@mc-and-his-agents/loom-installer 0.1.20 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "7394feec361832af98e5db10339f82631777fad3",
+  "source_commit": "c47ffde0d9c0adf3c91e9171f6c0ce3c2a8ef2bc",
   "source_ref": "main",
-  "built_at": "2026-04-25T15:03:31+08:00",
+  "built_at": "2026-04-26T22:56:41+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -628,8 +628,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -638,8 +638,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_status.py",
@@ -653,8 +653,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "plugin/loom/skills/upgrade-contract.json",
@@ -1213,8 +1213,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1223,8 +1223,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_status.py",
@@ -1238,8 +1238,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/upgrade-contract.json",
@@ -1828,8 +1828,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1838,8 +1838,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_status.py",
@@ -1853,8 +1853,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/upgrade-contract.json",
@@ -2443,8 +2443,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2453,8 +2453,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_status.py",
@@ -2468,8 +2468,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-init/.loom-runtime/upgrade-contract.json",
@@ -3063,8 +3063,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3073,8 +3073,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_status.py",
@@ -3088,8 +3088,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/upgrade-contract.json",
@@ -3678,8 +3678,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3688,8 +3688,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_status.py",
@@ -3703,8 +3703,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/upgrade-contract.json",
@@ -4293,8 +4293,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4303,8 +4303,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_status.py",
@@ -4318,8 +4318,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/upgrade-contract.json",
@@ -4908,8 +4908,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4918,8 +4918,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_status.py",
@@ -4933,8 +4933,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/upgrade-contract.json",
@@ -5523,8 +5523,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5533,8 +5533,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_status.py",
@@ -5548,8 +5548,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-review/.loom-runtime/upgrade-contract.json",
@@ -6138,8 +6138,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 274003,
-      "sha256": "3a74814dd253fbf18190e5c871fbdbfefc8f4b8a308d7f5c533bf72dd942a11c"
+      "bytes": 275385,
+      "sha256": "6cf4df1afa7dd6772a18f45fdc10c14917ad457dc3fd2f5a48980081d4883daa"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6148,8 +6148,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_init.py",
-      "bytes": 83763,
-      "sha256": "3132627c8aec74fd5f8dd232bd2f8c10a035674723de22877b6079c1ca8cf9d1"
+      "bytes": 85228,
+      "sha256": "f7748a8971611a3c23e5e0bcbb3d49cf0854db12469961c074756f9887bd25a8"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_status.py",
@@ -6163,8 +6163,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19009,
-      "sha256": "554b951e33a3979ed255e661e4edc6a30e9e059da80d893882a8dd7cf95a06e7"
+      "bytes": 19697,
+      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/upgrade-contract.json",

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -3675,14 +3675,15 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
             root,
             ["python3", ".loom/bin/loom_init.py", "runtime-state", "--target", "."],
             cwd=bootstrap_target,
+            env={"LOOM_SOURCE_REPO_ROOT": "/tmp/not-loom"},
         )
         if error:
-            failures.append(Failure("daily-execution-cli", f"`bootstrapped loom-init runtime-state` failed: {error}"))
+            failures.append(Failure("daily-execution-cli", f"`bootstrapped loom-init runtime-state with unrelated source env` failed: {error}"))
         else:
             require_runtime_state_payload(
                 failures,
                 category="daily-execution-cli",
-                context="`bootstrapped loom-init runtime-state`",
+                context="`bootstrapped loom-init runtime-state with unrelated source env`",
                 payload=payload.get("runtime_state"),
                 expected_scene="installed-runtime",
                 expected_carrier="bootstrapped-target-runtime",
@@ -3710,6 +3711,27 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         elif payload.get("result") != "block":
             failures.append(Failure("daily-execution-cli", "`bootstrapped runtime-state` must block when the bootstrap manifest drifts"))
 
+        hash_drift_bootstrap = tmp_root / "hash-drift-bootstrapped-target"
+        shutil.copytree(example_target, hash_drift_bootstrap)
+        manifest_path = hash_drift_bootstrap / ".loom" / "bootstrap" / "manifest.json"
+        manifest = load_json_file(manifest_path)
+        if isinstance(manifest, dict):
+            artifacts = manifest.get("artifacts")
+            if isinstance(artifacts, list):
+                for artifact in artifacts:
+                    if isinstance(artifact, dict) and artifact.get("path") == ".loom/bin/runtime_state.py":
+                        artifact["sha256"] = "0" * 64
+            manifest_path.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+        payload, error = load_command_json(
+            root,
+            ["python3", ".loom/bin/loom_init.py", "runtime-state", "--target", "."],
+            cwd=hash_drift_bootstrap,
+        )
+        if error:
+            failures.append(Failure("daily-execution-cli", f"`bootstrapped runtime-state` provenance hash drift failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("daily-execution-cli", "`bootstrapped runtime-state` must block when runtime provenance hashes drift"))
+
     if shutil.which("git") is not None:
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-pre-merge-") as tmp:
             tmp_root = Path(tmp)

package/payload/plugin/loom/skills/shared/scripts/loom_init.py

@@ -4,7 +4,9 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
+import os
 import re
 import subprocess
 import sys
@@ -26,6 +28,17 @@ TOOL_VERSION = "1.3.0"
 CONTRACT_VERSION = "1.3.0"
 WORK_ITEM_ID = "INIT-0001"
 
+RUNTIME_ARTIFACT_SOURCES = {
+    ".loom/bin/loom_init.py": RUNTIME_SOURCE,
+    ".loom/bin/fact_chain_support.py": FACT_CHAIN_RUNTIME_SOURCE,
+    ".loom/bin/governance_surface.py": GOVERNANCE_RUNTIME_SOURCE,
+    ".loom/bin/loom_flow.py": FLOW_RUNTIME_SOURCE,
+    ".loom/bin/loom_status.py": STATUS_RUNTIME_SOURCE,
+    ".loom/bin/runtime_paths.py": "skills/shared/scripts/runtime_paths.py",
+    ".loom/bin/runtime_state.py": "skills/shared/scripts/runtime_state.py",
+    ".loom/bin/loom_check.py": CHECK_RUNTIME_SOURCE,
+}
+
 ROOT_BOUNDARY_FILES = (
     "AGENTS.md",
     "WORKFLOW.md",
@@ -815,46 +828,14 @@ def initial_artifacts(target_root: Path, install_pr_template: bool, adoption_pat
             "kind": "capability-map",
             "source": "generated",
         },
-        {
-            "path": ".loom/bin/loom_init.py",
-            "kind": "loom-tool",
-            "source": RUNTIME_SOURCE,
-        },
-        {
-            "path": ".loom/bin/fact_chain_support.py",
-            "kind": "loom-tool-support",
-            "source": FACT_CHAIN_RUNTIME_SOURCE,
-        },
-        {
-            "path": ".loom/bin/governance_surface.py",
-            "kind": "loom-tool-support",
-            "source": GOVERNANCE_RUNTIME_SOURCE,
-        },
-        {
-            "path": ".loom/bin/loom_flow.py",
-            "kind": "loom-tool",
-            "source": FLOW_RUNTIME_SOURCE,
-        },
-        {
-            "path": ".loom/bin/loom_status.py",
-            "kind": "loom-tool",
-            "source": STATUS_RUNTIME_SOURCE,
-        },
-        {
-            "path": ".loom/bin/runtime_paths.py",
-            "kind": "loom-tool-support",
-            "source": "skills/shared/scripts/runtime_paths.py",
-        },
-        {
-            "path": ".loom/bin/runtime_state.py",
-            "kind": "loom-tool-support",
-            "source": "skills/shared/scripts/runtime_state.py",
-        },
-        {
-            "path": ".loom/bin/loom_check.py",
-            "kind": "loom-tool",
-            "source": CHECK_RUNTIME_SOURCE,
-        },
+        runtime_artifact(".loom/bin/loom_init.py", "loom-tool", RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/fact_chain_support.py", "loom-tool-support", FACT_CHAIN_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/governance_surface.py", "loom-tool-support", GOVERNANCE_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/loom_flow.py", "loom-tool", FLOW_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/loom_status.py", "loom-tool", STATUS_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/runtime_paths.py", "loom-tool-support", "skills/shared/scripts/runtime_paths.py"),
+        runtime_artifact(".loom/bin/runtime_state.py", "loom-tool-support", "skills/shared/scripts/runtime_state.py"),
+        runtime_artifact(".loom/bin/loom_check.py", "loom-tool", CHECK_RUNTIME_SOURCE),
     ]
     if uses_attach_only_path(adoption_path):
         artifacts.extend(
@@ -1361,6 +1342,34 @@ def copy_file(source: Path, target: Path, force: bool) -> bool:
     return write_text(target, content, force=force)
 
 
+def sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def runtime_artifact(path: str, kind: str, source: str) -> dict[str, str]:
+    runtime_sources = {
+        ".loom/bin/loom_init.py": Path(__file__),
+        ".loom/bin/fact_chain_support.py": Path(__file__).with_name("fact_chain_support.py"),
+        ".loom/bin/governance_surface.py": Path(__file__).with_name("governance_surface.py"),
+        ".loom/bin/loom_flow.py": Path(__file__).with_name("loom_flow.py"),
+        ".loom/bin/loom_status.py": Path(__file__).with_name("loom_status.py"),
+        ".loom/bin/runtime_paths.py": Path(__file__).with_name("runtime_paths.py"),
+        ".loom/bin/runtime_state.py": Path(__file__).with_name("runtime_state.py"),
+        ".loom/bin/loom_check.py": Path(__file__).with_name("loom_check.py"),
+    }
+    source_path = runtime_sources[path]
+    return {
+        "path": path,
+        "kind": kind,
+        "source": source,
+        "sha256": sha256_file(source_path),
+    }
+
+
 def manifest_payload(result: dict[str, object]) -> dict[str, object]:
     return {
         "schema_version": "loom-bootstrap-manifest/v1",
@@ -1745,12 +1754,16 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
             )
 
         for label, command, allowed in commands:
+            command_env = os.environ.copy()
+            for key in ("LOOM_SOURCE_REPO_ROOT", "LOOM_INSTALLED_SKILLS_ROOT", "LOOM_RUNTIME_SCENE"):
+                command_env.pop(key, None)
             result = subprocess.run(
                 command,
                 cwd=target_root,
                 check=False,
                 capture_output=True,
                 text=True,
+                env=command_env,
             )
             output = result.stdout.strip()
             if not output:

package/payload/plugin/loom/skills/shared/scripts/runtime_state.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import json
+import hashlib
 import os
 from pathlib import Path
 from typing import Any
@@ -76,15 +77,23 @@ def _check(status: str, summary: str, *, evidence: object | None = None) -> dict
 
 
 def detect_carrier(caller_file: str) -> str | None:
-    if source_repo_root() is not None:
-        return "repo-local-wrapper"
     if bootstrap_runtime_root(caller_file) is not None:
         return "bootstrapped-target-runtime"
+    if source_repo_root() is not None:
+        return "repo-local-wrapper"
     if installed_skills_root(caller_file) is not None:
         return "installed-skills-root"
     return None
 
 
+def sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
 def _default_scene_for_carrier(carrier: str) -> str:
     if carrier == "repo-local-wrapper":
         return "repo-local-demo"
@@ -284,6 +293,14 @@ def _validate_bootstrapped_runtime(caller_file: str) -> tuple[dict[str, Any], li
         runtime_file = runtime_root / Path(relative).name
         if not runtime_file.exists():
             errors.append(f"bootstrapped runtime file is missing: `{relative}`")
+            continue
+        expected_hash = artifact.get("sha256")
+        if not isinstance(expected_hash, str) or not expected_hash.strip():
+            errors.append(f"bootstrap runtime artifact `{relative}` must declare sha256 provenance")
+            continue
+        actual_hash = sha256_file(runtime_file)
+        if actual_hash != expected_hash:
+            errors.append(f"bootstrap runtime artifact `{relative}` sha256 drifted")
 
     status = "pass" if not errors else "block"
     summary = (

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -3675,14 +3675,15 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
             root,
             ["python3", ".loom/bin/loom_init.py", "runtime-state", "--target", "."],
             cwd=bootstrap_target,
+            env={"LOOM_SOURCE_REPO_ROOT": "/tmp/not-loom"},
         )
         if error:
-            failures.append(Failure("daily-execution-cli", f"`bootstrapped loom-init runtime-state` failed: {error}"))
+            failures.append(Failure("daily-execution-cli", f"`bootstrapped loom-init runtime-state with unrelated source env` failed: {error}"))
         else:
             require_runtime_state_payload(
                 failures,
                 category="daily-execution-cli",
-                context="`bootstrapped loom-init runtime-state`",
+                context="`bootstrapped loom-init runtime-state with unrelated source env`",
                 payload=payload.get("runtime_state"),
                 expected_scene="installed-runtime",
                 expected_carrier="bootstrapped-target-runtime",
@@ -3710,6 +3711,27 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         elif payload.get("result") != "block":
             failures.append(Failure("daily-execution-cli", "`bootstrapped runtime-state` must block when the bootstrap manifest drifts"))
 
+        hash_drift_bootstrap = tmp_root / "hash-drift-bootstrapped-target"
+        shutil.copytree(example_target, hash_drift_bootstrap)
+        manifest_path = hash_drift_bootstrap / ".loom" / "bootstrap" / "manifest.json"
+        manifest = load_json_file(manifest_path)
+        if isinstance(manifest, dict):
+            artifacts = manifest.get("artifacts")
+            if isinstance(artifacts, list):
+                for artifact in artifacts:
+                    if isinstance(artifact, dict) and artifact.get("path") == ".loom/bin/runtime_state.py":
+                        artifact["sha256"] = "0" * 64
+            manifest_path.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+        payload, error = load_command_json(
+            root,
+            ["python3", ".loom/bin/loom_init.py", "runtime-state", "--target", "."],
+            cwd=hash_drift_bootstrap,
+        )
+        if error:
+            failures.append(Failure("daily-execution-cli", f"`bootstrapped runtime-state` provenance hash drift failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("daily-execution-cli", "`bootstrapped runtime-state` must block when runtime provenance hashes drift"))
+
     if shutil.which("git") is not None:
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-pre-merge-") as tmp:
             tmp_root = Path(tmp)