@mc-and-his-agents/loom-installer 0.1.32 → 0.1.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "3fb64673745f62b2ea76f770c2f2e06cd6192b76",
+  "source_commit": "9fdb80209ca29512bf64e65a0822e66bececc793",
   "source_ref": "main",
-  "built_at": "2026-04-27T14:19:25+08:00",
+  "built_at": "2026-04-27T14:50:48+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -633,13 +633,13 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_init.py",
@@ -1223,13 +1223,13 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_init.py",
@@ -1843,13 +1843,13 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py",
@@ -2463,13 +2463,13 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_init.py",
@@ -3088,13 +3088,13 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py",
@@ -3708,13 +3708,13 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -4328,13 +4328,13 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_init.py",
@@ -4948,13 +4948,13 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_init.py",
@@ -5568,13 +5568,13 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -6188,13 +6188,13 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 326062,
-      "sha256": "984cb68a9c5c95e268810b1a6a3c90590bb410b399b2d7ea60efe3da5c377689"
+      "bytes": 331399,
+      "sha256": "0c3378d7c3da8caede613f26c5d4d705117bde4c69df24653b54c99b143f4b97"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 322554,
-      "sha256": "02f9b19b65ad580aaee0431a1f5151ac87a4755c95d4045168efb9624f44a558"
+      "bytes": 332816,
+      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_init.py",

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -2544,6 +2544,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
             ["python3", "tools/loom_flow.py", "carrier", "refresh", "--target", "examples/new-project", "--item", "INIT-0001", "--dry-run"],
             {"pass"},
         ),
+        (
+            "host-binding-validate",
+            ["python3", "tools/loom_flow.py", "host-binding", "validate", "--target", ".", "--owner", "MC-and-his-Agents", "--repo", "Loom", "--branch", "main"],
+            {"pass"},
+        ),
         (
             "governance-profile-status",
             ["python3", "tools/loom_flow.py", "governance-profile", "status", "--target", "examples/new-project"],
@@ -2830,6 +2835,14 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
                 failures.append(Failure("daily-execution-cli", "`carrier refresh` must report schema v1"))
             if not isinstance(payload.get("actions"), list):
                 failures.append(Failure("daily-execution-cli", "`carrier refresh` must include actions"))
+        if label == "host-binding-validate":
+            if payload.get("command") != "host-binding" or payload.get("operation") != "validate":
+                failures.append(Failure("daily-execution-cli", "`host-binding validate` must report command/operation"))
+            if payload.get("schema_version") != "loom-host-binding/v1":
+                failures.append(Failure("daily-execution-cli", "`host-binding validate` must report schema v1"))
+            branch = payload.get("branch")
+            if not isinstance(branch, dict) or branch.get("status") != "present":
+                failures.append(Failure("daily-execution-cli", "`host-binding validate --branch main` must read the branch via REST"))
         if label in {"governance-profile-status", "governance-profile-upgrade-plan"}:
             if payload.get("command") != "governance-profile":
                 failures.append(Failure("daily-execution-cli", f"`{label}` must report `command: governance-profile`"))
@@ -6363,12 +6376,47 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
             ("shadow-parity", ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(baseline)], "pass"),
             ("shadow-parity --blocking", ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(baseline), "--blocking"], "pass"),
             ("flow resume", ["python3", "tools/loom_flow.py", "flow", "resume", "--target", str(baseline), "--item", "INIT-0001"], "pass"),
+            ("adopt verify", ["python3", "tools/loom_flow.py", "adopt", "verify", "--target", str(baseline), "--item", "INIT-0001"], "pass"),
         ):
             payload, error = load_command_json(root, args)
             if error:
                 failures.append(Failure("adversarial-adoption", f"`{label}` baseline failed: {error}"))
             elif payload.get("result") != expected:
                 failures.append(Failure("adversarial-adoption", f"`{label}` baseline must return `{expected}`"))
+            elif label == "adopt verify":
+                roundtrip = payload.get("producer_consumer_roundtrip")
+                deleted_section = (
+                    roundtrip.get("bypass_check")
+                    if isinstance(roundtrip, dict)
+                    else None
+                )
+                if not isinstance(deleted_section, dict) or deleted_section.get("consumer_result") != "block":
+                    failures.append(Failure("adversarial-adoption", "`adopt verify` must prove required Review Artifacts deletion cannot bypass the consumer"))
+
+        sha_only_payload, sha_only_error = load_command_json(
+            root,
+            [
+                "python3",
+                "tools/loom_flow.py",
+                "host-binding",
+                "validate",
+                "--target",
+                str(baseline),
+                "--owner",
+                "MC-and-his-Agents",
+                "--repo",
+                "Loom",
+                "--head-sha",
+                current_head,
+            ],
+            timeout_seconds=60,
+        )
+        if sha_only_error:
+            failures.append(Failure("adversarial-adoption", f"SHA-only host-binding negative sample failed: {sha_only_error}"))
+        else:
+            missing_inputs = sha_only_payload.get("missing_inputs")
+            if sha_only_payload.get("result") != "block" or not isinstance(missing_inputs, list) or not missing_inputs:
+                failures.append(Failure("adversarial-adoption", "SHA-only host-binding must fail closed when REST cannot prove issue or PR binding"))
 
         path_escape_payload, error = load_command_json(
             root,
@@ -6559,28 +6607,66 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         elif payload.get("result") != "block":
             failures.append(Failure("adversarial-adoption", "metadata spoofing must fail closed in the canonical section"))
 
-        shadow_target = base / "shadow-broken"
-        shutil.copytree(baseline, shadow_target)
-        shadow_payload = load_json_file(shadow_target / ".loom/shadow/review-repo.json")
-        if isinstance(shadow_payload, dict):
-            shadow_payload.pop("source_sha256", None)
-            write_json(shadow_target / ".loom/shadow/review-repo.json", shadow_payload)
-        warn_payload, warn_error = load_command_json(
-            root,
-            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(shadow_target), "--surface", "review"],
-        )
-        block_payload, block_error = load_command_json(
-            root,
-            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(shadow_target), "--surface", "review", "--blocking"],
-        )
-        if warn_error:
-            failures.append(Failure("adversarial-adoption", f"shadow evidence validation-only sample failed: {warn_error}"))
-        elif warn_payload.get("result") != "warn":
-            failures.append(Failure("adversarial-adoption", "broken shadow evidence must warn in validation-only mode"))
-        if block_error:
-            failures.append(Failure("adversarial-adoption", f"shadow evidence blocking sample failed: {block_error}"))
-        elif block_payload.get("result") != "block":
-            failures.append(Failure("adversarial-adoption", "broken shadow evidence must block in blocking mode"))
+        def assert_broken_shadow_evidence(
+            label: str,
+            mutate: object,
+            *,
+            expect_validation_warn: bool = True,
+        ) -> None:
+            shadow_target = base / f"shadow-broken-{label}"
+            shutil.copytree(baseline, shadow_target)
+            if callable(mutate):
+                mutate(shadow_target)
+            warn_payload, warn_error = load_command_json(
+                root,
+                ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(shadow_target), "--surface", "review"],
+            )
+            block_payload, block_error = load_command_json(
+                root,
+                ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(shadow_target), "--surface", "review", "--blocking"],
+            )
+            if warn_error:
+                failures.append(Failure("adversarial-adoption", f"shadow evidence `{label}` validation-only sample failed: {warn_error}"))
+            elif expect_validation_warn and warn_payload.get("result") != "warn":
+                failures.append(Failure("adversarial-adoption", f"shadow evidence `{label}` must warn in validation-only mode"))
+            if block_error:
+                failures.append(Failure("adversarial-adoption", f"shadow evidence `{label}` blocking sample failed: {block_error}"))
+            elif block_payload.get("result") != "block":
+                failures.append(Failure("adversarial-adoption", f"shadow evidence `{label}` must block in blocking mode"))
+
+        def remove_source_hash(target: Path) -> None:
+            shadow_payload = load_json_file(target / ".loom/shadow/review-repo.json")
+            if isinstance(shadow_payload, dict):
+                shadow_payload.pop("source_sha256", None)
+                write_json(target / ".loom/shadow/review-repo.json", shadow_payload)
+
+        def partial_source_hash(target: Path) -> None:
+            shadow_payload = load_json_file(target / ".loom/shadow/review-repo.json")
+            if isinstance(shadow_payload, dict):
+                shadow_payload["source_files"] = ["native/status/review.json", "host/guardian-review.json"]
+                shadow_payload["source_sha256"] = {"native/status/review.json": sha256_file(target / "native/status/review.json")}
+                write_json(target / ".loom/shadow/review-repo.json", shadow_payload)
+
+        def drift_source_hash(target: Path) -> None:
+            shadow_payload = load_json_file(target / ".loom/shadow/review-repo.json")
+            if isinstance(shadow_payload, dict):
+                shadow_payload["source_sha256"] = {"native/status/review.json": "0" * 64}
+                write_json(target / ".loom/shadow/review-repo.json", shadow_payload)
+
+        def undeclared_shadow_evidence(target: Path) -> None:
+            write_json(
+                target / ".loom/shadow/rogue.json",
+                {
+                    "result": "pass",
+                    "source_files": ["native/status/review.json"],
+                    "source_sha256": {"native/status/review.json": sha256_file(target / "native/status/review.json")},
+                },
+            )
+
+        assert_broken_shadow_evidence("missing-hash", remove_source_hash)
+        assert_broken_shadow_evidence("partial-hash", partial_source_hash)
+        assert_broken_shadow_evidence("hash-drift", drift_source_hash)
+        assert_broken_shadow_evidence("undeclared", undeclared_shadow_evidence, expect_validation_warn=False)
 
         head_before_drift = run_command(root, ["git", "rev-parse", "HEAD"], cwd=baseline, timeout_seconds=30).stdout.strip()
         (baseline / "implementation-drift.txt").write_text("changed after review\n", encoding="utf-8")
@@ -6593,6 +6679,14 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         )
         if not binding_errors or binding_payload.get("status") != "implementation-drift-only":
             failures.append(Failure("adversarial-adoption", "review head binding must classify implementation drift after review"))
+        drift_refresh_payload, drift_refresh_error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "carrier", "refresh", "--target", str(baseline), "--dry-run"],
+        )
+        if drift_refresh_error:
+            failures.append(Failure("adversarial-adoption", f"carrier refresh implementation-drift sample failed: {drift_refresh_error}"))
+        elif drift_refresh_payload.get("result") != "block":
+            failures.append(Failure("adversarial-adoption", "carrier refresh must block implementation drift instead of refreshing review metadata"))
 
     return failures