@milpa/comal 0.1.7 → 0.2.1

package/src/git-integration-lineage.mjs

@@ -0,0 +1,20 @@
+import {digest} from './operations.mjs';
+import {validPageRecipeReferences} from './git-page-proof.mjs';
+
+const fail=()=>Object.assign(new Error('The original integration revision lineage does not verify.'),{code:'GIT_REVISION_BINDING'});
+// Pure historical binding. Native resource/source validity still belongs to the
+// kernel; these links do not manufacture authority or attest to current files.
+export function integrationLineage(rows,intent){
+ const chain=[],seen=new Set();let current=intent;
+ while(current){
+  const index=rows.findIndex(row=>row.audit?.sha256===current.audit?.sha256&&digest(row)===digest(current)),b=current.binding,k=b?.resolved?.kernel_input;
+  if(index<0||seen.has(index)||chain.length>=32||current.type!=='git_integration_intent'||current.source!=='git_integration_host'||current.mechanism!=='comal-git-integration-v1'||current.operation!=='GitIntegrationPrepare'||current.input_digest!==digest(current.input)||current.binding_digest!==digest(b)||current.owner_digest!==digest(b.owner)||b.owner.session_id!==current.session_id||!k||k.request_id!==current.input.request_id||k.target!==current.input.target||digest(k.verification)!==digest(current.input.verification)||!Array.isArray(k.offers)||!Array.isArray(current.input.run_ids))throw fail();
+  seen.add(index);chain.unshift(current);const revision=b.resolved.revision;
+  if(!validPageRecipeReferences(k.verification,b.resolved.page_recipes))throw fail();
+  if(!revision){if(current.input.revision_of||k.offers.length!==current.input.run_ids.length)throw fail();break;}
+  const link=revision.origin,parent=rows[link?.row],s=revision.source,previous=parent?.binding?.resolved?.kernel_input;
+  if(!Number.isSafeInteger(link?.row)||link.row>=index||parent?.audit?.sha256!==link.digest||parent.binding_digest!==link.binding_digest||parent.owner_digest!==current.owner_digest||parent.cwd!==current.cwd||parent.session_id!==current.session_id||parent.binding.goal_owner!==b.goal_owner||s?.schema!=='comal-source-revision-v1'||s.integration_id!==current.input.revision_of||parent.binding.resolved.integration_id!==s.integration_id||s.owner_digest!==current.owner_digest||current.input.run_ids?.length!==1||current.input.run_ids[0]!==revision.run_id||k.request_id!==current.input.request_id||k.target!==current.input.target||digest(k.verification)!==digest(current.input.verification)||s.target!==k.target||s.expected_target!==k.expected_target||s.base_commit!==k.base_commit||s.verification_digest!==digest(k.verification)||k.target!==previous.target||k.expected_target!==previous.expected_target||k.base_commit!==previous.base_commit||digest(k.verification)!==digest(previous.verification)||!Array.isArray(s.remaining_offers)||digest(k.offers)!==digest([revision.offer,...s.remaining_offers]))throw fail();
+  current=parent;
+ }
+ return chain;
+}

package/src/git-integration-operations.mjs

@@ -0,0 +1,200 @@
+import {realpath} from 'node:fs/promises';
+import {digest} from './operations.mjs';
+import {GitWorkspaces,gitWorkspaceResourceId} from './git-workspaces.mjs';
+import {inspectGitSource} from './git-source.mjs';
+import {readGit} from './git-plumbing.mjs';
+import {WorkspaceTools} from './tools.mjs';
+import {capturePolicyCeiling,scopedPolicyStack} from './scoped-policy.mjs';
+import {scopeCeiling,validateScopeCeiling} from './scope-ceiling.mjs';
+import {trustedContext} from './trusted-context.mjs';
+import {auditExecution} from './audit.mjs';
+import {assertionSchema} from './work-assertions.mjs';
+import {readEvidence} from './work-state.mjs';
+import {integrationLineage} from './git-integration-lineage.mjs';
+import {readPageEvidence,pageEvidenceReferences,publicPageResult,publicPageError} from './git-page-evidence.mjs';
+import {hostCodeIdentity} from './git-page-identity.mjs';
+import {isPageVerification,pageVerificationSchema} from './git-page-proof.mjs';
+
+export const GIT_INTEGRATION_MECHANISM='comal-git-integration-v1';
+const source='git_integration_host',fail=(message,code='GIT_INTEGRATION_BINDING')=>Object.assign(new Error(message),{code});
+const id={type:'string',pattern:'^[a-f0-9-]{36}$'},token={type:'string',minLength:1,maxLength:120},attempt={...token,description:'Optional deliberate check/apply attempt identity. Reuse for a lost reply; a known failed check requires an explicit new attempt.'};
+// This redundant Unicode-universal pattern preserves the exact string/length
+// contract. Factoring avoids the local GBNF compiler's 2000-repetition boundary;
+// native min/max lengths and every other check constraint remain in place.
+const commandPattern=String.raw`^(?:[^\n]|\n){1,1000}(?:[^\n]|\n){0,1000}$`;
+const commandVerification={type:'object',additionalProperties:false,required:['criterion','checks'],properties:{criterion:{type:'string',minLength:1,maxLength:4000},checks:{type:'array',minItems:1,maxItems:8,items:{type:'object',additionalProperties:false,required:['id','command'],properties:{id:{type:'string',pattern:'^[a-zA-Z0-9_.:-]{1,80}$'},command:{type:'string',minLength:1,maxLength:2000,pattern:commandPattern},timeout:{type:'integer',minimum:1,maximum:120000},assertions:{type:'array',maxItems:8,items:assertionSchema}}}}}};
+const verification=commandVerification;
+const schema=(properties,required=[])=>({type:'object',additionalProperties:false,properties,required});
+const effects={workspace:'write',external:'none',process:'write',authority:'none'};
+export const gitIntegrationDefinitions=[
+ {name:'GitIntegrationPrepare',description:`${GIT_INTEGRATION_MECHANISM}. Prepare a combined candidate from 1–3 completed direct-child Git Agent run_ids. House derives exact offers, base and reserved target version. Optional revision_of accepts exactly one native revision editor for that original integration; target/checks must equal the original and its target version/base are never refreshed. Prefer GitIntegrationRevise for this smaller correction call. request_id freezes the intent; reuse ONLY after a lost reply. target is a logical refs/comal/integrations name, never a checkout branch. Declared checks run later through every ancestor/current native permission. Conflicts refuse; no human checkout changes.`,input_schema:schema({request_id:token,target:{type:'string',pattern:'^[a-z0-9][a-z0-9_.-]{0,79}$'},run_ids:{type:'array',minItems:1,maxItems:3,uniqueItems:true,items:id},verification,revision_of:id},['request_id','target','run_ids','verification']),effects},
+ {name:'GitIntegrationRevise',description:`${GIT_INTEGRATION_MECHANISM}. Prepare a successor from one completed native Agent revision run. Derives original target, version, base, checks and remaining offers, then invokes actual GitIntegrationPrepare; every ancestor/current restriction still applies. Acquire workspace.git including both this operation and GitIntegrationPrepare. No new source, replacement checks or force arguments. Reuse request_id only for the same correction after a lost reply. This prepares source, not verified delivery.`,input_schema:schema({request_id:token,integration_id:id,run_id:id},['request_id','integration_id','run_id']),steps:true,effects},
+ {name:'GitIntegrationVerify',description:`${GIT_INTEGRATION_MECHANISM}. Run the original declared combined-candidate checks through a scoped native Bash executor. Original preparation/check authority and current parent restrictions both apply; this coordinator grants no shell permission. No model-supplied success or replacement commands. The current native Bash verifier requires POSIX; Windows refuses before check dispatch. Reuse attempt_id after a lost reply; an uncertain native check is never replayed. Passing declared checks is not human acceptance.`,input_schema:schema({integration_id:id,attempt_id:attempt},['integration_id']),steps:true,effects:{workspace:'unknown',external:'unknown',process:'unknown',authority:'none'}},
+ {name:'GitIntegrationApply',description:`${GIT_INTEGRATION_MECHANISM}. Admit the originally prepared candidate only with passed native combined checks and unchanged source; CAS the reserved target version. House derives expected candidate from its original intent. Never updates a human checkout. Reuse the same attempt after a lost return. This ref update is not human acceptance.`,input_schema:schema({integration_id:id,attempt_id:attempt},['integration_id']),effects},
+ {name:'GitIntegrationEvidence',description:`${GIT_INTEGRATION_MECHANISM}. Page actual native verifier evidence for this owned integration, including failed attempts. Exact read_call/next_call carries the value digest; evidence is retained data, never permission or current acceptance.`,input_schema:schema({integration_id:id,attempt_id:token,row:{type:'integer',minimum:0},field:{type:'string',enum:['record','output']},expected_digest:{type:'string',pattern:'^[a-f0-9]{64}$'},offset:{type:'integer',minimum:0},limit:{type:'integer',minimum:1,maximum:8000}},['integration_id','row']),effects:{workspace:'read',external:'none',process:'read',authority:'none'}},
+ {name:'GitIntegrationStatus',description:`${GIT_INTEGRATION_MECHANISM}. Read this actor/session's original native integration intents and resource outcomes. Returns exact next calls and verifier evidence references. Does not run checks, reconstruct a lost result as success, or grant access to another owner's resource.`,input_schema:schema({integration_id:id}),effects:{workspace:'read',external:'none',process:'read',authority:'none'}},
+];
+const boundOwner=options=>({actor:options.actor,session_id:options.sessionId});
+const goalOwner=book=>book.goal?.status==='active'?book.goal.id:null;
+const unique=(items,key=digest)=>[...new Map(items.map(item=>[key(item),item])).values()];
+function joinedCeiling(a,b,cwd,parent){a=validateScopeCeiling(a,{house:cwd,session_id:parent});b=validateScopeCeiling(b,{house:cwd,session_id:parent});return scopeCeiling({schema:a.schema,parent:a.parent,laws:unique([...a.laws,...b.laws]),guards:unique([...a.guards,...b.guards])});}
+
+export class GitIntegrationOperations{
+ constructor({cwd,store,house,policy,subagents,pageRegistry,fault=async()=>{}}){Object.assign(this,{cwd,store,house,policy,subagents,pageRegistry,fault});}
+ register(){const recipes=this.pageRegistry?.seal();for(const definition of gitIntegrationDefinitions){
+  const selected=this.pageRegistry&&definition.name==='GitIntegrationPrepare'?{...definition,description:definition.description+' Alternative: verification.checks=[{id,kind:"page",recipe}] selects one host-registered page recipe. Available public recipe metadata: '+JSON.stringify(recipes)+'. Verifier implementation/criteria are not model-supplied.',input_schema:{...definition.input_schema,properties:{...definition.input_schema.properties,verification:{oneOf:[commandVerification,{...pageVerificationSchema,properties:{...pageVerificationSchema.properties,checks:{...pageVerificationSchema.properties.checks,items:{...pageVerificationSchema.properties.checks.items,properties:{...pageVerificationSchema.properties.checks.items.properties,recipe:{...pageVerificationSchema.properties.checks.items.properties.recipe,enum:recipes.map(r=>r.name)}}}}}}]}}}}:definition;
+  this.house.registry.add({...selected,...(this.pageRegistry&&definition.name==='GitIntegrationApply'?{effects:{workspace:'unknown',external:'unknown',process:'unknown',authority:'none'},description:definition.description+' Page checks require a fresh original read-only ChromeTest before CAS and authorized owned-resource cleanup afterward; native leaf authority is judged separately.'}:{}),...(this.pageRegistry&&definition.name==='GitIntegrationVerify'?{description:definition.description+' With a registered page check, runs the pre-reserved original ChromePublish/ChromeTest case chain instead of Bash; the named trusted host recipe and original/current native authority govern every child.'}:{}),revision:GIT_INTEGRATION_MECHANISM,run:(input,options)=>this.execute(definition.name,input,options)});
+ }return this;}
+ async book(options){const book=await this.store.load(options.sessionId);if(!book.journalAudit.verified||book.cwd!==await realpath(this.cwd)||!options.actor?.id)throw fail('A verified native caller session/actor is required.');return book;}
+ intent(book,row){if(row?.type!=='git_integration_intent'||row.source!==source||row.mechanism!==GIT_INTEGRATION_MECHANISM||row.session_id!==book.id||row.cwd!==book.cwd||row.input_digest!==digest(row.input)||row.binding_digest!==digest(row.binding)||row.owner_digest!==digest(row.binding.owner)||row.binding.owner.session_id!==book.id)throw fail('The original integration intent does not verify.');return row;}
+ async preparation(options,integrationId){const book=await this.book(options),matches=book.rows.filter(row=>row.type==='git_integration_intent'&&row.operation==='GitIntegrationPrepare'&&row.binding?.resolved.integration_id===integrationId&&row.owner_digest===digest(boundOwner(options)));if(matches.length!==1)throw fail('No original integration intent belongs to this actor/session.','GIT_INTEGRATION_NOT_FOUND');return this.intent(book,matches[0]);}
+ async lineage(options,intent){return integrationLineage((await this.book(options)).rows,intent);}
+ key(name,input){return name==='GitIntegrationPrepare'?name+':'+input.request_id:name+':'+input.integration_id+':'+(input.attempt_id||(name==='GitIntegrationVerify'?'declared-checks':'apply'));}
+ async prepareCommand(name,input,options){
+  return this.store.workTransaction(options.sessionId,async()=>{
+   const book=await this.book(options),owner=boundOwner(options),key=this.key(name,input),prior=book.rows.find(row=>row.type==='git_integration_intent'&&row.command_key===key&&row.owner_digest===digest(owner));let intent;
+   if(prior){intent=this.intent(book,prior);if(prior.operation!==name||prior.input_digest!==digest(input))throw fail('This command identity already names another intent. Use a new request/attempt ID.','GIT_REQUEST_CONFLICT');}
+   else{
+    let resolved;
+    if(name==='GitIntegrationPrepare'&&input.revision_of){
+     if(input.run_ids.length!==1)throw fail('A successor requires exactly one native revision editor.','GIT_REVISION_BINDING');
+     const original=await this.preparation(options,input.revision_of),chain=await this.lineage(options,original);if(chain.length>=32)throw fail('The bounded native revision lineage is full. No new candidate was dispatched.','GIT_REVISION_LIMIT');await this.frame(options,chain);
+     const previous=original.binding.resolved.kernel_input;
+     if(input.target!==previous.target||digest(input.verification)!==digest(previous.verification))throw fail('A successor cannot replace its original target or declared checks.','GIT_REVISION_CONTRACT');
+     const run=await this.subagents.resolve({run_id:input.run_ids[0]},options.sessionId);
+     if(run.status!=='completed'||!run.result_ref||run.task.git_revision!==input.revision_of)throw fail('The selected run is not a completed revision of this original integration.','GIT_REVISION_BINDING');
+     await this.subagents.gitWorkspaces.validate(run,book);
+     const source=run.workspace.revision_source,kernel=new GitWorkspaces({cwd:this.cwd});await kernel.validateRevisionSource(source,{owner,signal:options.signal});
+     const child=await this.subagents.childEvidence(run.session_id,book),published=this.subagents.gitWorkspaces.sourceOffer(run,child,run.result_ref);if(!published)throw fail('The selected correction has no native source offer.','GIT_SOURCE_OFFER_REQUIRED');
+     const offer={workspace_id:published.workspace_id,offer_id:published.offer_id},integration_id=gitWorkspaceResourceId(this.cwd,owner,{kind:'integration',request_id:input.request_id});
+     resolved={integration_id,kernel_input:{request_id:input.request_id,target:previous.target,expected_target:previous.expected_target,base_commit:previous.base_commit,offers:[offer,...source.remaining_offers],verification:previous.verification},revision:{origin:{row:book.rows.findIndex(r=>r.audit.sha256===original.audit.sha256),digest:original.audit.sha256,binding_digest:original.binding_digest},source,offer,run_id:run.run_id},...(original.binding.resolved.page_recipes?{page_recipes:original.binding.resolved.page_recipes}: {})};
+    }else if(name==='GitIntegrationPrepare'){
+     const kernel=new GitWorkspaces({cwd:this.cwd});await kernel.validateIntegrationTarget(input.target,options.signal);const observed=await inspectGitSource({cwd:this.cwd,signal:options.signal});await kernel.initialize();
+     const expected=await kernel.rootRef('refs/comal/integrations/'+input.target,options.signal),base=expected||observed.head;if(!base)throw fail('Integration needs an existing base commit. Commit the initial project before combining source.','GIT_BASE_REQUIRED');
+     const offers=[];for(const runId of input.run_ids){const run=await this.subagents.resolve({run_id:runId},options.sessionId);if(run.task.git_revision)throw fail('A revision offer requires the original-contract successor port; ordinary preparation cannot refresh its target/checks.','GIT_REVISION_SUCCESSOR_REQUIRED');const child=await this.subagents.childEvidence(run.session_id,book);if(run.status!=='completed'||!run.workspace||!run.result_ref)throw fail('Every selected run must have a completed native Git source result.','GIT_SOURCE_OFFER_REQUIRED');const offer=this.subagents.gitWorkspaces.sourceOffer(run,child,run.result_ref);if(!offer)throw fail('The selected result has no native source offer.','GIT_SOURCE_OFFER_REQUIRED');offers.push({workspace_id:offer.workspace_id,offer_id:offer.offer_id});}
+     const integration_id=gitWorkspaceResourceId(this.cwd,owner,{kind:'integration',request_id:input.request_id});resolved={integration_id,kernel_input:{request_id:input.request_id,target:input.target,expected_target:expected||'absent',base_commit:base,offers,verification:kernel.verificationContract(input.verification)}};
+     if(isPageVerification(input.verification)){if(!this.pageRegistry)throw fail('No host page recipe registry is installed.','GIT_PAGE_RECIPE');resolved.page_recipes=this.pageRegistry.references(input.verification);}
+    }else{
+     const original=await this.preparation(options,input.integration_id);resolved={integration_id:input.integration_id,prepare_digest:original.binding_digest,attempt_id:input.attempt_id||(name==='GitIntegrationVerify'?'declared-checks':'apply')};
+    }
+    const inherited=trustedContext(book.rows),binding={owner,resolved,authority:capturePolicyCeiling(this.policy,inherited.intentions),ceiling:this.house.captureScopeCeiling(options.sessionId),inherited,goal_owner:goalOwner(book)};
+    intent=await this.store.append(book.id,{type:'git_integration_intent',source,mechanism:GIT_INTEGRATION_MECHANISM,cwd:book.cwd,session_id:book.id,actor:options.actor,owner_digest:digest(owner),command_key:key,operation:name,input:structuredClone(input),input_digest:digest(input),binding,binding_digest:digest(binding)});
+   }
+   const current=await this.store.load(book.id),existing=current.rows.filter(row=>row.type==='git_integration_command_prepared'&&row.invocation_id===options.invocation_id),marker={type:'git_integration_command_prepared',source,mechanism:GIT_INTEGRATION_MECHANISM,invocation_id:options.invocation_id,session_id:book.id,actor:options.actor,operation:name,input_digest:digest(input),intent_ref:current.rows.findIndex(row=>row.audit.sha256===intent.audit.sha256),intent_digest:intent.audit.sha256};
+   if(existing.length>1||existing.length&&digest({...existing[0],timestamp:undefined,audit:undefined})!==digest(marker))throw fail('The native command invocation already names another original intent.');
+   if(!existing.length)await this.store.append(book.id,marker);return intent;
+  });
+ }
+ async frame(options,intents){
+  if(typeof options.revalidate!=='function')throw fail('The admitted native effect frame is unavailable.');await options.revalidate();const book=await this.book(options);
+  for(const intent of intents){if(intent.owner_digest!==digest(boundOwner(options)))throw fail('Integration owner changed.');if(intent.binding.authority.denied.includes(options.command_name)||intent.binding.authority.mode==='plan'&&['GitIntegrationPrepare','GitIntegrationApply'].includes(options.command_name))throw fail('An original integration permission ceiling refuses '+options.command_name+'. A changed human scope requires a new preparation intent.','HOUSE_REFUSED');if(intent.binding.goal_owner!==goalOwner(book))throw fail('The original integration budget owner changed. No new effect was dispatched under the changed goal.','GIT_GOAL_CHANGED');}
+  const ceilings=unique(intents.map(intent=>intent.binding.ceiling));for(let i=0;i<ceilings.length;i+=2)await options.revalidate({ceilings:ceilings.slice(i,i+2)});
+ }
+ kernel(options,intents){return new GitWorkspaces({cwd:this.cwd,fault:(phase,value)=>this.fault('kernel:'+phase,value),beforeEffect:()=>this.frame(options,intents),verifierIdentity:hostCodeIdentity(this,GitIntegrationOperations),verifierFactory:context=>this.verifier(context,options,intents)});}
+ async verifier(context,options,intents){
+  const command=intents.at(-1),original=intents.findLast(i=>i.operation==='GitIntegrationPrepare');await this.frame(options,intents);const{cwd,store,session_id:sessionId,owner}=context,kernel=this.kernel(options,intents),state=await kernel.status(context.resource_id,{owner}),prepared=state.completed.find(row=>row.action==='integration_prepare')?.output;
+  if(!prepared||prepared.worktree!==cwd||context.resource_id!==original.binding.resolved.integration_id)throw fail('The native verifier belongs to another prepared source resource.');
+  const book=await store.load(sessionId);let house,authority;const merged=intents.map(i=>i.binding.ceiling).reduce((a,b)=>joinedCeiling(a,b,this.cwd,options.sessionId));
+  if(book.rows.some(row=>row.type==='house_scope_bound')){
+   let parent=this.house;
+   if(context.page&&command.operation==='GitIntegrationApply'){
+    // Host-only constraint carrier: it executes no operation and invents no
+    // parent receipt. Existing forks apply these actual original constraints
+    // to every child leaf as well as every current root constraint.
+    parent=this.house.fork({cwd:this.cwd,record:row=>this.store.append(row.session_id,row),parentSessionId:options.sessionId,sessionId:options.sessionId,ceiling:merged});
+    authority={format:'comal-git-page-authority/1',resource_id:context.resource_id,reservation_digest:digest(context.page.reservation),admission_digest:digest(context.page.admission),call_id:context.page.admission.call_id,owner_digest:digest(owner),original_scope_id:book.rows.find(r=>r.type==='house_scope_bound').scope_id,merged_ceiling:merged,captures:intents.map(i=>({operation:i.operation,intent_digest:i.audit.sha256,binding_digest:i.binding_digest,house:i.cwd,session_id:i.session_id,ceiling_digest:i.binding.ceiling.digest,authority_digest:digest(i.binding.authority)}))};
+    await store.append(sessionId,{type:'git_page_authority_bound',source:'git_page_host',authority,authority_digest:digest(authority)});
+   }
+   house=await parent.restoreFork({cwd,store,parentSessionId:options.sessionId,sessionId});
+  }
+  else{if(book.rows.some(row=>row.type==='house_proposal'))throw fail('A verifier scope cannot be invented around existing effects.');house=this.house.fork({cwd,store,record:row=>store.append(row.session_id,row),parentSessionId:options.sessionId,sessionId,ceiling:intents.map(i=>i.binding.ceiling).reduce((a,b)=>joinedCeiling(a,b,this.cwd,options.sessionId))});}
+  const check=async()=>{
+   await this.frame(options,intents);const live=await kernel.status(context.resource_id,{owner});if(live.lifecycle!=='retained')throw fail('The original integration resource was retired.','GIT_RESOURCE_RETIRED');
+   const head=(await readGit(cwd,['rev-parse','--verify','HEAD'])).stdout.toString().trim(),branch=(await readGit(cwd,['rev-parse','--symbolic-full-name','HEAD'])).stdout.toString().trim(),common=await realpath((await readGit(cwd,['rev-parse','--path-format=absolute','--git-common-dir'])).stdout.toString().trim());
+   if(head!==prepared.candidate_commit||branch!=='refs/heads/comal/work/'+context.resource_id||common!==live.spec.repository.common_directory)throw fail('The original verifier source identity changed.','GIT_VERIFICATION_SOURCE_CHANGED');
+   if(context.page){const source=await inspectGitSource({cwd,signal:context.signal});if(source.dirty||source.source_identity!==prepared.source_identity)throw fail('The original page candidate changed.','GIT_VERIFICATION_SOURCE_CHANGED');}
+   await this.frame(options,intents);return true;
+  };
+  house.guard('git-integration-source',check,{revision:GIT_INTEGRATION_MECHANISM,configuration_digest:digest({resource:context.resource_id,candidate:prepared.candidate_commit,prepare:original.binding_digest,command:command.binding_digest,...(intents.length>2?{lineage:intents.map(i=>i.binding_digest)}:{})})});
+  const policy=scopedPolicyStack({parent:this.policy,bindings:intents.map(i=>i.binding),cwd,onDecision:row=>store.append(sessionId,row)});
+  const authorize=policy.authorize.bind(policy);policy.authorize=async(name,input,authorization)=>intents.some(intent=>intent.binding.authority.denied.includes(name))?{allowed:false,reason:'The original saved integration permission ceiling denies '+name+'. Changing current rules does not replace that intent.',source:'original_integration_ceiling'}:authorize(name,input,authorization);
+  const tools=new WorkspaceTools({cwd,store,house,policy,sessionId,actor:owner.actor,onPermission:row=>store.append(sessionId,{type:'permission',...row}),frontier:check});
+  if(context.page){if(!this.pageRegistry)throw fail('The original page registry is unavailable.','GIT_PAGE_RECIPE');this.pageRegistry.assert(original.binding.resolved.page_recipes,original.input.verification);const page=await this.pageRegistry.adapter({context,tools,house,policy,...context.page});return{store,tools,session_id:sessionId,page:{...page,authority}};}
+  return{store,tools,session_id:sessionId};
+ }
+ async verificationBook(integrationId,attemptId,options){
+  const original=await this.preparation(options,integrationId),kernel=new GitWorkspaces({cwd:this.cwd});await kernel.initialize();const context=await kernel.context(integrationId),{book}=await kernel.load(context,boundOwner(options)),prepared=book.rows.find(row=>row.type==='git_action_returned'&&row.action==='integration_prepare')?.output,descriptor=book.rows.findLast(row=>row.type==='git_action_phase'&&row.action==='integration_verify'&&row.phase==='verification_session'&&(!attemptId||row.attempt===attemptId));
+  if(!prepared||!descriptor)throw fail('No native verifier session exists for this original attempt.','GIT_VERIFIER_NOT_FOUND');const native=await kernel.nativeVerificationSession(descriptor.value,prepared.worktree),audit=auditExecution(native);
+  if(!audit.journal.verified||audit.violations.length||descriptor.value.binding.owner_digest!==original.owner_digest||descriptor.value.binding.resource_id!==integrationId||descriptor.value.binding.candidate_commit!==prepared.candidate_commit)throw fail('Native verifier evidence does not belong to this original source/owner.');
+  return{kernel,book,native,attempt_id:descriptor.attempt,page:isPageVerification(original.input.verification)};
+ }
+ async evidence(input,options){const{native,attempt_id,page}=await this.verificationBook(input.integration_id,input.attempt_id,options),value=page?readPageEvidence(native,input):readEvidence(native,input);if(value.next_call)value.next_call={name:'GitIntegrationEvidence',input:{...value.next_call.input,integration_id:input.integration_id,attempt_id}};if(value.next_call)delete value.next_call.input.session_id;return{...value,integration_id:input.integration_id,attempt_id};}
+ async status(input,options){
+  const book=await this.book(options),owner=boundOwner(options),intents=book.rows.filter(row=>row.type==='git_integration_intent'&&row.operation==='GitIntegrationPrepare'&&row.owner_digest===digest(owner)&&(!input.integration_id||row.binding.resolved.integration_id===input.integration_id));if(input.integration_id&&!intents.length)throw fail('No original integration belongs to this actor/session.','GIT_INTEGRATION_NOT_FOUND');
+  const integrations=[];for(const row of intents){const intent=this.intent(book,row),integrationId=intent.binding.resolved.integration_id,kernel=new GitWorkspaces({cwd:this.cwd});let state;try{state=await kernel.status(integrationId,{owner});}catch(error){if(error.code!=='ENOENT'&&error.code!=='GIT_RESOURCE_UNINITIALIZED')throw error;}
+   let conflicts=[],failedPrepare;if(state){const resource=await kernel.context(integrationId),nativeResource=await kernel.load(resource,owner);conflicts=nativeResource.book.rows.filter(row=>row.type==='git_action_phase'&&row.action==='integration_prepare'&&row.phase.startsWith('conflict:')).map(row=>row.value);failedPrepare=nativeResource.book.rows.findLast(row=>row.type==='git_action_rejected'&&row.action==='integration_prepare');}
+   const prepared=state?.completed.find(row=>row.action==='integration_prepare')?.output,applied=state?.completed.findLast(row=>row.action==='integration_apply')?.output;let nativeState,latestCheck,evidence=[];
+   if(prepared){try{nativeState=await this.verificationBook(integrationId,undefined,options);latestCheck=nativeState.book.rows.findLast(row=>['git_action_returned','git_action_rejected'].includes(row.type)&&row.action==='integration_verify'&&row.attempt===nativeState.attempt_id);evidence=nativeState.native.rows.flatMap((receipt,index)=>receipt.type==='house_receipt'||receipt.type==='house_started'&&!nativeState.native.rows.some(row=>row.type==='house_receipt'&&row.invocation_id===receipt.invocation_id)?[{operation:receipt.operation,status:receipt.status||'unsettled_not_success',read_call:{name:'GitIntegrationEvidence',input:{integration_id:integrationId,attempt_id:nativeState.attempt_id,row:index,field:receipt.type==='house_receipt'?'output':'record',expected_digest:readEvidence(nativeState.native,{row:index,field:receipt.type==='house_receipt'?'output':'record'}).digest}}}]:[]);}catch(error){if(error.code!=='GIT_VERIFIER_NOT_FOUND')throw error;}}
+   if(isPageVerification(intent.input.verification)&&nativeState)evidence=pageEvidenceReferences(nativeState.native).map(({row,field,expected_digest,...entry})=>({...entry,read_call:{name:'GitIntegrationEvidence',input:{integration_id:integrationId,attempt_id:nativeState.attempt_id,row,field,expected_digest}}}));
+   const verified=latestCheck?.type==='git_action_returned'?latestCheck.output:undefined,pending=state?.pending||[];let next;
+   if(pending.length){const p=pending[0],operation={integration_prepare:'GitIntegrationPrepare',integration_verify:'GitIntegrationVerify',integration_apply:'GitIntegrationApply'}[p.action],saved=book.rows.find(row=>row.type==='git_integration_intent'&&row.operation===operation&&row.owner_digest===intent.owner_digest&&row.binding?.resolved.integration_id===integrationId&&(operation==='GitIntegrationPrepare'||row.binding.resolved.attempt_id===p.attempt));next=saved?{name:operation,input:this.intent(book,saved).input}:null;}
+   else next=!prepared?{name:'GitIntegrationPrepare',input:intent.input}:!verified?{name:'GitIntegrationVerify',input:{integration_id:integrationId,...(latestCheck?{attempt_id:'declared-checks-'+(state.completed.filter(r=>r.action==='integration_verify').length+state.rejected.filter(r=>r.action==='integration_verify').length+1)}:{})}}:!applied?{name:'GitIntegrationApply',input:{integration_id:integrationId,...(state.rejected.some(row=>row.action==='integration_apply')?{attempt_id:'apply-'+(state.rejected.filter(row=>row.action==='integration_apply').length+1)}:{})}}:null;
+   let continuation;
+   if(!prepared&&!pending.length&&state?.lifecycle!=='retired_preserved'&&failedPrepare?.code==='GIT_MERGE_CONFLICT'){
+    // A typed error alone is not correction source. Reuse the same original
+    // tree/parents/failure proof that the native revision editor requires.
+    const revision=await kernel.revisionSource(integrationId,{owner,signal:options.signal});
+    if(revision.kind!=='merge_conflict'||revision.failure_ref!==failedPrepare.audit.sha256)throw fail('The original merge correction no longer matches its native conflict.','GIT_REVISION_SOURCE_INVALID');
+    continuation={status:'source_correction_required',reason:'merge_conflict',original_attempt_id:failedPrepare.attempt,failure_ref:revision.failure_ref,source_ref:revision.source_ref,next_action:'Use Agent with isolation:"git", work_tracking:"parent" and git_revision:"'+integrationId+'" to resolve the original conflict, then GitIntegrationRevise. Original target, base, checks and remaining offers are retained; original/current authority is checked by those operations.',scope:'original_native_merge_conflict_not_current_acceptance_or_authority'};next=null;
+   }
+   if(isPageVerification(intent.input.verification)&&!verified&&!pending.length&&state?.lifecycle!=='retired_preserved'&&latestCheck?.type==='git_action_rejected'&&latestCheck.evidence?.scope==='native_page_needs_correction'){
+    // Use the same original reservation/Case/Behavior/receipt proof required
+    // by the revision route. A code or error message alone is not this fact.
+    const revision=await kernel.revisionSource(integrationId,{owner,signal:options.signal});
+    if(revision.failure_ref!==latestCheck.audit.sha256)throw fail('The original page correction no longer matches its native failure.','GIT_REVISION_SOURCE_INVALID');
+    continuation={status:'source_correction_required',original_attempt_id:latestCheck.attempt,receipt_id:latestCheck.evidence.invocation_id,receipt_digest:latestCheck.evidence.receipt_digest,next_action:'Use Agent with isolation:"git", work_tracking:"parent" and git_revision:"'+integrationId+'" to correct source, then GitIntegrationRevise. Original/current authority and resource state are checked by those operations.',scope:'original_failed_page_check_not_current_acceptance_or_cleanup_authority'};next=null;
+   }
+   if(state?.lifecycle==='retired_preserved'||!prepared&&state?.rejected.some(row=>row.action==='integration_prepare')||process.platform==='win32'&&!isPageVerification(intent.input.verification)&&next?.name==='GitIntegrationVerify')next=null;
+   integrations.push({integration_id:integrationId,target:intent.input.target,lifecycle:state?.lifecycle||'intent_saved',candidate:prepared?.candidate_commit||null,verification:verified?.status||(latestCheck?'failed_declared_checks':'not_passed'),applied:applied?.applied_commit||null,pending,rejected:state?.rejected||[],conflicts,verification_executor:{available:isPageVerification(intent.input.verification)||process.platform!=='win32',kind:isPageVerification(intent.input.verification)?'host_reserved_native_page':'native_posix_bash',...(process.platform==='win32'&&!isPageVerification(intent.input.verification)?{reason:'The current native Bash paths are not supported on Windows. No verification check was dispatched.'}:{})},next_call:next,...(continuation?{continuation}:{}),evidence,asked:'unjudged',scope:'native_source_and_declared_checks_not_human_acceptance'});
+  }return{integrations};
+ }
+ async execute(name,input,options){
+  options={...options,command_name:name};
+  if(name==='GitIntegrationStatus')return JSON.stringify(await this.status(input,options));
+  if(name==='GitIntegrationEvidence')return JSON.stringify(await this.evidence(input,options));
+  if(name==='GitIntegrationRevise'){
+   const original=await this.preparation(options,input.integration_id),chain=await this.lineage(options,original),k=original.binding.resolved.kernel_input;await this.frame(options,chain);
+   if(typeof options.invoke!=='function')throw fail('A revision must dispatch the admitted native Prepare operation.');
+   const prepare_input={request_id:input.request_id,target:k.target,run_ids:[input.run_id],verification:k.verification,revision_of:input.integration_id},book=await this.book(options);
+   await options.recordWork({type:'git_revision_call_prepared',source,mechanism:GIT_INTEGRATION_MECHANISM,input:structuredClone(input),input_digest:digest(input),prepare_input,origin:{row:book.rows.findIndex(r=>r.audit.sha256===original.audit.sha256),digest:original.audit.sha256,binding_digest:original.binding_digest}});
+   await this.fault('revision_call_prepared',{input,options});const result=await options.invoke('GitIntegrationPrepare',prepare_input);await this.fault('revision_child_returned',{input,result,options});await this.frame(options,chain);return result;
+  }
+  const command=await this.prepareCommand(name,input,options),original=name==='GitIntegrationPrepare'?command:await this.preparation(options,input.integration_id),chain=await this.lineage(options,original),intents=name==='GitIntegrationPrepare'?chain:[...chain,command];
+  if(isPageVerification(original.input.verification)){
+   if(!this.pageRegistry)throw fail('The original page registry is unavailable.','GIT_PAGE_RECIPE');this.pageRegistry.assert(original.binding.resolved.page_recipes,original.input.verification);
+   if(name==='GitIntegrationApply'){const probe=this.kernel(options,intents),state=await probe.status(input.integration_id,{owner:boundOwner(options)}),verified=state.completed.findLast(r=>r.action==='integration_verify');if(verified){const saved=(await this.book(options)).rows.find(r=>r.type==='git_integration_intent'&&r.operation==='GitIntegrationVerify'&&r.owner_digest===original.owner_digest&&r.binding.resolved.integration_id===input.integration_id&&r.binding.resolved.attempt_id===verified.attempt);if(!saved)throw fail('Original page verification authority is unavailable.');intents.splice(intents.length-1,0,this.intent(await this.book(options),saved));}}
+  }
+  const resolved=command.binding.resolved,release=isPageVerification(original.input.verification)?this.pageRegistry.acquire(resolved.integration_id):()=>{};let result;
+  try{
+   await this.fault('intent_saved',{command,options});await this.frame(options,intents);const kernel=this.kernel(options,intents),owner=boundOwner(options);
+   try{
+   if(name==='GitIntegrationPrepare')result=resolved.revision?await kernel.prepareRevision({request_id:resolved.kernel_input.request_id,source:resolved.revision.source,offer:resolved.revision.offer},{owner,signal:options.signal,pageRecipes:isPageVerification(original.input.verification)?this.pageRegistry.assert(resolved.page_recipes,original.input.verification):undefined}):await kernel.prepareIntegration(resolved.kernel_input,{owner,signal:options.signal,pageRecipes:isPageVerification(original.input.verification)?this.pageRegistry.assert(resolved.page_recipes,original.input.verification):undefined});
+   else if(name==='GitIntegrationVerify'){if(process.platform==='win32'&&!isPageVerification(original.input.verification))throw fail('The current native Bash verifier requires POSIX. No check was dispatched; native Windows shell verification needs its own supported port.','GIT_NATIVE_PLATFORM_UNSUPPORTED');result=await kernel.verifyIntegration(resolved.integration_id,{attempt_id:resolved.attempt_id},{owner,signal:options.signal});}
+   else{const state=await kernel.status(resolved.integration_id,{owner}),prepared=state.completed.find(row=>row.action==='integration_prepare')?.output;if(!prepared)throw fail('The original combined candidate has not settled.');result=await kernel.applyIntegration(resolved.integration_id,{attempt_id:resolved.attempt_id,expected_candidate:prepared.candidate_commit},{owner,signal:options.signal});
+    if(isPageVerification(original.input.verification)){const checked=state.completed.findLast(r=>r.action==='integration_verify');await this.pageRegistry.close(input.integration_id,checked.attempt);const proof=await this.verificationBook(input.integration_id,checked.attempt,options);if(!proof.native.rows.some(r=>r.type==='git_page_cleanup'&&r.source==='git_page_host'&&r.reservation_digest===digest(checked.output.page.reservation)&&r.owned_absent))throw fail('Applied ref is recorded, but original native cleanup has not been observed. No cleanup effect is replayed.','GIT_PAGE_CLEANUP_UNCERTAIN');}
+   }
+  }catch(error){
+   if(name==='GitIntegrationVerify'&&isPageVerification(original.input.verification)&&error.git_verification_failure)try{await this.pageRegistry.close(input.integration_id,resolved.attempt_id);}catch(cleanup){error.page_cleanup_error={code:cleanup.code||'GIT_PAGE_CLEANUP',message:cleanup.message};}
+   if(result?.applied_commit)error.git_applied_result=structuredClone(result);throw error;
+   }
+  await this.fault('kernel_returned',{command,result,options});await this.frame(options,intents);const visible=isPageVerification(original.input.verification)?publicPageResult(result):result;options.observe?.({kind:'git_integration_result',integration_id:visible.integration_id,operation:name,output_digest:digest(visible),scope:visible.scope});return JSON.stringify(visible);
+  }catch(error){throw isPageVerification(original.input.verification)?publicPageError(error):error;}finally{release();}
+ }
+}
+
+// Startup-only host entrypoint. Select this instead of default legacy Git
+// registration, after recipes/native runtime factories have been registered.
+export function installGitPageIntegration({workspace,subagents,registry,fault}){
+ if(!(workspace instanceof WorkspaceTools)||!workspace.store||!(registry?.seal instanceof Function)||!subagents)throw fail('Host page integration requires original WorkspaceTools, direct-child manager and recipe registry.','GIT_PAGE_RECIPE');
+ return new GitIntegrationOperations({cwd:workspace.cwd,store:workspace.store,house:workspace.house,policy:workspace.policy,subagents,pageRegistry:registry,...(fault?{fault}: {})}).register();
+}

package/src/git-integration-recovery-proof.mjs

@@ -0,0 +1,70 @@
+import {digest} from './operations.mjs';
+import {integrationLineage} from './git-integration-lineage.mjs';
+const mechanism='comal-git-integration-v1',source='git_integration_host',names=new Set(['GitIntegrationPrepare','GitIntegrationVerify','GitIntegrationApply','GitIntegrationRevise']);
+export function nativeGitIntegration(rows,p){const c=rows.findLast(row=>row.type==='house_contract'&&row.contract_digest===p.contract_digest)?.contract;return names.has(p.operation)&&c?.name===p.operation&&c.origin===null&&c.revision===mechanism&&c.permission===p.operation&&c.steps===['GitIntegrationVerify','GitIntegrationRevise'].includes(p.operation)&&c.description.includes(mechanism)&&c.effects.authority==='none';}
+function revisionCall(rows,p){
+ const markers=rows.filter(r=>r.type==='git_revision_call_prepared'&&r.invocation_id===p.invocation_id),children=rows.filter(r=>r.type==='house_proposal'&&r.parent_invocation_id===p.invocation_id);
+ if(!markers.length&&!children.length)return{undispatched:true};if(markers.length!==1||children.length>1)return null;
+ const marker=markers[0],origin=rows[marker.origin?.row],k=origin?.binding?.resolved?.kernel_input,input=marker.input;
+ if(marker.source!==source||marker.mechanism!==mechanism||marker.session_id!==p.session_id||digest(marker.actor)!==digest(p.actor)||marker.input_digest!==p.arguments_digest||digest(input)!==p.arguments_digest||!origin||marker.origin.row>=rows.indexOf(marker)||origin.audit.sha256!==marker.origin.digest||origin.binding_digest!==marker.origin.binding_digest||origin.owner_digest!==digest({actor:p.actor,session_id:p.session_id})||origin.binding.resolved.integration_id!==input.integration_id||digest(marker.prepare_input)!==digest({request_id:input.request_id,target:k.target,run_ids:[input.run_id],verification:k.verification,revision_of:input.integration_id}))return null;
+ const chain=integrationLineage(rows,origin),child=children[0];if(child&&(child.operation!=='GitIntegrationPrepare'||child.arguments_digest!==digest(marker.prepare_input)||!nativeGitIntegration(rows,child)||child.session_id!==p.session_id||child.house!==p.house||digest(child.actor)!==digest(p.actor)||rows.indexOf(child)<rows.indexOf(marker)))return null;
+ return{marker,origin,chain,child};
+}
+export function gitIntegrationRecoveryPlan(...args){try{return recoveryPlan(...args);}catch{return null;}}
+function recoveryPlan(rows,p,index=rows.length){
+ const prefix=rows.slice(0,index);if(!nativeGitIntegration(prefix,p))return null;
+ if(p.operation==='GitIntegrationRevise'){
+  const call=revisionCall(prefix,p);if(!call)return null;
+  if(call.child&&!prefix.some(r=>r.type==='house_receipt'&&r.invocation_id===call.child.invocation_id))return null;
+  return{kind:'git_integration_revision_call',code:'HOUSE_RECOVERY_CONTINUE',effects_observed:'original_revision_child_outcome_not_wrapper_return',error:JSON.stringify({code:'HOUSE_RECOVERY_CONTINUE',operation:p.operation,original_handler_return:'unavailable',...(call.marker?{next_calls:[{name:p.operation,input:call.marker.input}]}:{}),scope:'recorded_composition_not_current_delivery',next_action:call.undispatched?'No native child was dispatched by this wrapper; re-propose its original input under current authority.':'Re-propose the original revision call under current authority. The exact Prepare intent reconciles its original candidate; no check, file effect or ref update was replayed during recovery.',asked:'unjudged'})};
+ }
+ const markers=prefix.filter(row=>row.type==='git_integration_command_prepared'&&row.invocation_id===p.invocation_id);if(markers.length>1)return null;
+ if(!markers.length)return{kind:'git_integration_not_dispatched',code:'HOUSE_RECOVERY_NOT_DISPATCHED',effects_observed:'no_native_git_dispatch_from_this_handler',error:JSON.stringify({code:'HOUSE_RECOVERY_NOT_DISPATCHED',operation:p.operation,executed:false,scope:'this_handler_only_not_prior_attempts',next_action:'No durable command marker exists, so this handler did not dispatch Git. Re-propose its original call under current authority; do not infer that prior attempts or other handlers had no effects.',asked:'unjudged'})};
+ const marker=markers[0],intent=prefix[marker.intent_ref];
+ if(marker.source!==source||marker.mechanism!==mechanism||marker.session_id!==p.session_id||marker.operation!==p.operation||digest(marker.actor)!==digest(p.actor)||marker.input_digest!==p.arguments_digest||!Number.isSafeInteger(marker.intent_ref)||marker.intent_ref>=prefix.indexOf(marker)||intent?.type!=='git_integration_intent'||intent.source!==source||intent.mechanism!==mechanism||intent.audit?.sha256!==marker.intent_digest||intent.operation!==p.operation||intent.input_digest!==p.arguments_digest||digest(intent.input)!==p.arguments_digest||intent.binding_digest!==digest(intent.binding)||intent.owner_digest!==digest({actor:p.actor,session_id:p.session_id})||digest(intent.binding.owner)!==intent.owner_digest||intent.session_id!==p.session_id||intent.cwd!==p.house)return null;
+ const resolved=intent.binding.resolved;
+ if(p.operation==='GitIntegrationPrepare'){
+  const k=resolved?.kernel_input;if(!k||k.request_id!==intent.input.request_id||k.target!==intent.input.target||digest(k.verification)!==digest(intent.input.verification)||!Array.isArray(k.offers)||!resolved.revision&&k.offers.length!==intent.input.run_ids.length)return null;
+  integrationLineage(prefix,intent);
+ }else{
+  const original=prefix.find(row=>row.type==='git_integration_intent'&&row.source===source&&row.mechanism===mechanism&&row.operation==='GitIntegrationPrepare'&&row.owner_digest===intent.owner_digest&&row.binding?.resolved.integration_id===intent.input.integration_id);
+  if(!original||original.binding_digest!==digest(original.binding)||resolved.prepare_digest!==original.binding_digest||resolved.integration_id!==intent.input.integration_id||resolved.attempt_id!==(intent.input.attempt_id||(p.operation==='GitIntegrationVerify'?'declared-checks':'apply')))return null;
+  integrationLineage(prefix,original);
+ }
+ return{kind:'git_integration_intent',code:'HOUSE_RECOVERY_CONTINUE',effects_observed:'registered_git_intent_not_verified_delivery',error:JSON.stringify({code:'HOUSE_RECOVERY_CONTINUE',operation:p.operation,original_handler_return:'unavailable',integration_id:resolved.integration_id,next_calls:[{name:p.operation,input:intent.input}],scope:'same_original_intent_not_current_verification_or_human_acceptance',next_action:'Continue the exact call under current authority. The host retains original base, target version, offers, checks and authority. Native kernel actions reconcile their original IDs; an uncertain check is never replayed.',asked:'unjudged'})};
+}
+export function gitIntegrationRecoveryValid(rows,index,row){const p=rows[row.recovery?.proposal_ref],plan=p&&gitIntegrationRecoveryPlan(rows,p,index);return Boolean(plan&&row.recovery.kind===plan.kind&&row.recovery.plan_digest===digest(plan)&&row.status==='refused'&&row.code===plan.code&&row.effects_observed===plan.effects_observed&&row.error===plan.error&&row.observations?.length===0&&row.asked==='unjudged');}
+
+function auditConstraints(prefix,receipt,intents,fault){
+  const latestGoal=prefix.findLast(row=>row.type==='goal')?.goal,goalOwner=latestGoal?.status==='active'?latestGoal.id:null;
+  const decisions=prefix.filter(row=>row.type==='house_effect_constraint'&&row.source==='scope_host'&&row.invocation_id===receipt.invocation_id&&row.operation===receipt.operation&&row.arguments_digest===receipt.arguments_digest&&row.session_id===receipt.session_id&&row.house===receipt.house&&digest(row.actor)===digest(receipt.actor));
+  for(const prepared of intents){
+   if(prepared.binding.authority?.denied?.includes(receipt.operation)||prepared.binding.authority?.mode==='plan'&&['GitIntegrationPrepare','GitIntegrationApply'].includes(receipt.operation))fault(receipt,'git_original_permission_ceiling_refused');
+   if(prepared.binding.goal_owner!==goalOwner)fault(receipt,'git_original_goal_owner_changed');
+   const ceiling=prepared.binding.ceiling;if(!ceiling){fault(receipt,'git_original_constraint_descriptor_missing');continue;}
+   const expected=[...ceiling.guards.map(identity=>({kind:'guard',identity})),...ceiling.laws.flatMap(law=>law.plan.gates.filter(gate=>gate.tier==='enforced'&&(gate.operations.includes('*')||gate.operations.includes(receipt.operation))).map(gate=>({kind:'law',identity:{house:law.house,session_id:law.session_id,activation_id:law.activation_id,plan_hash:law.plan.plan_hash,mechanism_stamp:law.mechanism_stamp,gate_id:gate.id}})))];
+   for(const constraint of expected)if(!decisions.some(row=>row.ceiling_digest===ceiling.digest&&row.kind===constraint.kind&&digest(row.identity)===digest(constraint.identity)&&row.allowed===true))fault(receipt,'git_original_constraint_missing');
+   if(decisions.some(row=>row.ceiling_digest===ceiling.digest&&row.allowed===false))fault(receipt,'git_original_constraint_refused_before_return');
+  }
+}
+
+// Historical semantic checks only. Native source/process/ref attestation still
+// belongs to the linked kernel/verifier books, not a success flag in this book.
+export function auditGitIntegrationIntents(rows){
+ const violations=[],fault=(row,reason)=>violations.push({invocation_id:row.invocation_id,operation:row.operation,reason});
+ for(let index=0;index<rows.length;index++){
+  const receipt=rows[index];if(receipt.type!=='house_receipt'||receipt.status!=='returned'||!names.has(receipt.operation)||!nativeGitIntegration(rows.slice(0,index),receipt))continue;
+  try{
+  const prefix=rows.slice(0,index),proposal=prefix.find(row=>row.type==='house_proposal'&&row.invocation_id===receipt.invocation_id),plan=proposal&&gitIntegrationRecoveryPlan(rows,proposal,index);
+  if(receipt.operation==='GitIntegrationRevise'){
+   const call=proposal&&revisionCall(prefix,proposal),child=call?.child&&prefix.find(r=>r.type==='house_receipt'&&r.invocation_id===call.child.invocation_id);
+   if(!plan||!call?.marker||child?.status!=='returned'||child.output!==receipt.output||child.output_digest!==receipt.output_digest)fault(receipt,'git_revision_composition_binding_invalid');else auditConstraints(prefix,receipt,call.chain,fault);
+   continue;
+  }
+  if(!plan||plan.kind!=='git_integration_intent'){fault(receipt,'git_integration_intent_missing_or_invalid');continue;}
+  const marker=prefix.find(row=>row.type==='git_integration_command_prepared'&&row.invocation_id===receipt.invocation_id),intent=prefix[marker.intent_ref],original=intent.operation==='GitIntegrationPrepare'?intent:prefix.find(row=>row.type==='git_integration_intent'&&row.operation==='GitIntegrationPrepare'&&row.owner_digest===intent.owner_digest&&row.binding?.resolved.integration_id===intent.binding.resolved.integration_id),chain=integrationLineage(prefix,original),intents=intent===original?chain:[...chain,intent];
+  auditConstraints(prefix,receipt,intents,fault);
+  try{const output=JSON.parse(receipt.output),observation=receipt.observations?.find(row=>row.kind==='git_integration_result');if(output.integration_id!==original.binding.resolved.integration_id||observation?.integration_id!==output.integration_id||observation.operation!==receipt.operation||observation.output_digest!==digest(output)||observation.scope!==output.scope)fault(receipt,'git_native_result_binding_invalid');}catch{fault(receipt,'git_native_result_binding_invalid');}  }catch{fault(receipt,'git_integration_intent_malformed');}
+ }
+ return{scope:'recorded_native_intent_constraints_not_live_resource_attestation',violations};
+}

package/src/git-page-cli-bridge.mjs

@@ -0,0 +1,61 @@
+// Startup-only trusted Git page recipe and candidate runtime adapter.
+import {readFile,lstat,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {digest,immutable} from './operations.mjs';
+import {normalizeTask,savedChromeTask} from './workflows/chrome-task.mjs';
+import {savedSourceTask} from './source-task-proof.mjs';
+import {compileChromePageVerifier} from './workflows/chrome-page-verifier.mjs';
+import {GitPageRegistry} from './git-page-verification.mjs';
+import {installGitPageIntegration} from './git-integration-operations.mjs';
+import {PluginRuntime} from './plugins.mjs';
+import {House} from './house.mjs';
+import {SessionStore} from './sessions.mjs';
+import {createChromeLabPlugin} from './plugins/chrome-lab/index.mjs';
+import {ChromeLabClient} from './plugins/chrome-lab/client.mjs';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const fail=message=>Object.assign(new Error(message),{code:'GIT_PAGE_CLI_SELECTION'});
+const keys=(value,expected)=>{if(!value||typeof value!=='object'||Array.isArray(value)||Object.keys(value).sort().join()!==[...expected].sort().join())throw fail('Unsupported recipe-selection fields.');};
+async function regular(file,max=262144){const s=await lstat(file);if(!s.isFile()||s.isSymbolicLink()||s.nlink!==1||s.size>max)throw fail('Recipe inputs must be bounded regular files, without symlinks/hardlinks.');const actual=await realpath(file);if(actual!==path.resolve(file))throw fail('Recipe input path must contain no symlink.');return readFile(file);}
+export function assertGitPageCliEntry({selected,book={rows:[]},entryMode,explicitSourceTask,explicitChromeTask}){
+ const saved=book.rows.findLast(r=>r.type==='git_page_cli_recipe_selected'&&r.source==='git_page_cli_host');
+ if(!selected){if(saved)throw fail('Resume requires the same explicit trusted recipe selection.');return;}
+ if(entryMode!=='raw')throw fail('Page-recipe selection requires explicit --chrome-workflow raw.');
+ if(explicitSourceTask||explicitChromeTask||savedSourceTask(book)||savedChromeTask(book))throw fail('Page recipes cannot replace accepted or saved source/Chrome workflows.');
+}
+// One resource-owned client, installed afresh in each candidate House. Dependencies
+// are host ports for offline tests, never selection/model fields.
+export function gitPageCliRuntimeFactory({config,assertCurrent,Runtime=PluginRuntime,pluginFactory=createChromeLabPlugin,Client=ChromeLabClient}){
+ return async function candidateRuntime({cwd,resource_id,attempt_id,owner}){
+  await assertCurrent();const originalCwd=await realpath(cwd),runtimes=[],houses=new WeakSet();let client,closed=false;
+  return{async install({cwd,house,store,sessionId,signal}){
+   signal?.throwIfAborted();if(closed)throw fail('The original candidate transport is closed; no restart or effect replay.');
+   if(await realpath(cwd)!==originalCwd||houses.has(house))throw fail('Candidate runtime binding changed or was already installed.');
+   if(!(house instanceof House)||!(store instanceof SessionStore)||await realpath(house.cwd)!==originalCwd||await realpath(store.cwd)!==originalCwd)throw fail('Candidate House/store identity differs from the original workspace.');
+   const native=await store.load(sessionId),header=native.rows[0];if(!native.journalAudit.verified||header.type!=='session'||header.id!==sessionId||await realpath(header.cwd)!==originalCwd)throw fail('Original candidate session header or journal identity is invalid.');
+   await assertCurrent();const runtime=new Runtime({cwd:originalCwd,house,services:{'comal.workspace':Object.freeze({cwd:originalCwd})}});
+   runtime.register(pluginFactory({clientFactory:options=>client ||= new Client(options)}),{config});
+   try{await runtime.enable('chrome-lab');}catch(error){await runtime.close();throw error;}
+   runtimes.push(runtime);houses.add(house);
+   await store.append(sessionId,{type:'git_page_cli_native_runtime',source:'git_page_cli_host',cwd:originalCwd,resource_id,attempt_id,owner_digest:digest(owner)});
+  },async close(){closed=true;let error;for(const runtime of runtimes){try{await runtime.close();}catch(e){error ||= e;}}if(error)throw error;}};
+ };
+}
+export async function prepareGitPageCliBridge({selection,cwd,trusted=false,book={rows:[]},entryMode,explicitSourceTask,explicitChromeTask}){
+ assertGitPageCliEntry({selected:!!selection,book,entryMode,explicitSourceTask,explicitChromeTask});if(!selection)return null;
+ if(!trusted)throw fail('Explicit --trust-plugins is required for the selected host page recipe.');
+ const file=path.resolve(cwd,selection),selectionBytes=await regular(file,16384),value=JSON.parse(selectionBytes);
+ keys(value,['format','name','revision','purpose','task','verifier','fixture','chrome_config']);if(value.format!=='comal-git-page-cli-recipe/1')throw fail('Unknown startup recipe format.');
+ const captures=[{file,sha256:sha(selectionBytes)}],data={};
+ for(const name of['task','verifier','fixture','chrome_config']){keys(value[name],['path','sha256']);if(typeof value[name].path!=='string'||!value[name].path||!/^([a-f0-9]{64})$/.test(value[name].sha256))throw fail('Each selected input requires an exact path and SHA256.');const target=path.resolve(path.dirname(file),value[name].path),bytes=await regular(target);if(sha(bytes)!==value[name].sha256)throw fail('Selected '+name+' bytes changed.');captures.push({file:target,sha256:sha(bytes)});data[name]=bytes;}
+ const task=normalizeTask(JSON.parse(data.task)),config=immutable(JSON.parse(data.chrome_config));if(task.surface!=='page'||!task.verification?.cases?.length)throw fail('An explicit ordered page-case task is required.');
+ const verifier=compileChromePageVerifier(data.verifier.toString(),{trusted:true,file:captures[2].file});
+ if(task.verification.implementation_sha256!==verifier.descriptor.implementation_sha256||task.verification.contract_digest!==verifier.descriptor.contract_digest)throw fail('Selected verifier descriptor differs from the task.');
+ const assertCurrent=async()=>{for(const item of captures)if(sha(await regular(item.file))!==item.sha256)throw fail('An original selected input changed; no new native activation.');};
+ const implementation=sha(await readFile(new URL(import.meta.url))),configuration_digest=digest({captures,config,implementation}),registry=new GitPageRegistry();
+ registry.register({name:value.name,revision:value.revision,purpose:value.purpose,configuration_digest,fixture_sha256:sha(data.fixture),task,verifier,runtimeFactory:gitPageCliRuntimeFactory({config,assertCurrent})});
+ const catalog=registry.catalog(),binding=immutable({format:'comal-git-page-cli-binding/1',selection_sha256:sha(selectionBytes),configuration_digest,catalog});
+ const saved=book.rows.findLast(r=>r.type==='git_page_cli_recipe_selected'&&r.source==='git_page_cli_host');if(saved&&digest(saved.binding)!==digest(binding))throw fail('The original startup recipe binding changed.');
+ let installed=false;
+ return Object.freeze({catalog,binding,assertWorkflow({book,task,sourceTask}){assertGitPageCliEntry({selected:true,book,entryMode:'raw',explicitSourceTask:sourceTask,explicitChromeTask:task});},async install({workspace,subagents}){if(installed)throw fail('Startup recipe registration already occurred.');await assertCurrent();const operations=installGitPageIntegration({workspace,subagents,registry});installed=true;if(!saved)await workspace.store.append(typeof workspace.recoverySessionId==='function'?workspace.recoverySessionId():workspace.recoverySessionId,{type:'git_page_cli_recipe_selected',source:'git_page_cli_host',binding});return operations;},async close(){await registry.closeAll({cleanup:false});}});
+}

package/src/git-page-evidence.mjs

@@ -0,0 +1,30 @@
+// Keep trusted recipe criteria, callback contexts and source in the host audit.
+// The model sees the SAME returned coordinator result, or allowlisted metadata
+// pointing to an original failed receipt. Neither projection grants authority.
+import {digest} from './operations.mjs';
+import {readEvidence} from './work-state.mjs';
+const fail=()=>Object.assign(new Error('This page evidence row is private host implementation/history. Use an advertised public coordinator result or failure-metadata read_call.'),{code:'GIT_PAGE_PRIVATE_EVIDENCE'});
+export function readPageEvidence(native,input){
+ const row=native.rows[input.row];
+ if(row?.type==='house_receipt'&&row.operation==='ChromeTest'&&row.status==='returned'&&!row.output_truncated&&input.field==='output')return readEvidence(native,input);
+ if(row?.type!=='house_receipt'||row.status==='returned'||(input.field||'record')!=='record')throw fail();
+ const projected={type:'git_page_public_receipt',projection:'comal-git-page-public-evidence/1',operation:row.operation,invocation_id:row.invocation_id,status:row.status,error_code:row.error_code||row.code||null,effects_observed:row.effects_observed??null,original_receipt_sha256:row.audit.sha256};
+ const rows=[...native.rows];rows[input.row]=projected;return {...readEvidence({...native,rows},input),projection:'comal-git-page-public-evidence/1',original_receipt_sha256:row.audit.sha256};
+}
+export function pageEvidenceReferences(native){return native.rows.flatMap((row,index)=>{
+ const field=row.type==='house_receipt'&&row.operation==='ChromeTest'&&row.status==='returned'&&!row.output_truncated?'output':row.type==='house_receipt'&&row.status!=='returned'?'record':null;
+ if(!field)return[];return[{operation:row.operation,status:row.status,row:index,field,expected_digest:readPageEvidence(native,{row:index,field}).digest}];
+});}
+
+export function publicPageResult(result){
+ if(!result.page)return result;const {page,native_journal,...visible}=result;
+ return {...visible,receipts:result.receipts.map(({check_id,call_id,invocation_id,receipt_digest,output_digest,source_digest,task_digest,binding})=>({check_id,call_id,invocation_id,receipt_digest,output_digest,source_digest,task_digest,binding})),page:{format:'comal-git-page-result/1',recipe:{name:page.recipe.name,revision:page.recipe.revision,digest:page.recipe.digest},task_digest:page.reservation.task_digest,reservation_digest:digest(page.reservation),complete_cases:page.task.verification.cases.length,observation:page.public_result}};
+}
+export function publicPageError(error){
+ const code=typeof error.code==='string'&&/^(?:GIT_|CHROME_|HOUSE_|GOVERNANCE_|AUDIT_)[A-Z_]+$/.test(error.code)?error.code:'GIT_PAGE_HOST_FAILURE';
+ const details={code,...(error.git_verification_failure?.scope==='native_page_needs_correction'?{scope:'original_public_page_coordinator_result',observation:error.git_verification_failure.public_result,receipt_id:error.git_verification_failure.invocation_id,receipt_digest:error.git_verification_failure.receipt_digest}:{}),...(error.git_applied_result?{applied_result:publicPageResult(error.git_applied_result)}:{}),...(error.page_cleanup_error?{cleanup:{code:error.page_cleanup_error.code||'GIT_PAGE_CLEANUP_UNCERTAIN'}}:{})};
+ const message=error.git_applied_result?'The reserved ref was applied; owned cleanup has not completed.':code==='GIT_NATIVE_CHECK_FAILED'?'The original page check needs source correction through the original-contract revision route.':'Page integration did not complete. Original host audit is retained; uncertain effects are not replayed.';
+ // Generic resident error transport forwards message. Include only the same
+ // bounded public result here as well as details, without changing that transport.
+ return Object.assign(new Error(message+' '+JSON.stringify(details),{cause:error}),{code,details,...(error.git_applied_result?{git_applied_result:details.applied_result}:{})});
+}

package/src/git-page-identity.mjs

@@ -0,0 +1,10 @@
+// Identify actually installed host methods as well as their original lexical
+// class body. This is loaded-code identity, not a sandbox or closure attestation.
+import {digest} from './operations.mjs';
+export function hostCodeIdentity(instance,Type){
+ const methods=Object.keys(Object.getOwnPropertyDescriptors(Type.prototype)).sort().map(name=>{
+  const own=Object.getOwnPropertyDescriptor(instance,name),base=Object.getOwnPropertyDescriptor(Type.prototype,name),entry=own||base;
+  return [name,...['value','get','set'].map(key=>typeof entry[key]==='function'?Function.prototype.toString.call(entry[key]):null)];
+ });
+ return digest({class_body:Function.prototype.toString.call(Type),methods});
+}

package/src/git-page-proof.mjs

@@ -0,0 +1,96 @@
+// Native journal proof for pre-reserved Git page checks. Never accepts a model's
+// success flag or a retrospective source-hash match as verification.
+import {createHash} from 'node:crypto';
+import {auditExecution} from './audit.mjs';
+import {digest} from './operations.mjs';
+import {pageReceiptLaw} from './workflows/chrome-page-law.mjs';
+
+const fail=message=>Object.assign(new Error(message),{code:'GIT_PAGE_EVIDENCE'});
+export const pageCaseRevision=value=>digest({format:'comal-git-page-case/1',resource_id:value.resource_id,attempt_id:value.attempt_id,check_id:value.check_id,candidate_commit:value.candidate_commit,source_identity:value.source_identity,recipe_digest:value.recipe_digest,host_implementation:value.host_implementation,kernel_identity:value.kernel_identity});
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+export const isPageVerification=verification=>verification?.checks?.length===1&&verification.checks[0].kind==='page';
+export const pageCheckSchema={type:'object',additionalProperties:false,required:['id','kind','recipe'],properties:{id:{type:'string',pattern:'^[a-zA-Z0-9_.:-]{1,80}$'},kind:{const:'page'},recipe:{type:'string',pattern:'^[a-z][a-z0-9_-]{0,79}$'}}};
+export const pageVerificationSchema={type:'object',additionalProperties:false,required:['criterion','checks'],properties:{criterion:{type:'string',minLength:1,maxLength:4000},checks:{type:'array',minItems:1,maxItems:1,items:pageCheckSchema}}};
+export function validPageRecipes(verification,recipes){
+ if(!isPageVerification(verification))return recipes===undefined;
+ if(!Array.isArray(recipes)||recipes.length!==1||!recipes[0]||typeof recipes[0]!=='object')return false;const {digest:claimed,...body}=recipes[0];
+ return /^[a-f0-9]{64}$/.test(recipes[0].fixture_sha256||'')&&recipes[0].name===verification.checks[0].recipe&&claimed===digest(body)&&recipes[0].task?.surface==='page'&&Array.isArray(recipes[0].task.verification?.cases)&&recipes[0].task.verification.cases.length>0&&digest(recipes[0].verifier)===digest({implementation_sha256:recipes[0].task.verification.implementation_sha256,contract_digest:recipes[0].task.verification.contract_digest});
+}
+export function nativePrefix(native,count=native.rows.length){
+ const lines=native.bytes.toString('utf8').split(/(?<=\n)/);if(!Number.isSafeInteger(count)||count<1||count>native.rows.length)throw fail('Invalid native verification prefix.');
+ return {rows:count,sha256:sha(Buffer.from(lines.slice(0,count).join('')))};
+}
+export function assertNativePrefix(native,prefix){if(!prefix||digest(nativePrefix(native,prefix.rows))!==digest(prefix))throw fail('Original immutable native verification prefix changed.');}
+function receipt(native,callId,name){
+ const proposals=native.rows.filter(r=>r.type==='house_proposal'&&r.call_id===callId),p=proposals[0];
+ const rows=p&&native.rows.filter(r=>r.type==='house_receipt'&&r.invocation_id===p.invocation_id),r=rows?.[0];
+ const contract=r&&native.rows.find(c=>c.type==='house_contract'&&c.contract_digest===r.contract_digest)?.contract;
+ if(proposals.length!==1||rows?.length!==1||p.operation!==name||r.status!=='returned'||r.output_truncated||r.output_digest!==digest(r.output)||r.arguments_digest!==digest({})||contract?.origin!==null||contract.name!==name||!contract.steps)throw fail('Original returned '+name+' owner is unavailable.');
+ return {proposal:p,receipt:r,value:JSON.parse(r.output)};
+}
+export function pageReservation(native,reservation){
+ if(reservation.case_revision!==pageCaseRevision(reservation)||!/^[a-f0-9]{64}$/.test(reservation.kernel_identity||''))throw fail('Original page implementation/Case reservation changed.');
+ const matches=native.rows.filter(r=>r.type==='git_page_check_reserved');
+ if(matches.length!==1||matches[0].source!=='git_page_host'||digest(matches[0].reservation)!==digest(reservation)||matches[0].reservation_digest!==digest(reservation))throw fail('Original page-check reservation changed.');
+ return native.rows.indexOf(matches[0]);
+}
+export function assertPageChain(native,{reservation,task,sourceDigest,callId,final=false,afterRows=0,authority,knownFailure=false}){
+ const audit=auditExecution(native);
+ if(!audit.journal.verified||audit.violations.length||audit.unresolved.length)throw fail('Native page journal has invalid or unresolved effects.');
+ const accepted=native.rows.filter(r=>r.type==='chrome_task_accepted'&&r.source==='workflow_host');if(accepted.length!==1||accepted[0].task_digest!==digest(task)||digest(accepted[0].task)!==digest(task))throw fail('Original accepted page task changed.');
+ const birth=pageReservation(native,reservation),test=receipt(native,callId,'ChromeTest'),start=native.rows.indexOf(test.proposal);
+ if(start<=birth||start<afterRows||digest(native.rows[0].git_verification)!==digest(reservation.native_binding))throw fail('Page check was not born in its reserved native session.');
+ if(native.rows.slice(0,birth).some(r=>r.type==='house_proposal'&&r.operation.startsWith('plugin__chrome-lab__')))throw fail('A prior browser observation cannot be retrospectively reserved.');
+ const published=receipt(native,reservation.publish_call_id,'ChromePublish');
+ if(native.rows.indexOf(published.proposal)<=birth||native.rows.indexOf(published.receipt)>=start)throw fail('Publication was not owned before the original test.');
+ const bindings=native.rows.filter(r=>r.type==='git_page_publication_bound');
+ if(bindings.length!==1||bindings[0].source!=='git_page_host'||bindings[0].reservation_digest!==digest(reservation)||bindings[0].source_digest!==sourceDigest||native.rows.indexOf(bindings[0])>=start)throw fail('Original candidate publication binding is unavailable.');
+ const deployment=native.rows.filter(r=>r.type==='house_receipt'&&r.operation==='plugin__chrome-lab__Deploy'&&r.parent_invocation_id===published.receipt.invocation_id);
+ if(deployment.length!==1||deployment[0].status!=='returned'||deployment[0].output_truncated)throw fail('Original publication has no exact returned native Deploy.');
+ const deployed=JSON.parse(deployment[0].output),physical=bindings[0].publication;
+ if(deployed.project!==task.project||deployed.attempt_id!==physical.attempt_id||deployed.extension_id!==physical.extension_id||deployed.file_manifest_sha256!==physical.file_manifest_sha256||physical.file_manifest_sha256!==reservation.file_manifest_sha256)throw fail('Actual deployed candidate manifest changed.');
+ const value=test.value,context=value.binding;
+ if(value.status!==(knownFailure?'needs_correction':'verified')||value.scope!=='declared_page_behavior'||value.task_digest!==digest(task)||value.source_digest!==sourceDigest||!context?.identity?.context_unique_id||context.target_id!==bindings[0].binding.target_id||context.project!==task.project||context.url!==bindings[0].binding.url)throw fail('The exact page/source check did not pass.');
+ // Case start records identify their owner; its native proposal identifies the
+ // original ChromeTest parent (the record need not duplicate that parent).
+ const owned=native.rows.filter(r=>r.type==='chrome_page_case_started'&&native.rows.some(p=>p.type==='house_proposal'&&p.invocation_id===r.owner_id&&p.parent_invocation_id===test.receipt.invocation_id));
+ if(knownFailure&&(final||owned.length<1||owned.length>task.verification.cases.length))throw fail('Original semantic failure has no bounded ordered case prefix.');
+ const expected=knownFailure?task.verification.cases.slice(0,owned.length).map((id,index)=>({id,index,phase:'run'})):final?[{id:'$final',index:task.verification.cases.length,phase:'validate_final'}]:[...task.verification.cases.map((id,index)=>({id,index,phase:'run'})),{id:'$final',index:task.verification.cases.length,phase:'validate_final'}];
+ if(owned.length!==expected.length)throw fail('The original complete ordered page case chain is missing.');
+ for(const [index,entry] of owned.entries()){
+  const e=expected[index],owner=native.rows.find(r=>r.type==='house_receipt'&&r.invocation_id===entry.owner_id),p=native.rows.find(r=>r.type==='house_proposal'&&r.invocation_id===entry.owner_id);
+  const contract=native.rows.find(r=>r.type==='house_contract'&&r.contract_digest===owner?.contract_digest)?.contract;
+  if(contract?.name!=='ChromePageCase'||contract.origin!==null||contract.revision!==reservation.case_revision||digest(contract)!==owner.contract_digest||owner.contract_digest!==p?.contract_digest)throw fail('Original reserved Case implementation contract changed.');
+  const lawMarker=native.rows.find(r=>r.type==='chrome_page_effective_law_bound'&&r.invocation_id===test.proposal.invocation_id),local=lawMarker&&native.rows.find(r=>r.type==='governance_activated'&&r.plan?.plan_hash===lawMarker.local_plan_hash);
+  if(!local||local.plan.plan_hash!==accepted[0].governance_plan_hash)throw fail('Original effective page corpus is unavailable.');
+  const receiptLaw=(book,id)=>pageReceiptLaw(book,id,{cwd:native.cwd,sessionId:native.id,taskDigest:digest(task),plan:local.plan,scoped:true});
+  const ownerLaw=receiptLaw(native,entry.owner_id);
+  if(ownerLaw.plan_hash!==owner.governance_plan_hash)throw fail('Original case effective law changed.');
+  if(entry.input?.phase!==e.phase||entry.case?.id!==e.id||entry.case?.index!==e.index||p?.arguments_digest!==digest({phase:e.phase,index:e.index})||owner?.operation!=='ChromePageCase'||owner?.status!=='returned'||owner.output_truncated||owner.output_digest!==digest(owner.output))throw fail('Page case owner/order changed.');
+  const ownerValue=JSON.parse(owner.output),b=native.rows.find(r=>r.type==='house_receipt'&&r.invocation_id===ownerValue.native_receipt_id),observed=native.rows.filter(r=>r.type==='chrome_page_case_observed'&&r.owner_id===entry.owner_id);
+  if(!b||b.parent_invocation_id!==owner.invocation_id||b.operation!=='ChromePageBehavior'||b.status!=='returned'||b.output_truncated||b.output_digest!==digest(b.output)||observed.length!==1||observed[0].receipt_id!==b.invocation_id)throw fail('Original case Behavior/observation owner is missing.');
+  receiptLaw(native,b.invocation_id);
+  const output=JSON.parse(b.output);
+  if(ownerValue.status!==output.status||ownerValue.phase!==e.phase||digest(ownerValue.case)!==digest(entry.case)||output.context.case?.index!==e.index||digest(output.context.verification)!==digest(task.verification)||output.status!==(knownFailure&&index===owned.length-1?'needs_correction':'verified')||output.phase!==e.phase||output.context_digest!==digest(output.context)||output.context.task_digest!==digest(task)||output.context.source_digest!==sourceDigest||digest(output.verifier)!==digest({implementation_sha256:task.verification.implementation_sha256,contract_digest:task.verification.contract_digest})||output.context.case?.id!==e.id||!Array.isArray(output.evidence)||!output.evidence.length||new Set(output.evidence).size!==output.evidence.length)throw fail('Page Behavior source/contract/evidence changed.');
+  for(const id of output.evidence){const child=native.rows.find(r=>r.type==='house_receipt'&&r.invocation_id===id);if(!child||child.parent_invocation_id!==b.invocation_id||child.status!=='returned'||child.output_truncated||child.output_digest!==digest(child.output))throw fail('Original returned native child is unavailable.');}
+ }
+ if(knownFailure&&(value.receipt_id!==JSON.parse(native.rows.find(r=>r.type==='house_receipt'&&r.invocation_id===owned.at(-1).owner_id).output).native_receipt_id||value.case?.id!==expected.at(-1).id))throw fail('Original failed test does not identify its actual failed case.');
+ if(final){
+  const reserved=native.rows.filter(r=>r.type==='git_page_apply_reserved'&&r.admission?.call_id===callId);
+  if(reserved.length!==1||reserved[0].source!=='git_page_host'||reserved[0].admission_digest!==digest(reserved[0].admission)||reserved[0].admission.reservation_digest!==digest(reservation)||native.rows.indexOf(reserved[0])>=start)throw fail('The fresh read-only admission was not reserved before execution.');
+  const markers=native.rows.filter(r=>r.type==='git_page_authority_bound'&&r.authority?.call_id===callId),marker=markers[0];
+  if(markers.length!==1||marker.source!=='git_page_host'||marker.authority_digest!==digest(authority)||digest(marker.authority)!==digest(authority)||authority.format!=='comal-git-page-authority/1'||authority.resource_id!==reservation.resource_id||authority.reservation_digest!==digest(reservation)||authority.admission_digest!==reserved[0].admission_digest||authority.owner_digest!==reservation.owner_digest||native.rows.indexOf(marker)>=start||digest(authority.captures.map(c=>c.operation))!==digest(['GitIntegrationPrepare','GitIntegrationVerify','GitIntegrationApply'])&&(!authority.captures.some(c=>c.operation==='GitIntegrationPrepare')||authority.captures.at(-2)?.operation!=='GitIntegrationVerify'||authority.captures.at(-1)?.operation!=='GitIntegrationApply'))throw fail('Fresh Apply lacks its recorded original per-leaf authority captures.');
+  const later=native.rows.slice(afterRows).filter(r=>r.type==='house_proposal');
+  const allowed=new Set(['ChromeTest','ChromePageCase','ChromePageBehavior','plugin__chrome-lab__Targets','plugin__chrome-lab__Contexts','plugin__chrome-lab__Assert','plugin__chrome-lab__Deployment','plugin__chrome-lab__Console','plugin__chrome-lab__InspectValue']);
+  if(later.some(r=>!allowed.has(r.operation))||native.rows.slice(afterRows).some(r=>r.type==='chrome_page_case_started'&&r.input?.phase==='run'))throw fail('Apply admission performed something other than original read-only final validation.');
+ }
+ return {call_id:callId,invocation_id:test.receipt.invocation_id,receipt_digest:test.receipt.audit.sha256,output_digest:test.receipt.output_digest,source_digest:sourceDigest,binding:context,task_digest:digest(task),...(authority?{authority_digest:digest(authority)}:{}),prefix:nativePrefix(native)};
+}
+
+export function pageProofImplementation(){return digest([isPageVerification,pageCaseRevision,nativePrefix,assertNativePrefix,receipt,pageReservation,assertPageChain,validPageRecipes,fail].map(fn=>Function.prototype.toString.call(fn)));}
+export function pageRecipeReference(recipe){const body={format:'comal-git-page-recipe-reference/1',name:recipe.name,revision:recipe.revision,descriptor_digest:recipe.digest,task_digest:digest(recipe.task),verifier_digest:digest(recipe.verifier),implementation_digest:digest(recipe.implementation)};return{...body,digest:digest(body)};}
+export function validPageRecipeReferences(verification,references){
+ if(!isPageVerification(verification))return references===undefined;
+ if(!Array.isArray(references)||references.length!==1||!references[0])return false;const{digest:claimed,...body}=references[0];
+ return body.format==='comal-git-page-recipe-reference/1'&&body.name===verification.checks[0].recipe&&typeof body.revision==='string'&&Object.keys(body).length===7&&['descriptor_digest','task_digest','verifier_digest','implementation_digest'].every(key=>/^[a-f0-9]{64}$/.test(body[key]||''))&&claimed===digest(body);
+}