@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.131

package/ds-canonical/fork/launchers/authority-decision-evidence.mjs

@@ -0,0 +1,413 @@
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+
+export const AUTHORITY_DECISION_RECEIPT_KIND = 'provider-neutral-authority-decision-receipt'
+export const AUTHORITY_DECISION_RECEIPT_SCHEMA_VERSION = 2
+export const AUTHORITY_DECISION_POLICY_ID = 'canonical-decision-authority-v1'
+export const AUTHORITY_DECISION_CLASSIFIER_ID = 'approval-evidence-v1'
+
+const AUTHORITY_START = '<!-- canonical-decision-authority:start -->'
+const AUTHORITY_END = '<!-- canonical-decision-authority:end -->'
+const SHA256 = /^sha256:[a-f0-9]{64}$/
+const PROVIDER_ID = /^[a-z][a-z0-9-]*$/
+const RUNTIME_SURFACE = /^[a-z0-9][a-z0-9._/-]{0,255}$/
+const MAX_TARGET_BYTES = 16 * 1024
+const MAX_OPERATION_BYTES = 16 * 1024 * 1024
+const MAX_USER_MESSAGE_BYTES = 4 * 1024 * 1024
+const MAX_USER_MESSAGES_BYTES = 16 * 1024 * 1024
+const MAX_USER_MESSAGE_COUNT = 4096
+const MAX_SCOPE_VALUE_BYTES = 4096
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize)
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value)
+        .filter((key) => value[key] !== undefined)
+        .sort((left, right) => Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8')))
+        .map((key) => [key, canonicalize(value[key])]),
+    )
+  }
+  return value
+}
+
+function stableJson(value) {
+  return `${JSON.stringify(canonicalize(value), null, 2)}\n`
+}
+
+function digest(value) {
+  const bytes = Buffer.isBuffer(value)
+    ? value
+    : Buffer.from(typeof value === 'string' ? value : stableJson(value))
+  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`
+}
+
+const RECEIPT_KEYS = Object.freeze([
+  'binding',
+  'classification',
+  'classificationMode',
+  'kind',
+  'receiptDigest',
+  'schemaVersion',
+  'source',
+  'trust',
+])
+const BINDING_KEYS = Object.freeze([
+  'operationEvidenceDigest',
+  'providerId',
+  'runtimeSurface',
+  'scopeNonceDigest',
+  'sessionDigest',
+  'target',
+  'userMessagesDigest',
+])
+const SOURCE_KEYS = Object.freeze([
+  'authorityPolicy',
+  'authorityPolicyDigest',
+  'classifier',
+  'classifierDigest',
+  'providerRegistry',
+  'providerRegistryDigest',
+  'receiptContract',
+  'receiptContractDigest',
+])
+const TRUST_KEYS = Object.freeze([
+  'contentAddressed',
+  'promotionEligible',
+  'rawAuthorityTextStored',
+  'rawOperationTextStored',
+  'runtimeCertification',
+])
+const CLASSIFICATION_KEYS = Object.freeze([
+  'allowedScopes',
+  'decision',
+  'decisionDomain',
+  'decisionMessageSha256',
+  'deniedOrAmbiguousScopes',
+  'humanOnlyScopes',
+  'latestUserMessageSha256',
+  'operationEvidenceSha256',
+  'reasonCode',
+  'target',
+  'targetBinding',
+])
+const CLASSIFICATION_SCOPE_IDS = new Set([
+  'account-holder-platform-action',
+  'approved-ui-ux-implementation',
+  'consumer-template-adoption',
+  'credential-reference-required',
+  'current-target-operation',
+  'engineering-execution',
+  'external-activation',
+  'github-configuration',
+  'legal-account-organization-business-decision',
+  'mechanical-approved-ssot-projection',
+  'package-release',
+  'plan-external-spend',
+  'product-ui-ux-change',
+  'product-ui-ux-decision',
+  'protected-git-delivery',
+  'rollback-recovery',
+  'rollout',
+  'runtime-certification',
+  'testing-and-harness',
+])
+
+export class AuthorityDecisionEvidenceError extends Error {
+  constructor(code, detail) {
+    super(`authority decision evidence blocked:${code}:${detail}`)
+    this.name = 'AuthorityDecisionEvidenceError'
+    this.code = code
+  }
+}
+
+function block(code, detail) {
+  throw new AuthorityDecisionEvidenceError(code, detail)
+}
+
+function exactObject(value, keys, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    block('RECEIPT_SHAPE_INVALID', `${label} must be an object`)
+  }
+  const actual = Object.keys(value).sort()
+  const expected = [...keys].sort()
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    block('RECEIPT_SHAPE_INVALID', `${label} has an open or incomplete shape`)
+  }
+  return value
+}
+
+function exactString(value, label, maximumBytes, { pattern = null, allowEmpty = false } = {}) {
+  if (typeof value !== 'string' || (!allowEmpty && value.length === 0)) {
+    block('INPUT_INVALID', `${label} must be ${allowEmpty ? 'a' : 'a non-empty'} string`)
+  }
+  const bytes = Buffer.byteLength(value, 'utf8')
+  if (bytes > maximumBytes || value.includes('\0')) {
+    block('INPUT_INVALID', `${label} exceeds its closed byte or character contract`)
+  }
+  if (pattern && !pattern.test(value)) block('INPUT_INVALID', `${label} has an invalid format`)
+  return value
+}
+
+function exactBytes(value, label) {
+  if (!(typeof value === 'string' || Buffer.isBuffer(value) || ArrayBuffer.isView(value))) {
+    block('INPUT_INVALID', `${label} bytes are unavailable`)
+  }
+  return Buffer.isBuffer(value) ? Buffer.from(value) : Buffer.from(value)
+}
+
+function exactDigest(value, label) {
+  if (typeof value !== 'string' || !SHA256.test(value)) {
+    block('RECEIPT_SHAPE_INVALID', `${label} is not a canonical sha256 digest`)
+  }
+  return value
+}
+
+function exactBoolean(value, expected, label) {
+  if (value !== expected) block('RECEIPT_SHAPE_INVALID', `${label} is invalid`)
+}
+
+function normalizedUserMessages(value) {
+  if (!Array.isArray(value) || value.length > MAX_USER_MESSAGE_COUNT) {
+    block('INPUT_INVALID', 'userMessages must be one bounded array')
+  }
+  let aggregate = 0
+  const messages = value.map((message, index) => {
+    exactString(message, `userMessages[${index}]`, MAX_USER_MESSAGE_BYTES, { allowEmpty: false })
+    aggregate += Buffer.byteLength(message, 'utf8')
+    if (aggregate > MAX_USER_MESSAGES_BYTES) {
+      block('INPUT_INVALID', 'userMessages exceed the aggregate byte contract')
+    }
+    return message
+  })
+  return messages
+}
+
+function registeredProvider(registry, providerId) {
+  if (!registry || typeof registry !== 'object' || Array.isArray(registry)
+    || !Array.isArray(registry.providers)) {
+    block('PROVIDER_REGISTRY_INVALID', 'provider registry has no closed provider list')
+  }
+  exactString(providerId, 'providerId', 128, { pattern: PROVIDER_ID })
+  const matches = registry.providers.filter((provider) => provider?.id === providerId)
+  if (matches.length !== 1) {
+    block(matches.length === 0 ? 'PROVIDER_UNKNOWN' : 'PROVIDER_REGISTRY_INVALID', providerId)
+  }
+  return matches[0]
+}
+
+function canonicalAuthorityPolicy(bytes) {
+  const text = exactBytes(bytes, 'authority policy').toString('utf8')
+  const start = text.indexOf(AUTHORITY_START)
+  const end = text.indexOf(AUTHORITY_END)
+  if (start < 0 || end < start
+    || text.indexOf(AUTHORITY_START, start + AUTHORITY_START.length) >= 0
+    || text.indexOf(AUTHORITY_END, end + AUTHORITY_END.length) >= 0) {
+    block('AUTHORITY_POLICY_INVALID', 'canonical authority markers must occur exactly once')
+  }
+  return `${text.slice(start, end + AUTHORITY_END.length)}\n`
+}
+
+function classifierFunctions(classifier) {
+  if (!classifier || typeof classifier !== 'object'
+    || typeof classifier.classifyLatestAuthorization !== 'function'
+    || typeof classifier.classifyOperationAuthorization !== 'function') {
+    block('CLASSIFIER_INVALID', 'canonical authority classifier functions are unavailable')
+  }
+  return classifier
+}
+
+function classificationScopes(value, label) {
+  if (!Array.isArray(value)
+    || value.some((scope) => typeof scope !== 'string' || !CLASSIFICATION_SCOPE_IDS.has(scope))) {
+    block('CLASSIFIER_INVALID', `${label} is not one closed scope list`)
+  }
+  const sorted = [...value].sort((left, right) => (
+    Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'))
+  ))
+  if (new Set(value).size !== value.length
+    || value.some((scope, index) => scope !== sorted[index])) {
+    block('CLASSIFIER_INVALID', `${label} is not sorted and unique`)
+  }
+  return value
+}
+
+function classificationResult(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || !['approved', 'blocked'].includes(value.decision)
+    || !['engineering-remediation', 'product-ui-ux', 'unknown'].includes(value.decisionDomain)
+    || typeof value.reasonCode !== 'string'
+    || typeof value.operationEvidenceSha256 !== 'string'
+    || !/^[a-f0-9]{64}$/.test(value.operationEvidenceSha256)) {
+    block('CLASSIFIER_INVALID', 'canonical classifier returned an invalid decision')
+  }
+  const actualKeys = Object.keys(value).sort()
+  const expectedKeys = [...CLASSIFICATION_KEYS].sort()
+  if (actualKeys.length !== expectedKeys.length
+    || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    block('CLASSIFIER_INVALID', 'canonical classifier returned an open or incomplete decision')
+  }
+  const scopeLists = [
+    classificationScopes(value.allowedScopes, 'classification.allowedScopes'),
+    classificationScopes(value.humanOnlyScopes, 'classification.humanOnlyScopes'),
+    classificationScopes(
+      value.deniedOrAmbiguousScopes,
+      'classification.deniedOrAmbiguousScopes',
+    ),
+  ]
+  const allScopes = scopeLists.flat()
+  if (new Set(allScopes).size !== allScopes.length) {
+    block('CLASSIFIER_INVALID', 'classification scope lists overlap')
+  }
+  return canonicalize(value)
+}
+
+function receiptPayload({
+  authorityPolicyBytes,
+  classifierSourceBytes,
+  receiptContractSourceBytes,
+  classifier,
+  providerRegistry,
+  providerRegistrySource = 'packages/governance/canonical/providers.json',
+  providerId,
+  runtimeSurface,
+  sessionId,
+  scopeNonce,
+  target,
+  operationText,
+  userMessages,
+}) {
+  registeredProvider(providerRegistry, providerId)
+  exactString(providerRegistrySource, 'providerRegistrySource', 512)
+  if (providerRegistrySource.includes('\\')
+    || providerRegistrySource.startsWith('/')
+    || providerRegistrySource.split('#', 1)[0].split('/').some((segment) => (
+      !segment || segment === '.' || segment === '..'
+    ))) {
+    block('INPUT_INVALID', 'providerRegistrySource is not one canonical repository reference')
+  }
+  exactString(runtimeSurface, 'runtimeSurface', 256, { pattern: RUNTIME_SURFACE })
+  exactString(sessionId, 'sessionId', MAX_SCOPE_VALUE_BYTES)
+  exactString(scopeNonce, 'scopeNonce', MAX_SCOPE_VALUE_BYTES)
+  exactString(target, 'target', MAX_TARGET_BYTES)
+  exactString(operationText, 'operationText', MAX_OPERATION_BYTES, { allowEmpty: true })
+  const messages = normalizedUserMessages(userMessages)
+  const functions = classifierFunctions(classifier)
+  const classificationMode = messages.length ? 'user-context' : 'operation-only'
+  const classification = classificationResult(messages.length
+    ? functions.classifyLatestAuthorization(messages.at(-1), {
+      target,
+      operationText,
+      userMessages: messages,
+    })
+    : functions.classifyOperationAuthorization({ target, operationText }))
+  const authorityPolicy = canonicalAuthorityPolicy(authorityPolicyBytes)
+  const classifierBytes = exactBytes(classifierSourceBytes, 'classifier source')
+  const receiptContractBytes = exactBytes(receiptContractSourceBytes, 'receipt contract source')
+  return canonicalize({
+    schemaVersion: AUTHORITY_DECISION_RECEIPT_SCHEMA_VERSION,
+    kind: AUTHORITY_DECISION_RECEIPT_KIND,
+    source: {
+      authorityPolicy: 'AGENTS.md#canonical-decision-authority',
+      authorityPolicyDigest: digest(authorityPolicy),
+      classifier: 'packages/design-system/ds-canonical/hooks/lib/approval-evidence.mjs',
+      classifierDigest: digest(classifierBytes),
+      providerRegistry: providerRegistrySource,
+      providerRegistryDigest: digest(providerRegistry),
+      receiptContract: 'packages/governance/src/authority-decision-evidence.mjs',
+      receiptContractDigest: digest(receiptContractBytes),
+    },
+    binding: {
+      providerId,
+      runtimeSurface,
+      sessionDigest: digest(sessionId),
+      scopeNonceDigest: digest(scopeNonce),
+      userMessagesDigest: digest(messages),
+      target: classification.target,
+      operationEvidenceDigest: `sha256:${classification.operationEvidenceSha256}`,
+    },
+    classificationMode,
+    classification,
+    trust: {
+      contentAddressed: true,
+      runtimeCertification: 'not-certified',
+      promotionEligible: false,
+      rawAuthorityTextStored: false,
+      rawOperationTextStored: false,
+    },
+  })
+}
+
+export function prepareAuthorityDecisionReceipt(input = {}) {
+  const payload = receiptPayload(input)
+  return canonicalize({
+    ...payload,
+    receiptDigest: digest(payload),
+  })
+}
+
+export function validateAuthorityDecisionReceiptShape(receipt) {
+  exactObject(receipt, RECEIPT_KEYS, 'receipt')
+  if (receipt.schemaVersion !== AUTHORITY_DECISION_RECEIPT_SCHEMA_VERSION
+    || receipt.kind !== AUTHORITY_DECISION_RECEIPT_KIND) {
+    block('RECEIPT_SHAPE_INVALID', 'receipt identity is invalid')
+  }
+  exactObject(receipt.source, SOURCE_KEYS, 'receipt.source')
+  exactObject(receipt.binding, BINDING_KEYS, 'receipt.binding')
+  exactObject(receipt.trust, TRUST_KEYS, 'receipt.trust')
+  for (const [key, value] of Object.entries(receipt.source)) {
+    if (key.endsWith('Digest')) exactDigest(value, `receipt.source.${key}`)
+    else exactString(value, `receipt.source.${key}`, 512)
+  }
+  for (const key of [
+    'operationEvidenceDigest',
+    'scopeNonceDigest',
+    'sessionDigest',
+    'userMessagesDigest',
+  ]) exactDigest(receipt.binding[key], `receipt.binding.${key}`)
+  exactString(receipt.binding.providerId, 'receipt.binding.providerId', 128, { pattern: PROVIDER_ID })
+  exactString(receipt.binding.runtimeSurface, 'receipt.binding.runtimeSurface', 256, { pattern: RUNTIME_SURFACE })
+  exactString(receipt.binding.target, 'receipt.binding.target', MAX_TARGET_BYTES)
+  if (!['user-context', 'operation-only'].includes(receipt.classificationMode)) {
+    block('RECEIPT_SHAPE_INVALID', 'classificationMode is invalid')
+  }
+  classificationResult(receipt.classification)
+  exactBoolean(receipt.trust.contentAddressed, true, 'receipt.trust.contentAddressed')
+  exactBoolean(receipt.trust.promotionEligible, false, 'receipt.trust.promotionEligible')
+  exactBoolean(receipt.trust.rawAuthorityTextStored, false, 'receipt.trust.rawAuthorityTextStored')
+  exactBoolean(receipt.trust.rawOperationTextStored, false, 'receipt.trust.rawOperationTextStored')
+  if (receipt.trust.runtimeCertification !== 'not-certified') {
+    block('RECEIPT_SHAPE_INVALID', 'receipt must not claim runtime certification')
+  }
+  exactDigest(receipt.receiptDigest, 'receipt.receiptDigest')
+  const { receiptDigest, ...payload } = receipt
+  if (digest(payload) !== receiptDigest) {
+    block('RECEIPT_DIGEST_MISMATCH', 'receipt content address does not match its payload')
+  }
+  return true
+}
+
+export function verifyAuthorityDecisionReceipt({ receipt, ...expectedInput } = {}) {
+  validateAuthorityDecisionReceiptShape(receipt)
+  const expected = prepareAuthorityDecisionReceipt(expectedInput)
+  const checks = [
+    ['source.authorityPolicyDigest', receipt.source.authorityPolicyDigest, expected.source.authorityPolicyDigest, 'AUTHORITY_POLICY_STALE'],
+    ['source.classifierDigest', receipt.source.classifierDigest, expected.source.classifierDigest, 'CLASSIFIER_STALE'],
+    ['source.providerRegistryDigest', receipt.source.providerRegistryDigest, expected.source.providerRegistryDigest, 'PROVIDER_REGISTRY_STALE'],
+    ['source.receiptContractDigest', receipt.source.receiptContractDigest, expected.source.receiptContractDigest, 'RECEIPT_CONTRACT_STALE'],
+    ['binding.providerId', receipt.binding.providerId, expected.binding.providerId, 'PROVIDER_SUBSTITUTION'],
+    ['binding.runtimeSurface', receipt.binding.runtimeSurface, expected.binding.runtimeSurface, 'RUNTIME_SURFACE_SUBSTITUTION'],
+    ['binding.sessionDigest', receipt.binding.sessionDigest, expected.binding.sessionDigest, 'SESSION_SUBSTITUTION'],
+    ['binding.scopeNonceDigest', receipt.binding.scopeNonceDigest, expected.binding.scopeNonceDigest, 'REPLAY_OR_SCOPE_MISMATCH'],
+    ['binding.userMessagesDigest', receipt.binding.userMessagesDigest, expected.binding.userMessagesDigest, 'AUTHORITY_CONTEXT_SUBSTITUTION'],
+    ['binding.target', receipt.binding.target, expected.binding.target, 'TARGET_SUBSTITUTION'],
+    ['binding.operationEvidenceDigest', receipt.binding.operationEvidenceDigest, expected.binding.operationEvidenceDigest, 'OPERATION_SUBSTITUTION'],
+  ]
+  for (const [label, actual, expectedValue, code] of checks) {
+    if (actual !== expectedValue) block(code, label)
+  }
+  if (stableJson(receipt) !== stableJson(expected)) {
+    block('RECEIPT_NONCANONICAL', 'receipt differs from the current canonical classifier result')
+  }
+  return true
+}

package/ds-canonical/fork/launchers/canonical-order.mjs

@@ -0,0 +1,8 @@
+import { Buffer } from 'node:buffer'
+
+// Zero-I/O ordering primitive shared by authority, package, generated adapter, fork, and
+// product-template runtimes. Canonical artifacts preserve code points exactly and compare
+// their UTF-8 bytes; host locale collation and implicit Unicode normalization are forbidden.
+export function compareUtf8Bytes(left, right) {
+  return Buffer.compare(Buffer.from(String(left), 'utf8'), Buffer.from(String(right), 'utf8'))
+}

package/ds-canonical/fork/launchers/fork-governance-dispatcher.sh

@@ -0,0 +1,154 @@
+#!/bin/bash
+# fork-governance-dispatcher.sh — C-prime 治理派發器(committed in fork,極穩定、幾乎永不改)
+#
+# 這是 fork repo 唯一 commit 的「啟動器」:讀 npm 套件 ship 的 fork 治理 manifest,跑當下這個
+# event 的所有官方 fork hook。DS 未來治理增刪改 → immutable release 重生 manifest → consumer
+# 經 reviewed exact-version PR 升級後，本派發器才切到新 snapshot(committed 設定不用逐 rule 改)。
+#
+# 設計鐵則:
+#   - 本體在 exact-version node_modules payload(由 lockfile + upgrade PR 控管)
+#   - manifest 缺 → exit 0 不 brick；provider-neutral hard gate 會 fail-closed 報 degraded
+#   - descriptor-declared policy hook exit 2(BLOCKER)→ 派發器 exit 2(轉發攔截)
+#   - rc70、undefined exit、malformed/mixed output → integrity exit 70，絕不偽裝 policy 或 clean
+#   - proposed-text-v1 只收 canonical normalizer 由 provider mutation materialize 的完整 after-image
+
+set -uo pipefail
+
+# Generated provider argv removes the fixed pre-launch injection set before this
+# Bash process starts. Repeat the complete pattern here with Bash builtins so an
+# older adapter, a direct invocation, or a future provider cannot pass startup
+# injection to Git, jq, Python, Node, or a nested hook. The provider process and
+# any command shell it starts *before* the generated argv are necessarily part
+# of the native-host trust boundary; protected hooks-off CI remains authoritative.
+while IFS= read -r runtime_environment_name; do
+  case "$runtime_environment_name" in
+    PATH|GIT_*|BASH_ENV|ENV|SHELLOPTS|BASHOPTS|CDPATH|GLOBIGNORE|NODE_OPTIONS|NODE_PATH|PYTHONHOME|PYTHONPATH|PYTHONSTARTUP|PYTHONINSPECT|PERL5OPT|RUBYOPT|LD_*|DYLD_*)
+      builtin unset "$runtime_environment_name" 2>/dev/null || true
+      ;;
+  esac
+done < <(builtin compgen -e)
+export PATH="/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+while IFS= read -r inherited_function_name; do
+  builtin unset -f "$inherited_function_name" 2>/dev/null || true
+done < <(builtin compgen -A function)
+
+integrity_failure() {
+  printf 'GOVERNANCE_INTEGRITY:%s\n' "$1" >&2
+  exit 70
+}
+
+# Provider payloads are unbounded and belong exclusively on stdin. Scrub the canonical name and
+# every provider-neutral alias convention before the first external process is launched; compgen,
+# case, and unset are Bash builtins and therefore cannot hit the exec environment-size limit.
+while IFS= read -r payload_environment_name; do
+  case "$payload_environment_name" in
+    GOVERNANCE_TOOL_INPUT|*_TOOL_INPUT) builtin unset "$payload_environment_name" ;;
+  esac
+done < <(builtin compgen -e)
+
+# Bootstrap the neutral root before the installed manifest is reachable. The launcher's own Git
+# checkout is the trust anchor; inherited provider variables may identify it but may never redirect
+# this process into a different checkout.
+PROVIDER="${1:-${GOVERNANCE_PROVIDER:-claude}}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+PROJECT_HINT="${GOVERNANCE_PROJECT_DIR:-${CLAUDE_PROJECT_DIR:-$PWD}}"
+PROJECT_DIR="$(/usr/bin/git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)"
+HINT_ROOT="$(/usr/bin/git -C "$PROJECT_HINT" rev-parse --show-toplevel 2>/dev/null || true)"
+if [ -z "$PROJECT_DIR" ] || [ -z "$HINT_ROOT" ]; then
+  integrity_failure "PROJECT_ROOT_UNVERIFIED"
+fi
+PROJECT_DIR="$(cd "$PROJECT_DIR" && pwd -P)"
+HINT_ROOT="$(cd "$HINT_ROOT" && pwd -P)"
+if [ "$PROJECT_DIR" != "$HINT_ROOT" ]; then
+  integrity_failure "PROJECT_ROOT_MISMATCH"
+fi
+export GOVERNANCE_PROVIDER="$PROVIDER"
+export GOVERNANCE_PROJECT_DIR="$PROJECT_DIR"
+
+DS_FORK="$GOVERNANCE_PROJECT_DIR/node_modules/@qijenchen/design-system/ds-canonical/fork"
+MANIFEST="$DS_FORK/manifest.json"
+
+# 治理 payload 未就位 → native hook 不 brick；governance check/CI 負責 fail-closed
+[ -f "$MANIFEST" ] || exit 0
+
+if ! /usr/bin/jq -e --arg provider "$PROVIDER" '.providerAdapters[$provider] | type == "object"' "$MANIFEST" >/dev/null 2>&1; then
+  integrity_failure "ADAPTER_UNKNOWN:${PROVIDER}"
+fi
+
+# The registry-generated manifest is the only owner of provider-specific environment aliases.
+# This keeps future adapters data-only: declare a map in providers.json, rebuild, and dispatch.
+while IFS=$'\t' read -r canonical provider_name; do
+  [[ "$canonical" =~ ^[A-Z][A-Z0-9_]*$ ]] || integrity_failure "ADAPTER_ENVIRONMENT_CANONICAL_NAME_INVALID"
+  [[ "$provider_name" =~ ^[A-Z][A-Z0-9_]*$ ]] || integrity_failure "ADAPTER_ENVIRONMENT_NATIVE_NAME_INVALID"
+  if [ "$canonical" = "GOVERNANCE_TOOL_INPUT" ]; then
+    [[ "$provider_name" =~ ^[A-Z][A-Z0-9_]*_TOOL_INPUT$ ]] \
+      || integrity_failure "ADAPTER_TOOL_INPUT_ALIAS_INVALID"
+    unset "$canonical" "$provider_name"
+    continue
+  fi
+  [ -n "$(printenv "$canonical" 2>/dev/null || true)" ] && continue
+  provider_value="$(printenv "$provider_name" 2>/dev/null || true)"
+  [ -n "$provider_value" ] && export "$canonical=$provider_value"
+done < <(/usr/bin/jq -r --arg provider "$PROVIDER" '.providerAdapters[$provider].environmentMap // {} | to_entries[] | [.key, .value] | @tsv' "$MANIFEST" 2>/dev/null)
+
+# Print a lexical absolute path only when every existing component from the trusted root is a
+# real file-system entry. Never use realpath on the candidate: that would silently follow and
+# bless a pre-positioned governance-runtime symlink.
+safe_runtime_path() {
+  /usr/bin/python3 - "$1" "$2" <<'PY'
+import os
+import sys
+
+root = os.path.abspath(sys.argv[1])
+target = os.path.abspath(sys.argv[2])
+try:
+    if os.path.commonpath([root, target]) != root:
+        raise ValueError('escape')
+except ValueError:
+    raise SystemExit(2)
+
+cursor = root
+if os.path.lexists(cursor) and os.path.islink(cursor):
+    raise SystemExit(2)
+relative = os.path.relpath(target, root)
+if relative != '.':
+    for segment in relative.split(os.sep):
+        cursor = os.path.join(cursor, segment)
+        if not os.path.lexists(cursor):
+            break
+        if os.path.islink(cursor):
+            raise SystemExit(2)
+print(target)
+PY
+}
+
+GIT_DIR="$(/usr/bin/git -C "$PROJECT_DIR" rev-parse --absolute-git-dir 2>/dev/null || true)"
+[ -n "$GIT_DIR" ] || integrity_failure "RUNTIME_ROOT_UNAVAILABLE"
+GIT_DIR="$(cd "$GIT_DIR" 2>/dev/null && pwd -P)"
+[ -n "$GIT_DIR" ] || integrity_failure "RUNTIME_ROOT_UNAVAILABLE"
+RUNTIME_ROOT="$(safe_runtime_path "$GIT_DIR" "$GIT_DIR/governance-runtime" 2>/dev/null)"
+[ -n "$RUNTIME_ROOT" ] || integrity_failure "RUNTIME_PATH_SYMLINK_OR_ESCAPE"
+TELEMETRY_OPT_IN=0
+if [ "${GOVERNANCE_TELEMETRY_OPT_IN:-0}" = "1" ] && [ "${GOVERNANCE_READ_ONLY:-0}" != "1" ]; then
+  TELEMETRY_OPT_IN=1
+fi
+STATE_DIR="$RUNTIME_ROOT"
+if [ "$TELEMETRY_OPT_IN" = "1" ] && [ -n "${GOVERNANCE_STATE_DIR:-}" ]; then
+  STATE_CANDIDATE="$(/usr/bin/python3 -c 'import os,sys; print(os.path.abspath(sys.argv[1]))' "$GOVERNANCE_STATE_DIR" 2>/dev/null)"
+  case "$STATE_CANDIDATE" in
+    "$RUNTIME_ROOT"|"$RUNTIME_ROOT"/*) ;;
+    *) integrity_failure "STATE_DIR_OUTSIDE_RUNTIME_ROOT" ;;
+  esac
+  STATE_DIR="$(safe_runtime_path "$RUNTIME_ROOT" "$STATE_CANDIDATE" 2>/dev/null)"
+  [ -n "$STATE_DIR" ] || integrity_failure "STATE_DIR_SYMLINK_OR_ESCAPE"
+fi
+export GOVERNANCE_RUNTIME_ROOT="$RUNTIME_ROOT"
+export GOVERNANCE_STATE_DIR="$STATE_DIR"
+export GOVERNANCE_TELEMETRY_OPT_IN="$TELEMETRY_OPT_IN"
+export GOVERNANCE_TRANSCRIPT_PATH=""
+export GOVERNANCE_TRANSCRIPT_TRUST="unavailable"
+export GOVERNANCE_WRITE_STATE_TRUST="unavailable"
+
+RUNTIME="$SCRIPT_DIR/product-hook-dispatch-runtime.mjs"
+[ -f "$RUNTIME" ] && [ ! -L "$RUNTIME" ] || integrity_failure "PRODUCT_HOOK_RUNTIME_UNAVAILABLE_OR_UNSAFE"
+exec node "$RUNTIME" "$PROVIDER" "$MANIFEST" "$DS_FORK"

package/ds-canonical/fork/launchers/format-provider-hook-output.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+
+import {
+  formatProviderHookContext,
+  formatProviderStopDecision,
+} from './provider-hook-output-transport.mjs'
+
+const argument = (name) => {
+  const index = process.argv.indexOf(name)
+  return index >= 0 ? process.argv[index + 1] : ''
+}
+
+const kind = argument('--kind')
+const transport = argument('--transport')
+const event = argument('--event')
+let message = ''
+for await (const chunk of process.stdin) message += chunk
+
+let output
+if (kind === 'context') output = formatProviderHookContext({ transport, event, message })
+else if (kind === 'stop') output = formatProviderStopDecision({ transport, reason: message })
+else throw new Error(`provider hook output kind is unsupported:${kind || '<missing>'}`)
+
+if (output === null) throw new Error(`provider hook output transport requires a non-JSON channel:${transport}`)
+process.stdout.write(`${JSON.stringify(output)}\n`)