@mnstry/atelier 0.2.0-alpha.1 → 0.2.0-alpha.10

package/skills/claude/atelier-open/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: atelier-open
+description: Open the local Atelier preview in the current client when asked to show the portal or current page.
+---
+
 # Open the Atelier
 
 Use this skill when someone says "open the atelier", "pull up the atelier",
@@ -25,14 +30,15 @@ name (`atelier`) and use the port the harness returns. The equivalent manual
 command is:
 
 ```
-./node_modules/.bin/atelier server
+./node_modules/.bin/atelier dev
 ```
 
-Use the local binary path. Do **not** run `npx atelier` — this package is not
-yet published to npm, and the unscoped name `atelier` belongs to an unrelated
-third-party package that `npx` would download and execute.
+Use the local binary path. Do **not** run unscoped `npx atelier`: the unscoped
+name belongs to an unrelated third-party package that `npx` would download and
+execute. From outside an installed workspace, install `@mnstry/atelier` first
+and use the branded `npx mnstry-atelier` command.
 
-`atelier server` resolves its port as **argv > `PORT` env > 8137**, so a
+`atelier dev` resolves its port as **argv > `PORT` env > 8137**, so a
 supervisor can hand it a free port without a config edit.
 
 ## Do not fight for the canonical port

package/skills/claude/atelier-public-boundary/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: atelier-public-boundary
+description: Generalize a lesson from a private or tenant implementation into the public Atelier repository without carrying proprietary material across the trust boundary.
+---
+
+# Atelier public boundary
+
+Use this skill whenever a public Atelier change is informed by work in a
+private, client, tenant, or internal repository.
+
+## Extract the invariant, not the source
+
+1. State the reusable failure mode or contract without client vocabulary.
+2. Identify every source-specific name, path, port, field, content structure,
+   example, and operational fact. Keep those in the source repository.
+3. Re-derive the public mechanism against an invented fixture. Neutral wording
+   is not enough if the fixture still reproduces a proprietary structure.
+4. Keep private disclosure patterns in the ignored denylist or CI secret. Do
+   not place them in code, tests, docs, branch names, or commit messages.
+5. Add a regression test for the general control and run an evidence-backed
+   defensive review when a guard changes.
+
+## Required gates
+
+Before staging, run the repository's disclosure check. After staging, scan the
+staged index with the private denylist, then inspect the exact diff and release
+tarball. A structural-only pass is useful on an untrusted fork but is not a
+complete maintainer verdict.
+
+If the private denylist is unavailable, stop short of claiming the public
+boundary is green. Do not replace it with remembered client names.

package/skills/claude/atelier-skill-steward/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: atelier-skill-steward
+description: Audit, create, improve, reconcile, retire, or update an Atelier-backed agent skill catalog using evidence thresholds, behavioral checks, and reversible managed projections.
+---
+
+# Atelier skill steward
+
+Use this skill when a repository should maintain its agent skills as a coherent,
+self-improving catalog. Do not use it to turn a one-off preference into a skill,
+capture prompts or transcripts, or grant a skill new authority implicitly.
+
+## Route the work
+
+- Audit the current catalog with `atelier skills audit --json`.
+- Record only a content-free signal with `atelier skills observe`; use a stable
+  workflow key, enumerated signal, optional skill name, and outcome. Never put a
+  summary, prompt, source excerpt, person, client, or private method in the key.
+- Find evidence-thresholded work with `atelier skills candidates --json`.
+- Create or improve an authored skill only when the candidate evidence and the
+  current task establish a repeatable input, workflow, and success condition.
+- Update a repo-scoped deployed catalog with `atelier skills sync`. Review the
+  plan, then repeat its exact digest with `--apply --confirm`. Never manufacture
+  confirmation before inspecting blockers and actions.
+
+## Authoring boundary
+
+Keep each skill focused. Give `SKILL.md` lowercase kebab-case `name` and a
+discriminating `description`; put only decision-changing guidance in the body.
+Add scripts or references only when deterministic reuse or progressive
+disclosure justifies them. Test direct triggers, indirect triggers, incomplete
+inputs, non-triggers, and risky edge cases.
+
+In the public Atelier repository, read `AGENTS.md`, `CONTRIBUTING.md`, and
+`docs/release-engineering.md` before editing. Re-derive private lessons as
+generic invariants with invented fixtures. Keep Codex and Claude bundles
+byte-identical and run the repository disclosure and release gates required by
+those documents.
+
+## Promotion policy
+
+An instruction-only change that retains the same tools, data boundary, and
+external authority may advance after its behavioral checks and catalog audit
+pass. New scripts, tool dependencies, network access, filesystem scope,
+external messages, spending, destructive operations, credential handling, or
+audience changes require explicit human authorization immediately before that
+authority is introduced.
+
+Do not treat an audit pass as proof of behavioral quality. Compare the candidate
+against representative positive and negative requests. Reject it when it only
+memorizes one incident, broadens its trigger, weakens a refusal, or cannot name
+observable improvement.
+
+## Retirement and updates
+
+Remove obsolete skills from active discovery only after checking dependents and
+supersession. Preserve recovery through Git or the sync quarantine; never
+permanently delete a managed deployed bundle during sync. A locally drifted or
+unmanaged target is a blocker, not permission to overwrite it.
+
+The steward has no model provider, telemetry, send path, browser apply endpoint,
+or hidden source-mutation authority. Scheduling may invoke this workflow, but a
+schedule does not widen its permissions or lower its evidence gates.

package/skills/claude/mnstry-readiness/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: mnstry-readiness
+description: Prepare or review Atelier readiness outputs for a project workspace using its readiness protocols.
+---
+
 # MNSTRY Readiness
 
 Use this skill when preparing or reviewing MNSTRY Atelier readiness outputs for

package/skills/codex/atelier-guided-coauthor/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: atelier-guided-coauthor
+description: Guide an author through a selected packet in Codex, retaining private source-bound draft answers and resuming through the local Atelier coauthor CLI.
+---
+
+# Guided coauthor
+
+Use the installed `atelier coauthor` command, not a browser conversation service.
+The author chooses the packet and may read it normally without this workflow.
+
+Check the repository's instructions and local package first. Run
+`./node_modules/.bin/atelier coauthor --help` from the intended repository.
+Do not download another package if the command is unavailable. Explain that the
+installed version needs the coauthor capability and preserve ordinary packet review.
+
+## Start or resume
+
+- Require an existing Git workspace with ignored, untracked `.atelier-local/`.
+  Do not change global skills, sibling repositories, credentials or remote access.
+- Read the selected packet. Use consumer-owned field ids and workspace-relative
+  source references. Compute SHA-256 over each source file's exact UTF-8 bytes.
+  Send a `start` request containing `config: {id, fields}`; each field has
+  `id` and `source: {ref, digest}`. Packet structure stays in the consumer.
+- Requests are JSON on stdin; responses are JSON. Use an ignored request file
+  when needed, not shell interpolation of the author's text. Read the returned
+  state and revision. `read` takes `sessionId` and resumes retained history.
+- Ask one useful question at a time. Record the author's exact answer with an
+  `answer` event; events carry a unique `id`, `expectedRevision` and `type`.
+  Do not infer an answer or approval from silence.
+- If proposing edited wording, use `propose` and show the change. Wait for the
+  author's explicit confirmation before `confirm`. `reject` restores the
+  original. Even apparently stylistic rewrites need confirmation.
+- Send `save` only for the agreed draft. Say “saved as a private draft” only
+  after the command returns a saved receipt. The source packet is never edited.
+  `continueAfterSave: true` on an answer retains the author's advance intent;
+  otherwise `advance` is explicit.
+- `pause` and `resume` preserve the current phase. On restart, a `saving`
+  state may use `recover` to reconcile the pending private write. A
+  `recovery` state requires explicit `retry`, with one retry available.
+  Stop retrying when exhausted and retain all artifacts for inspection.
+
+## Boundaries
+
+Never submit store-owned receipt/failure events or fabricate persistence evidence.
+A stale source or revision is a visible conflict, not permission to overwrite it.
+Keep the old history and obtain a newly bound session for revised sources.
+Saved answers are proposals for later owner review, not publication, canonical
+acceptance, guide access, or a completed packet. No saved-answer undo is provided;
+do not erase history to simulate it. Summarize unresolved questions for the meeting.

package/skills/codex/atelier-guided-upgrade/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: atelier-guided-upgrade
+description: Prepare and explain an Atelier package upgrade in an isolated candidate, retain the owner decision, and apply only the approved effects. Use for owners asking to update an existing Atelier.
+---
+
+# Guided Atelier upgrade
+
+The default outcome is a reviewable candidate and an owner decision. Preserve the
+owner's actual request and existing scoped authority; no per-command approval
+loop is needed for actions already authorized. Preparation alone never authorizes
+changing the working installation, merging, publishing or restarting a service.
+
+## Establish the source and workspace
+
+Read the selected repository's instructions and upgrade procedure. Identify its
+actual installed scoped package, package-manager lock, Atelier lock, Git state,
+project roots, packs, overlays and running-service ownership. Resolve the package
+from that workspace (including a parent install); never use global Atelier,
+unscoped registry fallback or the first sibling checkout found on disk.
+Read `docs/guided-upgrades.md` and `docs/exact-upgrades.md` from the selected
+installed package when present. If an old install lacks this skill or commands,
+use the owner-selected new package's documentation only after verifying its
+source. Repository instructions and owner authority still govern.
+
+Select an exact release through a source already trusted by the owner. Record
+version, source commit when verified, artifact URL/integrity and the dependency
+lock. Mutable dist-tags are discovery hints, not final pins. A declaration in a
+lock or a digest supplied beside a download does not authenticate a publisher.
+An unpublished candidate must be labeled as such; use it only in an expressly
+selected rehearsal. Never invent a release or replace a pinned install with main.
+
+## Prepare without disturbing authoring
+
+Use a separate candidate with an identified base. Preserve dirty source and
+private answers; do not stash, reset, clean, stop services or commit another
+writer's edits to create eligibility. If using a snapshot of current edits,
+record and recheck its exact manifest; it is a snapshot, not an adopted commit.
+Ignored answers, browser storage and runtime credentials are not in a Git clone.
+Record that gap without importing them into a public report or projection.
+
+Stage the selected package using the owner's package manager and lock procedure,
+with lifecycle scripts disabled; investigate any required scripts before execution.
+Verify the resolved identity and inventory before running its commands. Inspect
+migration/compatibility effects before rewriting the old Atelier lock. Retain the
+old lock and all lineage. Keep installation changes distinct from generated files.
+
+Check exact-plan eligibility: Linux/macOS, one managed repository at `.`, config
+and workspace at its root, linked candidate worktree, clean state and supported
+Git settings. Packs, overlays and other unsupported participants require the
+repository's explicit operator procedure. Do not broaden graph roots, remove
+policies or disable filters/hooks to force eligibility. Never silently fall back
+to legacy `upgrade --apply`; it has different guarantees.
+
+For an eligible candidate, prepare `upgrade plan --save`, then use
+`upgrade explain --plan SAVED_PLAN_PATH` (JSON) and `--format markdown` (owner
+view). Invoke the verified installed binary with the explicit project path.
+Inspect `bindingsCurrent` and blockers even when the explanation exits zero.
+Keep source/pin/policy installation commits and the saved projection plan separate.
+For an operator procedure, retain an exact before/after file manifest and named
+commands instead; do not call it an exact-plan transaction or invent its digest.
+
+## Explain and retain consent
+
+Present the local benefit, exact target, changed files, preserved customizations,
+checks, known limits, recovery coverage and proposed effects. Show installation,
+local commit, merge, publication and activation separately. Ask one concrete
+question covering the effects that still need authority. A permission to prepare
+or a generic earlier “go” does not approve a newly introduced material effect.
+A prior explicit approval of this same current plan and effects remains valid.
+
+Retain a new decision record in ignored, untracked
+`.atelier-local/guided-upgrades/` (or a private sibling evidence directory):
+`kind: owner-decision`, report and plan/manifest SHA-256, candidate base, target
+identity, exact owner words, conversation reference, observation time, decision
+(approve/defer/decline), allowed effects, and
+`humanApprovalAuthenticated: false`, `recordedBy: agent`.
+Do not invent identity, words, references or approvals; missing provenance is a
+reported gap. This is an agent-attested record, not an authenticated signature or
+an execution grant. Keep existing records immutable. Silence conveys no consent.
+
+## Apply, validate and close
+
+After actual approval, use the saved path and exact confirmation digest literally.
+Recheck bindings; changed or expired plans require a fresh explanation and any
+newly necessary decision. A consumed plan is inspected, never replayed.
+Run the repository's documented acceptance checks and inspect the actual diff.
+Only a verified terminal transaction receipt means a candidate commit completed.
+Honor existing hooks and keep source/answer files within their ownership boundary.
+An operator procedure has its own validation evidence, not a transaction receipt.
+
+Continue authorized merge/activation steps only when included in the owner's
+scope. Report prepared, installed-in-candidate, committed, merged and running as
+separate observed states. A local preview passing is not recipient acceptance.
+On failure, preserve the candidate, backups and receipts; explain what changed
+and the next safe action. Recovery inspection does not automatically restore
+files or reset Git. Do not publish source, restart an existing service or advance
+an author's workflow phase merely because upgrade checks passed.

package/skills/codex/atelier-local-service/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: atelier-local-service
+description: Build or repair a durable loopback-only authoring, review, or preview service in an Atelier-backed repository when local state must survive agent commands and fail safely.
+---
+
+# Atelier local service
+
+Use this skill for a consumer-owned service that persists repository-backed
+local state. Do not use it to change `atelier dev` itself or to install an
+operating-system service without explicit authorization.
+
+Read `docs/local-services.md` from the installed Atelier package or source
+checkout before changing lifecycle code.
+
+## Boundary first
+
+Separate the portable mechanism from the consumer adapter before editing:
+
+- Atelier invariants: loopback binding, proven ownership, exact stop, ignored
+  mode-0600 state, atomic writes, recoverable browser failure, and tests.
+- Consumer details: service identity, port, commands, paths, schema, content,
+  and user-facing language.
+
+Never promote consumer names, content, structures, examples, or local paths
+into Atelier. Public tests use invented fixtures.
+
+## Workflow
+
+1. Inspect the existing server, process owner, port, persistence file,
+   `.gitignore`, health route, save handler, and tests. Preserve the live draft
+   before restarting anything.
+2. Expose repository-owned `start`, `status`, and `stop` commands. Start may
+   detach only because the user needs continuity beyond the launching command.
+3. Bind to loopback. Pair a random runtime identifier with the PID in both the
+   private runtime record and health response. Refuse unowned listeners.
+4. Keep drafts, runtime metadata, and operational logs ignored and owner-only.
+   Do not commit live authoring state.
+5. Make the UI retain the draft when the service disappears. Show the exact
+   restart command, snapshot export, and Retry path instead of a generic error.
+6. Serialize writes without permanently rejecting the queue after one failed
+   operation. Keep conflicts and invalid state fail-closed.
+7. Prove lifecycle ownership, server-loss recovery, later-save recovery,
+   permissions, ignore coverage, and fresh-checkout discoverability.
+
+Do not claim durability from a passing request alone. Report separately:
+saved file truth, managed-process truth, browser recovery truth, and the
+remaining OS-restart boundary.

package/skills/codex/atelier-open/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: atelier-open
+description: Open the local Atelier preview in the current client when asked to show the portal or current page.
+---
+
 # Open the Atelier
 
 Use this skill when someone says "open the atelier", "pull up the atelier",
@@ -25,14 +30,15 @@ name (`atelier`) and use the port the harness returns. The equivalent manual
 command is:
 
 ```
-./node_modules/.bin/atelier server
+./node_modules/.bin/atelier dev
 ```
 
-Use the local binary path. Do **not** run `npx atelier` — this package is not
-yet published to npm, and the unscoped name `atelier` belongs to an unrelated
-third-party package that `npx` would download and execute.
+Use the local binary path. Do **not** run unscoped `npx atelier`: the unscoped
+name belongs to an unrelated third-party package that `npx` would download and
+execute. From outside an installed workspace, install `@mnstry/atelier` first
+and use the branded `npx mnstry-atelier` command.
 
-`atelier server` resolves its port as **argv > `PORT` env > 8137**, so a
+`atelier dev` resolves its port as **argv > `PORT` env > 8137**, so a
 supervisor can hand it a free port without a config edit.
 
 ## Do not fight for the canonical port

package/skills/codex/atelier-public-boundary/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: atelier-public-boundary
+description: Generalize a lesson from a private or tenant implementation into the public Atelier repository without carrying proprietary material across the trust boundary.
+---
+
+# Atelier public boundary
+
+Use this skill whenever a public Atelier change is informed by work in a
+private, client, tenant, or internal repository.
+
+## Extract the invariant, not the source
+
+1. State the reusable failure mode or contract without client vocabulary.
+2. Identify every source-specific name, path, port, field, content structure,
+   example, and operational fact. Keep those in the source repository.
+3. Re-derive the public mechanism against an invented fixture. Neutral wording
+   is not enough if the fixture still reproduces a proprietary structure.
+4. Keep private disclosure patterns in the ignored denylist or CI secret. Do
+   not place them in code, tests, docs, branch names, or commit messages.
+5. Add a regression test for the general control and run an evidence-backed
+   defensive review when a guard changes.
+
+## Required gates
+
+Before staging, run the repository's disclosure check. After staging, scan the
+staged index with the private denylist, then inspect the exact diff and release
+tarball. A structural-only pass is useful on an untrusted fork but is not a
+complete maintainer verdict.
+
+If the private denylist is unavailable, stop short of claiming the public
+boundary is green. Do not replace it with remembered client names.

package/skills/codex/atelier-skill-steward/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: atelier-skill-steward
+description: Audit, create, improve, reconcile, retire, or update an Atelier-backed agent skill catalog using evidence thresholds, behavioral checks, and reversible managed projections.
+---
+
+# Atelier skill steward
+
+Use this skill when a repository should maintain its agent skills as a coherent,
+self-improving catalog. Do not use it to turn a one-off preference into a skill,
+capture prompts or transcripts, or grant a skill new authority implicitly.
+
+## Route the work
+
+- Audit the current catalog with `atelier skills audit --json`.
+- Record only a content-free signal with `atelier skills observe`; use a stable
+  workflow key, enumerated signal, optional skill name, and outcome. Never put a
+  summary, prompt, source excerpt, person, client, or private method in the key.
+- Find evidence-thresholded work with `atelier skills candidates --json`.
+- Create or improve an authored skill only when the candidate evidence and the
+  current task establish a repeatable input, workflow, and success condition.
+- Update a repo-scoped deployed catalog with `atelier skills sync`. Review the
+  plan, then repeat its exact digest with `--apply --confirm`. Never manufacture
+  confirmation before inspecting blockers and actions.
+
+## Authoring boundary
+
+Keep each skill focused. Give `SKILL.md` lowercase kebab-case `name` and a
+discriminating `description`; put only decision-changing guidance in the body.
+Add scripts or references only when deterministic reuse or progressive
+disclosure justifies them. Test direct triggers, indirect triggers, incomplete
+inputs, non-triggers, and risky edge cases.
+
+In the public Atelier repository, read `AGENTS.md`, `CONTRIBUTING.md`, and
+`docs/release-engineering.md` before editing. Re-derive private lessons as
+generic invariants with invented fixtures. Keep Codex and Claude bundles
+byte-identical and run the repository disclosure and release gates required by
+those documents.
+
+## Promotion policy
+
+An instruction-only change that retains the same tools, data boundary, and
+external authority may advance after its behavioral checks and catalog audit
+pass. New scripts, tool dependencies, network access, filesystem scope,
+external messages, spending, destructive operations, credential handling, or
+audience changes require explicit human authorization immediately before that
+authority is introduced.
+
+Do not treat an audit pass as proof of behavioral quality. Compare the candidate
+against representative positive and negative requests. Reject it when it only
+memorizes one incident, broadens its trigger, weakens a refusal, or cannot name
+observable improvement.
+
+## Retirement and updates
+
+Remove obsolete skills from active discovery only after checking dependents and
+supersession. Preserve recovery through Git or the sync quarantine; never
+permanently delete a managed deployed bundle during sync. A locally drifted or
+unmanaged target is a blocker, not permission to overwrite it.
+
+The steward has no model provider, telemetry, send path, browser apply endpoint,
+or hidden source-mutation authority. Scheduling may invoke this workflow, but a
+schedule does not widen its permissions or lower its evidence gates.

package/skills/codex/mnstry-readiness/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: mnstry-readiness
+description: Prepare or review Atelier readiness outputs for a project workspace using its readiness protocols.
+---
+
 # MNSTRY Readiness
 
 Use this skill when preparing or reviewing MNSTRY Atelier readiness outputs for

package/src/access/preview-enforcer.mjs

@@ -0,0 +1,84 @@
+import { parseRequest, parseBoundedJSON, need, isRef, isDigest, canonical, deepFreeze, MODES } from '../composition/wire.mjs';
+import { digestBytes } from '../composition/registry.mjs';
+
+const messages = Object.freeze({ loading: 'Checking access.', ready: 'Preview ready.', unauthenticated: 'Sign in to preview.',
+  forbidden: 'Preview is not permitted.', expired: 'Session expired.', unavailable: 'Preview unavailable.', stale: 'Preview changed. Refresh to continue.' });
+export class PreviewRefusal extends Error {
+  constructor(state) { super('Preview refused'); need(Object.hasOwn(messages, state) && !['ready', 'loading'].includes(state)); this.state = state; }
+}
+function principal(p) { need(p && isRef(p.issuer) && isRef(p.subject) && ['human', 'agent', 'service', 'local-owner'].includes(p.kind)); }
+function sessionCheck(s, now) {
+  need(s && Number.isSafeInteger(s.generation) && s.generation >= 0 && Number.isFinite(s.expiresAt));
+  for (const k of ['sessionRef', 'workspaceRef', 'audienceRef', 'policyRevision']) need(isRef(s[k]));
+  need(s.tenantRef === null || isRef(s.tenantRef));
+  // This prototype deliberately cannot admit production or implicit public access.
+  need(s.plane === 'preview');
+  if (!s.principal) throw new PreviewRefusal('unauthenticated');
+  principal(s.principal); principal(s.representedPrincipal);
+  if (s.expiresAt <= now) throw new PreviewRefusal('expired');
+}
+function checkDelegation(s, request, target, now) {
+  const d = s.delegation;
+  if (!d) {
+    need(s.principal.kind !== 'agent' && canonical(s.principal) === canonical(s.representedPrincipal)); return;
+  }
+  need(s.principal.kind === 'agent' && d.active === true && d.redelegationAllowed === false && isRef(d.ref) && isRef(d.revision));
+  need(Number.isFinite(d.expiresAt) && d.expiresAt > now && d.expiresAt <= s.expiresAt);
+  need(canonical(d.actor) === canonical(s.principal) && canonical(d.representedPrincipal) === canonical(s.representedPrincipal));
+  for (const key of ['sessionRef', 'generation', 'tenantRef', 'workspaceRef', 'audienceRef', 'plane']) need(d[key] === s[key]);
+  for (const key of ['modes', 'operationRefs', 'resourceRefs']) need(Array.isArray(d[key]) && d[key].length <= 64 && new Set(d[key]).size === d[key].length);
+  need(d.modes.every(m => MODES.includes(m)) && d.operationRefs.every(isRef) && d.resourceRefs.every(isRef));
+  if (!d.modes.includes(request.mode) || !d.operationRefs.includes(target.operationRef) || !d.resourceRefs.includes(target.resourceRef)) throw new PreviewRefusal('forbidden');
+}
+export function createPreviewEnforcer(ports, { now = Date.now } = {}) {
+  for (const key of ['authenticate', 'resolveTarget', 'authorize', 'revalidate', 'perform', 'projectResult', 'audit']) need(typeof ports?.[key] === 'function');
+  return Object.freeze({ async handle(channel, bytes, signal) {
+    let request, binding, phase = 'parse', performed = false;
+    const generation = Number.isSafeInteger(channel?.generation) && channel.generation >= 0 ? channel.generation : 0;
+    const state = (name, projectedData) => deepFreeze({ state: {
+      schema: 'atelier-preview-state/proposal-v1', requestId: request?.requestId || 'invalid', placementId: request?.placementId || 'invalid',
+      sourceDigest: request?.sourceDigest || '0'.repeat(64), mode: request?.mode || 'synthetic', state: name,
+      sessionGeneration: generation, publicMessage: messages[name],
+    }, ...(name === 'ready' ? { projectedData } : {}) });
+    const live = () => { if (signal?.aborted) throw new PreviewRefusal('stale'); if (binding && binding.expiresAt <= now()) throw new PreviewRefusal('expired'); };
+    const fresh = async () => { live(); if (await ports.revalidate(binding, signal) !== true) throw new PreviewRefusal('stale'); live(); };
+    const audit = (stage, outcome) => ports.audit(deepFreeze({ binding, phase: stage, outcome }));
+    try {
+      request = deepFreeze(parseRequest(bytes)); live(); phase = 'authenticate';
+      const s = deepFreeze(structuredClone(await ports.authenticate(channel, signal)));
+      sessionCheck(s, now()); live(); phase = 'resolve';
+      const t = deepFreeze(structuredClone(await ports.resolveTarget(s, request, signal)));
+      for (const key of ['resourceRef', 'operationRef', 'serviceRef', 'sourceRef', 'placementRef', 'registryRevision']) need(isRef(t?.[key]));
+      for (const key of ['sourceDigest', 'descriptorDigest', 'rendererDigest']) need(isDigest(t[key]));
+      need(t.sourceDigest === request.sourceDigest && t.placementRef === request.placementId);
+      checkDelegation(s, request, t, now());
+      binding = deepFreeze({ sessionRef: s.sessionRef, generation: s.generation, principal: s.principal, representedPrincipal: s.representedPrincipal,
+        delegationRef: s.delegation?.ref || null, delegationRevision: s.delegation?.revision || null,
+        tenantRef: s.tenantRef, workspaceRef: s.workspaceRef, plane: s.plane, mode: request.mode, audienceRef: s.audienceRef,
+        target: t, requestRef: request.requestId, requestDigest: digestBytes(canonical(request)), policyRevision: s.policyRevision,
+        expiresAt: Math.min(s.expiresAt, s.delegation?.expiresAt ?? Infinity) });
+      phase = 'authorize'; live(); await audit('requested', 'pending');
+      const decision = deepFreeze(structuredClone(await ports.authorize(binding, signal))); live();
+      need(canonical(decision?.binding) === canonical(binding));
+      if (decision.outcome !== 'allow') throw new PreviewRefusal(decision.outcome === 'deny' ? 'forbidden' : decision.outcome === 'reauth-required' ? 'expired' : 'unavailable');
+      await audit('authorized', 'allowed'); await fresh(); phase = 'perform'; performed = true;
+      const raw = await ports.perform(s, request, decision, signal);
+      await fresh(); phase = 'project';
+      const projected = await ports.projectResult(binding, raw, signal);
+      // Trusted projector owns the field allowlist. Root still enforces JSON,
+      // byte/depth bounds and cannot accidentally serialize result metadata.
+      const data = parseBoundedJSON(JSON.stringify(projected));
+      // Preparation is not a browser delivery acknowledgement. Keep the last
+      // asynchronous audit inside the revalidation boundary before returning.
+      await fresh(); await audit('settled', 'prepared'); await fresh();
+      return state('ready', data);
+    } catch (error) {
+      const name = error instanceof PreviewRefusal ? error.state : 'unavailable';
+      if (binding) {
+        try { await audit('settled', performed ? 'uncertain' : name === 'stale' ? 'stale' : phase === 'authorize' ? 'denied' : 'failed'); }
+        catch { /* No output or automatic effect retry if audit storage fails. */ }
+      }
+      return state(name);
+    }
+  } });
+}