight, policyDigest, actionCatalogDigest }) {
+  const effectiveProfile = profilePreflight?.effective_profile || '';
+  const policyProfile = profilePreflight?.configured_policy_profile || profilePreflight?.policy_profile || '';
+  const enabled = profilePreflight?.enabled_by_config === true;
+  const ready = profilePreflight?.ready_for_candidate === true;
+  const blockedReasons = list(
+    enabled ? '' : 'execution profile is not enabled by config',
+    effectiveProfile === executionEnabledProfileName() ? '' : 'effective profile must be execution-enabled',
+    policyProfile === controlledLocalRuntimePolicyProfileName() ? '' : `policy profile must be ${controlledLocalRuntimePolicyProfileName()}`,
+    ready ? '' : 'profile preflight is not ready for candidate',
+  );
+  return {
+    profile: executionEnabledProfileName(),
+    effective_profile: effectiveProfile,
+    enabled_by_config: enabled,
+    policy_profile: policyProfile,
+    policy_digest: policyDigest || '',
+    action_catalog_digest: actionCatalogDigest || '',
+    ready_for_candidate: ready,
+    blocked_reasons: blockedReasons,
+    contract_sync: bridgeSyncMarker,
+  };
+}
+
+export function candidateProfileBindingFailures(candidate) {
+  const binding = currentCandidateBinding(candidate);
+  return list(
+    binding.effective_profile === executionEnabledProfileName() ? '' : 'candidate effective profile must be execution-enabled',
+    binding.enabled_by_config === true ? '' : 'candidate execution profile must be enabled by config',
+    binding.policy_profile === controlledLocalRuntimePolicyProfileName() ? '' : `candidate policy profile must be ${controlledLocalRuntimePolicyProfileName()}`,
+    binding.ready_for_candidate === true ? '' : 'candidate profile preflight must be ready',
+    binding.policy_digest && binding.policy_digest === candidate?.policy?.policy_digest ? '' : 'candidate profile policy digest mismatch',
+    binding.action_catalog_digest && binding.action_catalog_digest === candidate?.candidate?.runtime_action_catalog?.catalog_digest ? '' : 'candidate profile action catalog digest mismatch',
+    ...(binding.blocked_reasons || []).map((reason) => `candidate profile: ${reason}`),
+  );
+}
+
+export function approvalProfileBinding({ candidate, candidateDigest, policyEvaluation, runtimeActionEvaluation }) {
+  const candidateBinding = currentCandidateBinding(candidate);
+  const blockedReasons = list(
+    candidateProfileBindingFailures(candidate),
+    policyEvaluation?.policy_digest === candidateBinding.policy_digest ? '' : 'approval policy digest drifted from candidate',
+    runtimeActionEvaluation?.catalog_digest === candidateBinding.action_catalog_digest ? '' : 'approval action catalog digest drifted from candidate',
+  );
+  return {
+    profile: executionEnabledProfileName(),
+    effective_profile: candidateBinding.effective_profile || '',
+    enabled_by_config: candidateBinding.enabled_by_config === true,
+    policy_profile: candidateBinding.policy_profile || '',
+    candidate_digest: candidateDigest || '',
+    policy_digest: policyEvaluation?.policy_digest || '',
+    candidate_policy_digest: candidateBinding.policy_digest || '',
+    action_catalog_digest: runtimeActionEvaluation?.catalog_digest || '',
+    candidate_action_catalog_digest: candidateBinding.action_catalog_digest || '',
+    drift_blocked: blockedReasons.length > 0,
+    blocked_reasons: blockedReasons,
+    contract_sync: bridgeSyncMarker,
+  };
+}
+
+export function approvalProfileBindingFailures(approval) {
+  const binding = currentApprovalBinding(approval);
+  return list(
+    binding.effective_profile === executionEnabledProfileName() ? '' : 'approval effective profile must be execution-enabled',
+    binding.enabled_by_config === true ? '' : 'approval execution profile must be enabled by config',
+    binding.policy_profile === controlledLocalRuntimePolicyProfileName() ? '' : `approval policy profile must be ${controlledLocalRuntimePolicyProfileName()}`,
+    binding.policy_digest && binding.policy_digest === approval?.approval?.policy_digest ? '' : 'approval profile policy digest mismatch',
+    binding.action_catalog_digest && binding.action_catalog_digest === approval?.approval?.runtime_action_catalog?.catalog_digest ? '' : 'approval profile action catalog digest mismatch',
+    ...(binding.blocked_reasons || []).map((reason) => `approval profile: ${reason}`),
+  );
+}
+
+export function orderedProfileBinding({ candidate, approval, candidateDigest, policyEvaluation }) {
+  const candidateBinding = currentCandidateBinding(candidate);
+  const approvalBinding = currentApprovalBinding(approval);
+  const blockedReasons = list(
+    candidateProfileBindingFailures(candidate),
+    approval ? approvalProfileBindingFailures(approval) : 'approval missing',
+    approval?.approval?.candidate_digest === candidateDigest ? '' : 'approval candidate digest drifted from candidate file',
+    approvalBinding.candidate_policy_digest === candidateBinding.policy_digest ? '' : 'approval candidate policy digest drifted',
+    approvalBinding.candidate_action_catalog_digest === candidateBinding.action_catalog_digest ? '' : 'approval candidate action catalog digest drifted',
+  );
+  return {
+    effective_profile: candidateBinding.effective_profile || '',
+    profile_status: blockedReasons.length === 0 ? 'ready' : 'blocked',
+    policy_digest: policyEvaluation?.policy_digest || candidateBinding.policy_digest || '',
+    action_catalog_digest: policyEvaluation?.action_catalog_digest || candidateBinding.action_catalog_digest || '',
+    candidate_policy_digest: candidateBinding.policy_digest || '',
+    approval_policy_digest: approvalBinding.policy_digest || '',
+    candidate_action_catalog_digest: candidateBinding.action_catalog_digest || '',
+    approval_action_catalog_digest: approvalBinding.action_catalog_digest || '',
+    blocked_reasons: [...new Set(blockedReasons)],
+  };
+}