@mean-weasel/lineage 0.1.12 → 0.1.14

package/dist/server.js

@@ -5,8 +5,8 @@ import { existsSync as existsSync14 } from "node:fs";
 import { join as join14 } from "node:path";
 
 // src/server/assetCore.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join6, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -284,13 +284,31 @@ function createS3StorageAdapter(deps) {
 // src/server/assetLineageDb.ts
 import { createRequire as createRequire2 } from "node:module";
 import { existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { join as join5 } from "node:path";
+
+// src/server/profileWriterLease.ts
+import { createHash as createHash3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 
 // src/server/lineageProfiles.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync as statSync3 } from "node:fs";
+import {
+  chmodSync,
+  constants as fsConstants,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync3,
+  linkSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync,
+  rmSync,
+  statSync as statSync3,
+  writeFileSync
+} from "node:fs";
 import { homedir, platform } from "node:os";
-import { dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, isAbsolute, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/shared/lineageProfileTypes.ts
 var lineageProfileSchemaVersion = "lineage.profile.v1";
@@ -346,6 +364,16 @@ function validateChannel(value) {
   if (value === "stable" || value === "preview" || value === "dev") return value;
   throw new Error(`Invalid expected runtime channel: ${String(value)}`);
 }
+function validateCodeOrigin(value) {
+  if (value === void 0) return void 0;
+  if (value === "checkout" || value === "package") return value;
+  throw new Error(`Invalid expected runtime code_origin: ${String(value)}`);
+}
+function validateFingerprint(value, field) {
+  if (value === void 0) return void 0;
+  if (!/^[a-f0-9]{64}$/i.test(value)) throw new Error(`Profile ${field} must be a 64-character SHA-256 fingerprint`);
+  return value.toLowerCase();
+}
 function resolveManifestPath(manifestPath, value) {
   return resolve2(dirname2(manifestPath), value);
 }
@@ -361,9 +389,6 @@ function validateServiceOrigin(value) {
   if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
     throw new Error("Profile service_origin must contain only scheme, host, and port");
   }
-  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  const isLocal = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
-  if (!isLocal) throw new Error("Profile service_origin must use a loopback or localhost host");
   return parsed.origin;
 }
 function resolveLineageProfile(selector) {
@@ -391,6 +416,8 @@ function resolveLineageProfile(selector) {
   const expected = expectedRaw;
   const expectedGitSha = expected ? optionalString(expected, "git_sha") : void 0;
   const expectedVersion = expected ? optionalString(expected, "version") : void 0;
+  const expectedCodeFingerprint = validateFingerprint(expected ? optionalString(expected, "code_fingerprint") : void 0, "expected_runtime.code_fingerprint");
+  const expectedCodeOrigin = validateCodeOrigin(expected?.code_origin);
   const migrationsRaw = record.required_schema_migrations;
   if (migrationsRaw !== void 0 && (!Array.isArray(migrationsRaw) || migrationsRaw.some((value) => typeof value !== "string" || !value.trim()))) {
     throw new Error("Profile required_schema_migrations must be an array of non-empty strings");
@@ -407,6 +434,8 @@ function resolveLineageProfile(selector) {
     ...expected ? {
       expected_runtime: {
         ...expectedChannel ? { channel: expectedChannel } : {},
+        ...expectedCodeFingerprint ? { code_fingerprint: expectedCodeFingerprint } : {},
+        ...expectedCodeOrigin ? { code_origin: expectedCodeOrigin } : {},
         ...expectedGitSha ? { git_sha: expectedGitSha } : {},
         ...expectedVersion ? { version: expectedVersion } : {}
       }
@@ -416,7 +445,31 @@ function resolveLineageProfile(selector) {
     schema_version: lineageProfileSchemaVersion,
     service_origin: validateServiceOrigin(requiredString(record, "service_origin"))
   };
-  return { ...manifest, manifest_path: manifestPath };
+  return { ...manifest, manifest_path: manifestPath, profile_fingerprint: lineageProfileFingerprint(manifest) };
+}
+function lineageProfileFingerprint(profile) {
+  return createHash2("sha256").update(JSON.stringify({
+    asset_root: resolve2(profile.asset_root),
+    database_path: resolve2(profile.database_path),
+    environment: profile.environment,
+    profile_id: profile.profile_id,
+    schema_version: profile.schema_version,
+    service_origin: profile.service_origin
+  })).digest("hex");
+}
+function assertProfileRuntimePin(profile, runtime) {
+  if (!profile.expected_runtime?.code_fingerprint || !profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} must pin expected_runtime.code_fingerprint and expected_runtime.code_origin before binding or writing`);
+  }
+  if (!runtime?.code?.verified) {
+    throw new Error(`Profile ${profile.profile_id} requires a verified runtime code identity before binding or writing`);
+  }
+  if (runtime.code.fingerprint !== profile.expected_runtime.code_fingerprint) {
+    throw new Error(`Profile ${profile.profile_id} expects code fingerprint ${profile.expected_runtime.code_fingerprint}, found ${runtime.code.fingerprint}`);
+  }
+  if (runtime.code.origin !== profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} expects code origin ${profile.expected_runtime.code_origin}, found ${runtime.code.origin}`);
+  }
 }
 function assertProfileChannel(profile, channel) {
   const requiredChannel = environmentChannel(profile.environment);
@@ -429,12 +482,9 @@ function assertProfileChannel(profile, channel) {
 function tableExists(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
 }
-function gitShasMatch(expected, actual) {
-  if (!actual) return false;
-  const normalizedExpected = expected.toLowerCase();
-  const normalizedActual = actual.toLowerCase();
-  const shorterLength = Math.min(normalizedExpected.length, normalizedActual.length);
-  return shorterLength >= 12 && normalizedExpected.slice(0, shorterLength) === normalizedActual.slice(0, shorterLength);
+function tableColumns(database, table) {
+  if (!tableExists(database, table)) return /* @__PURE__ */ new Set();
+  return new Set(database.prepare(`pragma table_info(${table})`).all().map((row) => row.name));
 }
 function inspectDatabase(profile) {
   const result = {
@@ -448,11 +498,14 @@ function inspectDatabase(profile) {
     const database = new DatabaseSync(profile.database_path, { readOnly: true });
     try {
       if (tableExists(database, "lineage_profile_identity")) {
-        const rows = database.prepare("select profile_id, environment, bound_at from lineage_profile_identity").all();
+        const columns = tableColumns(database, "lineage_profile_identity");
+        const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "'' as profile_fingerprint";
+        const rows = database.prepare(`select profile_id, environment, bound_at, ${fingerprintExpression} from lineage_profile_identity`).all();
         if (rows.length === 1) {
           const identity = {
             bound_at: typeof rows[0].bound_at === "string" ? rows[0].bound_at : void 0,
             environment: String(rows[0].environment),
+            profile_fingerprint: typeof rows[0].profile_fingerprint === "string" ? rows[0].profile_fingerprint : "",
             profile_id: String(rows[0].profile_id)
           };
           result.identity = identity;
@@ -476,7 +529,14 @@ function doctorLineageProfile(selector, runtime) {
   const result = {
     checks,
     ok: false,
-    runtime: { channel: runtime.channel, git_sha: runtime.gitSha, version: runtime.version },
+    runtime: {
+      channel: runtime.channel,
+      code_fingerprint: runtime.code?.fingerprint,
+      code_origin: runtime.code?.origin,
+      code_verified: runtime.code?.verified,
+      git_sha: runtime.gitSha,
+      version: runtime.version
+    },
     schema_version: lineageProfileDoctorSchemaVersion
   };
   let profile;
@@ -495,12 +555,18 @@ function doctorLineageProfile(selector, runtime) {
   } catch (error) {
     checks.push({ id: "runtime_channel", message: error instanceof Error ? error.message : String(error), status: "fail" });
   }
+  try {
+    assertProfileRuntimePin(profile, runtime);
+    checks.push({ id: "runtime_code", message: `Verified ${runtime.code.origin} code ${runtime.code.fingerprint}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_code", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
   if (profile.expected_runtime?.version && profile.expected_runtime.version !== runtime.version) {
     checks.push({ id: "runtime_version", message: `Expected version ${profile.expected_runtime.version}, found ${runtime.version}`, status: "fail" });
   } else {
     checks.push({ id: "runtime_version", message: `Runtime version ${runtime.version}`, status: "pass" });
   }
-  if (profile.expected_runtime?.git_sha && !gitShasMatch(profile.expected_runtime.git_sha, runtime.gitSha)) {
+  if (profile.expected_runtime?.git_sha && profile.expected_runtime.git_sha !== runtime.gitSha) {
     checks.push({ id: "runtime_git_sha", message: `Expected Git SHA ${profile.expected_runtime.git_sha}, found ${runtime.gitSha || "unavailable"}`, status: "fail" });
   } else if (profile.expected_runtime?.git_sha) {
     checks.push({ id: "runtime_git_sha", message: `Git SHA ${runtime.gitSha}`, status: "pass" });
@@ -523,10 +589,10 @@ function doctorLineageProfile(selector, runtime) {
   if (database.error) checks.push({ id: "database_read", message: database.error, status: "fail" });
   if (!database.identity) {
     checks.push({ id: "database_identity", message: "Database is not bound to a Lineage profile", status: "fail" });
-  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment) {
+  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment || database.identity.profile_fingerprint !== profile.profile_fingerprint) {
     checks.push({
       id: "database_identity",
-      message: `Database identity ${database.identity.profile_id}/${database.identity.environment} does not match ${profile.profile_id}/${profile.environment}`,
+      message: `Database identity ${database.identity.profile_id}/${database.identity.environment}/${database.identity.profile_fingerprint || "no-fingerprint"} does not match ${profile.profile_id}/${profile.environment}/${profile.profile_fingerprint}`,
       status: "fail"
     });
   } else {
@@ -549,6 +615,7 @@ function runtimeProfileIdentity(channel) {
     return {
       bound: true,
       environment,
+      fingerprint: process.env.LINEAGE_PROFILE_FINGERPRINT,
       id,
       manifest_path: process.env.LINEAGE_PROFILE_MANIFEST,
       service_origin: process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
@@ -558,12 +625,12 @@ function runtimeProfileIdentity(channel) {
     bound: false,
     environment: channelEnvironment(channel),
     id: "legacy-unbound",
-    warning: id || environment || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
+    warning: id || environment || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
   };
 }
 function assertRuntimeProfileSafety(channel) {
   const hasDerivedIdentity = Boolean(
-    process.env.LINEAGE_PROFILE_ID || process.env.LINEAGE_PROFILE_ENVIRONMENT || process.env.LINEAGE_PROFILE_MANIFEST || process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
+    process.env.LINEAGE_PROFILE_ID || process.env.LINEAGE_PROFILE_ENVIRONMENT || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST || process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
   );
   if (hasDerivedIdentity && !process.env.LINEAGE_PROFILE) {
     throw new Error("Derived Lineage profile identity requires LINEAGE_PROFILE; start through the Lineage CLI with --profile");
@@ -574,16 +641,6 @@ function assertRuntimeProfileSafety(channel) {
   }
 }
 function assertUnselectedDatabaseIsUnbound(runtime) {
-  if (runtime.database.exists && runtime.database.error) {
-    throw new Error(
-      `Database ${runtime.database.path} identity could not be verified: ${runtime.database.error}; refusing unselected access`
-    );
-  }
-  if (runtime.schema.profile_identity_rows !== void 0 && runtime.schema.profile_identity_rows !== 1) {
-    throw new Error(
-      `Database ${runtime.database.path} has invalid Lineage profile identity row count ${runtime.schema.profile_identity_rows}; refusing unselected access`
-    );
-  }
   if (!runtime.schema.profile_id) return;
   const environment = runtime.schema.profile_environment || "unknown";
   throw new Error(
@@ -592,15 +649,15 @@ function assertUnselectedDatabaseIsUnbound(runtime) {
 }
 function assertResolvedRuntimeProfileEnvironment(profile) {
   const serviceUrl = new URL(profile.service_origin);
-  const serviceHost = serviceUrl.hostname.startsWith("[") && serviceUrl.hostname.endsWith("]") ? serviceUrl.hostname.slice(1, -1) : serviceUrl.hostname;
   const expected = /* @__PURE__ */ new Map([
     ["LINEAGE_PROFILE_ID", profile.profile_id],
     ["LINEAGE_PROFILE_ENVIRONMENT", profile.environment],
+    ["LINEAGE_PROFILE_FINGERPRINT", profile.profile_fingerprint],
     ["LINEAGE_PROFILE_MANIFEST", profile.manifest_path],
     ["LINEAGE_PROFILE_SERVICE_ORIGIN", profile.service_origin],
     ["LINEAGE_DB", profile.database_path],
     ["LINEAGE_ASSET_ROOT", profile.asset_root],
-    ["HOST", serviceHost],
+    ["HOST", serviceUrl.hostname],
     ["PORT", serviceUrl.port]
   ]);
   const conflicts = [];
@@ -616,9 +673,6 @@ function assertResolvedRuntimeProfileEnvironment(profile) {
 }
 
 // src/server/profileWriterLease.ts
-import { createHash as createHash2, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { basename as basename3, dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 var writerLeaseSchemaVersion = "lineage.profile_writer_lease.v1";
 var ownerFileName = "owner.json";
 var ProfileWriterLeaseConflictError = class extends Error {
@@ -629,24 +683,8 @@ var ProfileWriterLeaseConflictError = class extends Error {
   }
   owner;
 };
-function canonicalDatabasePath(databasePath) {
-  const resolved = resolve3(databasePath);
-  const missingSegments = [];
-  let candidate = resolved;
-  while (!existsSync4(candidate)) {
-    const parent = dirname3(candidate);
-    if (parent === candidate) return resolved;
-    missingSegments.unshift(basename3(candidate));
-    candidate = parent;
-  }
-  try {
-    return join4(realpathSync(candidate), ...missingSegments);
-  } catch {
-    return resolved;
-  }
-}
 function profileWriterLockPath(profile) {
-  return `${canonicalDatabasePath(profile.database_path)}.writer.lock`;
+  return join4(dirname3(profile.manifest_path), "writer.lock");
 }
 function ownerPath(lockPath) {
   return join4(lockPath, ownerFileName);
@@ -669,7 +707,7 @@ function readOwner(lockPath) {
     throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
   }
   const owner = raw;
-  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
+  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || typeof owner.profile_fingerprint !== "string" || !/^[a-f0-9]{64}$/i.test(owner.profile_fingerprint) || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
     throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
   }
   return owner;
@@ -686,10 +724,10 @@ function processIsAlive(pid) {
 function createLeaseDirectory(lockPath, owner) {
   mkdirSync3(lockPath, { mode: 448 });
   try {
-    writeFileSync(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
+    writeFileSync2(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
 `, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch (error) {
-    rmSync(lockPath, { force: true, recursive: true });
+    rmSync2(lockPath, { force: true, recursive: true });
     throw error;
   }
 }
@@ -701,14 +739,15 @@ function reclaimDeadOwner(lockPath, owner) {
       publicOwner
     );
   }
-  const tokenFence = createHash2("sha256").update(owner.token).digest("hex").slice(0, 24);
+  const tokenFence = createHash3("sha256").update(owner.token).digest("hex").slice(0, 24);
   const tombstone = `${lockPath}.stale-${owner.pid}-${tokenFence}`;
   try {
     renameSync(lockPath, tombstone);
   } catch (error) {
-    if (errorCode(error) === "ENOENT" || errorCode(error) === "EEXIST" || errorCode(error) === "ENOTEMPTY") return;
+    if (errorCode(error) === "ENOENT") return;
     throw error;
   }
+  rmSync2(tombstone, { force: true, recursive: true });
 }
 function acquireProfileWriterLease(profile, channel, role = "service") {
   assertProfileChannel(profile, channel);
@@ -717,11 +756,12 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
     acquired_at: (/* @__PURE__ */ new Date()).toISOString(),
     environment: profile.environment,
     pid: process.pid,
+    profile_fingerprint: profile.profile_fingerprint,
     profile_id: profile.profile_id,
     role,
     schema_version: writerLeaseSchemaVersion,
     ...role === "service" ? { service_origin: profile.service_origin } : {},
-    token: randomUUID()
+    token: randomUUID2()
   };
   for (let attempt = 0; attempt < 4; attempt += 1) {
     try {
@@ -744,7 +784,7 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
           released = true;
           try {
             const current = readOwner(lockPath);
-            if (current.token === owner.token && current.pid === owner.pid) rmSync(lockPath, { force: true, recursive: true });
+            if (current.token === owner.token && current.pid === owner.pid) rmSync2(lockPath, { force: true, recursive: true });
           } catch {
           }
           if (process.env.LINEAGE_WRITER_LEASE_TOKEN === owner.token) delete process.env.LINEAGE_WRITER_LEASE_TOKEN;
@@ -760,7 +800,7 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
         if (errorCode(readError) === "ENOENT") continue;
         throw readError;
       }
-      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment) {
+      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment || existing.profile_fingerprint !== profile.profile_fingerprint) {
         throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; manual inspection is required`, { cause: error });
       }
       reclaimDeadOwner(lockPath, existing);
@@ -769,23 +809,47 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
   throw new Error(`Could not acquire writer lease for Lineage profile ${profile.profile_id}; another writer is racing for ownership`);
 }
 function assertProfileWriterLeaseHeld() {
-  if (!process.env.LINEAGE_PROFILE) return;
+  if (!process.env.LINEAGE_PROFILE) {
+    throw new Error("Persistent writes require a selected named Lineage profile and its writer lease; legacy-unbound access is read-only");
+  }
   const profileId = process.env.LINEAGE_PROFILE_ID;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
   const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
   const manifestPath = process.env.LINEAGE_PROFILE_MANIFEST;
-  const databasePath = process.env.LINEAGE_DB;
   const lockPath = process.env.LINEAGE_WRITER_LOCK_PATH;
   const token = process.env.LINEAGE_WRITER_LEASE_TOKEN;
-  if (!profileId || !environment || !manifestPath || !databasePath || !lockPath || !token) {
+  if (!profileId || !profileFingerprint || !environment || !manifestPath || !lockPath || !token) {
     throw new Error("Named Lineage profiles may write only through a process holding the profile writer lease");
   }
-  const expectedLockPath = `${canonicalDatabasePath(databasePath)}.writer.lock`;
-  if (resolve3(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile database");
+  const expectedLockPath = join4(dirname3(resolve3(manifestPath)), "writer.lock");
+  if (resolve3(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile manifest");
   const owner = readOwner(lockPath);
-  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.environment !== environment) {
+  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.profile_fingerprint !== profileFingerprint || owner.environment !== environment) {
     throw new Error("Current process does not own the selected Lineage profile writer lease");
   }
 }
+function assertSelectedProfileDatabaseIdentity(database) {
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  if (!process.env.LINEAGE_PROFILE || !profileId || !environment || !profileFingerprint) {
+    throw new Error("Writable SQLite identity validation requires a fully resolved named Lineage profile");
+  }
+  const table = database.prepare("select name from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
+  if (!table) throw new Error(`Refusing writable open: database is not bound to Lineage profile ${profileId}`);
+  const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("profile_fingerprint")) {
+    throw new Error(`Refusing writable open: database identity for ${profileId} is missing required fingerprint fields`);
+  }
+  const rows = database.prepare("select profile_id, environment, profile_fingerprint from lineage_profile_identity").all();
+  if (rows.length !== 1) throw new Error(`Refusing writable open: expected exactly one database profile identity, found ${rows.length}`);
+  const identity = rows[0];
+  if (identity.profile_id !== profileId || identity.environment !== environment || identity.profile_fingerprint !== profileFingerprint) {
+    throw new Error(
+      `Refusing writable open: database identity ${String(identity.profile_id)}/${String(identity.environment)}/${String(identity.profile_fingerprint)} does not match selected profile ${profileId}/${environment}/${profileFingerprint}`
+    );
+  }
+}
 
 // src/server/assetLineageDb.ts
 var require3 = createRequire2(import.meta.url);
@@ -795,44 +859,19 @@ function nowIso() {
 function lineageDbPath() {
   return process.env.LINEAGE_DB || join5(packageRoot, ".lineage", "asset-lineage.sqlite");
 }
-function assertOpenedProfileIdentity(database, databasePath) {
-  const selector = process.env.LINEAGE_PROFILE;
-  if (!selector) return;
-  const profile = resolveLineageProfile(selector);
-  if (resolve4(databasePath) !== profile.database_path) {
-    throw new Error(`Profile ${profile.profile_id} requires database ${profile.database_path}, not ${databasePath}`);
-  }
-  const table = database.prepare("select 1 from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
-  if (!table) throw new Error(`Profile database ${databasePath} is not bound to a Lineage profile identity`);
-  const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
-  if (rows.length !== 1) {
-    throw new Error(`Profile database ${databasePath} has invalid Lineage profile identity row count ${rows.length}`);
-  }
-  if (rows[0].profile_id !== profile.profile_id || rows[0].environment !== profile.environment) {
-    throw new Error(
-      `Profile database ${databasePath} is bound to ${rows[0].profile_id}/${rows[0].environment}, not ${profile.profile_id}/${profile.environment}`
-    );
-  }
-}
 function lineageDb() {
   const readOnly = process.env.LINEAGE_DB_ACCESS === "read-only";
-  const databasePath = lineageDbPath();
   if (!readOnly) assertProfileWriterLeaseHeld();
-  if (process.env.LINEAGE_PROFILE && !existsSync5(databasePath)) {
-    throw new Error(`Profile database does not exist: ${databasePath}; bind the profile before opening it`);
+  if (!readOnly && !existsSync5(lineageDbPath())) {
+    throw new Error(`Refusing writable open of missing profile database ${lineageDbPath()}; bind an existing database or create a non-production clone first`);
   }
-  if (!readOnly) mkdirSync4(join5(databasePath, ".."), { recursive: true });
+  if (!readOnly) mkdirSync4(join5(lineageDbPath(), ".."), { recursive: true });
   const { DatabaseSync } = require3("node:sqlite");
-  const database = readOnly ? new DatabaseSync(databasePath, { readOnly: true }) : new DatabaseSync(databasePath);
-  try {
-    assertOpenedProfileIdentity(database, databasePath);
-    database.exec("PRAGMA foreign_keys = ON");
-    database.exec("PRAGMA busy_timeout = 5000");
-    if (readOnly) return database;
-  } catch (error) {
-    database.close();
-    throw error;
-  }
+  const database = readOnly ? new DatabaseSync(lineageDbPath(), { readOnly: true }) : new DatabaseSync(lineageDbPath());
+  if (process.env.LINEAGE_PROFILE) assertSelectedProfileDatabaseIdentity(database);
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA busy_timeout = 5000");
+  if (readOnly) return database;
   database.exec("PRAGMA journal_mode = WAL");
   database.exec(`
     create table if not exists projects (
@@ -1680,8 +1719,8 @@ function resolvePackageRoot() {
   const moduleDir = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.LINEAGE_REPO_ROOT,
-    resolve5(moduleDir, ".."),
-    resolve5(moduleDir, "../.."),
+    resolve4(moduleDir, ".."),
+    resolve4(moduleDir, "../.."),
     process.cwd()
   ].filter((candidate) => Boolean(candidate));
   const root = candidates.find(isPackageRoot);
@@ -1689,9 +1728,9 @@ function resolvePackageRoot() {
   return root;
 }
 var packageRoot = resolvePackageRoot();
-var repoRoot = resolve5(process.env.LINEAGE_ASSET_ROOT || packageRoot);
+var repoRoot = resolve4(process.env.LINEAGE_ASSET_ROOT || packageRoot);
 function setLineageAssetRoot(path) {
-  repoRoot = resolve5(path || packageRoot);
+  repoRoot = resolve4(path || packageRoot);
   return repoRoot;
 }
 var defaultProject = "demo-project";
@@ -1881,7 +1920,7 @@ function loadCatalog(project = defaultProject) {
 function saveCatalog(project, catalog) {
   const normalized = normalizeCatalog(catalog, project);
   mkdirSync5(dirname4(catalogPath(project)), { recursive: true });
-  writeFileSync2(catalogPath(project), `${JSON.stringify(normalized, null, 2)}
+  writeFileSync3(catalogPath(project), `${JSON.stringify(normalized, null, 2)}
 `);
   return normalized;
 }
@@ -2072,7 +2111,7 @@ function ensureUploadDir() {
 function cleanupUploadedTemp(file) {
   if (!file) return;
   const uploadRoot = ensureUploadDir();
-  const resolved = resolve5(file);
+  const resolved = resolve4(file);
   if (resolved.startsWith(`${uploadRoot}/`) && existsSync6(resolved)) {
     unlinkSync(resolved);
   }
@@ -2130,7 +2169,7 @@ function normalizeSelectionInput(fields) {
 import { randomBytes as randomBytes2 } from "node:crypto";
 
 // src/server/agentClaims.ts
-import { createHash as createHash3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash4, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var defaultTtlSeconds = 20 * 60;
 var idleAfterSeconds = 5 * 60;
 var staleAfterSeconds = 15 * 60;
@@ -2166,7 +2205,7 @@ function randomId(prefix) {
   return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
 function tokenHash(token) {
-  return createHash3("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function safeEqual(a, b) {
   const left = Buffer.from(a);
@@ -3474,8 +3513,8 @@ function rootFor(database, project, assetId) {
 }
 function assertCanonicalRoot(database, project, root) {
   requireAsset3(database, project, root);
-  const canonicalRoot = rootFor(database, project, root);
-  if (canonicalRoot !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
+  const canonicalRoot2 = rootFor(database, project, root);
+  if (canonicalRoot2 !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
 }
 function explicitWorkspaceRoot(database, project, assetId) {
   const row = database.prepare(`
@@ -5947,7 +5986,7 @@ function getAdapterStatus(project, env = process.env) {
 }
 
 // src/server/adapters/posting/bufferPostingService.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/server/contentPostHandoff.ts
@@ -6449,7 +6488,7 @@ function payloadPath(project, postId) {
 function writePayload(project, postId, payload) {
   const file = payloadPath(project, postId);
   mkdirSync6(join9(file, ".."), { recursive: true });
-  writeFileSync3(file, `${JSON.stringify(payload, null, 2)}
+  writeFileSync4(file, `${JSON.stringify(payload, null, 2)}
 `);
   return file;
 }
@@ -6559,7 +6598,7 @@ import { Router } from "express";
 
 // src/server/contentBatchImport.ts
 import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename4, join as join10, relative as relative2 } from "node:path";
+import { basename as basename3, join as join10, relative as relative3 } from "node:path";
 function walk(dir) {
   return readdirSync3(dir, { withFileTypes: true }).flatMap((entry) => {
     const path = join10(dir, entry.name);
@@ -6587,7 +6626,7 @@ function phaseFromStatus(value) {
   return "draft";
 }
 function postIdFor(kind, file) {
-  const slug2 = basename4(file, ".md").replace(/^\d{4}-\d{2}-/, "");
+  const slug2 = basename3(file, ".md").replace(/^\d{4}-\d{2}-/, "");
   return `${kind}-${slug2}`;
 }
 function itemFromFile(file) {
@@ -6607,8 +6646,8 @@ function itemFromFile(file) {
     phase: phaseFromStatus(meta.status),
     postId: postIdFor(kind, file),
     relatedAsset,
-    sourcePath: relative2(repoRoot, file),
-    title: text.match(/^#\s+(.+)$/m)?.[1] || basename4(file, ".md")
+    sourcePath: relative3(repoRoot, file),
+    title: text.match(/^#\s+(.+)$/m)?.[1] || basename3(file, ".md")
   };
 }
 function demoMarkdownItems(kind) {
@@ -6953,8 +6992,8 @@ function contentBatchRouter(projectFrom2) {
 
 // src/server/generationReceipts.ts
 import { existsSync as existsSync9, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
-import { relative as relative3, resolve as resolve6 } from "node:path";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { relative as relative4, resolve as resolve5 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var adapterVersion = "generation-receipts-v1";
 var provider = "codex-handoff";
 var GenerationReceiptError = class extends Error {
@@ -6968,7 +7007,7 @@ function isGenerationReceiptError(error) {
   return error instanceof GenerationReceiptError;
 }
 function jobId() {
-  return `gen-${Date.now().toString(36)}-${randomUUID2().slice(0, 8)}`;
+  return `gen-${Date.now().toString(36)}-${randomUUID3().slice(0, 8)}`;
 }
 function quote(value) {
   return JSON.stringify(value);
@@ -7164,12 +7203,12 @@ function planImageReroll(project = defaultProject, fields) {
   }
 }
 function isPathInside2(child, parent) {
-  const rel = relative3(parent, child);
+  const rel = relative4(parent, child);
   return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
 }
 function resolveScratchFile(file) {
-  const scratchRoot = resolve6(repoRoot, ".asset-scratch");
-  const candidate = file.startsWith(".asset-scratch/") || resolve6(file).startsWith(scratchRoot) ? resolve6(repoRoot, file) : resolve6(scratchRoot, file);
+  const scratchRoot = resolve5(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve5(file).startsWith(scratchRoot) ? resolve5(repoRoot, file) : resolve5(scratchRoot, file);
   if (!isPathInside2(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
   if (!existsSync9(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
   const realScratchRoot = realpathSync2(scratchRoot);
@@ -7179,7 +7218,7 @@ function resolveScratchFile(file) {
   if (!stats.isFile()) throw new GenerationReceiptError(`Import path is not a file: ${file}`);
   const checksum = fileSha256(candidate);
   return {
-    relativePath: relative3(scratchRoot, candidate),
+    relativePath: relative4(scratchRoot, candidate),
     checksum,
     size: stats.size,
     contentType: contentTypeFor(candidate),
@@ -7343,8 +7382,8 @@ function registerLineageTaskRoutes(app2, projectFrom2, asyncRoute2) {
 }
 
 // src/server/assetLineageDemo.ts
-import { createHash as createHash4 } from "node:crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import { copyFileSync as copyFileSync3, existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname as dirname5, join as join11, posix } from "node:path";
 import { gunzipSync } from "node:zlib";
@@ -7435,7 +7474,7 @@ function swissifierMediaState(manifest) {
   return { invalid, missing };
 }
 function sha256Hex(input) {
-  return createHash4("sha256").update(input).digest("hex");
+  return createHash5("sha256").update(input).digest("hex");
 }
 function safeTarEntryName(rawName) {
   const stripped = rawName.replace(/\0.*$/, "").replace(/^\.\//, "");
@@ -7500,7 +7539,7 @@ function extractSwissifierMediaArchive(archive, manifest, destination) {
     if (actualSha !== asset.checksum_sha256) throw new Error(`Checksum mismatch for Swissifier media archive entry: ${name}`);
     const target = join11(destination, directName);
     mkdirSync7(dirname5(target), { recursive: true });
-    writeFileSync4(target, file);
+    writeFileSync5(target, file);
     extracted.add(directName);
     offset = nextOffset;
   }
@@ -7607,7 +7646,7 @@ async function downloadSwissifierRichDemoMedia(project = defaultProject, fields
       media_status: swissifierRichDemoMediaStatus(project)
     };
   } finally {
-    rmSync2(sourceDir, { force: true, recursive: true });
+    rmSync3(sourceDir, { force: true, recursive: true });
   }
 }
 function restoreDemoSeedMedia(project = defaultProject, fields = { confirmWrite: false }) {
@@ -7666,7 +7705,7 @@ function restoreSwissifierRichDemoMedia(project = defaultProject, fields = { con
     for (const item of copyable) {
       const target = swissifierFilePath(manifest, item.asset);
       mkdirSync7(dirname5(target), { recursive: true });
-      copyFileSync2(item.source, target);
+      copyFileSync3(item.source, target);
     }
   }
   return {
@@ -7696,7 +7735,7 @@ function svg(label, fill, stroke) {
 `;
 }
 function assetIdFor(asset) {
-  return `local-${createHash4("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
+  return `local-${createHash5("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
 }
 function demoAssetIds() {
   return Object.fromEntries(demoAssets.map((asset) => [asset.key, assetIdFor(asset)]));
@@ -7704,7 +7743,7 @@ function demoAssetIds() {
 function writeDemoFile(project, asset) {
   const path = demoFilePath(project, asset);
   mkdirSync7(dirname5(path), { recursive: true });
-  writeFileSync4(path, svg(asset.label, asset.fill, asset.stroke));
+  writeFileSync5(path, svg(asset.label, asset.fill, asset.stroke));
 }
 function writeDemoFiles(project) {
   const ids = demoAssetIds();
@@ -7729,7 +7768,7 @@ function writeSwissifierRerollFiles(manifest) {
     swissifierRerollAsset(attempt);
     const target = swissifierRerollFilePath(manifest, attempt);
     mkdirSync7(dirname5(target), { recursive: true });
-    copyFileSync2(swissifierRerollFixturePath(attempt), target);
+    copyFileSync3(swissifierRerollFixturePath(attempt), target);
   }
 }
 function upsertDemoAssets(project, ids) {
@@ -7763,7 +7802,7 @@ function upsertDemoAssets(project, ids) {
         ids[asset.key],
         project,
         demoRelativePath(project, asset),
-        createHash4("sha256").update(body).digest("hex"),
+        createHash5("sha256").update(body).digest("hex"),
         asset.label,
         asset.channel,
         Buffer.byteLength(body),
@@ -8022,7 +8061,7 @@ function archiveDemoLineageWorkspace(project, confirmWrite) {
     if (!isLineageWorkspaceError(error) || error.status !== 404) throw error;
     archived = { ok: true, message: "No demo lineage workspace exists yet", workspace: null };
   }
-  if (confirmWrite) rmSync2(demoProjectDir(project), { force: true, recursive: true });
+  if (confirmWrite) rmSync3(demoProjectDir(project), { force: true, recursive: true });
   return {
     ok: true,
     message: confirmWrite ? `Archived ${demoWorkspaceTitle}` : `Would archive ${demoWorkspaceTitle}`,
@@ -8116,14 +8155,49 @@ function registerLineageWorkspaceRoutes(app2, projectFrom2, asyncRoute2) {
 }
 
 // src/server/runtimeInfo.ts
+import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire as createRequire4 } from "node:module";
-import { existsSync as existsSync11, readFileSync as readFileSync7, statSync as statSync5 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync11, lstatSync as lstatSync2, readFileSync as readFileSync7, readdirSync as readdirSync4, readlinkSync, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join12, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/shared/runtimeInfoTypes.ts
+var lineageRuntimeBuildSchemaVersion = "lineage.runtime_build.v1";
+var lineageRuntimeInstallSchemaVersion = "lineage.runtime_install.v1";
+
+// src/server/runtimeInfo.ts
 var require5 = createRequire4(import.meta.url);
-function packageInfo() {
+var processStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+function isLineagePackageRoot(root) {
   try {
-    const info = JSON.parse(readFileSync7(join12(packageRoot, "package.json"), "utf8"));
+    const info = JSON.parse(readFileSync7(join12(root, "package.json"), "utf8"));
+    return info.name === "@mean-weasel/lineage";
+  } catch {
+    return false;
+  }
+}
+function executingCodeRoot() {
+  const moduleDirectory = dirname6(fileURLToPath2(import.meta.url));
+  const candidates = [resolve6(moduleDirectory, "../.."), resolve6(moduleDirectory, "..")];
+  const root = candidates.find(isLineagePackageRoot);
+  if (!root) throw new Error(`Unable to derive Lineage code root from executing module ${fileURLToPath2(import.meta.url)}`);
+  return canonicalRoot(root);
+}
+var codeRoot = executingCodeRoot();
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function canonicalRoot(root) {
+  try {
+    return realpathSync3(root);
+  } catch {
+    return resolve6(root);
+  }
+}
+function packageInfo(root = codeRoot) {
+  try {
+    const info = JSON.parse(readFileSync7(join12(root, "package.json"), "utf8"));
     return { name: info.name || "@mean-weasel/lineage", version: info.version || "0.0.0" };
   } catch {
     return { name: "@mean-weasel/lineage", version: "0.0.0" };
@@ -8136,12 +8210,199 @@ function normalizeRuntimeChannel(value) {
   if (value === "development") return "dev";
   return process.env.NODE_ENV === "production" ? "stable" : "dev";
 }
-function gitSha() {
-  const envSha = process.env.LINEAGE_GIT_SHA || process.env.GITHUB_SHA;
-  if (envSha) return envSha.slice(0, 40);
-  if (!existsSync11(join12(packageRoot, ".git"))) return void 0;
-  const result = spawnSync2("git", ["rev-parse", "--short=12", "HEAD"], { cwd: packageRoot, encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim() || void 0 : void 0;
+function git(root, args) {
+  const result = spawnSync2("git", args, { cwd: root, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function untrackedFingerprint(root, status) {
+  const hash = createHash6("sha256");
+  hash.update(status);
+  const listed = git(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (listed === void 0) return hash.digest("hex");
+  for (const relativePath of listed.split("\0").filter(Boolean).sort()) {
+    hash.update("\0");
+    hash.update(relativePath);
+    const path = join12(root, relativePath);
+    try {
+      const stat = lstatSync2(path);
+      if (stat.isSymbolicLink()) hash.update(readlinkSync(path));
+      else if (stat.isFile()) hash.update(readFileSync7(path));
+      else hash.update(`[${stat.mode}:${stat.size}]`);
+    } catch (error) {
+      hash.update(`[unreadable:${error instanceof Error ? error.message : String(error)}]`);
+    }
+  }
+  return hash.digest("hex");
+}
+function checkoutCodeIdentity(root, channel, version) {
+  const errors = [];
+  const gitRootRaw = git(root, ["rev-parse", "--show-toplevel"])?.trim();
+  const gitSha = git(root, ["rev-parse", "HEAD"])?.trim();
+  const status = git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  const diff = git(root, ["diff", "--binary", "HEAD", "--"]);
+  const canonicalGitRoot = gitRootRaw ? canonicalRoot(gitRootRaw) : void 0;
+  if (!canonicalGitRoot || canonicalGitRoot !== root) errors.push("Code root is not the canonical root of a Git checkout/worktree");
+  if (!gitSha || !/^[a-f0-9]{40}$/i.test(gitSha)) errors.push("Checkout Git revision is unavailable");
+  if (status === void 0 || diff === void 0) errors.push("Checkout dirty state could not be inspected");
+  if (channel !== "dev") errors.push(`Checkout code may run only as dev, not ${channel}`);
+  const dirty = Boolean(status);
+  const sourceFingerprint = sha256(`${gitSha || "unknown"}\0${sha256(diff || "")}\0${untrackedFingerprint(root, status || "")}`);
+  return {
+    channel,
+    dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, dirty, git_sha: gitSha, origin: "checkout", root, source_fingerprint: sourceFingerprint, version })),
+    git_sha: gitSha,
+    origin: "checkout",
+    package_version: version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function buildFingerprint(build) {
+  return sha256(JSON.stringify({
+    package_name: build.package_name,
+    package_version: build.package_version,
+    schema_version: build.schema_version,
+    source_dirty: build.source_dirty,
+    source_fingerprint: build.source_fingerprint,
+    source_git_sha: build.source_git_sha
+  }));
+}
+function readBuildIdentity(root, errors) {
+  const path = join12(root, "dist", "runtime-build.json");
+  let build;
+  try {
+    build = JSON.parse(readFileSync7(path, "utf8"));
+  } catch (error) {
+    errors.push(`Embedded build identity is missing or unreadable at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (build.schema_version !== lineageRuntimeBuildSchemaVersion) errors.push(`Unsupported build identity schema: ${String(build.schema_version)}`);
+  if (!/^[a-f0-9]{40}$/i.test(build.source_git_sha || "")) errors.push("Embedded build Git revision is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(build.source_fingerprint || "")) errors.push("Embedded source fingerprint is invalid");
+  const expected = buildFingerprint(build);
+  if (build.build_fingerprint !== expected) errors.push("Embedded build fingerprint does not match its contents");
+  return build;
+}
+function readInstallReceipt(path, errors) {
+  if (!path) {
+    errors.push("Packaged runtime was not launched through a channel install receipt");
+    return void 0;
+  }
+  let receipt;
+  const receiptPath = resolve6(path);
+  try {
+    receipt = JSON.parse(readFileSync7(receiptPath, "utf8"));
+  } catch (error) {
+    errors.push(`Runtime install receipt is missing or unreadable at ${receiptPath}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (receipt.schema_version !== lineageRuntimeInstallSchemaVersion) errors.push(`Unsupported runtime install receipt schema: ${String(receipt.schema_version)}`);
+  if (!isAbsolute2(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
+  if (!receipt.package_integrity?.startsWith("sha512-")) errors.push("Runtime install receipt package integrity is invalid");
+  if (receipt.package_source !== "registry" && receipt.package_source !== "local") errors.push("Runtime install receipt package source is invalid");
+  if (typeof receipt.package_spec !== "string" || !receipt.package_spec) errors.push("Runtime install receipt package spec is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(receipt.package_tree_sha256 || "")) errors.push("Runtime install receipt package tree hash is invalid");
+  if (Number.isNaN(Date.parse(receipt.installed_at))) errors.push("Runtime install receipt timestamp is invalid");
+  return { ...receipt, receipt_path: receiptPath };
+}
+function lineagePackageTreeSha256(root) {
+  const hash = createHash6("sha256");
+  const visit = (directory, relativeDirectory = "") => {
+    for (const entry of readdirSync4(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      const relativePath = relativeDirectory ? join12(relativeDirectory, entry.name) : entry.name;
+      const path = join12(directory, entry.name);
+      hash.update(relativePath.replaceAll("\\", "/"));
+      hash.update("\0");
+      if (entry.isDirectory()) {
+        hash.update("directory\0");
+        visit(path, relativePath);
+      } else if (entry.isSymbolicLink()) {
+        hash.update("symlink\0");
+        hash.update(readlinkSync(path));
+      } else if (entry.isFile()) {
+        hash.update("file\0");
+        hash.update(readFileSync7(path));
+      } else {
+        hash.update("other\0");
+      }
+      hash.update("\0");
+    }
+  };
+  visit(root);
+  return hash.digest("hex");
+}
+function packageCodeIdentity(root, channel, info, receiptPath) {
+  const errors = [];
+  const build = readBuildIdentity(root, errors);
+  const install = readInstallReceipt(receiptPath, errors);
+  if (channel === "dev") errors.push("Published package code cannot run as dev; use a Git checkout/worktree");
+  if (build?.package_name !== info.name || build?.package_version !== info.version) {
+    errors.push("Embedded build package identity does not match package.json");
+  }
+  if (build?.source_dirty) errors.push("Stable and preview package installs require a clean-source build");
+  if (install) {
+    if (install.channel !== channel) errors.push(`Install receipt channel ${install.channel} does not match requested ${channel}`);
+    if (canonicalRoot(install.package_root) !== root) errors.push("Install receipt package root does not match the executing package root");
+    if (install.package_name !== info.name || install.package_version !== info.version) errors.push("Install receipt package identity does not match package.json");
+    if (build && install.build_fingerprint !== build.build_fingerprint) errors.push("Install receipt build fingerprint does not match the embedded build");
+    try {
+      if (lineagePackageTreeSha256(root) !== install.package_tree_sha256) errors.push("Installed package tree does not match the channel install receipt");
+    } catch (error) {
+      errors.push(`Installed package tree could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  const gitSha = build?.source_git_sha;
+  const sourceFingerprint = build?.source_fingerprint;
+  return {
+    build,
+    channel,
+    dirty: build?.source_dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({
+      build_fingerprint: build?.build_fingerprint,
+      channel,
+      install_integrity: install?.package_integrity,
+      origin: "package",
+      root,
+      version: info.version
+    })),
+    git_sha: gitSha,
+    install,
+    origin: "package",
+    package_version: info.version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function getLineageCodeIdentity(channel, options = {}) {
+  const root = canonicalRoot(options.root || codeRoot);
+  const info = packageInfo(root);
+  if (existsSync11(join12(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
+  if (existsSync11(join12(root, "package.json"))) {
+    return packageCodeIdentity(root, channel, info, options.receiptPath ?? process.env.LINEAGE_RUNTIME_RECEIPT);
+  }
+  const errors = [`Code root has neither checkout metadata nor package.json: ${root}`];
+  return {
+    channel,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, origin: "unknown", root, version: info.version })),
+    origin: "unknown",
+    package_version: info.version,
+    root,
+    verified: false
+  };
+}
+function assertLineageCodeOrigin(channel) {
+  const identity = getLineageCodeIdentity(channel);
+  if (!identity.verified) {
+    const migration = channel === "dev" ? "Run dev from a Git checkout with npm run lineage:dev -- <command>." : `Install and launch an isolated ${channel} runtime with lineage-channel install ${channel}.`;
+    throw new Error(`Unverified ${channel} code origin: ${identity.errors.join("; ")}. ${migration}`);
+  }
+  return identity;
 }
 function tableExists2(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
@@ -8159,6 +8420,7 @@ function getLineageRuntimeInfo(options = {}) {
   const info = packageInfo();
   const dbPath = options.dbPath || lineageDbPath();
   const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+  const code = options.code || getLineageCodeIdentity(channel);
   const databaseInfo = { exists: existsSync11(dbPath), path: dbPath };
   const schema = { migration_keys: [] };
   if (databaseInfo.exists) {
@@ -8173,11 +8435,13 @@ function getLineageRuntimeInfo(options = {}) {
         databaseInfo.workspaces = tableCount(database, "lineage_workspaces");
         schema.migration_keys = migrationKeys(database);
         if (tableExists2(database, "lineage_profile_identity")) {
-          const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
-          schema.profile_identity_rows = rows.length;
+          const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+          const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "null as profile_fingerprint";
+          const rows = database.prepare(`select profile_id, environment, ${fingerprintExpression} from lineage_profile_identity`).all();
           if (rows.length === 1) {
             schema.profile_id = rows[0].profile_id;
             schema.profile_environment = rows[0].environment;
+            if (rows[0].profile_fingerprint) schema.profile_fingerprint = rows[0].profile_fingerprint;
           }
         }
       } finally {
@@ -8190,13 +8454,20 @@ function getLineageRuntimeInfo(options = {}) {
   return {
     asset_root: repoRoot,
     channel,
+    code,
     database: databaseInfo,
     fetchedAt: nowIso(),
-    git_sha: gitSha(),
+    git_sha: code.git_sha,
     node_env: process.env.NODE_ENV,
     package_name: info.name,
     profile: runtimeProfileIdentity(channel),
     schema,
+    service: {
+      instance_id: process.env.LINEAGE_SERVICE_INSTANCE_ID,
+      launcher_pid: process.env.LINEAGE_LAUNCHER_PID ? Number(process.env.LINEAGE_LAUNCHER_PID) : void 0,
+      pid: process.pid,
+      started_at: processStartedAt
+    },
     version: info.version
   };
 }
@@ -8275,14 +8546,14 @@ function registerManagedWriterRoute(app2, fields) {
 }
 
 // src/cli/lineageCli.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join13, resolve as resolve8 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join13, resolve as resolve8 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/server/lineageSelectionPacket.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { existsSync as existsSync12, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
 var LineageSelectionPacketError = class extends Error {
   constructor(message, warnings = [], errors = [], diagnostics = []) {
     super(message);
@@ -8328,7 +8599,7 @@ function resolveWorkspace(project, options) {
 }
 function resolveLocalReference(reference) {
   if (!reference) return void 0;
-  if (isAbsolute2(reference)) return reference;
+  if (isAbsolute3(reference)) return reference;
   const repoRelative = resolve7(repoRoot, reference);
   if (existsSync12(repoRelative)) return repoRelative;
   return resolve7(repoRoot, ".asset-scratch", reference);
@@ -8407,7 +8678,7 @@ function assetForNode(node, catalogAsset, warnings) {
   };
 }
 function packetId(packetIdentity) {
-  const digest = createHash5("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
+  const digest = createHash7("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
   return `lineage_packet_${digest}`;
 }
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -8478,7 +8749,7 @@ function lineageSelectionPacketV2IdentityProjection(packet) {
 }
 function lineageSelectionPacketV2IdentitySha256(packet) {
   const projection = lineageSelectionPacketV2IdentityProjection(packet);
-  return createHash5("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
+  return createHash7("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
 }
 function addDiagnostic(diagnostics, diagnostic) {
   if (diagnostics.some((item) => item.code === diagnostic.code && item.severity === diagnostic.severity && item.asset_id === diagnostic.asset_id)) return;
@@ -8784,7 +9055,7 @@ function getLineageSelectionPacket(project, options = {}) {
 
 // src/cli/lineageCli.ts
 function packageRoot2() {
-  return resolve8(dirname6(fileURLToPath2(import.meta.url)), "..", "..");
+  return resolve8(dirname7(fileURLToPath3(import.meta.url)), "..", "..");
 }
 function packageVersion() {
   try {
@@ -8881,8 +9152,8 @@ function runLineageDataCommand(command, args) {
     const out = readOption(args, "--out");
     if (out) {
       const outPath = resolve8(out);
-      mkdirSync8(dirname6(outPath), { recursive: true });
-      writeFileSync5(outPath, `${JSON.stringify(packet, null, 2)}
+      mkdirSync8(dirname7(outPath), { recursive: true });
+      writeFileSync6(outPath, `${JSON.stringify(packet, null, 2)}
 `);
     }
     return packet;
@@ -9092,15 +9363,21 @@ function runLineageAgentCommand(command, args) {
 
 // src/server.ts
 var runtimeChannel = normalizeRuntimeChannel(process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+var startupCode = assertLineageCodeOrigin(runtimeChannel);
 assertRuntimeProfileSafety(runtimeChannel);
-var startupRuntime = getLineageRuntimeInfo({ channel: runtimeChannel });
+var startupRuntime = getLineageRuntimeInfo({ channel: runtimeChannel, code: startupCode });
 if (!process.env.LINEAGE_PROFILE) assertUnselectedDatabaseIsUnbound(startupRuntime);
 var startupProfile;
 if (process.env.LINEAGE_PROFILE) {
   if (!process.env.LINEAGE_PROFILE_ID || !process.env.LINEAGE_PROFILE_ENVIRONMENT || !process.env.LINEAGE_PROFILE_MANIFEST) {
     throw new Error("LINEAGE_PROFILE must be resolved by the Lineage CLI before server startup; use lineage start --profile or lineage-dev start --profile");
   }
-  const doctor = doctorLineageProfile(process.env.LINEAGE_PROFILE, { channel: runtimeChannel, gitSha: startupRuntime.git_sha, version: startupRuntime.version });
+  const doctor = doctorLineageProfile(process.env.LINEAGE_PROFILE, {
+    channel: runtimeChannel,
+    code: startupRuntime.code,
+    gitSha: startupRuntime.git_sha,
+    version: startupRuntime.version
+  });
   if (!doctor.ok) {
     const failures = doctor.checks.filter((check) => check.status === "fail").map((check) => `${check.id}: ${check.message}`).join("; ");
     throw new Error(`Configured Lineage profile failed doctor: ${failures}`);
@@ -9109,7 +9386,8 @@ if (process.env.LINEAGE_PROFILE) {
   startupProfile = doctor.profile;
 }
 var writerLease = startupProfile ? acquireProfileWriterLease(startupProfile, runtimeChannel, "service") : void 0;
-delete process.env.LINEAGE_DB_ACCESS;
+if (startupProfile) delete process.env.LINEAGE_DB_ACCESS;
+else process.env.LINEAGE_DB_ACCESS = "read-only";
 if (writerLease) {
   try {
     const startupDatabase = lineageDb();
@@ -9124,7 +9402,10 @@ var port = Number(process.env.PORT || 5173);
 var host = process.env.HOST || "lineage.localhost";
 var isProduction = process.env.NODE_ENV === "production";
 var maxUploadBytes = Number(process.env.LINEAGE_MAX_UPLOAD_MB || 200) * 1024 * 1024;
-var upload = multer({ dest: ensureUploadDir(), limits: { fileSize: maxUploadBytes } });
+var upload = multer({
+  limits: { fileSize: maxUploadBytes },
+  storage: startupProfile ? multer.diskStorage({ destination: ensureUploadDir() }) : multer.memoryStorage()
+});
 app.use(express2.json({ limit: "1mb" }));
 registerManagedWriterRoute(app, {
   accepts: lineageCliCanDelegateMutation,
@@ -9133,6 +9414,13 @@ registerManagedWriterRoute(app, {
   profile: startupProfile,
   writerLease
 });
+app.use((req, res, next) => {
+  if (startupProfile || req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS") return next();
+  res.status(409).json({
+    error: "profile_required",
+    message: "Persistent writes require a selected named Lineage profile; legacy-unbound service access is read-only."
+  });
+});
 function projectFrom(input) {
   const candidate = input.body?.project || input.body?.product || input.query?.project || input.query?.product;
   return typeof candidate === "string" ? candidate : defaultProduct;
@@ -9146,7 +9434,7 @@ app.get("/api/projects", asyncRoute((_req, res) => {
   res.json({ projects: listProjects() });
 }));
 app.get("/api/runtime", asyncRoute((_req, res) => {
-  res.json({ ok: true, runtime: getLineageRuntimeInfo() });
+  res.json({ ok: true, runtime: getLineageRuntimeInfo({ channel: runtimeChannel, code: startupCode }) });
 }));
 app.get(
   "/api/assets",