@lapxo/bound 0.1.0 → 0.1.2

package/dist/host/release.js

@@ -2,17 +2,31 @@ import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, sep } from 'node:path';
 import { canonical } from '@lapxo/topos/wire';
-import { fieldOf, isWire } from "../fold/claims.js";
+import { fieldOf, isWire, isConfig } from "../fold/claims.js";
 import { archiveCoordinate, archiveDestination, members } from "./archive.js";
 import { blobAt, holdStore, landBlob, replaceWhole, storeAt } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 export const laidAt = (store, digest) => storeAt(store, 'cas', 'laid', digest.replace(/^[^:]*:/, ''));
-export const releasesOf = (lock) => lock.filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads' && fieldOf(line, 'value') !== 'withdraw');
+/** A host artifact binding, not a measured ceiling or an object act. */
+export const isReleaseBinding = (line) => isConfig(line)
+    && fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads'
+    && fieldOf(line, 'value') !== 'withdraw'
+    && (fieldOf(line, 'measure') === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(fieldOf(line, 'value')));
+export const releasesOf = (lock) => lock.filter(isReleaseBinding);
 const laidMark = '.laid';
 const digestOf = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
 const hashed = (digest, bytes) => createHash(digest.includes(':') ? digest.slice(0, digest.indexOf(':')) : 'sha256').update(bytes).digest('hex') === digest.replace(/^[^:]*:/, '');
 const snapshotOf = (text) => text.split('\n').filter(isWire).filter((line) => fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'scope').startsWith('file/'))
     .map((line) => [fieldOf(line, 'scope').slice('file/'.length), fieldOf(line, 'value')]);
+/** Mount an explicitly declared archive coordinate; never infer a package root. */
+function mountedFiles(files, root) {
+    if (!root)
+        return files;
+    const prefix = archiveCoordinate(root) + '/';
+    if (!files.length || files.some(([name]) => !name.startsWith(prefix)))
+        throw new Error(`REFUSE·release archive root ${root} does not contain every member`);
+    return files.map(([name, digest]) => [archiveCoordinate(name.slice(prefix.length)), digest]);
+}
 function snapshotLines(files) {
     return files.map(([coord, digest]) => canonical({
         scope: `file/${coord}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target',
@@ -110,6 +124,11 @@ function keepSnapshot(store, digest, bytes) {
 export function layReleases(store, own, lock, contentStore = own) {
     let laid = 0;
     for (const line of releasesOf(lock)) {
+        // A release catalog entry without a mount is materialized only when requested.
+        // Its absence must not block an unrelated place's fold.
+        const needs = fieldOf(line, 'needs');
+        if (!needs)
+            continue;
         const digest = fieldOf(line, 'value');
         const at = laidAt(store, digest);
         const dir = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() ?? false;
@@ -125,20 +144,18 @@ export function layReleases(store, own, lock, contentStore = own) {
             throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
         if (bytes === undefined && !dir && current === undefined)
             throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
-        const needs = fieldOf(line, 'needs');
-        if (!needs)
-            continue;
+        const root = fieldOf(line, 'shape');
         const place = join(own, archiveCoordinate(needs));
         const link = lstatSync(place, { throwIfNoEntry: false });
         if (link?.isSymbolicLink() && !realpathSync(place).includes(`${sep}cas${sep}laid${sep}`))
             continue;
         if (dir) {
-            const files = bytes === undefined ? undefined : members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+            const files = bytes === undefined ? undefined : mountedFiles(members(bytes).map((one) => [one.name, digestOf(one.bytes)]), root);
             if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && files !== undefined && layoutMatches(place, files))
                 continue;
             const next = nextPlace(place);
             try {
-                layDir(at, next);
+                layDir(root ? join(at, archiveCoordinate(root)) : at, next);
                 swapPlace(place, next, digest);
             }
             catch (error) {
@@ -151,11 +168,12 @@ export function layReleases(store, own, lock, contentStore = own) {
         const snap = observeText(at);
         if (snap === undefined)
             throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available snapshot`);
-        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, snapshotOf(snap)))
+        const mounted = mountedFiles(snapshotOf(snap), root);
+        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, mounted))
             continue;
         const next = nextPlace(place);
         try {
-            layFiles(store, contentStore, snapshotOf(snap), next);
+            layFiles(store, contentStore, mounted, next);
             swapPlace(place, next, digest);
         }
         catch (error) {
@@ -180,12 +198,12 @@ export const resolvedOf = (store, own, lock, contentStore = own) => releasesOf(l
     const historicalDirectory = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() === true;
     const snapshot = observeText(at);
     const complete = expected !== undefined && (needs
-        ? layoutMatches(place, expected)
+        ? layoutMatches(place, mountedFiles(expected, fieldOf(line, 'shape')))
         : historicalDirectory ? layoutMatches(at, expected) : snapshot !== undefined && sameSnapshot(snapshotOf(snapshot), expected));
     return ok && laid && complete ? [canonical({ scope: `resolved/${fieldOf(line, 'scope').slice('dep/'.length)}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target' })] : [];
 });
 /** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
-export function runtimeTreeAt(store, own, digest, contentStore = own) {
+export function runtimeTreeAt(store, own, digest, contentStore = own, root = '') {
     const named = /^([a-zA-Z0-9-]+):([a-fA-F0-9]+)$/.exec(digest);
     if (named === null)
         throw new Error(`REFUSE·release invalid digest ${digest}`);
@@ -195,9 +213,11 @@ export function runtimeTreeAt(store, own, digest, contentStore = own) {
     if (!hashed(digest, bytes))
         throw new Error(`REFUSE·release ${digest} does not name its available bytes`);
     const files = members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+    mountedFiles(files, root); // Validate the same declared projection used for installation.
     const place = storeAt(store, 'cas', 'runtime', named[1], named[2]);
+    const selected = root ? join(place, archiveCoordinate(root)) : place;
     if (observeText(join(place, laidMark)) === digest && layoutMatches(place, files))
-        return place;
+        return selected;
     for (const member of members(bytes))
         landBlob(store, digestOf(member.bytes), member.bytes);
     const next = nextPlace(place);
@@ -209,5 +229,5 @@ export function runtimeTreeAt(store, own, digest, contentStore = own) {
         rmSync(next, { recursive: true, force: true });
         throw error;
     }
-    return place;
+    return selected;
 }

package/dist/host/selected-capsules.d.ts

@@ -2,7 +2,7 @@ import { capsuleAt } from './capsule.ts';
 import type { Capsule } from './capsule.ts';
 import type { ToposResolver } from './selected-topos.ts';
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export declare function selectedCapsules(pins: readonly string[], resolve?: typeof capsuleAt, select?: ToposResolver): readonly {
+export declare function selectedCapsules(pins: readonly string[], resolve?: typeof capsuleAt, select?: ToposResolver, host?: readonly string[]): readonly {
     readonly capsule: Capsule;
     readonly offer: string;
 }[];

package/dist/host/selected-capsules.js

@@ -4,13 +4,17 @@ import { selectedTopoi, toposAt } from "./selected-topos.js";
 import { canonical } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
 import { ownLock } from "../observe/runner.js";
+import { archiveCoordinate } from "./archive.js";
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt) {
+export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
     return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const projections = ownLock().filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads' && fieldOf(line, 'value') === offer.value);
-        if (projections.length !== 1 || !fieldOf(projections[0], 'shape'))
+        const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
+        if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
             throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-        const projected = { ...offer, shape: fieldOf(projections[0], 'shape') };
+        const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
+        if (entries.length !== 1)
+            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
+        const projected = { ...offer, shape: entries[0] };
         const capsule = resolve(offer.value, projected.shape);
         if (capsule === undefined)
             throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);

package/dist/host/selected-topos.d.ts

@@ -1,4 +1,5 @@
 import type { StandingTopos } from '@lapxo/topos/standing';
+import { wireAt } from '@lapxo/topos/wire';
 export interface SelectedTopos {
     readonly digest: string;
     readonly topos: StandingTopos;
@@ -15,3 +16,6 @@ export declare function selectedTopoi(pins: readonly string[], resolve?: ToposRe
  * Independent declarations must agree; selection order cannot choose a contract.
  */
 export declare function selectedWireList(local: readonly string[], epoch: number, pins: readonly string[], list: string, resolve?: ToposResolver): readonly string[];
+/** Complete an admission snapshot from the selected standing. Local declarations
+ * govern their own lists; independent selected contracts cannot choose by order. */
+export declare function selectedWireAt(local: readonly Readonly<Record<string, string>>[], epoch: number, pins: readonly string[], resolve?: ToposResolver): ReturnType<typeof wireAt>;

package/dist/host/selected-topos.js

@@ -59,3 +59,26 @@ export function selectedWireList(local, epoch, pins, list, resolve = toposAt) {
         throw Error(`REFUSE·wire wire/${list} has conflicting contracts · ${contracts.map(one => one.name).join(' · ')}`);
     return first.words;
 }
+/** Complete an admission snapshot from the selected standing. Local declarations
+ * govern their own lists; independent selected contracts cannot choose by order. */
+export function selectedWireAt(local, epoch, pins, resolve = toposAt) {
+    const own = wireAt(local, epoch);
+    const worlds = selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ digest, parts: topos.parts, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }));
+    const key = (scope) => scope.startsWith('wire/') ? scope.slice(5) : scope.startsWith('audit/wire/') ? scope.slice(11) : undefined;
+    const declared = new Set(local.filter(f => Number(f.epoch ?? 0) <= epoch).map(f => key(f.scope ?? '')).filter((k) => k !== undefined));
+    const selected = new Map();
+    for (const world of worlds)
+        for (const f of world.parts) {
+            const name = key(f.scope ?? '');
+            if (name === undefined || declared.has(name))
+                continue;
+            const list = world.wire?.lists.get(name);
+            const value = list ? [...list].sort().join('|') : f.value ?? '';
+            const previous = selected.get(name);
+            if (previous && previous.value !== value)
+                throw Error(`REFUSE·wire wire/${name} has conflicting selected contracts · ${previous.digest} · ${world.digest}`);
+            if (!previous)
+                selected.set(name, { value, fields: f, digest: world.digest });
+        }
+    return selected.size ? wireAt([...selected.values()].map(one => one.fields).concat(local), epoch) : own;
+}

package/dist/host/signing.d.ts

@@ -0,0 +1,3 @@
+import type { SigningLot } from './ports/signing.ts';
+/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
+export declare function signerFor(lines: readonly string[], keyId: string, selected?: string, keyFile?: string): (lot: SigningLot) => Promise<readonly import("./ports/signing.ts").SignatureRecord[]>;

package/dist/host/signing.js

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
+import { invokeSigner, SigningFailure } from "./ports/signing.js";
+/** An explicitly supplied host registry; a repository cannot supply executable bindings. */
+function binding(name, keyFile) {
+    if (name === 'file') {
+        if (!keyFile)
+            throw new SigningFailure('REFUSE·signer file needs --key-file');
+        return { kind: 'file', path: keyFile };
+    }
+    if (keyFile)
+        throw new SigningFailure('REFUSE·signer command cannot use --key-file');
+    const path = process.env['BOUND_SIGNERS'];
+    if (!path)
+        throw new SigningFailure('REFUSE·signer no host binding registry');
+    try {
+        const registry = JSON.parse(readFileSync(path, 'utf8'));
+        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, name))
+            throw Error();
+        const record = registry[name];
+        if (!record || typeof record !== 'object')
+            throw Error();
+        const f = record;
+        if (f['kind'] !== 'command' || typeof f['executable'] !== 'string' || !f['executable']
+            || !Array.isArray(f['args']) || !f['args'].every(a => typeof a === 'string'))
+            throw Error();
+        return { kind: 'command', executable: f['executable'], args: f['args'] };
+    }
+    catch {
+        throw new SigningFailure('REFUSE·signer host binding unavailable or invalid');
+    }
+}
+/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
+export function signerFor(lines, keyId, selected, keyFile) {
+    const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const declaration = signerSelection(fields, keyId);
+    if (selected !== undefined && selected !== declaration.name)
+        throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
+    const mechanism = binding(declaration.name, keyFile);
+    const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
+    return (lot) => invokeSigner(lot, mechanism, protocol, declaration);
+}

package/dist/host/source-content.d.ts

@@ -7,4 +7,4 @@ export interface ContentPort {
 /** Transport uses declared locations; only the requested digest admits bytes into the cache. */
 export declare function resolveSelectedContent(lines: readonly string[], port: ContentPort): Promise<readonly string[]>;
 /** Exact resource URLs; no repository checkout or inferred release. */
-export declare function resolveSources(standing: readonly string[]): Promise<void>;
+export declare function resolveSources(standing: readonly string[], materializeInstrument?: boolean): Promise<void>;

package/dist/host/source-content.js

@@ -8,7 +8,10 @@ import { ownLock, ownStore } from "../observe/runner.js";
 export async function resolveSelectedContent(lines, port) {
     const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
     const selectionIndex = (scope) => { const match = /(^|\/)uses\//.exec(scope); return match === null ? -1 : match.index + match[1].length; };
-    const bindings = fields.filter(f => selectionIndex(f.scope ?? '') >= 0 || f.scope?.startsWith('dep/'));
+    // A dependency constraint is not a content binding. Historical artifact records
+    // use measure=id; explicit digest records still validate even when malformed.
+    const bindings = fields.filter(f => selectionIndex(f.scope ?? '') >= 0 ||
+        (f.scope?.startsWith('dep/') && (f.measure === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(f.value ?? ''))));
     const locations = new Map();
     for (const binding of bindings) {
         const scope = binding.scope ?? '';
@@ -73,12 +76,19 @@ export async function resolveSelectedContent(lines, port) {
     return received;
 }
 /** Exact resource URLs; no repository checkout or inferred release. */
-export async function resolveSources(standing) {
+export async function resolveSources(standing, materializeInstrument = false) {
     const instrument = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
     const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
     if (wire === null)
         throw Error('REFUSE·pin instrument has no admitted wire');
-    const received = await resolveSelectedContent([...standing, ...ownLock().filter(line => { const p = parse(line); return p.kind === 'fact' && (p.value.fields.scope?.startsWith('dep/') || p.value.fields.scope?.startsWith('sources/')); })], {
+    const bindings = ownLock().filter(line => {
+        const p = parse(line);
+        if (p.kind !== 'fact')
+            return false;
+        const fields = p.value.fields;
+        return fields.scope?.startsWith('sources/') || (fields.scope?.startsWith('dep/') && (fields.role !== 'reads' || (materializeInstrument && !!fields.needs)));
+    });
+    const received = await resolveSelectedContent([...standing, ...bindings], {
         algorithms: wire.digests,
         read: digest => observeFile(blobAt(ownStore(), digest)),
         write: (digest, bytes) => { landBlob(ownStore(), digest, bytes); },

package/dist/land/sign.d.ts

@@ -1,16 +1,15 @@
-type Signed = {
+import type { SigningLot, SignatureRecord } from '../host/ports/signing.ts';
+/** Prepare and verify a whole lot. No key material and no output/admission side effects. */
+export declare function signConsentLot(lines: readonly string[], stamp: {
+    readonly epoch?: number;
+    readonly by: string;
+    readonly algorithm: string;
+}, publicKey: string, admitted: readonly string[], invoke: (lot: SigningLot) => Promise<readonly SignatureRecord[]>): Promise<{
     readonly kind: 'fact';
-    readonly line: string;
+    readonly lines: readonly string[];
 } | {
     readonly kind: 'refuse';
     readonly why: string;
-};
-/** A consent line (by=target, no sig) becomes the owner's claim: stamped with its epoch, then signed over the canonical bytes. */
-export declare function signConsentLine(line: string, privateKeyPem: string, stamp: {
-    readonly epoch?: number;
-    readonly by: string;
-    readonly algorithm: string;
-}): Signed;
+}>;
 export declare function verifiesOwnerLine(line: string, publicKeyPem: string, admitted: readonly string[]): boolean;
 export declare function verifiesFields(fields: Readonly<Record<string, string>>, publicKey: string, admitted: readonly string[]): boolean;
-export {};

package/dist/land/sign.js

@@ -1,21 +1,44 @@
 import { canonical, parse, parseForSigning, signedBytes, signedFieldsOf } from '@lapxo/topos/wire';
-import { signBytes, verifyBytes } from "../host/adapters/keys/ed25519.js";
-/** A consent line (by=target, no sig) becomes the owner's claim: stamped with its epoch, then signed over the canonical bytes. */
-export function signConsentLine(line, privateKeyPem, stamp) {
+import { verifyBytes } from "../host/adapters/keys/ed25519.js";
+import { SigningFailure } from "../host/ports/signing.js";
+function prepareConsentLine(line, stamp) {
     const got = parseForSigning(line);
     if (got.kind !== 'fact')
-        return { kind: 'refuse', why: `REFUSE·accept not a claim line: ${got.why}` };
+        return { kind: 'refuse', why: 'REFUSE·accept not a claim line' };
     const fields = got.value.fields;
     const scope = fields['scope'] ?? '?';
     if (fields['sig'] !== undefined)
         return { kind: 'refuse', why: `REFUSE·accept ${scope} is already signed` };
-    if (fields['by'] !== 'target') {
-        return { kind: 'refuse', why: `REFUSE·accept ${scope} is by=${fields['by'] ?? '∅'}; only by=target lines are signed` };
-    }
+    if (fields['by'] !== 'target')
+        return { kind: 'refuse', why: `REFUSE·accept ${scope} must be drafted by=target` };
     const covered = signedFieldsOf(fields, stamp.by);
     if (stamp.epoch !== undefined)
         covered['epoch'] = String(stamp.epoch);
-    return { kind: 'fact', line: canonical({ ...covered, sig: signBytes(signedBytes(covered), privateKeyPem, stamp.algorithm) }) };
+    return { kind: 'fact', fields: covered };
+}
+/** Prepare and verify a whole lot. No key material and no output/admission side effects. */
+export async function signConsentLot(lines, stamp, publicKey, admitted, invoke) {
+    const fields = [];
+    for (const line of lines) {
+        const prepared = prepareConsentLine(line, stamp);
+        if (prepared.kind === 'refuse')
+            return prepared;
+        fields.push(prepared.fields);
+    }
+    if (!fields.length)
+        return { kind: 'refuse', why: `REFUSE·signer ${stamp.by} empty lot` };
+    let records;
+    try {
+        records = await invoke({ bytes: fields.map(f => signedBytes(f)), keyId: stamp.by, algorithm: stamp.algorithm });
+    }
+    catch (error) {
+        return { kind: 'refuse', why: error instanceof SigningFailure ? error.message : `REFUSE·signer ${stamp.by} acquisition failed` };
+    }
+    if (records.length !== fields.length || records.some((record, i) => record.keyId !== stamp.by
+        || !verifyBytes(signedBytes(fields[i]), publicKey, record.signature, admitted))) {
+        return { kind: 'refuse', why: `REFUSE·signer ${stamp.by} signature does not verify` };
+    }
+    return { kind: 'fact', lines: fields.map((f, i) => canonical({ ...f, sig: records[i].signature })) };
 }
 export function verifiesOwnerLine(line, publicKeyPem, admitted) {
     const got = parse(line);

package/dist/observe/regions.js

@@ -1,5 +1,5 @@
 import { selectedCapsules } from "../host/selected-capsules.js";
-import { selectionLines } from "../fold/reach.js";
+import { selectionLines, projectionLines } from "../fold/reach.js";
 export { selectionLines } from "../fold/reach.js";
 import { createHash } from 'node:crypto';
 import { basename, dirname, join, relative } from 'node:path';
@@ -125,7 +125,7 @@ export function capsulesOf(fold) {
     const cached = heldCapsules.get(fold);
     if (cached !== undefined)
         return cached;
-    const got = selectedCapsules(selectionLines(fold)).map(one => one.capsule);
+    const got = selectedCapsules(selectionLines(fold), undefined, undefined, projectionLines(fold)).map(one => one.capsule);
     heldCapsules.set(fold, got);
     return got;
 }

package/dist/observe/runner.js

@@ -21,7 +21,8 @@ const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
 const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
 const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
 export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
-export const ownStore = () => join(ownRoot(), '..', EXTENSION);
+export const ownStore = () => existsSync(join(ownRoot(), EXTENSION, 'ledger'))
+    ? join(ownRoot(), EXTENSION) : join(ownRoot(), '..', EXTENSION);
 /** The colocated public artifact is read without an unrelated parent's authority store. */
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;
@@ -30,7 +31,9 @@ export const ownLock = () => {
         return instrumentLock;
     const lines = (observeText(join(ownRoot(), LOCK)) ?? '').split('\n').filter(isWire);
     const published = publicLock(lines);
-    instrumentLock = published === undefined ? ownLockOf(join(ownRoot(), '..'), basename(ownRoot()), true) : foldClaims(published).standing;
+    instrumentLock = published === undefined
+        ? dirname(ownStore()) === ownRoot() ? ownLockOf(ownRoot(), '', true) : ownLockOf(join(ownRoot(), '..'), basename(ownRoot()), true)
+        : foldClaims(published).standing;
     return instrumentLock;
 };
 export const sourceOf = () => (fromBlob() ? join(ownRoot(), 'src', 'cli', 'verb.ts') : self());

package/dist/render/view.js

@@ -166,7 +166,8 @@ export function prerender(fold, views) {
     capsuleViews(fold, due.map((view) => ({ asking: view.regions.filter((asked) => REGIONS[asked.name] === undefined), shape: view.shape })));
 }
 export function viewOf(fold, view) {
-    const live = !view.shape;
+    // Native receipts project current file bytes, not only the cached fold's observations.
+    const live = !view.shape || view.regions.some(asked => asked.name === 'receipts');
     const kept = !live && fold.key ? keptRender(fold.store, fold.key, view.name) : undefined;
     if (kept !== undefined)
         return kept;

package/docs/usage.md

@@ -12,11 +12,11 @@ Start by asking for help and folding the project. If a selected view is unavaila
 
 ## Keys and coverage
 
-Use a named key already admitted by the project. The authority contract declares its public key, class and scope coverage. The private key is a matching PKCS8 PEM file outside the repository. Point `--key-file` at that file and `--key` at the admitted identifier.
+Use a named key already admitted by the project. The authority contract declares its public key, class and scope coverage. Signing uses a declared port. The lock names `keys/<who> measure=signer value=<name>`; `signer/timeout` and `signer/response-bytes` bound each invocation. The built-in `file` port reads a matching PKCS8 PEM outside the repository through `--key-file`. For a command port, the host supplies a `BOUND_SIGNERS` registry mapping that admitted name to `{ "kind": "command", "executable": "...", "args": [] }`. A repository declaration cannot authorize a program. `--signer <name>` must match the admitted selection.
 
 A new device must have its public key and coverage admitted by an authority that already covers the intended scope. The CLI does not currently certify silent key creation or tap-to-sign. This guide does not substitute a self-authorized fixture key for the team's authority.
 
-For automation, supply the private key through the runner's secret storage to a temporary external file with restricted permissions. Do not print, commit or upload it. A source-control token and a Bound authority key have different purposes. Key rotation and revocation are changes to the admitted authority contract, not edits that erase prior signatures.
+For automation through the file port, supply the private key through the runner's secret storage to a temporary external file with restricted permissions. A command signer receives the lot once as canonical signed bytes, one line per record in order. It returns one canonical wire response per record, containing `by` and `sig`, in that same order. Bound verifies the entire reply against the admitted public key before any admission. Timeout, nonzero exit, missing or invalid replies refuse the whole lot; raw signer output is not logged. Hosts can keep private keys outside Bound through this port. Key generation, storage and rotation belong to the host. Do not print, commit or upload it. A source-control token and a Bound authority key have different purposes. Key rotation and revocation are changes to the admitted authority contract, not edits that erase prior signatures.
 
 ## Proposal → signature → admission → reading
 
@@ -42,7 +42,7 @@ receipts.bound is native fold output. Do not write it by hand, use JSON from a t
 
 REFUSE·wire means the current grammar does not admit the record. REFUSE·pin/release means named authentic content or its closure is unavailable or does not match. REFUSE·view means the requested view cannot be rendered under its contract. Authority refusal means the signer is not covered. Keep the line and the failed exit status; follow an explicit fix without changing the named digest or dropping a conflicting statement.
 
-release/blocks is policy read by the fold. The existing policy is incomplete because it has no admitted category links. An incomplete policy is not READY and is not permission to fabricate selectors.
+release/blocks is policy read by the fold. Its admitted category links select existing obligations. The fold prints each missing reading or crossed ceiling as BLOCK; a blocked or incomplete policy is not READY. Read the captured verdict for the exact candidate instead of inferring acceptance from a successful render.
 
 ## Repository and PR review
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -32,7 +32,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "0.1.7"
+    "@lapxo/topos": "0.1.8"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
@@ -44,5 +44,21 @@
   },
   "bin": {
     "bound": "./dist/cli/verb.js"
-  }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Lapxo/bound.git"
+  },
+  "homepage": "https://github.com/Lapxo/bound#readme",
+  "bugs": {
+    "url": "https://github.com/Lapxo/bound/issues"
+  },
+  "keywords": [
+    "cli",
+    "content-addressed",
+    "provenance",
+    "receipts",
+    "constraints",
+    "reproducible"
+  ]
 }