@opengsd/gsd-path 1.0.0 → 1.2.0

package/scripts/state_checkpoint.py

@@ -4,6 +4,11 @@
 
 from __future__ import annotations
 
+import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
+
 import hashlib
 import json
 import os
@@ -20,6 +25,43 @@ except ModuleNotFoundError as error:  # pragma: no cover - package imports used
     from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
 
 
+if __package__:
+    from . import roadmap
+else:
+    import roadmap
+
+if __package__:  # imported as scripts.state_checkpoint
+    from . import pipeline_state
+    from .pipeline_state import (
+        CHECKPOINT_JOURNAL_NAME,
+        CHECKPOINT_KINDS,
+        CHECKPOINT_SCHEMA,
+        PLAN_APPROVAL_SUBJECT,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        TASK_FILE_RE,
+        TASK_ID_RE,
+        ApprovedTaskContract,
+        PipelineState,
+        PipelineStateError,
+    )
+else:  # standalone script or sibling import
+    import pipeline_state
+    from pipeline_state import (
+        CHECKPOINT_JOURNAL_NAME,
+        CHECKPOINT_KINDS,
+        CHECKPOINT_SCHEMA,
+        PLAN_APPROVAL_SUBJECT,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        TASK_FILE_RE,
+        TASK_ID_RE,
+        ApprovedTaskContract,
+        PipelineState,
+        PipelineStateError,
+    )
+
+
 def _sha256(content: str) -> str:
     return hashlib.sha256(content.encode("utf-8")).hexdigest()
 
@@ -65,41 +107,29 @@ def _checkpoint_artifact_digest(project: Path, mutable_paths: set[str]) -> str:
     return digest.hexdigest()
 
 
-def _roadmap_status(lines: list[str], start: int, end: int) -> str:
-    values = []
-    for line in lines[start:end]:
-        match = re.fullmatch(r"Status:\s*(\S+)\s*", line.rstrip("\r\n"))
-        if match:
-            values.append(match.group(1))
-    if len(values) != 1:
-        raise PipelineStateError("ROADMAP.md milestone must have one Status field")
-    return values[0]
-
-
 def _activate_roadmap_milestone(text: str, milestone: str) -> str:
-    sections = pipeline_state._roadmap_sections(text)
-    if milestone not in sections:
-        raise PipelineStateError(f"ROADMAP.md is missing selected milestone: {milestone}")
-    lines = text.splitlines(keepends=True)
-    active = [
-        slug
-        for slug, (_, start, end) in sections.items()
-        if _roadmap_status(lines, start, end) == "active"
-    ]
-    if active:
-        raise PipelineStateError(
-            "ROADMAP.md already has an active milestone: " + ", ".join(active)
-        )
-    _, start, end = sections[milestone]
-    pipeline_state._replace_roadmap_field(lines, start, end, "Status", {"pending"}, "active")
-    return "".join(lines)
-
+    try:
+        return roadmap.activate_milestone(text, milestone)
+    except roadmap.RoadmapError as error:
+        raise PipelineStateError(str(error)) from error
 
 def _approval_details(
     kind: str,
     state: PipelineState,
     selected_milestone: Optional[str],
 ) -> tuple[dict[str, Optional[str]], str, str, str]:
+    if kind == "roadmap-reslice":
+        if state.status != "active" or state.archive is not None:
+            raise PipelineStateError("roadmap re-slice requires active, unarchived state")
+        if state.phase in {"inspect", "define"} and selected_milestone == state.milestone and state.milestone:
+            changes = {}
+            event = "program roadmap re-slice approved"
+        elif state.phase == "roadmap" and state.milestone is None and selected_milestone and SLUG_RE.fullmatch(selected_milestone):
+            changes = {"phase": "inspect", "milestone": selected_milestone}
+            event = "roadmap approved after abandoned milestone"
+        else:
+            raise PipelineStateError("roadmap re-slice must preserve the active milestone or select after abandon")
+        return changes, event, "roadmap: program roadmap approved", "Why: approved roadmap checkpoint"
     if kind == "plan":
         if selected_milestone is not None:
             raise PipelineStateError("plan approval does not accept a selected milestone")
@@ -126,6 +156,12 @@ def _approval_details(
     raise PipelineStateError(f"unsupported approval kind: {kind}")
 
 
+def _reslice_roadmap(before: str, candidate: str, state: PipelineState, selected: str) -> str:
+    try:
+        return roadmap.reslice(before, candidate, state.phase, selected)
+    except roadmap.RoadmapError as error:
+        raise PipelineStateError(str(error)) from error
+
 def _checkpoint_request_fields(
     kind: str,
     project_dir: str,
@@ -175,6 +211,10 @@ def _approval_journal(repo: Path, journal: Mapping[str, object]) -> dict[str, ob
         "roadmap_before",
         "roadmap_after",
     }
+    if journal.get("kind") == "roadmap-reslice":
+        expected_keys.add("baseline_before")
+        if not isinstance(journal.get("baseline_before"), str):
+            raise PipelineStateError("checkpoint journal has an invalid re-slice baseline")
     if set(journal) != expected_keys:
         raise PipelineStateError("checkpoint journal has invalid fields")
     if journal.get("schema") != CHECKPOINT_SCHEMA or journal.get("repo") != str(repo):
@@ -253,12 +293,14 @@ def _approval_journal(repo: Path, journal: Mapping[str, object]) -> dict[str, ob
         or journal["state_after"] != rendered
     ):
         raise PipelineStateError("checkpoint journal approval contract is invalid")
-    if str(journal["kind"]) == "roadmap":
+    if journal["kind"] in {"roadmap", "roadmap-reslice"}:
         if project_dir != ".project":
             raise PipelineStateError("roadmap approval is legal only on the active track")
         if journal["roadmap_path"] != ".project/ROADMAP.md":
             raise PipelineStateError("checkpoint journal has an invalid ROADMAP path")
-        expected_roadmap = _activate_roadmap_milestone(
+        expected_roadmap = _reslice_roadmap(
+            str(journal["baseline_before"]), str(journal["roadmap_before"]), before, str(selected),
+        ) if journal["kind"] == "roadmap-reslice" else _activate_roadmap_milestone(
             str(journal["roadmap_before"]),
             str(selected),
         )
@@ -307,6 +349,12 @@ def _resume_checkpoint_locked(
     transaction = _approval_journal(repo, journal)
     state_path = _checkpoint_file(repo, str(transaction["state_path"]), "STATE.md")
     mutable = {state_path.relative_to(project).as_posix()}
+    baseline = project / "ROADMAP.before-reslice.md" if transaction["kind"] == "roadmap-reslice" else None
+    if baseline is not None:
+        mutable.add(baseline.name)
+        if baseline.exists() or baseline.is_symlink():
+            if pipeline_state._read_real_file(baseline, "re-slice baseline") != transaction["baseline_before"]:
+                raise PipelineStateError("re-slice baseline drifted during checkpoint recovery")
     roadmap_path: Optional[Path] = None
     if transaction["roadmap_path"] is not None:
         roadmap_path = _checkpoint_file(
@@ -354,6 +402,8 @@ def _resume_checkpoint_locked(
             raise PipelineStateError("completed checkpoint has the wrong ROADMAP.md")
 
     try:
+        if baseline is not None and baseline.exists():
+            baseline.unlink()
         committed = isolation_checkpoint(
             repo,
             expected_head,
@@ -362,6 +412,8 @@ def _resume_checkpoint_locked(
             [".project"],
         )
     except IsolationError as error:
+        if baseline is not None and pipeline_state._run_git(repo, "rev-parse", "HEAD").stdout.strip() == expected_head:
+            pipeline_state._atomic_write(baseline, str(transaction["baseline_before"]))
         raise PipelineStateError(f"approval checkpoint failed: {error}") from error
     if committed.get("commit") != pipeline_state._run_git(repo, "rev-parse", "HEAD").stdout.strip():
         raise PipelineStateError("approval checkpoint returned the wrong commit")
@@ -381,6 +433,8 @@ def _resume_checkpoint_locked(
 def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
     if kind != "plan":
         return
+    if project_dir == ".project":
+        pipeline_state._build_recovery().validate_plan(repo)
     head = pipeline_state._run_git(repo, "rev-parse", "--verify", "HEAD", check=False)
     if head.returncode != 0:
         # Pre-Git approval defers base-dependent checks to build.
@@ -476,6 +530,8 @@ def checkpoint_approval(
         state, state_before, state_path = pipeline_state.load_state(resolved, project_dir)
         changes, event, subject, body = _approval_details(kind, state, selected_milestone)
         _validate_plan_briefs(resolved, kind, project_dir)
+        if kind == "plan" and project_dir == ".project":
+            pipeline_state._build_recovery().restore_unchanged_reviews(resolved)
         expected = {
             "phase": state.phase,
             "status": state.status,
@@ -497,13 +553,18 @@ def checkpoint_approval(
         roadmap_path: Optional[Path] = None
         roadmap_before: Optional[str] = None
         roadmap_after: Optional[str] = None
-        if kind == "roadmap":
+        baseline_before = None
+        if kind in {"roadmap", "roadmap-reslice"}:
             if project_dir != ".project":
                 raise PipelineStateError("roadmap approval is legal only on the active track")
             assert selected_milestone is not None
             roadmap_path = project / "ROADMAP.md"
             roadmap_before = pipeline_state._read_real_file(roadmap_path, "ROADMAP.md")
-            roadmap_after = _activate_roadmap_milestone(
+            if kind == "roadmap-reslice":
+                baseline_before = pipeline_state._read_real_file(project / "ROADMAP.before-reslice.md", "re-slice baseline")
+            roadmap_after = _reslice_roadmap(
+                baseline_before, roadmap_before, state, selected_milestone,
+            ) if kind == "roadmap-reslice" else _activate_roadmap_milestone(
                 roadmap_before,
                 selected_milestone,
             )
@@ -512,6 +573,8 @@ def checkpoint_approval(
         mutable = {state_relative}
         if roadmap_path is not None:
             mutable.add(roadmap_path.relative_to(project).as_posix())
+        if baseline_before is not None:
+            mutable.add("ROADMAP.before-reslice.md")
         journal: dict[str, object] = {
             "schema": CHECKPOINT_SCHEMA,
             "repo": str(resolved),
@@ -528,6 +591,8 @@ def checkpoint_approval(
             "roadmap_before": roadmap_before,
             "roadmap_after": roadmap_after,
         }
+        if baseline_before is not None:
+            journal["baseline_before"] = baseline_before
         pipeline_state._write_json(journal_path, journal)
         return _resume_checkpoint_locked(resolved, project, journal_path, journal)
 
@@ -576,6 +641,10 @@ def defer_approval(
     with pipeline_state._state_lock(project):
         state, state_before, state_path = pipeline_state.load_state(resolved, project_dir)
         changes, event, _, _ = _approval_details(kind, state, selected_milestone)
+        if project_dir == ".project":
+            recovery = pipeline_state._build_recovery().context(resolved, state_before)
+            if recovery and recovery["active"]:
+                raise PipelineStateError("build recovery requires a plan checkpoint")
         _validate_plan_briefs(resolved, kind, project_dir)
         if patch:
             event = "patch plan approved"
@@ -595,17 +664,25 @@ def defer_approval(
             project_dir,
             approval_kind=kind,
         )
-        if kind == "roadmap":
+        baseline = None
+        if kind in {"roadmap", "roadmap-reslice"}:
             if project_dir != ".project":
                 raise PipelineStateError("roadmap approval is legal only on the active track")
             assert selected_milestone is not None
             roadmap_path = project / "ROADMAP.md"
-            roadmap_after = _activate_roadmap_milestone(
-                pipeline_state._read_real_file(roadmap_path, "ROADMAP.md"),
-                selected_milestone,
-            )
+            roadmap_before = pipeline_state._read_real_file(roadmap_path, "ROADMAP.md")
+            if kind == "roadmap-reslice":
+                baseline = project / "ROADMAP.before-reslice.md"
+                roadmap_after = _reslice_roadmap(
+                    pipeline_state._read_real_file(baseline, "re-slice baseline"),
+                    roadmap_before, state, selected_milestone,
+                )
+            else:
+                roadmap_after = _activate_roadmap_milestone(roadmap_before, selected_milestone)
             pipeline_state._atomic_write(roadmap_path, roadmap_after)
         pipeline_state._atomic_write(state_path, state_after)
+        if baseline is not None:
+            baseline.unlink()
     return {
         "schema": CHECKPOINT_SCHEMA,
         "status": "approved",
@@ -1002,38 +1079,3 @@ def _classify_plan_drift(
         "contract_paths": sorted(contract_paths),
         "reason": "; ".join(reasons) if reasons else "approval contracts and declared paths are unchanged",
     }
-
-
-# pipeline_state imports this module, so the parent is resolved after the
-# definitions above. Parent functions are looked up on the module at call time
-# so patches applied to pipeline_state stay visible here.
-if __package__:  # imported as scripts.state_checkpoint
-    from . import pipeline_state
-    from .pipeline_state import (
-        CHECKPOINT_JOURNAL_NAME,
-        CHECKPOINT_KINDS,
-        CHECKPOINT_SCHEMA,
-        PLAN_APPROVAL_SUBJECT,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        TASK_FILE_RE,
-        TASK_ID_RE,
-        ApprovedTaskContract,
-        PipelineState,
-        PipelineStateError,
-    )
-else:  # standalone script or sibling import
-    import pipeline_state
-    from pipeline_state import (
-        CHECKPOINT_JOURNAL_NAME,
-        CHECKPOINT_KINDS,
-        CHECKPOINT_SCHEMA,
-        PLAN_APPROVAL_SUBJECT,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        TASK_FILE_RE,
-        TASK_ID_RE,
-        ApprovedTaskContract,
-        PipelineState,
-        PipelineStateError,
-    )

package/scripts/state_promote.py

@@ -4,6 +4,11 @@
 
 from __future__ import annotations
 
+import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
+
 import json
 import re
 import shutil
@@ -11,6 +16,31 @@ from pathlib import Path, PurePosixPath
 from typing import Mapping, Optional
 
 
+if __package__:  # imported as scripts.state_promote
+    from . import pipeline_state, state_checkpoint
+    from .pipeline_state import (
+        NULL,
+        PROMOTION_RESIDUAL,
+        PROMOTION_SCHEMA,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        PipelineState,
+        PipelineStateError,
+    )
+else:  # standalone script or sibling import
+    import pipeline_state
+    import state_checkpoint
+    from pipeline_state import (
+        NULL,
+        PROMOTION_RESIDUAL,
+        PROMOTION_SCHEMA,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        PipelineState,
+        PipelineStateError,
+    )
+
+
 def _render_roadmap(
     text: str,
     previous_milestone: str,
@@ -243,9 +273,9 @@ def _completed_promotion(
     if _head_with_exact_message(repo, subject, fields) != head:
         raise PipelineStateError("completed promotion has the wrong commit message")
 
-    active_text = pipeline_state._git_text_at(repo, base, ".project/STATE.md")
-    next_text = pipeline_state._git_text_at(repo, base, ".project/next/STATE.md")
-    roadmap_text = pipeline_state._git_text_at(repo, base, ".project/ROADMAP.md")
+    active_text = state_checkpoint._git_text_at(repo, base, ".project/STATE.md")
+    next_text = state_checkpoint._git_text_at(repo, base, ".project/next/STATE.md")
+    roadmap_text = state_checkpoint._git_text_at(repo, base, ".project/ROADMAP.md")
     if active_text is None or next_text is None or roadmap_text is None:
         raise PipelineStateError("promotion parent is missing required metadata")
     active_state = pipeline_state._state_from_text(active_text, "promotion parent STATE.md")
@@ -265,7 +295,7 @@ def _completed_promotion(
         )
 
     _promotion_tree_mapping(repo, base, head)
-    drift = pipeline_state._classify_plan_drift(repo, next_state, base, landing)
+    drift = state_checkpoint._classify_plan_drift(repo, next_state, base, landing)
     expected_roadmap = _render_roadmap(
         roadmap_text,
         active_state.milestone,
@@ -273,11 +303,11 @@ def _completed_promotion(
         branch,
         landing,
     )
-    current_roadmap = pipeline_state._git_text_at(repo, head, ".project/ROADMAP.md")
+    current_roadmap = state_checkpoint._git_text_at(repo, head, ".project/ROADMAP.md")
     if current_roadmap != expected_roadmap:
         raise PipelineStateError("completed promotion has invalid ROADMAP.md")
 
-    current_state = pipeline_state._git_text_at(repo, head, ".project/STATE.md")
+    current_state = state_checkpoint._git_text_at(repo, head, ".project/STATE.md")
     if current_state is None:
         raise PipelineStateError("completed promotion has no STATE.md")
     event = re.escape(_promotion_event(drift, branch, landing, base))
@@ -438,10 +468,10 @@ def _prepare_promotion(
         if source.exists() or source.is_symlink():
             if destination.exists() or destination.is_symlink():
                 raise PipelineStateError(f"promotion destination already exists: {destination}")
-            tracks[name] = pipeline_state._tree_digest(source)
+            tracks[name] = state_checkpoint._tree_digest(source)
     if not tracks:
         raise PipelineStateError("lookahead track has no promotable artifacts")
-    drift = pipeline_state._classify_plan_drift(repo, next_state, base, landing)
+    drift = state_checkpoint._classify_plan_drift(repo, next_state, base, landing)
     roadmap_path = project / "ROADMAP.md"
     roadmap_text = pipeline_state._read_real_file(roadmap_path, "ROADMAP.md")
     target_state = _promotion_state(
@@ -464,10 +494,10 @@ def _prepare_promotion(
         "landing": landing,
         "base": base,
         "tracks": tracks,
-        "residual_sha256": pipeline_state._tree_digest(next_root, tuple(tracks)),
-        "next_state_sha256": pipeline_state._sha256(next_text),
-        "active_state_sha256": pipeline_state._sha256(active_text),
-        "roadmap_sha256": pipeline_state._sha256(roadmap_text),
+        "residual_sha256": state_checkpoint._tree_digest(next_root, tuple(tracks)),
+        "next_state_sha256": state_checkpoint._sha256(next_text),
+        "active_state_sha256": state_checkpoint._sha256(active_text),
+        "roadmap_sha256": state_checkpoint._sha256(roadmap_text),
         "target_state": target_state,
         "target_roadmap": target_roadmap,
         "drift": drift,
@@ -521,7 +551,7 @@ def _resume_track_moves(project: Path, journal: dict[str, object], path: Path) -
         if not source_exists and not destination_exists:
             raise PipelineStateError(f"promotion lost both source and destination: {name}")
         candidate = source if source_exists else destination
-        if pipeline_state._tree_digest(candidate) != expected_digest:
+        if state_checkpoint._tree_digest(candidate) != expected_digest:
             raise PipelineStateError(f"promotion track drifted: {name}")
         if source_exists:
             source.rename(destination)
@@ -542,7 +572,7 @@ def _resume_metadata(project: Path, journal: dict[str, object], path: Path) -> N
             raise PipelineStateError("promotion journal has invalid metadata")
         if current == desired:
             continue
-        if pipeline_state._sha256(current) != expected_original:
+        if state_checkpoint._sha256(current) != expected_original:
             raise PipelineStateError(f"promotion metadata drifted: {target}")
         pipeline_state._atomic_write(target, desired)
         journal["stage"] = f"updated:{target.name}"
@@ -560,9 +590,9 @@ def _resume_next_removal(
         if residual.exists() or residual.is_symlink():
             raise PipelineStateError("promotion has both next track and residual staging")
         next_text = pipeline_state._read_real_file(next_root / "STATE.md", "next/STATE.md")
-        if pipeline_state._sha256(next_text) != journal.get("next_state_sha256"):
+        if state_checkpoint._sha256(next_text) != journal.get("next_state_sha256"):
             raise PipelineStateError("lookahead STATE drifted during promotion")
-        if pipeline_state._tree_digest(next_root) != journal.get("residual_sha256"):
+        if state_checkpoint._tree_digest(next_root) != journal.get("residual_sha256"):
             raise PipelineStateError("lookahead residual drifted during promotion")
         next_root.rename(residual)
         journal["stage"] = "next-staged"
@@ -574,7 +604,7 @@ def _resume_next_removal(
         raise PipelineStateError("promotion lost next track and residual staging")
     if residual.is_symlink() or not residual.is_dir():
         raise PipelineStateError(f"promotion residual must be a real directory: {residual}")
-    if pipeline_state._tree_digest(residual) != journal.get("residual_sha256"):
+    if state_checkpoint._tree_digest(residual) != journal.get("residual_sha256"):
         raise PipelineStateError("staged lookahead residual drifted during promotion")
 
 
@@ -714,30 +744,3 @@ def promote_next(
         "commit": commit,
         "drift": journal["drift"],
     }
-
-
-# pipeline_state imports this module, so the parent is resolved after the
-# definitions above. Parent functions are looked up on the module at call time
-# so patches applied to pipeline_state stay visible here.
-if __package__:  # imported as scripts.state_promote
-    from . import pipeline_state
-    from .pipeline_state import (
-        NULL,
-        PROMOTION_RESIDUAL,
-        PROMOTION_SCHEMA,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        PipelineState,
-        PipelineStateError,
-    )
-else:  # standalone script or sibling import
-    import pipeline_state
-    from pipeline_state import (
-        NULL,
-        PROMOTION_RESIDUAL,
-        PROMOTION_SCHEMA,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        PipelineState,
-        PipelineStateError,
-    )

package/scripts/status_runtime.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 """Launch the project status runtime across an atomic refresh handoff."""
 
+import argparse
+import hashlib
 import errno
 import json
 import os
@@ -72,8 +74,85 @@ def install_lock_active(lock: Path) -> bool:
     return current_identity == identity
 
 
+RUNTIME_SCHEMA = "gsd-path/runtime/v1"
+
+
+def runtime_home() -> Path:
+    return Path.home() / ".gsd-path" / "runtimes"
+
+
+def declaration(repo: Path) -> dict:
+    path = repo / ".gsd-path" / "runtime.json"
+    if path.is_symlink() or path.parent.is_symlink():
+        raise ValueError(f"unsafe runtime declaration: {path}")
+    data = json.loads(path.read_text(encoding="utf-8"))
+    if (not isinstance(data, dict) or data.get("schema") != RUNTIME_SCHEMA
+            or not isinstance(data.get("version"), str)
+            or not isinstance(data.get("digest"), str)
+            or len(data["digest"]) != 64
+            or any(c not in "0123456789abcdef" for c in data["digest"])):
+        raise ValueError(f"invalid runtime declaration: {path}")
+    return data
+
+
+def manifest_digest(manifest: dict) -> str:
+    return hashlib.sha256(json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def validate_runtime(data: dict) -> Path:
+    root = runtime_home() / data["digest"]
+    hint = (f"Runtime {data['version']} ({data['digest']}) is unavailable or invalid at {root}. "
+            "Run gsd-path --runtime-restore --project <project-root> "
+            "--source-root <matching-package-root> to restore this exact runtime.")
+    try:
+        if any(p.is_symlink() for p in (root, root.parent, root.parent.parent)):
+            raise ValueError("symlinked runtime storage")
+        manifest_path = root / "manifest.json"
+        if manifest_path.is_symlink():
+            raise ValueError("symlinked manifest")
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+        if (not isinstance(manifest, dict) or manifest_digest(manifest) != data["digest"]
+                or manifest.get("version") != data["version"]):
+            raise ValueError("manifest identity mismatch")
+        files = manifest.get("files")
+        if not isinstance(files, dict) or "pipeline_state.py" not in files:
+            raise ValueError("invalid runtime file inventory")
+        for name, expected in files.items():
+            if Path(name).name != name or not name.endswith(".py"):
+                raise ValueError("invalid runtime file name")
+            path = root / name
+            if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != expected:
+                raise ValueError(f"runtime file changed: {name}")
+        if set(p.name for p in root.iterdir()) != set(files) | {"manifest.json"}:
+            raise ValueError("unexpected runtime files")
+    except (OSError, ValueError, TypeError) as error:
+        raise ValueError(hint + f" ({error})") from error
+    return root
+
+
+def resolve_runtime(repo: Path) -> Path:
+    return validate_runtime(declaration(repo))
+
+
+def run_guard(repo: Path, name: str) -> None:
+    # Keep the guard's project identity while executing verified external bytes.
+    root = resolve_runtime(repo)
+    sys.dont_write_bytecode = True
+    sys.path.insert(0, str(root))
+    code = compile((root / name).read_bytes(), str(root / name), "exec")
+    exec(code, {"__name__": "__main__", "__file__": str(repo / ".gsd-path" / name)})
+
+
 def launch(repo: Path) -> int:
     parent = repo / ".gsd-path"
+    if os.path.lexists(parent / "runtime.json"):
+        try:
+            runtime = resolve_runtime(repo) / "pipeline_state.py"
+        except (OSError, ValueError) as error:
+            print(str(error), file=sys.stderr)
+            return 2
+        return subprocess.call([sys.executable, "-B", str(runtime), "status", "--repo", str(repo)],
+                               env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"})
     runtime = parent / "runtime" / "pipeline_state.py"
     lock = repo / ".gsd-path-install-lock"
     command = [sys.executable, "-B", str(runtime), "status", "--repo", str(repo)]
@@ -108,14 +187,21 @@ def launch(repo: Path) -> int:
 
 
 def main(argv: Sequence[str] = sys.argv[1:]) -> int:
-    if len(argv) != 2 or argv[0] != "--repo":
-        print("usage: status_runtime.py --repo <absolute-root>", file=sys.stderr)
-        return 2
-    repo = Path(argv[1])
-    if not repo.is_absolute():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--repo", required=True, type=Path)
+    parser.add_argument("--runtime-path", action="store_true")
+    args = parser.parse_args(argv)
+    if not args.repo.is_absolute():
         print("GSD Path status repository must be absolute", file=sys.stderr)
         return 2
-    return launch(repo.resolve())
+    if args.runtime_path:
+        try:
+            print(resolve_runtime(args.repo.resolve()))
+            return 0
+        except (OSError, ValueError) as error:
+            print(str(error), file=sys.stderr)
+            return 2
+    return launch(args.repo.resolve())
 
 
 if __name__ == "__main__":