@ornexus/neocortex 4.60.21 → 4.60.23

package/packages/shared/dist/generated/command-registry.generated.js

@@ -1,41 +1,41 @@
 /** Generated by scripts/generate-command-registry.mjs. Do not edit. */
 export const COMMAND_REGISTRY_SCHEMA_VERSION = 1;
 export const COMMAND_REGISTRY_VERSION = "1.0.0";
-export const COMMAND_REGISTRY_CHECKSUM = "b8fcdb246f7e22f820f667442f7a489bf3f53376b6540280d59fb89495ff4520";
+export const COMMAND_REGISTRY_CHECKSUM = "39c74bfd2ec67a12b19bda587ffcf6a987dfca1b6d33142a28988c574f7eb7c0";
 export const COMMAND_REGISTRY_PROJECTION_MANIFEST = {
     "schemaVersion": 1,
     "registryVersion": "1.0.0",
-    "registryChecksum": "b8fcdb246f7e22f820f667442f7a489bf3f53376b6540280d59fb89495ff4520",
+    "registryChecksum": "39c74bfd2ec67a12b19bda587ffcf6a987dfca1b6d33142a28988c574f7eb7c0",
     "projections": [
         {
             "kind": "admin",
-            "entryCount": 62,
-            "sha256": "4ca10e54b2028a01dad3b492dacead708d858842ba5ba23bcca70faa8c5b9689"
+            "entryCount": 63,
+            "sha256": "ca4b20573423f84de80a5664c0171d01b48d43fb3cb2041597a48ab44374dd5d"
         },
         {
             "kind": "client",
-            "entryCount": 62,
-            "sha256": "4ca10e54b2028a01dad3b492dacead708d858842ba5ba23bcca70faa8c5b9689"
+            "entryCount": 63,
+            "sha256": "ca4b20573423f84de80a5664c0171d01b48d43fb3cb2041597a48ab44374dd5d"
         },
         {
             "kind": "docs",
-            "entryCount": 62,
-            "sha256": "4ca10e54b2028a01dad3b492dacead708d858842ba5ba23bcca70faa8c5b9689"
+            "entryCount": 63,
+            "sha256": "ca4b20573423f84de80a5664c0171d01b48d43fb3cb2041597a48ab44374dd5d"
         },
         {
             "kind": "metrics",
-            "entryCount": 62,
-            "sha256": "4ca10e54b2028a01dad3b492dacead708d858842ba5ba23bcca70faa8c5b9689"
+            "entryCount": 63,
+            "sha256": "ca4b20573423f84de80a5664c0171d01b48d43fb3cb2041597a48ab44374dd5d"
         },
         {
             "kind": "server",
-            "entryCount": 67,
-            "sha256": "682d4238281ea4e00d110fdf7d67257cc9ee8c029a87232b26c8fc3f00604884"
+            "entryCount": 68,
+            "sha256": "4c10d04de88c08d694d1eaa6f43b688897dfaafd60dcdf155389a1903121465b"
         },
         {
             "kind": "shared",
-            "entryCount": 67,
-            "sha256": "f82436b633efc99f247aa0f0e755d66fe538ba3afd205dcec49e4a5fdb7d9928"
+            "entryCount": 68,
+            "sha256": "3b9bde2f873434594c1aedebaa608d401f29729f14e962a9639760f0139bc60b"
         }
     ]
 };
@@ -1130,14 +1130,14 @@ export const GENERATED_SHARED_COMMANDS = [
         "name": "Diagnosticar Story ou Contexto",
         "number": 25,
         "policy": {
-            "billingClass": "billable",
-            "idempotencyClass": "logical-supported",
+            "billingClass": "non-billable",
+            "idempotencyClass": "none",
             "minimumTier": "free",
-            "mutationClass": "stateful",
+            "mutationClass": "read-only",
             "privilege": "authenticated",
-            "quotaClass": "workflow",
+            "quotaClass": "none",
             "replayClass": "signed-request",
-            "strictReadOnly": "deny"
+            "strictReadOnly": "allow"
         },
         "projections": [
             "admin",
@@ -2746,6 +2746,53 @@ export const GENERATED_SHARED_COMMANDS = [
         "visibility": "public",
         "subcommands": []
     },
+    {
+        "aliases": [
+            "migrate-project",
+            "project-id-migrate"
+        ],
+        "category": "recovery",
+        "compatibility": {
+            "deprecatedIn": null,
+            "introducedIn": "1.0.0",
+            "removedIn": null,
+            "replacement": null
+        },
+        "description": {
+            "en": "Migrate stable project identity with backup and remote seed.",
+            "es": "Migra la identidad estable del proyecto con respaldo y seed remoto.",
+            "pt-BR": "Migra a identidade estavel do projeto com backup e seed remoto."
+        },
+        "examples": [
+            "@neocortex *migrate-project-id"
+        ],
+        "id": "migrate-project-id",
+        "inputShape": "standalone",
+        "mode": "utility",
+        "name": "Migrate Project Identity",
+        "number": 63,
+        "policy": {
+            "billingClass": "non-billable",
+            "idempotencyClass": "logical-required",
+            "minimumTier": "free",
+            "mutationClass": "stateful",
+            "privilege": "authenticated",
+            "quotaClass": "none",
+            "replayClass": "signed-request",
+            "strictReadOnly": "deny"
+        },
+        "projections": [
+            "admin",
+            "client",
+            "docs",
+            "metrics",
+            "server",
+            "shared"
+        ],
+        "stepId": "step-u-migrate-project-id",
+        "visibility": "public",
+        "subcommands": []
+    },
     {
         "aliases": [
             "migrate",

package/packages/shared/dist/generated/invocation-schema.generated.js

@@ -2,13 +2,13 @@
 export const GENERATED_INVOCATION_SCHEMA_MANIFEST = {
     "schemaVersion": "p205-invocation-schema-v1",
     "registryVersion": "1.0.0",
-    "registryChecksum": "b8fcdb246f7e22f820f667442f7a489bf3f53376b6540280d59fb89495ff4520",
-    "schemaChecksum": "667c67ed7a55553d74eab12ec46c2e0f12b0529ad01303d4ca9cae14d49270bd",
-    "commandCount": 62,
+    "registryChecksum": "39c74bfd2ec67a12b19bda587ffcf6a987dfca1b6d33142a28988c574f7eb7c0",
+    "schemaChecksum": "14ea14ebfd79941609426b34690c0fade17034a4b1b166b14d985cb097ee7128",
+    "commandCount": 63,
     "optionCount": 47,
     "positionalCount": 44,
     "operationCount": 33,
-    "projectionSha256": "84ffc9791306d642d0603ce81e0b0a12ee48a2ebbc6bf4ad3bb45b9eb940abff",
+    "projectionSha256": "3052d8fa2bdfcfcc8bca17ba1a5ad5ec39270064ca68760f691b36a9eb2b0ed0",
     "commands": [
         {
             "commandId": "arch-api-contracts",
@@ -1128,6 +1128,18 @@ export const GENERATED_INVOCATION_SCHEMA_MANIFEST = {
             ],
             "terminator": true
         },
+        {
+            "commandId": "migrate-project-id",
+            "inputShape": "standalone",
+            "operation": {
+                "required": false,
+                "unknownAsPositional": false,
+                "operations": []
+            },
+            "options": [],
+            "positionals": [],
+            "terminator": true
+        },
         {
             "commandId": "migrate-state",
             "inputShape": "standalone",

package/packages/shared/dist/invocation/index.d.ts

@@ -1,3 +1,8 @@
+export * from './input-envelope.js';
+export * from './project-identity-migration.js';
+export * from './state-projection.js';
+export * from './strict-effect-receipt.js';
+export * from './public-diagnostics.js';
 export declare const EXACT_INVOCATION_POLICY: "p205-exact-invocation-v1";
 export declare const INVOCATION_SCHEMA_VERSION: "p205-invocation-schema-v1";
 export declare const INVOCATION_LIMITS: Readonly<{
@@ -115,7 +120,7 @@ export interface InvocationCommandSchemaV1 {
     readonly positionals: readonly InvocationPositionalSchemaV1[];
     readonly terminator: true;
 }
-export declare const INVOCATION_SCHEMA_CHECKSUM: "667c67ed7a55553d74eab12ec46c2e0f12b0529ad01303d4ca9cae14d49270bd";
+export declare const INVOCATION_SCHEMA_CHECKSUM: "14ea14ebfd79941609426b34690c0fade17034a4b1b166b14d985cb097ee7128";
 export interface InvocationSchemaManifestV1 {
     readonly schemaVersion: typeof INVOCATION_SCHEMA_VERSION;
     readonly registryVersion: string;
@@ -172,4 +177,3 @@ export interface InvocationDeprecationCountV1 {
 }
 /** Count-only migration telemetry; raw input is intentionally not accepted. */
 export declare function createInvocationDeprecationCount(result: RejectedInvocationAdmissionV1): InvocationDeprecationCountV1;
-export {};

package/packages/shared/dist/invocation/index.js

@@ -9,10 +9,18 @@ import { createHash } from 'node:crypto';
 import { COMMAND_REGISTRY_CHECKSUM, COMMAND_REGISTRY_VERSION, GENERATED_SHARED_COMMANDS, } from '../generated/command-registry.generated.js';
 import { GENERATED_INVOCATION_SCHEMA_MANIFEST, GENERATED_INVOCATION_SCHEMAS, } from '../generated/invocation-schema.generated.js';
 import { canonicalizeCommandRegistryJcs } from '../command-registry-contract.js';
+export * from './input-envelope.js';
+export * from './project-identity-migration.js';
+export * from './state-projection.js';
+export * from './strict-effect-receipt.js';
+export * from './public-diagnostics.js';
 export const EXACT_INVOCATION_POLICY = 'p205-exact-invocation-v1';
 export const INVOCATION_SCHEMA_VERSION = 'p205-invocation-schema-v1';
 export const INVOCATION_LIMITS = Object.freeze({
-    inputBytes: 64 * 1024,
+    // Keep exact admission bounded while allowing the client args-file/stdin
+    // materialization path to carry requests that exceed the 256 KiB HTTP body
+    // once envelope metadata is added.
+    inputBytes: 256 * 1024,
     tokens: 512,
     tokenBytes: 16 * 1024,
     briefBytes: 16 * 1024,
@@ -99,7 +107,9 @@ function bucket(bytes) {
         return '1025-4096';
     if (bytes <= 16384)
         return '4097-16384';
-    return '16385-65536';
+    if (bytes <= 65536)
+        return '16385-65536';
+    return '65537-262144';
 }
 export function lexInvocationEnvelope(input) {
     const inputBytes = byteLength(input);

package/packages/shared/dist/invocation/input-envelope.d.ts

@@ -0,0 +1,37 @@
+export declare const INVOKE_INPUT_ENVELOPE_VERSION: 2;
+export declare const INVOKE_HTTP_BODY_LIMIT_BYTES: number;
+export type InvokeInputSourceV2 = 'args' | 'stdin' | 'args-file';
+export type InvokeNewlineStyleV2 = 'none' | 'lf' | 'crlf' | 'mixed';
+export interface InvokeInputEnvelopeV2 {
+    readonly version: typeof INVOKE_INPUT_ENVELOPE_VERSION;
+    readonly source: InvokeInputSourceV2;
+    readonly rawArgs: string;
+    readonly byteLength: number;
+    readonly sha256: string;
+    readonly newlineStyle: InvokeNewlineStyleV2;
+    readonly admissionView: string;
+}
+export declare const INVOKE_INPUT_EVIDENCE_VERSION: 1;
+/** Public-safe transport projection; rawArgs remains the single args field. */
+export interface InvokeInputEvidenceV1 {
+    readonly version: typeof INVOKE_INPUT_EVIDENCE_VERSION;
+    readonly source: InvokeInputSourceV2;
+    readonly byteLength: number;
+    readonly sha256: string;
+    readonly newlineStyle: InvokeNewlineStyleV2;
+}
+export type InvocationMalformedInputReasonV1 = 'multiple-input-sources' | 'missing-input-value' | 'unexpected-cli-token' | 'invalid-utf8' | 'invalid-control-character' | 'unterminated-quote' | 'input-limit-exceeded';
+export interface InvocationInputDiagnosticV1 {
+    readonly code: 'INVOCATION_MALFORMED_INPUT';
+    readonly reason: InvocationMalformedInputReasonV1;
+    readonly source?: InvokeInputSourceV2;
+    readonly byteLength?: number;
+    readonly remediation: string;
+}
+export declare function classifyNewlineStyle(value: string): InvokeNewlineStyleV2;
+export declare function isInvokeHttpBodyBelowLimit(byteLength: number): boolean;
+export declare function invokeInputSha256(rawArgs: string): string;
+export declare function createInvokeInputEnvelopeV2(source: InvokeInputSourceV2, rawArgs: string): InvokeInputEnvelopeV2;
+export declare function projectInvokeInputEvidenceV1(envelope: InvokeInputEnvelopeV2): InvokeInputEvidenceV1;
+export declare function assertInvokeInputEvidenceV1(value: unknown, rawArgs?: string): asserts value is InvokeInputEvidenceV1;
+export declare function assertInvokeInputEnvelopeV2(value: unknown): asserts value is InvokeInputEnvelopeV2;

package/packages/shared/dist/invocation/input-envelope.js

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import { SHA256_HEX_PATTERN } from './project-identity-migration.js';
+export const INVOKE_INPUT_ENVELOPE_VERSION = 2;
+export const INVOKE_HTTP_BODY_LIMIT_BYTES = 256 * 1024;
+export const INVOKE_INPUT_EVIDENCE_VERSION = 1;
+export function classifyNewlineStyle(value) {
+    const withoutCrlf = value.replaceAll('\r\n', '');
+    const hasCrlf = withoutCrlf.length !== value.length;
+    const hasLf = withoutCrlf.includes('\n');
+    const hasBareCr = withoutCrlf.includes('\r');
+    if (!hasCrlf && !hasLf && !hasBareCr)
+        return 'none';
+    if (hasCrlf && !hasLf && !hasBareCr)
+        return 'crlf';
+    if (!hasCrlf && hasLf && !hasBareCr)
+        return 'lf';
+    return 'mixed';
+}
+export function isInvokeHttpBodyBelowLimit(byteLength) {
+    return Number.isSafeInteger(byteLength) && byteLength >= 0 && byteLength < INVOKE_HTTP_BODY_LIMIT_BYTES;
+}
+export function invokeInputSha256(rawArgs) {
+    return createHash('sha256').update(rawArgs, 'utf8').digest('hex');
+}
+export function createInvokeInputEnvelopeV2(source, rawArgs) {
+    return Object.freeze({
+        version: INVOKE_INPUT_ENVELOPE_VERSION,
+        source,
+        rawArgs,
+        byteLength: Buffer.byteLength(rawArgs, 'utf8'),
+        sha256: invokeInputSha256(rawArgs),
+        newlineStyle: classifyNewlineStyle(rawArgs),
+        admissionView: rawArgs.trim(),
+    });
+}
+export function projectInvokeInputEvidenceV1(envelope) {
+    assertInvokeInputEnvelopeV2(envelope);
+    return Object.freeze({
+        version: INVOKE_INPUT_EVIDENCE_VERSION,
+        source: envelope.source,
+        byteLength: envelope.byteLength,
+        sha256: envelope.sha256,
+        newlineStyle: envelope.newlineStyle,
+    });
+}
+export function assertInvokeInputEvidenceV1(value, rawArgs) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('INVOKE_INPUT_EVIDENCE_INVALID');
+    }
+    const candidate = value;
+    const expectedKeys = ['byteLength', 'newlineStyle', 'sha256', 'source', 'version'];
+    const actualKeys = Object.keys(candidate).sort();
+    if (actualKeys.length !== expectedKeys.length
+        || actualKeys.some((key, index) => key !== expectedKeys[index])
+        || candidate.version !== INVOKE_INPUT_EVIDENCE_VERSION
+        || !['args', 'stdin', 'args-file'].includes(String(candidate.source))
+        || !Number.isSafeInteger(candidate.byteLength)
+        || candidate.byteLength < 0
+        || typeof candidate.sha256 !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.sha256)
+        || !['none', 'lf', 'crlf', 'mixed'].includes(String(candidate.newlineStyle))) {
+        throw new Error('INVOKE_INPUT_EVIDENCE_INVALID');
+    }
+    if (rawArgs !== undefined
+        && (candidate.byteLength !== Buffer.byteLength(rawArgs, 'utf8')
+            || candidate.sha256 !== invokeInputSha256(rawArgs)
+            || candidate.newlineStyle !== classifyNewlineStyle(rawArgs))) {
+        throw new Error('INVOKE_INPUT_EVIDENCE_CONFLICT');
+    }
+}
+export function assertInvokeInputEnvelopeV2(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('INVOKE_INPUT_ENVELOPE_INVALID');
+    }
+    const candidate = value;
+    if (candidate.version !== INVOKE_INPUT_ENVELOPE_VERSION) {
+        throw new Error('INVOKE_INPUT_ENVELOPE_VERSION_UNSUPPORTED');
+    }
+    const expectedKeys = ['admissionView', 'byteLength', 'newlineStyle', 'rawArgs', 'sha256', 'source', 'version'];
+    const actualKeys = Object.keys(candidate).sort();
+    if (actualKeys.length !== expectedKeys.length
+        || actualKeys.some((key, index) => key !== expectedKeys[index])
+        || !['args', 'stdin', 'args-file'].includes(String(candidate.source))
+        || typeof candidate.rawArgs !== 'string'
+        || !Number.isSafeInteger(candidate.byteLength)
+        || typeof candidate.sha256 !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.sha256)
+        || !['none', 'lf', 'crlf', 'mixed'].includes(String(candidate.newlineStyle))
+        || typeof candidate.admissionView !== 'string') {
+        throw new Error('INVOKE_INPUT_ENVELOPE_INVALID');
+    }
+    if (candidate.byteLength !== Buffer.byteLength(candidate.rawArgs, 'utf8')
+        || candidate.sha256 !== invokeInputSha256(candidate.rawArgs)
+        || candidate.newlineStyle !== classifyNewlineStyle(candidate.rawArgs)
+        || candidate.admissionView !== candidate.rawArgs.trim()) {
+        throw new Error('INVOKE_INPUT_ENVELOPE_INTEGRITY');
+    }
+}

package/packages/shared/dist/invocation/project-identity-migration.d.ts

@@ -0,0 +1,28 @@
+export declare const PROJECT_IDENTITY_MIGRATION_VERSION: 1;
+export declare const PROJECT_IDENTITY_MIGRATION_CAPABILITY: "project-identity-migration-v1";
+export declare const PROJECT_ID_PATTERN: RegExp;
+export declare const PROJECT_IDENTITY_OPERATION_PATTERN: RegExp;
+export declare const SHA256_HEX_PATTERN: RegExp;
+export declare const MAX_LEGACY_EPIC_FLOOR: number;
+export interface ProjectIdentityMigrationRequestV1 {
+    readonly version: typeof PROJECT_IDENTITY_MIGRATION_VERSION;
+    readonly operationId: string;
+    readonly projectId: string;
+    readonly localStateDigest: string;
+    readonly legacyEpicFloor: number;
+    readonly phase: 'prepare' | 'seed';
+}
+export interface ProjectIdentityMigrationReceiptV1 {
+    readonly version: typeof PROJECT_IDENTITY_MIGRATION_VERSION;
+    readonly operationId: string;
+    readonly projectId: string;
+    readonly status: 'seeded' | 'already-seeded';
+    readonly acceptedLegacyFloor: number;
+    readonly nextEpicNumber: number;
+    readonly serverCapability: typeof PROJECT_IDENTITY_MIGRATION_CAPABILITY;
+    readonly receiptDigest: string;
+}
+export type ProjectIdentityMigrationReceiptBodyV1 = Omit<ProjectIdentityMigrationReceiptV1, 'receiptDigest'>;
+export declare function computeProjectIdentityMigrationReceiptDigestV1(receipt: ProjectIdentityMigrationReceiptBodyV1): string;
+export declare function assertProjectIdentityMigrationRequestV1(value: unknown): asserts value is ProjectIdentityMigrationRequestV1;
+export declare function assertProjectIdentityMigrationReceiptV1(value: unknown): asserts value is ProjectIdentityMigrationReceiptV1;

package/packages/shared/dist/invocation/project-identity-migration.js

@@ -0,0 +1,83 @@
+export const PROJECT_IDENTITY_MIGRATION_VERSION = 1;
+export const PROJECT_IDENTITY_MIGRATION_CAPABILITY = 'project-identity-migration-v1';
+export const PROJECT_ID_PATTERN = /^prj_[a-f0-9]{32}$/;
+export const PROJECT_IDENTITY_OPERATION_PATTERN = /^mig_[a-f0-9]{32}$/;
+export const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+export const MAX_LEGACY_EPIC_FLOOR = Number.MAX_SAFE_INTEGER - 1;
+export function computeProjectIdentityMigrationReceiptDigestV1(receipt) {
+    const canonicalBody = {
+        version: receipt.version,
+        operationId: receipt.operationId,
+        projectId: receipt.projectId,
+        status: receipt.status,
+        acceptedLegacyFloor: receipt.acceptedLegacyFloor,
+        nextEpicNumber: receipt.nextEpicNumber,
+        serverCapability: receipt.serverCapability,
+    };
+    return createHash('sha256')
+        .update(`nx-project-identity-migration-receipt-v1\0${JSON.stringify(canonicalBody)}`, 'utf8')
+        .digest('hex');
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validFloor(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}
+export function assertProjectIdentityMigrationRequestV1(value) {
+    const candidate = record(value);
+    if (candidate?.version !== PROJECT_IDENTITY_MIGRATION_VERSION) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_VERSION_UNSUPPORTED');
+    }
+    const keys = ['legacyEpicFloor', 'localStateDigest', 'operationId', 'phase', 'projectId', 'version'];
+    if (!exactKeys(candidate, keys)
+        || typeof candidate.operationId !== 'string'
+        || !PROJECT_IDENTITY_OPERATION_PATTERN.test(candidate.operationId)
+        || typeof candidate.projectId !== 'string'
+        || !PROJECT_ID_PATTERN.test(candidate.projectId)
+        || typeof candidate.localStateDigest !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.localStateDigest)
+        || (candidate.phase !== 'prepare' && candidate.phase !== 'seed')
+        || !validFloor(candidate.legacyEpicFloor)) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_INVALID');
+    }
+    if (candidate.legacyEpicFloor > MAX_LEGACY_EPIC_FLOOR) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_FLOOR_LIMIT');
+    }
+}
+export function assertProjectIdentityMigrationReceiptV1(value) {
+    const candidate = record(value);
+    if (candidate?.version !== PROJECT_IDENTITY_MIGRATION_VERSION) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_RECEIPT_VERSION_UNSUPPORTED');
+    }
+    const keys = [
+        'acceptedLegacyFloor', 'nextEpicNumber', 'operationId', 'projectId',
+        'receiptDigest', 'serverCapability', 'status', 'version',
+    ];
+    if (!exactKeys(candidate, keys)
+        || typeof candidate.operationId !== 'string'
+        || !PROJECT_IDENTITY_OPERATION_PATTERN.test(candidate.operationId)
+        || typeof candidate.projectId !== 'string'
+        || !PROJECT_ID_PATTERN.test(candidate.projectId)
+        || (candidate.status !== 'seeded' && candidate.status !== 'already-seeded')
+        || !validFloor(candidate.acceptedLegacyFloor)
+        || candidate.acceptedLegacyFloor > MAX_LEGACY_EPIC_FLOOR
+        || !Number.isSafeInteger(candidate.nextEpicNumber)
+        || candidate.nextEpicNumber <= candidate.acceptedLegacyFloor
+        || candidate.serverCapability !== PROJECT_IDENTITY_MIGRATION_CAPABILITY
+        || typeof candidate.receiptDigest !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.receiptDigest)) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_RECEIPT_INVALID');
+    }
+    const receipt = candidate;
+    if (receipt.receiptDigest !== computeProjectIdentityMigrationReceiptDigestV1(receipt)) {
+        throw new Error('PROJECT_IDENTITY_MIGRATION_RECEIPT_INVALID');
+    }
+}
+import { createHash } from 'node:crypto';

package/packages/shared/dist/invocation/public-diagnostics.d.ts

@@ -0,0 +1,87 @@
+import type { InvokeInputEvidenceV1 } from './input-envelope.js';
+import type { InvocationShapeV2 } from './state-projection.js';
+export declare const INVOCATION_PUBLIC_DIAGNOSTIC_VERSION: 1;
+export declare const INVOCATION_DIGEST_PREFIX_LENGTH = 12;
+export type InvocationPublicDiagnosticV1 = {
+    readonly version: 1;
+    readonly event: 'invoke.input';
+    readonly source: InvokeInputEvidenceV1['source'];
+    readonly bytesBucket: string;
+    readonly newlineStyle: InvokeInputEvidenceV1['newlineStyle'];
+    readonly digestPrefix: string;
+    readonly outcome: 'accepted' | 'rejected';
+    readonly reasonCode?: string;
+    readonly publicSafe: true;
+} | {
+    readonly version: 1;
+    readonly event: 'invoke.projection';
+    readonly shape: InvocationShapeV2;
+    readonly bytesBucket: string;
+    readonly includedEpics: number;
+    readonly includedStories: number;
+    readonly omittedEpics: number;
+    readonly omittedStories: number;
+    readonly nodes: number;
+    readonly edges: number;
+    readonly cycles: number;
+    readonly outcome: 'accepted' | 'rejected';
+    readonly reasonCode?: string;
+    readonly publicSafe: true;
+} | {
+    readonly version: 1;
+    readonly event: 'invoke.project-identity';
+    readonly phase: 'prepare' | 'seed' | 'remote-acknowledged' | 'finalize' | 'reconcile';
+    readonly outcome: 'prepared' | 'seeded' | 'already-seeded' | 'finalized' | 'rejected' | 'retry';
+    readonly floorBucket: string;
+    readonly scopeDigestPrefix: string;
+    readonly capability: 'project-identity-migration-v1';
+    readonly publicSafe: true;
+} | {
+    readonly version: 1;
+    readonly event: 'invoke.diagnose';
+    readonly authority: 'strict-read-only';
+    readonly receiptStatus: 'verified' | 'rejected';
+    readonly attemptedEffectCount: number;
+    readonly suppressedEffectCount: number;
+    readonly publicSafe: true;
+} | {
+    readonly version: 1;
+    readonly event: 'invoke.trace';
+    readonly stages: readonly ('admission' | 'input' | 'shape' | 'projection' | 'size-guard' | 'send')[];
+    readonly outcome: 'accepted' | 'rejected';
+    readonly reasonCode?: string;
+    readonly publicSafe: true;
+};
+export declare function invocationByteBucket(bytes: number): string;
+export declare function invocationFloorBucket(floor: number): string;
+export declare function invocationDigestPrefix(domain: string, value: string): string;
+export declare function buildInputPublicDiagnostic(evidence: InvokeInputEvidenceV1, outcome?: 'accepted' | 'rejected', reasonCode?: string): InvocationPublicDiagnosticV1;
+export declare function buildProjectionPublicDiagnostic(input: {
+    readonly shape: InvocationShapeV2;
+    readonly bytes: number;
+    readonly includedEpics: number;
+    readonly includedStories: number;
+    readonly omittedEpics: number;
+    readonly omittedStories: number;
+    readonly nodes?: number;
+    readonly edges?: number;
+    readonly cycles?: number;
+    readonly outcome?: 'accepted' | 'rejected';
+    readonly reasonCode?: string;
+}): InvocationPublicDiagnosticV1;
+export declare function buildProjectIdentityPublicDiagnostic(input: {
+    readonly phase: Extract<InvocationPublicDiagnosticV1, {
+        event: 'invoke.project-identity';
+    }>['phase'];
+    readonly outcome: Extract<InvocationPublicDiagnosticV1, {
+        event: 'invoke.project-identity';
+    }>['outcome'];
+    readonly floor: number;
+    readonly licenseId: string;
+    readonly projectId: string;
+}): InvocationPublicDiagnosticV1;
+export declare function buildDiagnosePublicDiagnostic(receiptStatus: 'verified' | 'rejected', attemptedEffectCount: number, suppressedEffectCount: number): InvocationPublicDiagnosticV1;
+export declare function buildInvokeTracePublicDiagnostic(stages: Extract<InvocationPublicDiagnosticV1, {
+    event: 'invoke.trace';
+}>['stages'], outcome: 'accepted' | 'rejected', reasonCode?: string): InvocationPublicDiagnosticV1;
+export declare function assertInvocationPublicDiagnosticV1(value: unknown): asserts value is InvocationPublicDiagnosticV1;