@opengsd/gsd-core 1.13.0 → 1.15.0

package/gsd-core/bin/lib/broken-windows.cjs

@@ -7,7 +7,10 @@
  * When `workflow.windows_enforce` is true, `/gsd-ship` blocks while any entry is
  * `open`; an entry can be `waived` only with a recorded reason or `fixed`.
  *
- * LEAF MODULE — imports ONLY: node:fs, node:path. No other src/ imports.
+ * LEAF MODULE — imports node:fs + node:path, plus two compiled sibling lib
+ * modules require()d at runtime: workstream-inventory.cjs (the #4487
+ * milestone stamp) and capability-lock.cjs (the #3780 cross-process ledger
+ * lock). No other src/ imports.
  *
  * Storage format (`.planning/WINDOWS.md`):
  *   ---
@@ -58,12 +61,15 @@ exports.parseLedger = parseLedger;
 exports.renderLedger = renderLedger;
 exports.renderTable = renderTable;
 exports.extractTableRegion = extractTableRegion;
+exports.withLedgerLock = withLedgerLock;
 exports.cmdWindowsStatus = cmdWindowsStatus;
 exports.cmdWindowsAppend = cmdWindowsAppend;
 exports.cmdWindowsWaive = cmdWindowsWaive;
 exports.cmdWindowsMarkFixed = cmdWindowsMarkFixed;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const workstreamInventory = require("./workstream-inventory.cjs");
 // ─── Constants ─────────────────────────────────────────────────────────────
 exports.LEDGER_FILE_NAME = 'WINDOWS.md';
 exports.SCHEMA_VERSION = 1;
@@ -90,6 +96,11 @@ exports.REASON = Object.freeze({
     // sole source of truth) at the pre-write seam — refuse rather than silently
     // reconcile by overwriting the operator's hand-edit or dropping a row.
     WINDOWS_LEDGER_TABLE_DRIFT: 'windows_ledger_table_drift',
+    // #3780: the read-compute-write cycle is serialized on a cross-process
+    // ledger lock; this fires only when another writer held the lock past the
+    // whole bounded retry budget — a typed, actionable refusal instead of a
+    // silently-lost mutation reported as success.
+    WINDOWS_LEDGER_LOCK: 'windows_ledger_lock',
 });
 /** Allowed window kinds. Aligned with the issue's enumerated sources. */
 exports.KINDS = Object.freeze([
@@ -219,12 +230,14 @@ function nextId(entries) {
  * Append a window to the ledger. Assigns the next dense id (max+1), sets
  * status=open, timestamps via opts.now.
  *
- * Concurrency (issue #1950 review L2): NOT safe for concurrent writers. Two
- * parallel `gsd_run windows append` invocations both read the same snapshot,
- * both compute the same nextId, both write — the second atomic rename wins
- * and the first append (and the entry it added) is silently lost. This is
- * acceptable in the current single-executor-per-phase model; document if the
- * executor ever gains parallel wave-level append.
+ * Concurrency (issue #1950 review L2, superseded by #3780): as a PURE
+ * function this operates on whatever ledger snapshot it is passed and cannot
+ * see concurrent writers — serialization is the CALLER's job. The I/O entry
+ * points below (cmdWindowsAppend/Waive/MarkFixed) now discharge that duty by
+ * holding the cross-process ledger lock across their whole
+ * read-compute-write cycle, so the previously-documented loss (two parallel
+ * writers, second rename wins, first entry silently gone) can no longer
+ * occur through the CLI.
  */
 function appendWindow(ledger, input, opts = { now: new Date().toISOString() }) {
     validateKind(input.kind);
@@ -243,6 +256,7 @@ function appendWindow(ledger, input, opts = { now: new Date().toISOString() }) {
         reason: '',
         recorded_at: opts.now,
         resolved_at: null,
+        milestone: input.milestone ?? null,
     };
     const entries = [...ledger.entries, entry];
     const result = recomputeCounts({ ...ledger, entries, last_updated: opts.now });
@@ -475,6 +489,19 @@ function validateEntryShape(e, i) {
         reason: o.reason,
         recorded_at: recordedStr,
         resolved_at: resolvedStr,
+        // #4487: NOT in `required` above -- an entry recorded before this field
+        // existed has no `milestone` key at all, and that must parse cleanly.
+        // Preserve the absence itself -- by not materializing the property at
+        // all, via the conditional spread below, rather than assigning it
+        // `milestone: undefined` (an object literal property set to `undefined`
+        // is still an OWN property; `'milestone' in entry` reads true either
+        // way) -- so a genuinely absent key stays absent both to `in` and to
+        // JSON.stringify on re-render. Collapsing absence to an explicit null
+        // instead would stamp every legacy entry with permanent
+        // `"milestone": null` noise the moment the ledger is next touched. A
+        // genuinely-recorded-but-unresolvable milestone (set by appendWindow)
+        // is still an explicit null and round-trips as one.
+        ...('milestone' in o ? { milestone: typeof o.milestone === 'string' ? o.milestone : null } : {}),
     };
 }
 function parseLedger(raw) {
@@ -685,6 +712,78 @@ function diffTableRowIds(expectedTable, actualTable) {
 function ledgerPath(cwd) {
     return node_path_1.default.join(cwd, '.planning', exports.LEDGER_FILE_NAME);
 }
+/**
+ * The SHARED hardened cross-process lock primitive (single source of truth
+ * for capability-lifecycle + capability-consent, extracted so locks cannot
+ * diverge). Required LAZILY: capability-lock captures the process start time
+ * at module load — a `ps` subprocess on macOS, PowerShell on win32 — and
+ * this module is loaded by lock-free readers (`windows status`, the
+ * /gsd-ship gate) that must not pay that per-invocation cost (#3780
+ * review). `require` is cached, so writers pay it once per process.
+ */
+let _lockMod = null;
+function ledgerLock() {
+    if (_lockMod === null) {
+        /* eslint-disable @typescript-eslint/no-require-imports */
+        _lockMod = require('./capability-lock.cjs');
+        /* eslint-enable @typescript-eslint/no-require-imports */
+    }
+    return _lockMod;
+}
+/**
+ * Budget mirrors capability-consent's CONSENT_LOCK_MAX_ATTEMPTS: two
+ * genuinely-racing writers must SERIALIZE, not fail. The ledger's critical
+ * section is sub-millisecond and the primitive backs off ~25-50ms per
+ * attempt, so 50 attempts is orders of magnitude beyond any real contention
+ * while keeping the worst case (a holder that never releases until the
+ * primitive's own liveness/deadman protocol reclaims it) bounded at ~2s
+ * before the typed refusal below.
+ */
+const LEDGER_LOCK_MAX_ATTEMPTS = 50;
+function ledgerLockPath(cwd) {
+    return node_path_1.default.join(cwd, '.planning', '.WINDOWS.lock');
+}
+function acquireLedgerLock(cwd) {
+    return ledgerLock().acquireLock(ledgerLockPath(cwd), {
+        maxAttempts: LEDGER_LOCK_MAX_ATTEMPTS,
+        // A contended fresh/live holder is WAITED FOR (back off + retry), not
+        // failed-fast — racing wave-level executors serialize (issue #3780).
+        waitForFresh: true,
+    });
+}
+function releaseLedgerLock(handle) {
+    ledgerLock().releaseLock(handle);
+}
+/**
+ * Run `fn` (a full ledger read-compute-write cycle) while holding the
+ * cross-process ledger lock. Throws a typed WindowsError — never falls back
+ * to an unlocked mutation — when the lock cannot be acquired within the
+ * budget, mirroring capability-consent finding 3: a locked store must refuse
+ * the write rather than silently race for it. Readers (cmdWindowsStatus, the
+ * ship gate) deliberately do NOT take this lock: the atomic rename already
+ * gives them a whole-file snapshot.
+ *
+ * EXPORTED (#3780) because `withLedgerLock` is the ONE serialization seam
+ * for WINDOWS.md: every writer of the ledger — the cmd* entry points here
+ * and any sibling module with its own read-compute-write cycle on the same
+ * file (refactor-trigger-command-router's strict-window record/resolve) —
+ * must hold this lock, or the lost-update race #3780 fixed survives on that
+ * path.
+ */
+function withLedgerLock(cwd, fn) {
+    const handle = acquireLedgerLock(cwd);
+    if (!handle) {
+        throw new WindowsError(exports.REASON.WINDOWS_LEDGER_LOCK, `Another writer holds the ledger lock at ${ledgerLockPath(cwd)}; WINDOWS.md ` +
+            'mutations are serialized per project. Re-run the command once the other ' +
+            'writer finishes — the lock is reclaimed automatically if its holder died.');
+    }
+    try {
+        return fn();
+    }
+    finally {
+        releaseLedgerLock(handle);
+    }
+}
 function readLedgerOrNull(cwd) {
     const p = ledgerPath(cwd);
     let raw;
@@ -910,24 +1009,36 @@ function cmdWindowsAppend(cwd, args, opts = {}) {
         flags: ['--kind', '--phase', '--file', '--line', '--description'],
         required: ['--kind', '--phase', '--description'],
     });
-    let ledger;
-    try {
-        ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
-    }
-    catch (e) {
-        if (e instanceof WindowsError)
-            throw e;
-        throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
-    }
-    const result = appendWindow(ledger, {
-        kind: parsed.values['--kind'],
-        phase: parsed.values['--phase'] ?? '',
-        file: parsed.values['--file'] ?? '',
-        line: parsed.values['--line'] == null ? null : Number(parsed.values['--line']),
-        description: parsed.values['--description'] ?? '',
-    }, { now: nowIso() });
-    writeLedgerAtomic(cwd, result.ledger);
-    emit({ ok: true, ledger: result.ledger, entry: result.entry });
+    // #3780: the whole read-compute-write cycle — snapshot, milestone stamp,
+    // id allocation, atomic rename — holds the ledger lock, so two parallel
+    // invocations can no longer compute the same nextId from the same snapshot
+    // and silently lose the first append to the second rename.
+    withLedgerLock(cwd, () => {
+        let ledger;
+        try {
+            ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
+        }
+        catch (e) {
+            if (e instanceof WindowsError)
+                throw e;
+            throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
+        }
+        // #4487: stamp the workstream's resolved milestone at record time -- the
+        // same STATE.md-first, ROADMAP-fallback resolution workstream-inventory.cts
+        // already uses. Best-effort: an unreadable/missing STATE.md or ROADMAP.md
+        // resolves to null, same as an entry recorded before this field existed.
+        const milestone = workstreamInventory.readCurrentMilestoneVersion(node_path_1.default.join(cwd, '.planning', 'STATE.md'), node_path_1.default.join(cwd, '.planning', 'ROADMAP.md'));
+        const result = appendWindow(ledger, {
+            kind: parsed.values['--kind'],
+            phase: parsed.values['--phase'] ?? '',
+            file: parsed.values['--file'] ?? '',
+            line: parsed.values['--line'] == null ? null : Number(parsed.values['--line']),
+            description: parsed.values['--description'] ?? '',
+            milestone,
+        }, { now: nowIso() });
+        writeLedgerAtomic(cwd, result.ledger);
+        emit({ ok: true, ledger: result.ledger, entry: result.entry });
+    });
 }
 /** `gsd-tools windows waive <id> "<reason>"`. */
 function cmdWindowsWaive(cwd, args, opts = {}) {
@@ -936,36 +1047,44 @@ function cmdWindowsWaive(cwd, args, opts = {}) {
     const idStr = positionals[0];
     const reason = positionals[1];
     const id = parseIdOrThrow(idStr);
-    let ledger;
-    try {
-        ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
-    }
-    catch (e) {
-        if (e instanceof WindowsError)
-            throw e;
-        throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
-    }
-    const updated = markWaived(ledger, id, reason ?? '', { now: nowIso() });
-    writeLedgerAtomic(cwd, updated);
-    emit({ ok: true, ledger: updated });
+    // #3780: same serialization as append — a concurrent append holding a stale
+    // snapshot would otherwise overwrite the waive and resurrect the entry.
+    withLedgerLock(cwd, () => {
+        let ledger;
+        try {
+            ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
+        }
+        catch (e) {
+            if (e instanceof WindowsError)
+                throw e;
+            throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
+        }
+        const updated = markWaived(ledger, id, reason ?? '', { now: nowIso() });
+        writeLedgerAtomic(cwd, updated);
+        emit({ ok: true, ledger: updated });
+    });
 }
 /** `gsd-tools windows fixed <id>`. */
 function cmdWindowsMarkFixed(cwd, args, opts = {}) {
     void opts;
     const { positionals } = parseArgs(args, { flags: [], required: [], positionals: 1 });
     const id = parseIdOrThrow(positionals[0]);
-    let ledger;
-    try {
-        ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
-    }
-    catch (e) {
-        if (e instanceof WindowsError)
-            throw e;
-        throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
-    }
-    const updated = markFixed(ledger, id, { now: nowIso() });
-    writeLedgerAtomic(cwd, updated);
-    emit({ ok: true, ledger: updated });
+    // #3780: same serialization as append — a concurrent writer holding a
+    // stale snapshot would otherwise overwrite the resolved status.
+    withLedgerLock(cwd, () => {
+        let ledger;
+        try {
+            ledger = readLedgerOrNull(cwd) ?? emptyLedger(nowIso());
+        }
+        catch (e) {
+            if (e instanceof WindowsError)
+                throw e;
+            throw new WindowsError(exports.REASON.WINDOWS_LEDGER_MALFORMED, e.message);
+        }
+        const updated = markFixed(ledger, id, { now: nowIso() });
+        writeLedgerAtomic(cwd, updated);
+        emit({ ok: true, ledger: updated });
+    });
 }
 function parseIdOrThrow(raw) {
     if (raw == null || raw === '') {

package/gsd-core/bin/lib/capability-lifecycle.cjs

@@ -25,6 +25,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const security_cjs_1 = require("./security.cjs");
 /* eslint-disable @typescript-eslint/no-require-imports */
 const sourceMod = require('./capability-source.cjs');
 const ledgerMod = require('./capability-ledger.cjs');
@@ -202,7 +203,10 @@ function safeRmUnder(runtimeDir, rel) {
     catch {
         return false;
     }
-    if (realParent !== realRoot && !realParent.startsWith(realRoot + node_path_1.default.sep))
+    // Containment decision is the canonical LEXICAL predicate (ADR-4650 decision 6); lexical because
+    // both operands are already realpath-resolved here and the final component is deliberately
+    // handled as a link (see above).
+    if ((0, security_cjs_1.tryWithinRootLexical)(realParent, realRoot) === null)
         return false;
     const realTarget = node_path_1.default.join(realParent, node_path_1.default.basename(target));
     let st;
@@ -250,11 +254,11 @@ function confinedSharedFile(runtimeDir, relFile) {
     catch {
         // Parent does not exist yet (created inside the scope on write): a non-existent path cannot be a
         // symlink escaping the root, so a lexical containment check is sufficient.
-        if (parentDir !== realRoot && !parentDir.startsWith(realRoot + node_path_1.default.sep))
+        if ((0, security_cjs_1.tryWithinRootLexical)(parentDir, realRoot) === null)
             return null;
         return target;
     }
-    if (realParent !== realRoot && !realParent.startsWith(realRoot + node_path_1.default.sep))
+    if ((0, security_cjs_1.tryWithinRootLexical)(realParent, realRoot) === null)
         return null;
     return node_path_1.default.join(realParent, node_path_1.default.basename(target));
 }
@@ -363,7 +367,7 @@ function confinedBundleScript(capDirPath, script) {
         // disk): a non-existent root cannot be a symlink escaping itself, so confine lexically.
         realCapRoot = node_path_1.default.resolve(capDirPath);
         const targetLex = node_path_1.default.resolve(realCapRoot, script);
-        if (targetLex !== realCapRoot && !targetLex.startsWith(realCapRoot + node_path_1.default.sep))
+        if ((0, security_cjs_1.tryWithinRootLexical)(targetLex, realCapRoot) === null)
             return null;
         return targetLex;
     }
@@ -376,13 +380,13 @@ function confinedBundleScript(capDirPath, script) {
     catch {
         // Parent does not exist yet (created inside the bundle): lexical containment is sufficient
         // because a non-existent path cannot be a symlink escaping the root.
-        if (parentDir !== realCapRoot && !parentDir.startsWith(realCapRoot + node_path_1.default.sep))
+        if ((0, security_cjs_1.tryWithinRootLexical)(parentDir, realCapRoot) === null)
             return null;
         return target;
     }
     // The realpath'd parent chain must remain inside the bundle — an ancestor symlink escaping the
     // bundle is refused here (the symlink is followed by realpathSync, so its real location is checked).
-    if (realParent !== realCapRoot && !realParent.startsWith(realCapRoot + node_path_1.default.sep))
+    if ((0, security_cjs_1.tryWithinRootLexical)(realParent, realCapRoot) === null)
         return null;
     return node_path_1.default.join(realParent, node_path_1.default.basename(target));
 }

package/gsd-core/bin/lib/capability-loader.cjs

@@ -70,6 +70,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readHostVersion = readHostVersion;
+exports.crossValidationSeed = crossValidationSeed;
 exports.loadRegistry = loadRegistry;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
@@ -366,6 +367,139 @@ function ledgerOverlayIds(ledger, rootDir) {
     catch { /* missing/invalid/non-regular/oversized ledger — no pending, no committed (fail closed) */ }
     return { pending, committed };
 }
+// ─── #3929: install-time cross-capability validation seed ──────────────────
+/** First-party capabilities from the frozen registry, keyed by id. */
+function firstPartyCaps() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const base = require('./capability-registry.cjs');
+    return base.capabilities ?? {};
+}
+/**
+ * Central config-schema validKeys for the ownership-exclusivity check — the
+ * same source `loadRegistry`'s generator path reads, with the same
+ * missing-schema fallback (empty set). Memoized per process: the manifest is
+ * static for the lifetime of the runtime.
+ */
+let _centralKeysMemo = null;
+function centralConfigKeys() {
+    if (_centralKeysMemo === null) {
+        // Same generator seam loadRegistry uses (including the test override), so
+        // install-time and load-time central keys cannot diverge when the
+        // generator is stubbed.
+        if (_generatorOverride) {
+            _centralKeysMemo = _generatorOverride.loadCentralConfigKeys();
+        }
+        else {
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const mod = require('../../../scripts/gen-capability-registry.cjs');
+                _centralKeysMemo = mod.loadCentralConfigKeys();
+            }
+            catch {
+                _centralKeysMemo = new Set();
+            }
+        }
+    }
+    return _centralKeysMemo;
+}
+/**
+ * #3929: the validation seed `capability-source.stageValidated` runs the
+ * cross-capability suite against. Built the way `loadRegistry` builds its
+ * accepted map: first-party registry capabilities, then each COMMITTED overlay
+ * of the TARGET (global) install scope accepted INCREMENTALLY — structural
+ * validation, engines.gsd against the running host, then the FULL
+ * cross-capability suite; an overlay joins only if the suite stays clean
+ * after adding it (load's invariant: first-party alone is clean, so any new
+ * error is that overlay's fault — skip it, never fail the seed). The seed is
+ * therefore CLEAN BY CONSTRUCTION: pre-existing junk in the install scope
+ * (colliding entries, shape-invalid manifests, engines-incompatible bundles)
+ * is skipped exactly as load skips it and can never fail or skew a
+ * candidate's install decision — a repo-planted ledger cannot veto installs
+ * (#1459 CB-3).
+ *
+ * Scope: only the install TARGET scope is walked — `stageValidated` promotes
+ * into `${gsdHome}/.gsd/capabilities`, so target scope == global.
+ * Project-scope overlays are deliberately NOT seeded (they additionally
+ * require user consent to activate at load; the issue asks for overlays "in
+ * the target scope"). The candidate is added by the caller LAST, mirroring
+ * `acceptedMap.set(id, cap)`.
+ *
+ * Exported (not inlined in the installer) so the semantics this reuses —
+ * `overlayRoots`, `ledgerOverlayIds`, the shared bounded manifest reader, and
+ * the incremental-accept rules — have exactly one owner and cannot drift from
+ * the loader's load-time rules.
+ */
+function crossValidationSeed(cwd, gsdHome, hostVersion, validator, semver) {
+    const fp = firstPartyCaps();
+    const capMap = new Map(Object.entries(fp));
+    const centralKeys = centralConfigKeys();
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const ledger = require('./capability-ledger.cjs');
+    for (const root of overlayRoots(cwd, gsdHome)) {
+        if (root.scope !== 'global')
+            continue; // seed the TARGET scope only
+        const { committed } = ledgerOverlayIds(ledger, root.dir);
+        for (const id of committed) {
+            // First-party always wins (CONTEXT.md capability-loader entry): an
+            // overlay claiming a first-party id — or a reserved first-party prefix
+            // — is rejected at load, so it must not join the validation set.
+            if (Object.prototype.hasOwnProperty.call(fp, id))
+                continue;
+            if (RESERVED_ID_PREFIX.test(id))
+                continue;
+            let cap;
+            try {
+                const manifestPath = path.join(root.dir, id, 'capability.json');
+                const raw = ledger.readSmallRegularFile(manifestPath, MANIFEST_MAX_BYTES);
+                if (raw === null)
+                    continue; // missing/non-regular/oversized — skip fail-closed
+                cap = JSON.parse(raw);
+            }
+            catch {
+                continue; // unreadable overlay — skip (same rule as load)
+            }
+            // Same per-overlay pre-filters load applies before the cross suite:
+            // structural validity, then engines.gsd against the running host.
+            // validateCapability itself is not total over malformed array entries
+            // (#1461 finding 1) — a throw skips the overlay, as load skips it.
+            try {
+                if (validator.validateCapability(cap, id).length > 0)
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            const engines = cap['engines'];
+            if (engines && typeof engines === 'object' && !Array.isArray(engines)) {
+                const range = engines['gsd'];
+                if (typeof range === 'string' && range && !semver.semverSatisfies(hostVersion, range))
+                    continue;
+            }
+            // Incremental accept: the overlay joins only if the FULL suite stays
+            // clean after adding it; any error is that overlay's fault — skip it.
+            capMap.set(id, cap);
+            let errs = [];
+            try {
+                errs = [
+                    ...validator.validateConsumesGlobal(capMap),
+                    ...validator.validateCrossCapability(capMap, centralKeys),
+                ];
+            }
+            catch {
+                // The cross validators are not total over arbitrary shapes (#1461
+                // finding 1 — e.g. the duplicate-producer invariant throws). A
+                // throwing overlay must be REMOVED here, exactly as load's
+                // acceptedMap.delete(id) does — retaining it would leave poisoning
+                // content in the seed and attribute pre-existing junk to the
+                // candidate.
+                capMap.delete(id);
+            }
+            if (errs.length > 0)
+                capMap.delete(id);
+        }
+    }
+    return { capMap, centralKeys };
+}
 /** Shallow-attach overlay diagnostics WITHOUT mutating the frozen registry module. */
 function withOverlayMeta(reg, meta) {
     return Object.assign({}, reg, { _overlay: meta });
@@ -821,4 +955,4 @@ function loadRegistry(options = {}) {
     }
 }
 // readHostVersion is exported for the #1920 regression (VERSION-first host-version resolution).
-module.exports = { loadRegistry, readHostVersion, _setValidatorForTest, _setGeneratorForTest };
+module.exports = { loadRegistry, readHostVersion, crossValidationSeed, _setValidatorForTest, _setGeneratorForTest };