@lapxo/bound 0.1.7 → 0.1.9

package/dist/host/native/route.js

@@ -0,0 +1,216 @@
+import { fieldNames } from "./reading.js";
+import { sha256 as hash } from "../hash.js";
+/** Instrument-only native route. The caller holds the existing Root lease
+ * across selection, cache authorization and this complete bounded child act.
+ */
+import { dirname } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { nativeBinaryOrigin } from "./native-binary.js";
+import { selectedHostControl } from "./control-selection.js";
+import { authorityAtEpoch } from '@lapxo/topos/wire';
+import { parsedLine as parse } from "../../fold/claims.js";
+import { authorityFor } from "../../fold/signers.js";
+import { authenticatedRootStanding } from "../admitted-place.js";
+import { nativeExecutorInputs } from "./materialize.js";
+export { materializeNativeRoute } from "./materialize.js";
+import { assertNativeRuntime } from "./runtime.js";
+import { nativeReferenceInputs } from "./references.js";
+import { rootAuthorityProtection } from "../../land/act.js";
+import { currentNativeRoot, inheritedNativeRoot } from "./root.js";
+import { authenticateSignedPort, authenticateNativeProfile, canonicalJson } from "./reading.js";
+import { boundedProcess } from "../process-lifetime.js";
+import { validResponse, CapsuleProcessError } from "../capsule-process.js";
+import { processOf } from "../../observe/runner.js";
+const fail = (why) => { throw Error('REFUSE·native route ' + why); };
+const routes = new WeakMap();
+/** Shared origins are one exact input; individual signed selectors remain separate. */
+export function nativeBinaryOriginInputs(binaries) {
+    const seen = new Map(), inputs = [];
+    for (const binary of binaries) {
+        if (!binary.origin)
+            continue;
+        const coordinate = 'native/binary-origin/' + binary.origin.coordinate, digest = hash(binary.origin.line), prior = seen.get(coordinate);
+        if (prior !== undefined) {
+            if (prior !== digest)
+                fail('conflicting binary origin input ' + coordinate);
+            continue;
+        }
+        seen.set(coordinate, digest);
+        inputs.push([coordinate, digest]);
+    }
+    return Object.freeze(inputs);
+}
+/** Inputs are semantic logical references. Fixed instrument/host graph and
+ * runtime-supervisor chain must also be supplied by the calling identity builder.
+ * Locations and lock-token/PID are operational custody, never these inputs.
+ */
+export function prepareNativeRoute(store, coordinate, readerMapping) {
+    const proof = rootAuthorityProtection(store), current = currentNativeRoot(store, process.pid, proof);
+    return prepareAtCurrentRoot(store, coordinate, readerMapping, current);
+}
+/** Private same-call reuse only: callers cannot supply a standing as authority. */
+function prepareAtCurrentRoot(store, coordinate, readerMapping, current) {
+    const { root, context } = current, selected = authenticateNativeProfile(root, coordinate), profile = selected.profile;
+    // The Root cursor authorizes today's act under the held lease. It is not a
+    // semantic input to every program: unrelated Root acts do not reopen it.
+    // Exact selected grants and the authenticated reader mapping remain inputs.
+    const binaries = authenticatedNativeBinaries(root, profile), control = selectedHostControl(root, profile), identity = hash(canonicalJson([coordinate, selected.line, profile, binaries, readerMapping ?? null, ...(control ? [control] : [])])), inputs = [['native/selection', identity], ...(readerMapping ? [['native/reader-mapping', hash(readerMapping)]] : []), ...profile.selection.members.map(m => ['native/' + m.coordinate, m.digest]), ...binaries.map(b => ['native/binary/' + b.coordinate, hash(b.line)])];
+    inputs.push(...nativeBinaryOriginInputs(binaries));
+    if (control)
+        inputs.push(['native/control-profile', hash(control.line)], ['native/control-worker', control.profile.worker.digest], ['native/control-runtime', control.profile.runtime.digest]);
+    const route = { identity, profile, binaries, ...(control ? { control } : {}), inputs: inputs };
+    routes.set(route, { store, coordinate, context, profile });
+    inputs.push(...nativeExecutorInputs(route));
+    if (control && inputs.find(([name]) => name === control.profile.worker.coordinate)?.[1] !== control.profile.worker.digest)
+        fail('control worker differs from sealed executor');
+    Object.freeze(inputs);
+    return Object.freeze(route);
+}
+/** Recheck authority before both a current retained answer and fresh execution.
+ * Historical public --check uses the existing receipt-inspection path, not this
+ * command authorization route.
+ */
+export function assertNativeRouteCurrent(route) {
+    const held = routes.get(route);
+    if (!held)
+        return fail('unknown prepared route');
+    const proof = rootAuthorityProtection(held.store), root = inheritedNativeRoot({ store: held.store, parent: process.pid, expected: held.context }, proof);
+    const profile = authenticateSignedPort(root, held.coordinate).profile;
+    if (canonicalJson(profile) !== canonicalJson(held.profile) || canonicalJson(authenticatedNativeBinaries(root, held.profile)) !== canonicalJson(route.binaries) || canonicalJson(selectedHostControl(root, held.profile) ?? null) !== canonicalJson(route.control ?? null))
+        fail('current port changed');
+}
+export function invokeNativeRoute(route, input) {
+    const held = routes.get(route);
+    if (!held)
+        return fail('unknown prepared route');
+    assertNativeRouteCurrent(route);
+    assertNativeRuntime(input.execution.env, input.execution.flags);
+    if (input.execution.context.implementation !== held.profile.selection.archive)
+        fail('reading implementation differs');
+    nativeReferenceInputs(input.execution.context.inputs, route.inputs);
+    if (input.limits.timeoutMs > held.profile.port.timeoutMs || input.limits.responseBytes > held.profile.port.responseBytes)
+        fail('reader limits exceed current command grant');
+    const proof = rootAuthorityProtection(held.store), frame = { proof, archive: input.archive, locations: input.locations, requests: input.requests };
+    const args = [processOf('native'), held.store, held.coordinate, JSON.stringify(held.context), 'reserved', String(held.profile.selection.budget.bytes), 'act', String(process.pid), JSON.stringify(input.execution)];
+    const result = boundedProcess(process.execPath, args, JSON.stringify(frame), input.limits, input.execution.cwd, input.execution.env);
+    if (result.signal !== null || result.status !== 0)
+        throw new CapsuleProcessError('native child exited ' + String(result.status ?? result.signal), result);
+    let values;
+    try {
+        values = JSON.parse(result.stdout.trimEnd());
+    }
+    catch {
+        return fail('native child malformed batch');
+    }
+    if (!Array.isArray(values) || values.length !== input.requests.length || !values.every((value, index) => validResponse(value, input.requests[index])))
+        fail('native child invalid batch');
+    assertNativeRouteCurrent(route);
+    return values;
+}
+/** This predicate only schedules an outer lease. It grants no command. */
+export function declaredNativeReaderPorts(lines) { return lines.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope.startsWith('reader/') && got.value.fields.scope.split('/').at(-1) === 'port' && got.value.fields.value !== 'withdraw'; }); }
+export function prepareNativeReaderRoute(store, reader) {
+    const expectedScope = ['reader', reader.module, 'port'].join('/');
+    const declared = authenticatedRootStanding(dirname(store));
+    if (!declared.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope && got.value.fields.value !== 'withdraw'; }))
+        return undefined;
+    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
+    const rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope; });
+    if (!rows.length)
+        return undefined;
+    if (rows.length !== 1)
+        fail('ambiguous reader port ' + expectedScope);
+    const got = parse(rows[0]);
+    if (got.kind !== 'fact')
+        return fail('invalid reader port ' + expectedScope);
+    const f = got.value.fields;
+    if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
+        fail('malformed reader port ' + expectedScope);
+    const auth = authorityFor(root.history, root.signer, root.eras), signed = auth.of(rows[0]);
+    if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
+        fail('reader port is not Root signed ' + expectedScope);
+    if (signed.kind !== 'admitted')
+        return fail('reader port signature not admitted');
+    const signer = auth.admitted.find(one => one.id === signed.signer);
+    if (!signer)
+        return fail('reader port signer absent');
+    const current = authorityAtEpoch(f, signer, root.epoch, expectedScope, 'authority');
+    if (current.kind !== 'admitted')
+        fail('reader port current eligibility ' + current.why);
+    return prepareAtCurrentRoot(store, f.value, rows[0], currentRoot);
+}
+export function nativeRouteStore(route) { const held = routes.get(route); if (!held)
+    return fail('unknown prepared route'); return held.store; }
+/** Quiet-pass gate: authenticate grants/cursor only, no image/materialization or
+ * program execution. Historical --check remains its separate receipt path. */
+export function assertNativeReaderGrantsCurrent(store) { currentNativeReaderSelections(store); }
+/** Executable kinds come only from current authenticated Root declarations. A
+ * matching JSON hint identifies a candidate, but is never permission to execute. */
+export function authenticatedNativeBinaries(root, profile) {
+    const out = [], names = new Set();
+    const keys = fieldNames;
+    for (const line of root.live) {
+        const row = parse(line);
+        if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
+            continue;
+        let hint;
+        try {
+            hint = JSON.parse(row.value.fields.about ?? '');
+        }
+        catch {
+            continue;
+        }
+        if (!['host-native-binary@1', 'host-native-binary-origin@1'].includes(hint?.profile) || hint.selector?.port !== profile.port.coordinate)
+            continue;
+        const coordinate = row.value.fields.scope, auth = authenticateSignedPort(root, coordinate), p = auth.profile;
+        if (keys(p) !== (p.profile === 'host-native-binary-origin@1' ? 'alias,condition,coordinate,entry,limits,origin,profile,selector' : 'alias,condition,coordinate,entry,limits,profile,selector') || p.coordinate !== coordinate || typeof p.alias !== 'string' || !p.alias.length || p.alias.includes('\0') || typeof p.condition !== 'string' || !p.condition.length || keys(p.selector ?? {}) !== 'binding,implementation,port' || p.selector.implementation !== profile.port.implementation || !profile.selection.bindings.some(b => b.id === p.selector.binding))
+            fail('binary declaration differs from selected parent ' + coordinate);
+        const entry = p.entry, member = profile.selection.members.find(m => m.coordinate === entry?.path);
+        if (keys(entry ?? {}) !== 'bytes,digest,path' || !member || entry.path === profile.selection.runtime || member.digest !== entry.digest || !Number.isSafeInteger(entry.bytes) || entry.bytes < 1 || keys(p.limits ?? {}) !== 'bytes' || !Number.isSafeInteger(p.limits.bytes) || p.limits.bytes < entry.bytes || p.limits.bytes > profile.selection.budget.bytes)
+            fail('binary outside selected image resources ' + coordinate);
+        if (names.has(coordinate))
+            fail('ambiguous binary declaration ' + coordinate);
+        names.add(coordinate);
+        if (entry.digest === profile.selection.members.find(m => m.coordinate === profile.selection.runtime)?.digest)
+            fail('binary aliases selected runtime');
+        const origin = nativeBinaryOrigin(root, p, auth.line);
+        if (origin?.path === realpathSync(process.execPath))
+            fail('binary origin aliases actual runtime');
+        out.push(Object.freeze({ line: auth.line, coordinate, profile: p, ...(origin ? { origin } : {}) }));
+    }
+    return Object.freeze(out);
+}
+/** Same semantic image identity for preparation, retained mount and quiet checks. */
+export function nativeMountIdentity(profile, binaries, control) { return hash(canonicalJson(['logical-native-image/2', profile.selection, binaries, ...(control ? [control] : [])])); }
+/** Current eligibility only: no executor graph, image load or materialization. */
+export function currentNativeReaderSelections(store) {
+    const declared = authenticatedRootStanding(dirname(store));
+    if (!declaredNativeReaderPorts(declared))
+        return [];
+    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
+    const mappings = root.live.flatMap(line => { const row = parse(line); return row.kind === 'fact' && row.value.fields.scope.startsWith('reader/') && row.value.fields.scope.split('/').at(-1) === 'port' ? [{ line, fields: row.value.fields }] : []; });
+    const seen = new Set(), auth = authorityFor(root.history, root.signer, root.eras), out = [];
+    for (const { line, fields: f } of mappings) {
+        if (seen.has(f.scope))
+            fail('ambiguous reader port ' + f.scope);
+        seen.add(f.scope);
+        if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
+            fail('malformed reader port ' + f.scope);
+        const signed = auth.of(line);
+        if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
+            fail('reader port is not Root signed ' + f.scope);
+        if (signed.kind !== 'admitted')
+            return fail('reader mapping not admitted');
+        const signer = auth.admitted.find(one => one.id === signed.signer);
+        if (!signer)
+            return fail('reader mapping signer absent');
+        const current = authorityAtEpoch(f, signer, root.epoch, f.scope, 'authority');
+        if (current.kind !== 'admitted')
+            fail('reader port current eligibility ' + current.why);
+        const { profile } = authenticateNativeProfile(root, f.value);
+        const control = selectedHostControl(root, profile);
+        out.push({ profile, binaries: authenticatedNativeBinaries(root, profile), ...(control ? { control } : {}) });
+    }
+    return out;
+}
+export function currentNativeReaderProfiles(store) { return currentNativeReaderSelections(store).map(selection => selection.profile); }

package/dist/host/native/runtime.d.ts

@@ -0,0 +1,4 @@
+/** Environment identity is not permission to bootstrap arbitrary executable
+ * preloads. The fixed native entry currently has no ambient loader contract.
+ */
+export declare function assertNativeRuntime(environment: Readonly<Record<string, string | undefined>>, flags: readonly string[]): void;

package/dist/host/native/runtime.js

@@ -0,0 +1,9 @@
+/** Environment identity is not permission to bootstrap arbitrary executable
+ * preloads. The fixed native entry currently has no ambient loader contract.
+ */
+export function assertNativeRuntime(environment, flags) {
+    if ((environment.NODE_OPTIONS ?? '').trim() !== '')
+        throw Error('REFUSE·native runtime NODE_OPTIONS has no fixed verified loader configuration');
+    if (flags.length)
+        throw Error('REFUSE·native runtime startup flags differ from the fixed dispatcher');
+}

package/dist/host/native-reader-context.d.ts

@@ -0,0 +1,3 @@
+import type { NativeRoute } from './native/route.ts';
+export declare const nativeReaderRoute: () => NativeRoute | undefined;
+export declare function withNativeReaderRoute<T>(route: NativeRoute | undefined, run: () => T): T;

package/dist/host/native-reader-context.js

@@ -0,0 +1,8 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+// An opaque instrument selection travels with one observation. A request or a
+// world's response cannot select its executor or replace another reader's port.
+const active = new AsyncLocalStorage();
+export const nativeReaderRoute = active.getStore.bind(active);
+export function withNativeReaderRoute(route, run) {
+    return route === undefined ? run() : active.run(route, run);
+}

package/dist/host/place-clock-selection.d.ts

@@ -0,0 +1,55 @@
+import { PLACE_ACT_CONTEXT, type ClockBudget, type TrustedClockContract } from '@lapxo/topos/core';
+import { type Signer } from '@lapxo/topos/wire';
+import { type PlaceActTrust, type PlaceActBudget, type PlaceActHead } from './ports/place-act.ts';
+export interface HostClockSelection {
+    readonly profile: typeof PLACE_ACT_CONTEXT;
+    readonly namespace: string;
+    readonly regionFamily: string;
+    readonly receiptSigner: string;
+    readonly receiptScope: string;
+    readonly digestAlgorithm: 'sha256';
+    readonly budget: ClockBudget;
+    readonly storageBudget: PlaceActBudget;
+    readonly initial: readonly {
+        place: string;
+        receiver: {
+            identity: string;
+            epoch: string;
+        };
+        origin: {
+            prefix: string;
+            epoch: string;
+        };
+    }[];
+}
+export interface HostClockInput {
+    readonly store: string;
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly history: readonly string[];
+    readonly anchor: Signer;
+    readonly algorithms: readonly string[];
+    readonly legacyOriginals: readonly string[];
+    /** Actual protected Root authority cursor: an authenticated signed Root config
+     * checkpoint, never a sibling receipt/evidence max epoch. */
+    readonly authorityCheckpoint: string;
+    /** Fixed host historical predecessor proof, never taken from a packet. */
+    readonly authenticatedReceiverHeads?: readonly PlaceActHead[];
+    readonly readCurrent: () => Pick<HostClockInput, 'history' | 'anchor' | 'algorithms' | 'legacyOriginals' | 'authorityCheckpoint'>;
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+/** Root chooses selector and anchors/resources from its authenticated standing.
+ * Selection must be ROOT signed; a world's signature grants no host capability. */
+export declare function hostClockSelection(input: HostClockInput): {
+    selection: HostClockSelection;
+    trust: PlaceActTrust;
+};

package/dist/host/place-clock-selection.js

@@ -0,0 +1,124 @@
+/** Fixed HOST construction for the opt-in SDK clock profile. No CLI activation,
+ * inferred genesis, new wire fields, or packet-supplied signature verifier. */
+import { createHash } from 'node:crypto';
+import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
+import { canonical, signedBytes, wireAt } from '@lapxo/topos/wire';
+import { foldClaims, isConfig, fieldOf, parsedLine as parse } from "../fold/claims.js";
+import { eraOf } from "../fold/digests.js";
+import { authorityFor } from "../fold/signers.js";
+import { verifyBytes } from "./adapters/keys/ed25519.js";
+import { verifiesOwnerLine } from "../land/sign.js";
+import { placeActHeads } from "./ports/place-act.js";
+const fail = (why) => { throw Error('REFUSE·clock selection ' + why); };
+const digest = (s) => 'sha256:' + createHash('sha256').update(s).digest('hex');
+const text = (s) => typeof s === 'string' && s.length > 0;
+const clock = (s) => { if (typeof s !== 'string' || !/^(0|[1-9][0-9]*)$/.test(s) || !Number.isSafeInteger(Number(s)))
+    fail('unknown clock'); return Number(s); };
+// Exact-byte parsing returns frozen values. Retain only this pure syntax verdict;
+// history, signatures, authority windows, clocks and protected rereads stay fresh.
+const canonicalValues = new WeakSet();
+const f = (line) => { const got = parse(line); if (got.kind !== 'fact')
+    return fail('noncanonical history'); if (!canonicalValues.has(got.value)) {
+    if (canonical(got.value.fields, got.value.version) !== line)
+        fail('noncanonical history');
+    canonicalValues.add(got.value);
+} return got.value.fields; };
+/** Root chooses selector and anchors/resources from its authenticated standing.
+ * Selection must be ROOT signed; a world's signature grants no host capability. */
+export function hostClockSelection(input) {
+    const b = input.resources;
+    if (!b || Object.keys(b).sort().join(',') !== 'bytes,lines,places' || Object.values(b).some(n => !Number.isSafeInteger(n) || n < 1))
+        fail('missing input resources');
+    const inherited = input.inherited;
+    if (!inherited?.clock || Object.keys(inherited.clock).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || !inherited.storage || Object.keys(inherited.storage).sort().join(',') !== 'acts,bytes' || [...Object.values(inherited.clock), ...Object.values(inherited.storage)].some(n => !Number.isSafeInteger(n) || n < 1))
+        fail('missing inherited resource authority');
+    if (input.history.length + input.legacyOriginals.length > b.lines)
+        fail('input line budget');
+    let bytes = 0;
+    for (const line of [...input.history, ...input.legacyOriginals]) {
+        if (typeof line !== 'string' || line.length > b.bytes || (bytes += Buffer.byteLength(line)) > b.bytes)
+            fail('input byte budget');
+    }
+    const snapshots = new Map();
+    for (const original of input.history) {
+        const epoch = clock(f(original).epoch ?? fail('history clock absent'));
+        let authority = snapshots.get(epoch);
+        if (!authority) {
+            const before = input.history.filter(l => !isConfig(l) || clock(f(l).epoch ?? fail('history clock absent')) <= epoch);
+            authority = authorityFor(before, input.anchor, eraOf(foldClaims(before.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted);
+            snapshots.set(epoch, authority);
+        }
+        if (authority.of(original).kind !== 'admitted')
+            fail('history not authenticated at admission');
+    }
+    const live = foldClaims(input.history.filter(isConfig)).standing.filter(l => fieldOf(l, 'value') !== 'withdraw');
+    const ids = live.filter(l => { const p = f(l); return p.scope === input.profileSelector && p.measure === 'id'; });
+    if (ids.length !== 1 || f(ids[0]).value !== PLACE_ACT_CONTEXT || f(ids[0]).role !== 'writes' || f(ids[0]).form !== 'alphabet' || f(ids[0]).by !== input.anchor.id)
+        fail('missing/ambiguous clock profile id');
+    const rows = live.filter(l => { const p = f(l); return p.scope === input.selector && p.measure === 'text'; });
+    if (rows.length !== 1)
+        fail('missing/ambiguous Root selector');
+    const line = rows[0], fields = f(line);
+    if (fields.by !== input.anchor.id || fields.role !== 'writes' || fields.form !== 'alphabet' || fields.value !== 'lock' || !verifiesOwnerLine(line, input.anchor.publicKey, input.algorithms))
+        fail('selector is not Root signed');
+    if (!fields.about || fields.about.length > b.bytes)
+        fail('missing selector body');
+    let selection;
+    try {
+        selection = JSON.parse(fields.about);
+    }
+    catch {
+        return fail('selector JSON');
+    }
+    if (!selection || Object.keys(selection).sort().join(',') !== 'budget,digestAlgorithm,initial,namespace,profile,receiptScope,receiptSigner,regionFamily,storageBudget' || selection.profile !== PLACE_ACT_CONTEXT || selection.digestAlgorithm !== 'sha256' || !text(selection.namespace) || !text(selection.regionFamily) || !text(selection.receiptSigner) || !text(selection.receiptScope) || !Array.isArray(selection.initial) || !selection.initial.length || selection.initial.length > b.places)
+        fail('unsupported selector shape');
+    if (JSON.stringify(selection) !== fields.about)
+        fail('noncanonical selector JSON');
+    if (!selection.budget || Object.keys(selection.budget).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || Object.values(selection.budget).some(n => !Number.isSafeInteger(n) || n < 1) || !selection.storageBudget || Object.keys(selection.storageBudget).sort().join(',') !== 'acts,bytes' || Object.values(selection.storageBudget).some(n => !Number.isSafeInteger(n) || n < 1))
+        fail('missing selected resources');
+    for (const name of ['bytes', 'records', 'placements', 'policies', 'proofs', 'signers'])
+        if (selection.budget[name] > inherited.clock[name])
+            fail('clock resource exceeds inherited ' + name);
+    for (const name of ['acts', 'bytes'])
+        if (selection.storageBudget[name] > inherited.storage[name])
+            fail('storage resource exceeds inherited ' + name);
+    if (selection.budget.bytes > b.bytes || selection.storageBudget.bytes > b.bytes || selection.budget.records > b.lines || selection.budget.placements > b.places)
+        fail('selected resources exceed input authority');
+    const wire = wireAt(live.map(f), Number.MAX_SAFE_INTEGER);
+    if (!wire || !wire.digests.has(selection.digestAlgorithm))
+        fail('digest algorithm not declared');
+    const authority = authorityFor(input.history, input.anchor, input.algorithms);
+    if (!input.history.includes(input.authorityCheckpoint) || !isConfig(input.authorityCheckpoint))
+        fail('missing authenticated Root authority checkpoint');
+    const checkpointEpoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
+    if (snapshots.get(checkpointEpoch)?.of(input.authorityCheckpoint).kind !== 'admitted')
+        fail('Root checkpoint not admitted at original epoch');
+    const epoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
+    if (input.history.filter(isConfig).some(l => clock(f(l).epoch ?? fail('history clock absent')) > epoch))
+        fail('authority checkpoint precedes Root configuration');
+    const prefix = digest(input.history.join('\n') + '\n'), head = digest(live.join('\n') + '\n');
+    const policies = [...new Set(live.map(digest))].sort();
+    if (policies.length > selection.budget.policies)
+        fail('actual dependency budget');
+    const root = { namespace: selection.namespace, snapshot: digest(JSON.stringify([prefix, head, String(epoch)])), epoch: String(epoch), prefix, head, policies };
+    const initialHeads = selection.initial.map(i => { if (!i || !i.receiver || !i.origin || !text(i.receiver.identity) || !text(i.origin.prefix) || !text(i.place))
+        fail('unknown initial namespace'); const parts = i.place.split('/'); if (i.place !== '.' && (parts.length < 2 || parts.at(-1) !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..')))
+        fail('unknown initial namespace'); clock(i.receiver.epoch); clock(i.origin.epoch); return { place: i.place, identity: i.receiver.identity, epoch: i.receiver.epoch }; });
+    if (new Set(initialHeads.map(h => h.place)).size !== initialHeads.length)
+        fail('duplicate namespace');
+    const legacy = new Set(input.legacyOriginals.map(l => digest(signedBytes(f(l)))));
+    let heads = [];
+    const contract = { budget: selection.budget, root, signers: authority.admitted, places: initialHeads.map(h => h.place), regionFamily: selection.regionFamily, receiptSigner: selection.receiptSigner, receiptScope: selection.receiptScope, digest,
+        verifiesRootContext: c => JSON.stringify(c) === JSON.stringify(root),
+        verifiesNamespaceAdmission: p => { if (p === '.')
+            return true; const parts = p.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
+            return false; const n = parts.join('/'), rows = live.filter(l => f(l).scope === selection.regionFamily + '/' + n); if (rows.length !== 1)
+            return false; const v = f(rows[0]); return v.role === 'writes' && v.form === 'alphabet' && v.measure === 'coordinates' && v.value === n + '/**'; },
+        verifiesNewLocalPrefix: (p, prefix, epoch, originals) => { const h = heads.find(h => h.place === p), i = selection.initial.find(i => i.place === p); if (!h || !i || originals.some(l => legacy.has(digest(signedBytes(f(l))))))
+            return false; return h.identity === i.receiver.identity ? prefix === i.origin.prefix && epoch === i.origin.epoch : prefix === h.identity && clock(epoch) === clock(h.epoch) + 1; },
+        verifiesOriginal: (l, s) => verifiesOwnerLine(l, s.publicKey, input.algorithms),
+        verifiesProof: (text, signature, s) => verifyBytes(text, s.publicKey, signature, input.algorithms), };
+    heads = input.authenticatedReceiverHeads ?? placeActHeads(input.store, initialHeads, { contract, historical: input.historical }, selection.storageBudget);
+    const trust = { contract, initialHeads, current: () => { const fresh = hostClockSelection({ ...input, ...input.readCurrent(), authenticatedReceiverHeads: undefined }); return { root: fresh.trust.contract.root, heads: placeActHeads(input.store, fresh.trust.initialHeads, fresh.trust, fresh.selection.storageBudget) }; }, historical: input.historical };
+    return { selection, trust };
+}

package/dist/host/ports/local-act.d.ts

@@ -15,11 +15,21 @@ export declare const actLines: (bytes: string) => readonly string[];
  * algorithm, not a new selection of the place's wire.
  */
 export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Internal integrity key only, not an act identity or a wire profile. */
+export declare function committedInventoryFingerprint(rows: readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[]): string;
 /** Committed segments are part of this ledger, not a second authority source. */
 export declare function committedLocalActs(store: string): readonly {
     identity: string;
     bundle: LocalActBundle;
 }[];
+/** Fixed host observation only: one synchronous, coherent committed inventory.
+ * It supplies no authority, verifier or async lifetime. Each outer invocation
+ * rereads exact bodies before entering; current authorization still runs inside.
+ */
+export declare function withCommittedLocalActObservation<T>(store: string, body: () => T): T;
 /** A public result is available only as a verified committed pair.
  * No writer-tail guess, newest-result selection or implicit authority.
  */

package/dist/host/ports/local-act.js

@@ -1,5 +1,7 @@
+import { hashText } from "../hash.js";
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { createHash } from 'node:crypto';
 import { requireEffects } from "../read-only.js";
 import { underTheRegions } from "../../land/act.js";
 import { publishBundle, nativePublicationStorage } from "./publication.js";
@@ -50,17 +52,78 @@ export function intactLocalAct(identity, bundle) {
         placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
     }) === identity;
 }
+/** One last integrity result only. Every call rereads all exact current bytes;
+ * signatures, coverage and current authority are never retained here. */
+let lastIntactInventory;
+/** Internal integrity key only, not an act identity or a wire profile. */
+export function committedInventoryFingerprint(rows) {
+    const hash = createHash('sha256');
+    const text = hashText.bind(undefined, hash);
+    text('committed-integrity-inventory');
+    text(String(rows.length));
+    for (const { identity, bundle } of rows) {
+        text(identity);
+        text(bundle.records);
+        text(bundle.receipt);
+        if (bundle.placements === undefined) {
+            text('absent');
+            continue;
+        }
+        text('present');
+        text(String(bundle.placements.length));
+        for (const placement of bundle.placements) {
+            text(placement.place);
+            text(placement.records);
+        }
+    }
+    return hash.digest('hex');
+}
 /** Committed segments are part of this ledger, not a second authority source. */
 export function committedLocalActs(store) {
+    const observed = observationAt(store);
+    if (observed)
+        return observed.rows;
+    return readCommittedLocalActs(store);
+}
+let committedObservation;
+function observationAt(store) { for (let one = committedObservation; one; one = one.parent)
+    if (one.store === store)
+        return one; return undefined; }
+/** Fixed host observation only: one synchronous, coherent committed inventory.
+ * It supplies no authority, verifier or async lifetime. Each outer invocation
+ * rereads exact bodies before entering; current authorization still runs inside.
+ */
+export function withCommittedLocalActObservation(store, body) {
+    const prior = committedObservation, existing = observationAt(store);
+    const rows = existing?.rows ?? Object.freeze(readCommittedLocalActs(store).map(row => Object.freeze({ identity: row.identity, bundle: Object.freeze({ ...row.bundle, ...(row.bundle.placements ? { placements: Object.freeze(row.bundle.placements.map(p => Object.freeze({ ...p }))) } : {}) }) })));
+    committedObservation = { store, rows, parent: prior };
+    try {
+        const result = body();
+        if (result !== null && (typeof result === 'object' || typeof result === 'function') && typeof result.then === 'function')
+            throw Error('REFUSE·act committed observation must be synchronous');
+        return result;
+    }
+    finally {
+        committedObservation = prior;
+    }
+}
+function readCommittedLocalActs(store) {
     const root = join(store, 'ledger', 'acts');
     if (!existsSync(root))
         return [];
-    return readdirSync(root).filter(name => name.startsWith('committed-')).map(name => {
-        const identity = decodeURIComponent(name.slice(10)), bundle = read(join(root, name));
-        if (!intactLocalAct(identity, bundle))
-            throw Error('REFUSE·act committed journal seal does not verify');
-        return { identity, bundle };
-    }).sort((a, b) => {
+    const rows = readdirSync(root).filter(name => name.startsWith('committed-')).map(name => ({
+        identity: decodeURIComponent(name.slice(10)), bundle: read(join(root, name)),
+    }));
+    // Ordered tuple framing commits every record, receipt and placement. No path,
+    // mtime, authority snapshot or caller-supplied seal substitutes for bytes.
+    const fingerprint = committedInventoryFingerprint(rows);
+    if (fingerprint !== lastIntactInventory) {
+        for (const { identity, bundle } of rows)
+            if (!intactLocalAct(identity, bundle))
+                throw Error('REFUSE·act committed journal seal does not verify');
+        lastIntactInventory = fingerprint;
+    }
+    return rows.sort((a, b) => {
         const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
         return epoch(a.bundle) - epoch(b.bundle);
     });
@@ -70,6 +133,15 @@ export function committedLocalActs(store) {
  */
 export function localActResult(store, identity, verify) {
     const at = atOf(store, identity);
+    const observed = observationAt(store);
+    if (observed) {
+        const bundle = observed.rows.find(row => row.identity === identity)?.bundle;
+        if (!bundle)
+            return undefined;
+        if (verify(identity, bundle) !== true)
+            throw Error('REFUSE·act committed result does not verify');
+        return bundle;
+    }
     if (!existsSync(at))
         return undefined;
     const bundle = read(at);

package/dist/host/ports/place-act.d.ts

@@ -0,0 +1,46 @@
+import { type TrustedClockContract, type PlaceReceipt, type RootContext } from '@lapxo/topos/core';
+import { type PublicationStorage } from './publication.ts';
+export interface PlaceActBudget {
+    readonly acts: number;
+    readonly bytes: number;
+}
+export interface PlaceActHead {
+    readonly place: string;
+    readonly identity: string;
+    readonly epoch: string;
+}
+export interface PlaceActSnapshot {
+    readonly root: RootContext;
+    readonly heads: readonly PlaceActHead[];
+}
+/** Fixed instrument construction, never supplied by world JSON. Historical
+ * authentication permits inspection only; current() is read under Root guards. */
+export interface PlaceActTrust {
+    readonly contract: TrustedClockContract;
+    readonly initialHeads: readonly PlaceActHead[];
+    readonly current: () => PlaceActSnapshot;
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+export interface PlaceActBundle {
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly originals: readonly (readonly string[])[];
+}
+/** Historical result reads never produce a current authorization permit. */
+export declare function placeActResult(store: string, id: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): PlaceActBundle | undefined;
+/** Each receiver chain advances independently. Initial heads are explicit,
+ * authenticated host inputs, not inferred zero or legacy global epochs. */
+export declare function placeActHeads(store: string, initial: readonly PlaceActHead[], trust: Pick<PlaceActTrust, 'historical' | 'contract'>, limits: PlaceActBudget): readonly PlaceActHead[];
+/** Context, exact original bytes and complete signed receipts have one visibility
+ * point. Real Root guard exclusion spans final authority/head comparison and
+ * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+export declare function commitPlaceAct(store: string, encoded: string, receipts: readonly PlaceReceipt[], trust: PlaceActTrust, limits: PlaceActBudget, storage?: PublicationStorage): Promise<PlaceActBundle & {
+    readonly kind: 'landed' | 'once';
+    readonly identity: string;
+}>;
+/** Enumerates only committed, historically authenticated carriers. Namespace
+ * projection is a caller's separate pure operation, never current permission. */
+export declare function committedPlaceActResults(store: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): readonly {
+    identity: string;
+    bundle: PlaceActBundle;
+}[];