@nklisch/pi-enhanced 0.1.0 → 0.1.2

package/node_modules/@nklisch/pi-conveniences/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nklisch/pi-conveniences",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Small drop-in quality-of-life conveniences for Pi — /exit, .agents/AGENTS.md context loading, context-window footer, and subagent model listing.",
   "author": {
     "name": "nklisch"
@@ -44,5 +44,8 @@
     "@earendil-works/pi-ai": "0.82.0",
     "@earendil-works/pi-coding-agent": "0.82.0",
     "@earendil-works/pi-tui": "0.82.0"
-  }
+  },
+  "files": [
+    "extensions"
+  ]
 }

package/node_modules/@nklisch/pi-fff-compat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nklisch/pi-fff-compat",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Fast FFF-backed file search through Pi-native find/grep semantics — glob-only file lookup and exact regex/literal grep with no fuzzy fallback.",
   "author": {
     "name": "nklisch"
@@ -47,5 +47,8 @@
   },
   "scripts": {
     "test": "bun test extensions/*.test.ts"
-  }
+  },
+  "files": [
+    "extensions"
+  ]
 }

package/node_modules/@nklisch/pi-plugins/README.md

@@ -8,7 +8,7 @@ Native plugin management for [Pi](https://github.com/badlogic/pi-mono), with com
 - transactional install, enable, disable, update, recovery, and uninstall;
 - Agent Skills and command-hook activation;
 - receipt-qualified MCP and subagent lifecycle integration;
-- deterministic `/plugin` commands and a Pi-native interactive manager;
+- deterministic `/plugins` commands and a Pi-native interactive manager;
 - offline-safe startup, update policy, diagnostics, and multiprocess coordination.
 
 ## Requirements
@@ -22,24 +22,27 @@ Native plugin management for [Pi](https://github.com/badlogic/pi-mono), with com
 pi install npm:@nklisch/pi-plugins
 ```
 
-Then start Pi and run `/plugin`. The manager uses the same progressive list footprint as Pi settings: choose **My Plugins**, **Discover**, **Sources**, **Updates**, or **Health**, then drill into an item and its available actions. Escape returns one level. On a clean installation, open Sources and choose **Add Source**, or use:
+Then start Pi and run `/plugins`. The manager uses the same progressive list footprint as Pi settings: choose **My Plugins**, **Discover**, **Sources**, **Updates**, or **Health**, then drill into an item and its available actions. Escape returns one level. On a clean installation, open Sources and choose **Add Source**, or use:
 
 ```text
-/plugin marketplace add nklisch/skills
-/plugin add <plugin@marketplace> --scope user
+/plugins marketplace add nklisch/skills
+/plugins add <plugin@marketplace> --scope user
 ```
 
-`/plugin add` adds the complete plugin to the selected user or project plugin list, collects any required configuration and executable trust, installs and enables it, and reloads Pi when activation changes. Use `/plugin help` for the concise command surface:
+`/plugins add` adds the complete plugin to the selected user or project plugin list, collects any required configuration and executable trust, installs and enables it, and reloads Pi when activation changes. Use `/plugins help` for the concise command surface:
+
+If an installed plugin's executable content changes outside a managed update (a rebuilt local source, a refreshed payload), its exact-trust grant no longer covers it and its hooks and MCP servers stop. At the next session start Pi asks whether to trust the changed content again; accepting records the grant and one `/reload` reactivates the plugin. The same remedy is available any time as the manager's **Trust plugin** action or `/plugins trust`.
 
 ```text
-/plugin add <plugin> --scope user|project
-/plugin remove <plugin> --scope user|project --keep-data|--delete-data
-/plugin update <plugin> --scope user|project
-/plugin enable <plugin> --scope user|project
-/plugin disable <plugin> --scope user|project
-/plugin list
-/plugin doctor [plugin]
-/plugin marketplace add|list|refresh|remove ...
+/plugins add <plugin> --scope user|project
+/plugins remove <plugin> --scope user|project --keep-data|--delete-data
+/plugins update <plugin> --scope user|project
+/plugins enable <plugin> --scope user|project
+/plugins disable <plugin> --scope user|project
+/plugins trust <plugin> --scope user|project --yes
+/plugins list
+/plugins doctor [plugin]
+/plugins marketplace add|list|refresh|remove ...
 ```
 
 The older `install`, `uninstall`, and `diagnose` forms remain accepted as compatibility aliases. Workflow-phase and operation-token routes remain available to automation but are intentionally omitted from normal help and completion.

package/node_modules/@nklisch/pi-plugins/dist/application/automatic-trust-continuity.d.ts

@@ -0,0 +1,34 @@
+import type { Sha256 } from "../domain/source.js";
+import { type ScopeContext } from "../domain/state/scope.js";
+import type { GenerationMutationCoordinator } from "./generation-mutation-coordinator.js";
+import type { InstalledPluginLoader } from "./ports/installed-plugin-loader.js";
+import type { LifecycleStateStore } from "./ports/lifecycle-state-store.js";
+import type { ProjectTrustPort } from "./ports/project-trust.js";
+/**
+ * Automatic trust continuity. Enabling automatic updates is the operator's
+ * consent to acquire, validate, and activate compatible new revisions from the
+ * same trusted source, including revisions that change hook or MCP execution
+ * definitions. Exact-subject trust evaluation never infers that consent at
+ * read time, so this service records the exact grant for the selected
+ * revision itself whenever the automatic policy, an unchanged source lineage,
+ * and a granted baseline all hold. Explicit revocation of the exact subject
+ * still wins; a lineage with no granted baseline still requires interactive
+ * consent.
+ */
+export interface AutomaticTrustContinuity {
+    ensure(scope: ScopeContext, signal: AbortSignal): Promise<AutomaticTrustContinuityResult>;
+}
+export type AutomaticTrustContinuityResult = Readonly<{
+    kind: "ensured";
+    granted: readonly string[];
+}> | Readonly<{
+    kind: "unavailable";
+}>;
+export type AutomaticTrustContinuityDependencies = Readonly<{
+    state: LifecycleStateStore;
+    mutations: GenerationMutationCoordinator;
+    installed: InstalledPluginLoader;
+    projectTrust?: ProjectTrustPort;
+    sha256: Sha256;
+}>;
+export declare function createAutomaticTrustContinuity(dependencies: AutomaticTrustContinuityDependencies): AutomaticTrustContinuity;

package/node_modules/@nklisch/pi-plugins/dist/application/automatic-trust-continuity.js

@@ -0,0 +1,310 @@
+import { compareUtf8 } from "../domain/canonical-json.js";
+import { MarketplaceNameSchema } from "../domain/identity.js";
+import { createTrustCandidate, grantTrust } from "../domain/trust-policy.js";
+import { createTrustStateDocument, verifyTrustStateRecord, } from "../domain/state/trust-state.js";
+import { toScopeReference } from "../domain/state/scope.js";
+import { deriveMarketplaceSourceIdentity } from "../domain/update-policy.js";
+import { parseStateMutation } from "./state-contract.js";
+import { resolveEffectiveUpdatePolicy } from "./update-policy-resolution.js";
+function installedPlugins(snapshot) {
+    return "installed" in snapshot ? snapshot.installed.plugins : snapshot.project.plugins;
+}
+function trustRecordsOf(snapshot) {
+    return "trust" in snapshot ? snapshot.trust.records : [];
+}
+function marketplaceOf(plugin) {
+    return plugin.slice(plugin.lastIndexOf("@") + 1);
+}
+/**
+ * Load-free presence check for the selected revision's exact subject. The
+ * subject is derived from evidence whose revision-embedded fields are fully
+ * determined by the materialization binding, so a record matching plugin,
+ * scope, immutable revision, and executable surface IS the exact subject.
+ */
+function hasExactSubjectRecord(records, pluginRecord, selected, scope, sha256) {
+    for (const raw of records) {
+        let record;
+        try {
+            record = verifyTrustStateRecord(raw, sha256);
+        }
+        catch {
+            continue;
+        }
+        if (record.evidence.plugin !== pluginRecord.plugin)
+            continue;
+        if (record.evidence.scope.kind !== scope.kind ||
+            (scope.kind === "project" && (record.evidence.scope.kind !== "project" || record.evidence.scope.projectKey !== scope.projectKey)))
+            continue;
+        if (record.evidence.immutableRevision === selected.revision &&
+            record.evidence.executableSurfaceDigest === selected.evidence.trust.executableSurfaceDigest) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Lineage consent: an exact grant for another installed revision of the same
+ * plugin whose stable source identities match the selected revision. Trust
+ * evidence embeds the immutable revision in its canonical sources, so lineage
+ * is anchored on installed revision records (revision digest plus executable
+ * surface) rather than on the grant's canonical source text.
+ */
+function hasGrantedBaseline(records, pluginRecord, selected, scope, sha256) {
+    const selectedIdentity = selected.evidence.source;
+    if (selectedIdentity.marketplaceSourceIdentity === undefined || selectedIdentity.pluginSourceIdentity === undefined)
+        return false;
+    for (const raw of records) {
+        let record;
+        try {
+            record = verifyTrustStateRecord(raw, sha256);
+        }
+        catch {
+            return false;
+        }
+        if (record.status !== "granted")
+            continue;
+        if (record.evidence.plugin !== pluginRecord.plugin)
+            continue;
+        if (record.evidence.scope.kind !== scope.kind ||
+            (scope.kind === "project" && (record.evidence.scope.kind !== "project" || record.evidence.scope.projectKey !== scope.projectKey)))
+            continue;
+        const anchor = pluginRecord.revisions.find((revision) => revision.revision === record.evidence.immutableRevision &&
+            revision.evidence.trust.executableSurfaceDigest === record.evidence.executableSurfaceDigest);
+        if (anchor === undefined)
+            continue;
+        if (anchor.evidence.source.marketplaceSourceIdentity !== selectedIdentity.marketplaceSourceIdentity ||
+            anchor.evidence.source.pluginSourceIdentity !== selectedIdentity.pluginSourceIdentity)
+            continue;
+        return true;
+    }
+    return false;
+}
+function exactRecord(records, subject, sha256) {
+    for (const raw of records) {
+        try {
+            const record = verifyTrustStateRecord(raw, sha256);
+            if (record.subject === subject)
+                return record;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+class NoContinuityGrants extends Error {
+    constructor() {
+        super("locked snapshot already adjudicated every planned subject");
+        this.name = "NoContinuityGrants";
+    }
+}
+class ProjectAuthorityStale extends Error {
+    constructor() {
+        super("project authority changed between planning and commit");
+        this.name = "ProjectAuthorityStale";
+    }
+}
+export function createAutomaticTrustContinuity(dependencies) {
+    if (dependencies === null || typeof dependencies !== "object" || typeof dependencies.sha256 !== "function") {
+        throw new TypeError("automatic trust continuity dependencies are required");
+    }
+    async function projectTrusted(scope, signal) {
+        if (scope.kind === "user")
+            return true;
+        if (dependencies.projectTrust === undefined)
+            return false;
+        try {
+            return (await dependencies.projectTrust.assess(scope.projectKey, signal)).kind === "trusted";
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            return false;
+        }
+    }
+    async function planGrants(scope, snapshot, userSnapshot, signal) {
+        const policyRecords = "config" in snapshot ? snapshot.config.records : snapshot.project.marketplaceUpdates;
+        const scopedPolicy = "config" in snapshot ? snapshot.config.scope.application : snapshot.project.scope.application;
+        const globalPolicy = "config" in userSnapshot ? userSnapshot.config.global.application : undefined;
+        if (globalPolicy === undefined)
+            return undefined;
+        const records = trustRecordsOf(userSnapshot);
+        const trusted = await projectTrusted(scope, signal);
+        if (!trusted)
+            return [];
+        const planned = [];
+        for (const pluginRecord of installedPlugins(snapshot)) {
+            const plugin = pluginRecord.plugin;
+            const policyRecord = policyRecords.find((record) => record.marketplace === MarketplaceNameSchema.parse(marketplaceOf(plugin)));
+            if (policyRecord === undefined)
+                continue;
+            const selected = pluginRecord.revisions.find((revision) => revision.revision === pluginRecord.selectedRevision);
+            if (selected === undefined)
+                continue;
+            const effective = resolveEffectiveUpdatePolicy({
+                plugin,
+                record: policyRecord,
+                global: globalPolicy,
+                ...(scopedPolicy === undefined ? {} : { scope: scopedPolicy }),
+                marketplaceSourceIdentity: selected.evidence.source.marketplaceSourceIdentity ?? "legacy-unavailable",
+                registeredMarketplaceSourceIdentity: deriveMarketplaceSourceIdentity(policyRecord.source, dependencies.sha256),
+                pluginSourceIdentity: selected.evidence.source.pluginSourceIdentity ?? "legacy-unavailable",
+            });
+            if (effective.application !== "automatic" || effective.sourceGuard !== "none")
+                continue;
+            // Already-adjudicated subjects (granted or revoked) and plugins with no
+            // granted lineage never need their retained content loaded. Continuity
+            // runs every background cycle, so keep the steady state disk-free.
+            if (hasExactSubjectRecord(records, pluginRecord, selected, scope, dependencies.sha256))
+                continue;
+            if (!hasGrantedBaseline(records, pluginRecord, selected, scope, dependencies.sha256))
+                continue;
+            let loaded;
+            try {
+                loaded = await dependencies.installed.load({ scope, revision: selected }, signal);
+            }
+            catch (error) {
+                if (signal.aborted)
+                    throw signal.reason ?? error;
+                // Fail closed for this subject only; one unavailable plugin must not
+                // block continuity for every other plugin in the scope.
+                continue;
+            }
+            let candidate;
+            try {
+                candidate = createTrustCandidate({
+                    scope: toScopeReference(scope),
+                    marketplaceSource: loaded.marketplaceSource,
+                    plugin: loaded.plugin,
+                    compatibility: loaded.compatibility,
+                    content: loaded.content,
+                    materializationBinding: loaded.binding,
+                }, dependencies.sha256);
+            }
+            catch {
+                continue;
+            }
+            // The load-free checks above established absence of any exact record
+            // and the presence of a baseline; the candidate only names the subject
+            // being granted.
+            planned.push({ plugin, candidate, record: pluginRecord, selected });
+        }
+        return planned;
+    }
+    async function ensure(scope, signal) {
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            signal.throwIfAborted();
+            const loaded = await dependencies.state.read(scope, signal).catch((error) => {
+                if (signal.aborted)
+                    throw error;
+                return undefined;
+            });
+            if (loaded === undefined)
+                return { kind: "unavailable" };
+            if (!loaded.ok)
+                return { kind: "unavailable" };
+            // Trust authority is always user state, even for project-scope plugins.
+            const userLoaded = scope.kind === "user"
+                ? loaded
+                : await dependencies.state.read({ kind: "user" }, signal).catch((error) => {
+                    if (signal.aborted)
+                        throw error;
+                    return undefined;
+                });
+            if (userLoaded === undefined || !userLoaded.ok || !("trust" in userLoaded.snapshot))
+                return { kind: "unavailable" };
+            const planned = await planGrants(scope, loaded.snapshot, userLoaded.snapshot, signal);
+            if (planned === undefined)
+                return { kind: "unavailable" };
+            if (planned.length === 0)
+                return { kind: "ensured", granted: [] };
+            const outcome = await (async () => {
+                try {
+                    return { result: await dependencies.mutations.runPreparedMutation({
+                            scope: { kind: "user" },
+                            plugins: planned.map((entry) => entry.plugin),
+                            expectedGeneration: userLoaded.snapshot.generation,
+                        }, async (context) => {
+                            if (!("trust" in context.snapshot))
+                                throw new Error("trust authority is not user state");
+                            const current = context.snapshot.trust.records;
+                            const additions = [];
+                            for (const entry of planned) {
+                                // Re-adjudicate inside the locked snapshot: a concurrent grant or
+                                // revocation of the exact subject since planning wins.
+                                if (exactRecord(current, entry.candidate.subject, dependencies.sha256) !== undefined)
+                                    continue;
+                                if (!hasGrantedBaseline(current, entry.record, entry.selected, scope, dependencies.sha256))
+                                    continue;
+                                additions.push(grantTrust(entry.candidate, dependencies.sha256));
+                            }
+                            // Re-adjudication can remove every planned subject (concurrent
+                            // grant or baseline revocation). Never commit a no-op trust
+                            // replacement: churning the user generation moves authority under
+                            // foreground readers for no semantic change.
+                            if (additions.length === 0)
+                                throw new NoContinuityGrants();
+                            const records = [...current, ...additions].sort((left, right) => compareUtf8(left.subject, right.subject));
+                            const trust = createTrustStateDocument({
+                                schemaVersion: 1,
+                                generation: context.snapshot.generation,
+                                records,
+                            }, dependencies.sha256);
+                            return {
+                                mutation: parseStateMutation({
+                                    scope: { kind: "user" },
+                                    expectedGeneration: context.snapshot.generation,
+                                    replace: { trust },
+                                }, dependencies.sha256),
+                                value: additions.map((record) => record.subject),
+                                ...(scope.kind === "project" ? {
+                                    // The locked snapshot is user state; project authority (trust,
+                                    // policy, selected revision, baseline) can move underneath the
+                                    // plan from another session without advancing the user
+                                    // generation. Re-adjudicate the exact plan against fresh
+                                    // project authority immediately before commit.
+                                    beforeCommit: async () => {
+                                        if (!await projectTrusted(scope, signal))
+                                            throw new ProjectAuthorityStale();
+                                        const fresh = await dependencies.state.read(scope, signal);
+                                        if (!fresh.ok)
+                                            throw new ProjectAuthorityStale();
+                                        const replanned = await planGrants(scope, fresh.snapshot, context.snapshot, signal);
+                                        if (replanned === undefined)
+                                            throw new ProjectAuthorityStale();
+                                        const wanted = planned.map((entry) => entry.candidate.subject).sort(compareUtf8);
+                                        const current = replanned.map((entry) => entry.candidate.subject).sort(compareUtf8);
+                                        if (wanted.length !== current.length || wanted.some((subject, index) => subject !== current[index])) {
+                                            throw new ProjectAuthorityStale();
+                                        }
+                                    },
+                                } : {}),
+                            };
+                        }, signal) };
+                }
+                catch (error) {
+                    if (error instanceof NoContinuityGrants)
+                        return { noGrants: true };
+                    // The project moved between planning and commit; the retry loop
+                    // replans against fresh authority.
+                    if (error instanceof ProjectAuthorityStale)
+                        return { projectStale: true };
+                    throw error;
+                }
+            })();
+            if ("noGrants" in outcome)
+                return { kind: "ensured", granted: [] };
+            if ("projectStale" in outcome)
+                continue;
+            const result = outcome.result;
+            if (result.kind === "committed")
+                return { kind: "ensured", granted: result.value };
+            if (result.kind === "stale-generation")
+                continue;
+            return { kind: "unavailable" };
+        }
+        return { kind: "unavailable" };
+    }
+    return Object.freeze({ ensure });
+}
+//# sourceMappingURL=automatic-trust-continuity.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/automatic-trust-continuity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-trust-continuity.js","sourceRoot":"","sources":["../../src/application/automatic-trust-continuity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAkB,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAuB,MAAM,2BAA2B,CAAC;AAClG,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAqB,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAA2B,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAwC7E,SAAS,gBAAgB,CAAC,QAA4B;IACpD,OAAO,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B;IAClD,OAAO,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,OAAoC,EACpC,YAAmC,EACnC,QAAoD,EACpD,KAAmB,EACnB,MAAc;IAEd,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,SAAS;QAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YACzC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAChJ,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,CAAC,QAAQ;YACvD,MAAM,CAAC,QAAQ,CAAC,uBAAuB,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,OAAoC,EACpC,YAAmC,EACnC,QAAoD,EACpD,KAAmB,EACnB,MAAc;IAEd,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IAClD,IAAI,gBAAgB,CAAC,yBAAyB,KAAK,SAAS,IAAI,gBAAgB,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClI,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,SAAS;QAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YACzC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAChJ,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtD,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,iBAAiB;YACvD,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,KAAK,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAC/F,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,KAAK,gBAAgB,CAAC,yBAAyB;YAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,KAAK,gBAAgB,CAAC,oBAAoB;YAAE,SAAS;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAoC,EAAE,OAAe,EAAE,MAAc;IACxF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,kBAAmB,SAAQ,KAAK;IACpC;QACE,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,qBAAsB,SAAQ,KAAK;IACvC;QACE,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAAC,YAAkD;IAC/F,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,KAAmB,EAAE,MAAmB;QACpE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,KAAmB,EAAE,QAA4B,EAAE,YAAgC,EAAE,MAAmB;QAChI,MAAM,aAAa,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC3G,MAAM,YAAY,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnH,MAAM,YAAY,GAAG,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,YAAY,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YACnC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/H,IAAI,YAAY,KAAK,SAAS;gBAAE,SAAS;YACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,gBAAgB,CAAC,CAAC;YAChH,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,SAAS,GAAG,4BAA4B,CAAC;gBAC7C,MAAM;gBACN,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,YAAY;gBACpB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;gBAC9D,yBAAyB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,IAAI,oBAAoB;gBACrG,mCAAmC,EAAE,+BAA+B,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;gBAC9G,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,IAAI,oBAAoB;aAC5F,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW,IAAI,SAAS,CAAC,WAAW,KAAK,MAAM;gBAAE,SAAS;YACxF,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC;gBAAE,SAAS;YACjG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC/F,IAAI,MAA0D,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YACpF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;gBACjD,qEAAqE;gBACrE,wDAAwD;gBACxD,SAAS;YACX,CAAC;YACD,IAAI,SAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,SAAS,GAAG,oBAAoB,CAAC;oBAC/B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;oBAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,sBAAsB,EAAE,MAAM,CAAC,OAAO;iBACvC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,iBAAiB;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAmB,EAAE,MAAmB;QAC5D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACnF,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC/E,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC;oBAChC,OAAO,SAAS,CAAC;gBACnB,CAAC,CAAC,CAAC;YACP,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YACpH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChC,IAAI,CAAC;oBACH,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,mBAAmB,CACnE;4BACE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;4BACvB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;4BAC7C,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;yBACnD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;4BAChB,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;gCAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;4BACzF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;4BAC/C,MAAM,SAAS,GAAuB,EAAE,CAAC;4BACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gCAC5B,kEAAkE;gCAClE,uDAAuD;gCACvD,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,SAAS;oCAAE,SAAS;gCAC/F,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC;oCAAE,SAAS;gCACrG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;4BACnE,CAAC;4BACD,+DAA+D;4BAC/D,4DAA4D;4BAC5D,kEAAkE;4BAClE,6CAA6C;4BAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gCAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;4BAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;4BAC3G,MAAM,KAAK,GAAG,wBAAwB,CAAC;gCACrC,aAAa,EAAE,CAAC;gCAChB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;gCACvC,OAAO;6BACR,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;4BACxB,OAAO;gCACL,QAAQ,EAAE,kBAAkB,CAAC;oCAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;oCACvB,kBAAkB,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;oCAC/C,OAAO,EAAE,EAAE,KAAK,EAAE;iCACnB,EAAE,YAAY,CAAC,MAAM,CAAC;gCACvB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;gCAChD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC;oCAC7B,+DAA+D;oCAC/D,+DAA+D;oCAC/D,uDAAuD;oCACvD,yDAAyD;oCACzD,+CAA+C;oCAC/C,YAAY,EAAE,KAAK,IAAI,EAAE;wCACvB,IAAI,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;4CAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;wCAC5E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wCAC3D,IAAI,CAAC,KAAK,CAAC,EAAE;4CAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;wCACjD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wCACpF,IAAI,SAAS,KAAK,SAAS;4CAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;wCAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wCACjF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wCACpF,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;4CACpG,MAAM,IAAI,qBAAqB,EAAE,CAAC;wCACpC,CAAC;oCACH,CAAC;iCACF,CAAC,CAAC,CAAC,EAAE,CAAC;6BACR,CAAC;wBACJ,CAAC,EACG,MAAM,CACP,EAAE,CAAC;gBACN,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,kBAAkB;wBAAE,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC;oBAC5E,gEAAgE;oBAChE,mCAAmC;oBACnC,IAAI,KAAK,YAAY,qBAAqB;wBAAE,OAAO,EAAE,YAAY,EAAE,IAAa,EAAE,CAAC;oBACnF,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,IAAI,UAAU,IAAI,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACnE,IAAI,cAAc,IAAI,OAAO;gBAAE,SAAS;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACnF,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBAAE,SAAS;YACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/application/automatic-update-coordinator.d.ts

@@ -1,13 +1,13 @@
 import { type UpdateNoticeId } from "../domain/update-policy.js";
 import type { Sha256 } from "../domain/source.js";
 import { type AutomaticUpdateEligibility } from "./automatic-update-eligibility.js";
+import type { AutomaticTrustContinuity } from "./automatic-trust-continuity.js";
 import type { GenerationMutationCoordinator } from "./generation-mutation-coordinator.js";
 import { type NativeAutomaticUpdateRunRequest, type NativeAutomaticUpdateRunResult } from "./native-update-contract.js";
 import type { AutomaticUpdateLifecyclePort } from "./ports/automatic-update-lifecycle.js";
 import type { LifecycleClock } from "./ports/lifecycle-clock.js";
 import type { LifecycleStateInventoryPort } from "./ports/lifecycle-state-inventory.js";
 import type { LifecycleStateStore } from "./ports/lifecycle-state-store.js";
-import type { UpdateActivationContextPort } from "./ports/update-activation-context.js";
 import type { UpdatePolicyAuthorityPort } from "./ports/update-policy-authority.js";
 import { type CurrentScopeAuthorityDependencies } from "./current-scope-authority.js";
 export interface AutomaticUpdateCoordinator {
@@ -23,7 +23,7 @@ export type AutomaticUpdateCoordinatorDependencies = Readonly<{
     mutations: GenerationMutationCoordinator;
     policy: UpdatePolicyAuthorityPort;
     lifecycle: AutomaticUpdateLifecyclePort;
-    activation: UpdateActivationContextPort;
+    continuity: AutomaticTrustContinuity;
     clock: LifecycleClock;
     sha256: Sha256;
 }> & CurrentScopeAuthorityDependencies;

package/node_modules/@nklisch/pi-plugins/dist/application/automatic-update-coordinator.js

@@ -60,10 +60,6 @@ export function createAutomaticUpdateCoordinator(dependencies) {
                 return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "retryable", retryAt: notice.automatic.retryAt });
             }
         }
-        // Without a live reload-capable context, defer before candidate materialization
-        // or lifecycle inspection. Every authority is reread on the admitted call.
-        if (dependencies.activation.availability() !== "available")
-            return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "awaiting-host-context" });
         const authority = await dependencies.lifecycle.inspect(notice, signal);
         if (authority.source === "changed")
             return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "approval-required" });
@@ -79,8 +75,6 @@ export function createAutomaticUpdateCoordinator(dependencies) {
             return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "secret-unavailable" });
         if (authority.capability === "unavailable")
             return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "capability-unavailable" });
-        if (dependencies.activation.availability() !== "available")
-            return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "awaiting-host-context" });
         return AutomaticUpdateEligibilitySchema.parse({ noticeId, kind: "eligible" });
     }
     async function updateNotice(context, id, update, signal) {
@@ -127,7 +121,6 @@ export function createAutomaticUpdateCoordinator(dependencies) {
                 case "eligible": return notice;
                 case "manual": return UpdateNoticeSchema.parse({ ...notice, disposition: "manual-required", automatic: undefined });
                 case "approval-required": return UpdateNoticeSchema.parse({ ...notice, disposition: "approval-required", automatic: { state: "blocked", reason: "approval-required", attemptedAt } });
-                case "awaiting-host-context": return UpdateNoticeSchema.parse({ ...notice, disposition: "automatic-pending", automatic: { state: "pending", reason: "awaiting-host-context", attemptedAt } });
                 case "configuration-required": return UpdateNoticeSchema.parse({ ...notice, disposition: "configuration-blocked", automatic: { state: "blocked", reason: "configuration-required", attemptedAt } });
                 case "secret-unavailable": return UpdateNoticeSchema.parse({ ...notice, disposition: "configuration-blocked", automatic: { state: "blocked", reason: "secret-unavailable", attemptedAt } });
                 case "capability-unavailable": return UpdateNoticeSchema.parse({ ...notice, disposition: "capability-blocked", automatic: { state: "blocked", reason: "capability-unavailable", attemptedAt } });
@@ -153,6 +146,11 @@ export function createAutomaticUpdateCoordinator(dependencies) {
                 kind: result.kind === "changed" ? "applied" : "current",
                 notice: UpdateNoticeSchema.parse({ ...notice, disposition: "automatic-applied", automatic: { state: "applied", attemptedAt }, resolution: { kind: "installed", at: attemptedAt } }),
             };
+        if (result.kind === "staged")
+            return {
+                kind: "staged",
+                notice: UpdateNoticeSchema.parse({ ...notice, disposition: "automatic-applied", automatic: { state: "applied", attemptedAt }, resolution: { kind: "installed", at: attemptedAt } }),
+            };
         if (result.kind === "recovery-required")
             return {
                 kind: "recovery-required",
@@ -162,7 +160,7 @@ export function createAutomaticUpdateCoordinator(dependencies) {
         if (result.kind === "stale")
             return { kind: "stale", reason: "stale", notice: eligibilityUpdate(notice, AutomaticUpdateEligibilitySchema.parse({ noticeId: notice.id, kind: "stale" })) };
         if (result.kind === "cancelled-before-commit")
-            return { kind: "pending", reason: "cancelled-before-commit", notice: UpdateNoticeSchema.parse({ ...notice, disposition: "automatic-pending", automatic: { state: "pending", reason: "awaiting-host-context", attemptedAt } }) };
+            return { kind: "pending", reason: "cancelled-before-commit", notice: UpdateNoticeSchema.parse({ ...notice, disposition: "automatic-pending", automatic: { state: "pending", attemptedAt } }) };
         const retryAt = attemptedAt + AUTOMATIC_RETRY_BASE_MS;
         if (result.kind === "rolled-back") {
             return { kind: "retryable", reason: "rolled-back", notice: eligibilityUpdate(notice, AutomaticUpdateEligibilitySchema.parse({ noticeId: notice.id, kind: "retryable", retryAt })) };
@@ -180,6 +178,15 @@ export function createAutomaticUpdateCoordinator(dependencies) {
         for (const context of await contexts(signal)) {
             if (!await authorized(context, signal))
                 continue;
+            // Heal already-installed revisions whose exact trust grant predates an
+            // authorized automatic update. Continuity never blocks notice work.
+            try {
+                await dependencies.continuity.ensure(context, signal);
+            }
+            catch (error) {
+                if (signal.aborted)
+                    throw signal.reason ?? error;
+            }
             const loaded = await dependencies.state.read(context, signal);
             if (!loaded.ok)
                 continue;
@@ -195,27 +202,33 @@ export function createAutomaticUpdateCoordinator(dependencies) {
             const eligibility = await evaluate({ noticeId: candidate.notice.id }, signal, parsed.explicit === true);
             if (eligibility.kind !== "eligible") {
                 await updateNotice(candidate.context, candidate.notice.id, (notice) => eligibilityUpdate(notice, eligibility), signal);
-                outcomes.push({ noticeId: candidate.notice.id, kind: eligibility.kind === "awaiting-host-context" ? "pending" : eligibility.kind === "retryable" ? "retryable" : eligibility.kind === "recovery-required" ? "recovery-required" : eligibility.kind === "stale" ? "stale" : "blocked", reason: eligibility.kind });
+                outcomes.push({ noticeId: candidate.notice.id, plugin: candidate.notice.plugin, display: candidate.notice.display, kind: eligibility.kind === "retryable" ? "retryable" : eligibility.kind === "recovery-required" ? "recovery-required" : eligibility.kind === "stale" ? "stale" : "blocked", reason: eligibility.kind });
                 continue;
             }
             const latest = await locate(candidate.notice.id, signal);
             if (latest === undefined || latest.notice.resolution !== undefined) {
-                outcomes.push({ noticeId: candidate.notice.id, kind: "stale", reason: "notice-stale" });
+                outcomes.push({ noticeId: candidate.notice.id, plugin: candidate.notice.plugin, display: candidate.notice.display, kind: "stale", reason: "notice-stale" });
                 continue;
             }
-            if (dependencies.activation.availability() !== "available") {
-                const pending = AutomaticUpdateEligibilitySchema.parse({ noticeId: latest.notice.id, kind: "awaiting-host-context" });
-                await updateNotice(latest.context, latest.notice.id, (notice) => eligibilityUpdate(notice, pending), signal);
-                outcomes.push({ noticeId: latest.notice.id, kind: "pending", reason: "awaiting-host-context" });
-                continue;
+            const result = parsed.mode === "stage"
+                ? await dependencies.lifecycle.stage(latest.notice, signal)
+                : await dependencies.lifecycle.apply(latest.notice, signal);
+            if (result.kind === "changed" || result.kind === "staged") {
+                // Chain the exact trust grant for the just-committed revision within
+                // this run so its hooks and MCP servers activate without re-consent.
+                // Like ledger settlement, this local write outranks caller
+                // cancellation once the update has committed.
+                try {
+                    await dependencies.continuity.ensure(latest.context, new AbortController().signal);
+                }
+                catch { /* healed by the next scheduler cycle */ }
             }
-            const result = await dependencies.lifecycle.apply(latest.notice, signal);
             const projected = lifecycleOutcome(latest.notice, result);
             // Once lifecycle may have committed, rollback/recovery truth outranks the
             // caller's cancellation. Settle the durable ledger with fresh authority.
             const settlementSignal = new AbortController().signal;
             await updateNotice(latest.context, latest.notice.id, (notice) => lifecycleOutcome(notice, result).notice, settlementSignal);
-            outcomes.push({ noticeId: latest.notice.id, kind: projected.kind, ...(projected.reason === undefined ? {} : { reason: projected.reason }) });
+            outcomes.push({ noticeId: latest.notice.id, plugin: latest.notice.plugin, display: latest.notice.display, kind: projected.kind, ...(projected.reason === undefined ? {} : { reason: projected.reason }) });
         }
         return NativeAutomaticUpdateRunResultSchema.parse({ outcomes });
     }