@oddington/cli 0.1.35 → 0.1.37

package/README.md

@@ -147,10 +147,13 @@ step IDs when available, or `authority_unavailable` / `execution_unavailable`
 without steps. Customer-owned module augmentation supplies the property types;
 it grants no authority.
 
-Local readiness requires the mapped `routines/<routine>/run.ts` and owning
-`routines/package.json` inside this worktree, Node native TypeScript stripping,
-`"type": "module"`, a satisfied npm `engines.node` range, and an installed
-`@oddington/sdk` that resolves without import. The assessment never imports
+Local readiness requires the mapped `routines/<routine>/run.ts` inside this
+worktree. Modern routines also require their private ESM package manifest,
+the shared frozen Bun workspace lock, Bun 1.3.14, compatible Node, the exact
+root authoring SDK 0.1.17 and the selected installed runtime graph. Launch uses
+the same OS-owned executable-unit builder as deployment. Legacy routines keep
+their existing module-root, Node TypeScript stripping and SDK requirements
+until a selected manifest explicitly cuts them over. The assessment never imports
 routine code, runs package scripts, installs dependencies or accepts browser
 path/runtime overrides. Missing code still permits app launch. Availability
 is fresh assessment, not a reservation or guarantee of later execution.
@@ -402,6 +405,23 @@ builds and checks definitions, then activates only a compatible ready version;
 a failure preserves the current active version. Deployment never invokes
 business code or creates installation authority.
 
+Modern layout uses one Bun workspace and lock under `routines/`, shared authoring
+tools at its root, and a private ESM manifest per selected routine. For example,
+dependency-free Ghost still has `routines/ghost/package.json`:
+
+```json
+{ "name": "ghost", "private": true, "type": "module" }
+```
+
+Include `ghost` in the root workspace membership and keep one frozen
+`routines/bun.lock`. OS packages only Ghost's reachable source, declared assets
+and frozen runtime graph; unrelated tooling and untouched legacy routines do
+not enlarge or invalidate it. The empty graph needs no customer dependency
+installation during deployment. Supported runtime packages are frozen registry
+imports; customer scripts, build hooks, aliases and SDK replacement are refused.
+See [frozen source admission](src/routine-deployment-source.md) for the bounded
+import and dependency contract.
+
 The command reports phases, bounded diagnostics, the opaque version, source
 summary, runtime profile/features and capability names. Closing the CLI stops
 inspection while accepted OS work continues. Repeat the identical command to
@@ -541,21 +561,30 @@ with the searched version. Missing/incomplete search data fails retryably with
 provider connections retain their normal network and authority requirements;
 local execution may contact OS or providers.
 
-Local execution requires native Node TypeScript stripping, a module
-`routines/package.json`, a matching `engines.node`, and an installed SDK.
-Before inspection, OS pins reachable ESM/CommonJS modules, runtime packages,
-governing package metadata and literal `new URL` assets, up to 20,000 files /
-256 MiB. Unrelated routines, historical output, unused dependencies, caches and
-logs are excluded. Reachable symlinks, native addons, computed loaders/assets
-and unsupported exports refuse; execution never uses changing checkout code.
+For modern local execution, install the workspace separately with Bun 1.3.14.
+Keep `@oddington/sdk` exactly 0.1.17 in root `devDependencies`, compatible Node,
+the selected private ESM manifest and the shared frozen lock. OS verifies only
+the selected installed graph, stages its confined bytes and builds the same
+executable unit used by deployment, preserving declared assets and SDK ownership.
+Missing build tools, incompatible SDK, invalid metadata or stale/unavailable
+packages report unavailable before business work. Local Python dependency
+provisioning is unsupported. Launch never repairs the workspace or falls back
+from a broken modern manifest to legacy execution.
+
+Routines without a selected package manifest retain the existing legacy path:
+native Node TypeScript stripping, a module `routines/package.json`, a matching
+`engines.node`, and an installed SDK. A workspace root alone does not cut over
+other routines or `_runtime`. Both paths freeze reachable source before
+inspection, up to 20,000 files / 256 MiB. Unrelated routines, historical output,
+unused dependencies, caches and logs are excluded. Reachable symlinks, native
+addons and computed loaders/assets refuse; execution never uses changing checkout code.
 No dependency installation or package script runs. Run state is bounded to
 64 MiB; reports and redacted output each retain at most 10 MiB. Launcher ownership
 renews every 20 seconds with a 90-second lease; execution retains the existing
 15-minute capability bound.
 
 `routine prepare`, `run --local`, executable/argv selection, routine workspace,
-name and working-root flags, and publish `--run` are retired. Remote execution,
-deployment and schedules are unavailable in this release. `os run --connection`
+name and working-root flags, and publish `--run` are retired. `os run --connection`
 remains the separate ad hoc command; app children still publish immediately.
 
 `changes.delete(record)` captures the selected `$ref` and `$version`. A mixed