@ran-sh/dsh-crew 0.5.7 → 1.0.1

package/src/config-readiness.mjs

@@ -80,6 +80,8 @@ export function buildConfigReadinessMatrix({
   providerCatalogBody = null,
   providerInventoryChecked = false,
   providerInventoryBody = null,
+  providerHealthChecked = false,
+  providerHealthBody = null,
   hubJobsChecked = false,
   hubJobsBody = null,
 } = {}) {
@@ -130,6 +132,14 @@ export function buildConfigReadinessMatrix({
           evidence_source: 'provider-inventory',
         };
   }
+
+  if (providerHealthChecked && providerHealthBody?.ok === false) {
+    evidence.provider_health = {
+      status: 'FAIL',
+      reason_code: 'PROVIDER_HEALTH_UNAVAILABLE',
+      evidence_source: 'provider-health',
+    };
+  }
 
   const matrix = buildReadinessMatrix({
     platform,

package/src/credential-lifecycle.mjs

@@ -0,0 +1,73 @@
+// Independent lifecycle planning for credential references. Actual purge is
+// deliberately adapter-gated: provider deletion never implies credential
+// deletion, and no default adapter reads or mutates secret stores.
+
+import { createHash, randomUUID } from 'node:crypto';
+
+export const CREDENTIAL_PURGE_STATES = Object.freeze([
+  'PLANNED', 'REFERENCE_RECHECKED', 'PURGE_PENDING_CONFIRMATION', 'PURGED', 'VERIFIED', 'FAILED',
+]);
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,191}$/;
+const REVISION_PATTERN = /^[a-f0-9]{64}$/;
+
+function text(value) { return typeof value === 'string' && value.trim() ? value.trim() : null; }
+function digest(value) { return createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex'); }
+
+export function planCredentialPurge({ inventory, referenceId, expectedRevision } = {}) {
+  const id = text(referenceId);
+  if (!id || !ID_PATTERN.test(id)) return { ok: false, code: 'CREDENTIAL_REFERENCE_INVALID' };
+  const record = (Array.isArray(inventory?.records) ? inventory.records : []).find((entry) => entry?.reference_id === id);
+  if (!record) return { ok: false, code: 'CREDENTIAL_REFERENCE_NOT_FOUND' };
+  if (record.orphan !== true || Number(record.consumer_count) !== 0 || (record.consumers?.length ?? 0) !== 0) {
+    return { ok: false, code: 'CREDENTIAL_REFERENCE_IN_USE' };
+  }
+  if (record.ownership !== 'crew-owned' || record.purge_capability !== 'eligible') {
+    return { ok: false, code: 'CREDENTIAL_PURGE_NOT_ALLOWED' };
+  }
+  const revision = digest(record);
+  if (expectedRevision !== undefined) {
+    if (!REVISION_PATTERN.test(expectedRevision ?? '')) return { ok: false, code: 'CREDENTIAL_REFERENCE_REVISION_INVALID' };
+    if (expectedRevision !== revision) return { ok: false, code: 'CREDENTIAL_REFERENCE_CHANGED' };
+  }
+  return {
+    ok: true,
+    plan: {
+      plan_id: randomUUID(),
+      reference_id: id,
+      kind: text(record.kind),
+      name_or_handle: text(record.name_or_handle),
+      ownership: 'crew-owned',
+      purge_capability: 'eligible',
+      expected_revision: revision,
+      state: 'PLANNED',
+      irreversible: true,
+    },
+  };
+}
+
+export async function executeCredentialPurge(plan, hooks = {}) {
+  if (!plan?.plan_id || !plan?.reference_id) return { ok: false, code: 'CREDENTIAL_PURGE_PLAN_INVALID' };
+  if (plan.state !== 'PLANNED') return { ok: false, code: 'CREDENTIAL_PURGE_PLAN_STATE_INVALID' };
+  if (plan.ownership !== 'crew-owned' || plan.purge_capability !== 'eligible') {
+    return { ok: false, code: 'CREDENTIAL_PURGE_NOT_ALLOWED' };
+  }
+  if (plan.irreversible !== true) return { ok: false, code: 'CREDENTIAL_PURGE_PLAN_INVALID' };
+  if (!REVISION_PATTERN.test(plan.expected_revision ?? '')) return { ok: false, code: 'CREDENTIAL_REFERENCE_REVISION_INVALID' };
+  if (typeof hooks.recheck !== 'function') return { ok: false, code: 'CREDENTIAL_REFERENCE_RECHECK_REQUIRED' };
+  const current = await hooks.recheck(plan.reference_id);
+  if (current?.ok !== true || current.revision !== plan.expected_revision || current.orphan !== true
+    || current.ownership !== 'crew-owned' || current.purge_capability !== 'eligible') {
+    return { ok: false, code: 'CREDENTIAL_REFERENCE_CHANGED' };
+  }
+  if (typeof hooks.purge !== 'function' || typeof hooks.verify !== 'function') {
+    return { ok: false, code: 'CREDENTIAL_PURGE_UNAVAILABLE', state: 'PURGE_PENDING_CONFIRMATION' };
+  }
+  try {
+    await hooks.purge(plan);
+    const verified = await hooks.verify(plan);
+    if (verified?.ok !== true) return { ok: false, code: 'CREDENTIAL_PURGE_VERIFY_FAILED', state: 'PURGED' };
+    return { ok: true, state: 'VERIFIED', reference_id: plan.reference_id, transaction_id: plan.plan_id };
+  } catch (error) {
+    return { ok: false, code: text(error?.code) ?? 'CREDENTIAL_PURGE_FAILED', state: 'FAILED' };
+  }
+}

package/src/credential-purge-adapters.mjs

@@ -0,0 +1,127 @@
+// Crew-owned credential purge adapter.
+//
+// The Harness credential store is intentionally narrow: only scalar env refs
+// in the Crew-owned `.credentials.yaml` are supported. The adapter never
+// returns or logs values and refuses paths outside the isolated Crew home.
+
+import { randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, isAbsolute, relative, resolve, join } from 'node:path';
+
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function failure(code, message = code) {
+  return Object.assign(new Error(message), { code });
+}
+
+function inside(root, file) {
+  const rel = relative(resolve(root), resolve(file));
+  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+
+function assertOwnedRegularStore(root, file) {
+  const rootPath = resolve(root);
+  const filePath = resolve(file);
+  if (!existsSync(rootPath)) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+  const rootStat = lstatSync(rootPath);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+  const relativePath = relative(rootPath, filePath);
+  if (relativePath === '' || relativePath.startsWith('..') || isAbsolute(relativePath)) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+  const segments = relativePath.split(/[\\/]/u).filter(Boolean);
+  let current = rootPath;
+  for (const segment of segments.slice(0, -1)) {
+    current = join(current, segment);
+    if (!existsSync(current)) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+    const stat = lstatSync(current);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+  }
+  if (!existsSync(filePath)) throw failure('CREDENTIAL_STORE_MISSING');
+  const fileStat = lstatSync(filePath);
+  if (!fileStat.isFile() || fileStat.isSymbolicLink()) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+  const realRoot = realpathSync(rootPath);
+  const realFile = realpathSync(filePath);
+  if (!inside(realRoot, realFile)) throw failure('CREDENTIAL_STORE_PATH_UNSAFE');
+}
+
+function parseRefs(source) {
+  const lines = String(source ?? '').split(/\r?\n/);
+  const entries = [];
+  let refs = false;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    const trimmed = line.trim();
+    if (trimmed === '' || trimmed.startsWith('#')) continue;
+    const indent = line.length - line.trimStart().length;
+    if (!refs) {
+      if (indent === 0 && /^refs:\s*(?:#.*)?$/u.test(line)) refs = true;
+      continue;
+    }
+    if (indent === 0) break;
+    if (indent !== 2) throw failure('CREDENTIAL_STORE_MALFORMED', 'credential refs shape is unsupported');
+    const match = /^ {2}([A-Za-z_][A-Za-z0-9_]*):(?:\s|$)/u.exec(line);
+    if (!match) throw failure('CREDENTIAL_STORE_MALFORMED', 'credential refs shape is unsupported');
+    entries.push({ key: match[1], index });
+  }
+  return { lines, entries };
+}
+
+function planEnvName(plan) {
+  if (plan?.kind !== 'env' || typeof plan?.name_or_handle !== 'string' || !ENV_NAME.test(plan.name_or_handle)) {
+    throw failure('CREDENTIAL_PURGE_KIND_UNSUPPORTED');
+  }
+  if (plan.reference_id !== `env:${plan.name_or_handle}`) throw failure('CREDENTIAL_REFERENCE_CHANGED');
+  return plan.name_or_handle;
+}
+
+function readStore(file, crewHome) {
+  assertOwnedRegularStore(crewHome, file);
+  let source;
+  try { source = readFileSync(file, 'utf8'); } catch { throw failure('CREDENTIAL_STORE_UNREADABLE'); }
+  return { source, ...parseRefs(source) };
+}
+
+function writeAtomic(file, content, crewHome) {
+  const dir = dirname(file);
+  assertOwnedRegularStore(crewHome, file);
+  const temp = join(dir, `.${basename(file)}.${process.pid}.${Date.now()}.${randomUUID()}.dsh-crew.tmp`);
+  try {
+    writeFileSync(temp, content, 'utf8');
+    assertOwnedRegularStore(crewHome, file);
+    renameSync(temp, file);
+  } catch (error) {
+    try { rmSync(temp, { force: true }); } catch {}
+    throw failure('CREDENTIAL_STORE_WRITE_FAILED', error?.code ?? 'CREDENTIAL_STORE_WRITE_FAILED');
+  }
+}
+
+export function createCredentialPurgeFileHooks({ credentialsFile, crewHome } = {}) {
+  if (typeof credentialsFile !== 'string' || typeof crewHome !== 'string'
+    || !isAbsolute(credentialsFile) || !isAbsolute(crewHome)
+    || !inside(crewHome, credentialsFile)) {
+    return { ok: false, code: 'CREDENTIAL_STORE_PATH_UNSAFE' };
+  }
+  const file = resolve(credentialsFile);
+  const root = resolve(crewHome);
+  return {
+    ok: true,
+    async purge(plan) {
+      const name = planEnvName(plan);
+      const current = readStore(file, root);
+      const entry = current.entries.find((candidate) => candidate.key === name);
+      if (!entry) throw failure('CREDENTIAL_REFERENCE_NOT_FOUND');
+      const newline = current.source.includes('\r\n') ? '\r\n' : '\n';
+      const lines = [...current.lines];
+      lines.splice(entry.index, 1);
+      writeAtomic(file, lines.join(newline), root);
+      return { ok: true, reference_id: plan.reference_id };
+    },
+    async verify(plan) {
+      const name = planEnvName(plan);
+      const current = readStore(file, root);
+      if (current.entries.some((candidate) => candidate.key === name)) {
+        return { ok: false, absent: false, reference_id: plan.reference_id };
+      }
+      return { ok: true, absent: true, reference_id: plan.reference_id };
+    },
+  };
+}

package/src/credential-purge-state.mjs

@@ -0,0 +1,59 @@
+// Durable, secret-free audit state for irreversible Crew credential purges.
+
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,191}$/u;
+const MAX_RECORDS = 128;
+
+function validId(value) { return typeof value === 'string' && ID_PATTERN.test(value); }
+
+export function normalizeCredentialPurgeState(input = {}) {
+  const purged = {};
+  const unverified = {};
+  const entries = input && typeof input === 'object' && !Array.isArray(input) && input.purged && typeof input.purged === 'object' && !Array.isArray(input.purged)
+    ? Object.entries(input.purged) : [];
+  for (const [referenceId, record] of entries.slice(-MAX_RECORDS)) {
+    if (!validId(referenceId) || !record || typeof record !== 'object' || Array.isArray(record) || !validId(record.transaction_id)) continue;
+    purged[referenceId] = { transaction_id: record.transaction_id };
+  }
+  const pending = input && typeof input === 'object' && !Array.isArray(input) && input.unverified && typeof input.unverified === 'object' && !Array.isArray(input.unverified)
+    ? Object.entries(input.unverified) : [];
+  for (const [referenceId, record] of pending.slice(-MAX_RECORDS)) {
+    if (!validId(referenceId) || !record || typeof record !== 'object' || Array.isArray(record)
+      || !validId(record.transaction_id) || record.state !== 'PURGED') continue;
+    unverified[referenceId] = { transaction_id: record.transaction_id, state: 'PURGED' };
+  }
+  return { schema_version: 1, purged, unverified };
+}
+
+export function markCredentialPurged(input, plan) {
+  const state = normalizeCredentialPurgeState(input);
+  if (!validId(plan?.reference_id) || !validId(plan?.plan_id)) return state;
+  const unverified = { ...state.unverified };
+  delete unverified[plan.reference_id];
+  return {
+    schema_version: 1,
+    purged: { ...state.purged, [plan.reference_id]: { transaction_id: plan.plan_id } },
+    unverified,
+  };
+}
+
+export function markCredentialPurgeUnverified(input, plan) {
+  const state = normalizeCredentialPurgeState(input);
+  if (!validId(plan?.reference_id) || !validId(plan?.plan_id)) return state;
+  const purged = { ...state.purged };
+  delete purged[plan.reference_id];
+  return {
+    schema_version: 1,
+    purged,
+    unverified: { ...state.unverified, [plan.reference_id]: { transaction_id: plan.plan_id, state: 'PURGED' } },
+  };
+}
+
+export function recordCredentialPurgeOutcome(input, plan, result) {
+  if (result?.state === 'VERIFIED') return markCredentialPurged(input, plan);
+  if (result?.state === 'PURGED') return markCredentialPurgeUnverified(input, plan);
+  return normalizeCredentialPurgeState(input);
+}
+
+export function isCredentialPurged(input, referenceId) {
+  return Object.prototype.hasOwnProperty.call(normalizeCredentialPurgeState(input).purged, referenceId);
+}

package/src/credential-reference-inventory.mjs

@@ -0,0 +1,78 @@
+// Secret-free credential reference inventory. This module only handles
+// provider reference names/handles and ownership metadata; it never resolves
+// or reads credential values.
+
+const OWNERSHIP = new Map([
+  ['crew', 'crew-owned'],
+  ['crew-owned', 'crew-owned'],
+  ['user', 'user-owned'],
+  ['user-owned', 'user-owned'],
+  ['harness', 'harness-owned'],
+  ['harness-owned', 'harness-owned'],
+  ['external', 'external'],
+  ['external-env', 'external'],
+]);
+
+function text(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeReference(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const kind = text(value.kind);
+  const name = text(value.name_or_handle);
+  const ownership = OWNERSHIP.get(text(value.ownership)?.toLowerCase() ?? '');
+  if (!kind || !name || !ownership) return null;
+  return { kind, name_or_handle: name, ownership };
+}
+
+function capability(ownership, orphan) {
+  if (ownership !== 'crew-owned') return 'report-only';
+  return orphan ? 'eligible' : 'eligible-after-last-consumer';
+}
+
+export function buildCredentialReferenceInventory({ providers = [], additional_refs: additionalRefs = [], purged_refs: purgedRefs = [] } = {}) {
+  const entries = new Map();
+  const purged = new Set(Array.isArray(purgedRefs) ? purgedRefs.filter((value) => typeof value === 'string' && value.trim()) : []);
+  const add = (ref, consumer) => {
+    const normalized = normalizeReference(ref);
+    if (!normalized) return;
+    const referenceId = `${normalized.kind}:${normalized.name_or_handle}`;
+    if (purged.has(referenceId)) return;
+    const current = entries.get(referenceId) ?? {
+      reference_id: referenceId,
+      kind: normalized.kind,
+      name_or_handle: normalized.name_or_handle,
+      ownership: normalized.ownership,
+      consumers: new Set(),
+    };
+    // Conflicting ownership is deliberately conservative: never upgrade a
+    // reference into a purge-eligible class based on one declaration.
+    if (current.ownership !== normalized.ownership) current.ownership = 'unknown';
+    if (typeof consumer === 'string' && consumer.trim()) current.consumers.add(consumer.trim());
+    entries.set(referenceId, current);
+  };
+
+  for (const provider of Array.isArray(providers) ? providers : []) {
+    const providerId = text(provider?.id);
+    if (!providerId) continue;
+    for (const ref of Array.isArray(provider?.credential_refs) ? provider.credential_refs : []) add(ref, providerId);
+  }
+  for (const ref of Array.isArray(additionalRefs) ? additionalRefs : []) add(ref, null);
+
+  const records = [...entries.values()].map((entry) => {
+    const consumers = [...entry.consumers].sort();
+    const orphan = consumers.length === 0;
+    return {
+      reference_id: entry.reference_id,
+      kind: entry.kind,
+      name_or_handle: entry.name_or_handle,
+      ownership: entry.ownership,
+      consumers,
+      consumer_count: consumers.length,
+      orphan,
+      purge_capability: entry.ownership === 'unknown' ? 'report-only' : capability(entry.ownership, orphan),
+    };
+  }).sort((a, b) => a.reference_id.localeCompare(b.reference_id));
+  return { ok: true, schema_version: 1, records };
+}

package/src/dsh-cli-runtime.mjs

@@ -17,9 +17,10 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'node:fs';
-import { dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { homedir } from 'node:os';
-import { crewDshHome, crewProfileDir } from './install/install.mjs';
+import { dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { crewDshHome, crewProfileDir } from './install/install.mjs';
+import { reconcileProviderDesiredState } from './provider-desired-state.mjs';
 
 export const DSH_CLI_PACKAGE = '@deepseek-ai/dsh';
 export const CREW_DSH_RUNTIME_DIRNAME = 'runtime';
@@ -313,15 +314,37 @@ function readProfileManifestForRegistration(profileRoot, { create = true, defaul
   return { profileManifest, manifest, created: false };
 }
 
-function ensureProfileScaffold(profileRoot) {
+function ensureProfileScaffold(profileRoot) {
   mkdirSync(profileRoot, { recursive: true });
   let changed = false;
   const patchFile = join(profileRoot, 'cordis.patch.yml');
   if (!existsSync(patchFile)) { writeFileSync(patchFile, PROFILE_PATCH_TEMPLATE); changed = true; }
   const workspaceFile = join(profileRoot, 'pnpm-workspace.yaml');
   if (!existsSync(workspaceFile)) { writeFileSync(workspaceFile, PROFILE_PNPM_WORKSPACE); changed = true; }
-  return changed;
-}
+  return changed;
+}
+
+function readCrewTombstones(home) {
+  const lifecycleFile = join(dirname(crewDshHome({ home })), 'provider-lifecycle.json');
+  if (!existsSync(lifecycleFile)) return { ok: true, tombstones: {} };
+  try {
+    const state = JSON.parse(readFileSync(lifecycleFile, 'utf8'));
+    return { ok: true, tombstones: state?.tombstones && typeof state.tombstones === 'object' && !Array.isArray(state.tombstones) ? state.tombstones : {} };
+  } catch { return { ok: false, code: 'PROVIDER_LIFECYCLE_STATE_INVALID' }; }
+}
+
+function reconcileCrewProfileProviders({ home, profileRoot }) {
+  const patchFile = join(profileRoot, 'cordis.patch.yml');
+  if (!existsSync(patchFile)) return { ok: true, changed: false, removed: [] };
+  const lifecycle = readCrewTombstones(home);
+  if (!lifecycle.ok) return lifecycle;
+  const source = readFileSync(patchFile, 'utf8');
+  if (source.trim() === '[]') return { ok: true, changed: false, removed: [] };
+  const reconciled = reconcileProviderDesiredState(source, { tombstones: lifecycle.tombstones });
+  if (!reconciled.ok) return reconciled;
+  if (reconciled.changed) writeFileSync(patchFile, reconciled.text);
+  return reconciled;
+}
 
 function ensureDirectoryLink(linkPath, targetRoot) {
   let stat;
@@ -408,9 +431,13 @@ export function ensurePluginRegistration({
   } catch { return { ok: false, code: 'CREW_PLUGIN_NOT_LOADABLE' }; }
 }
 
-export function ensureCrewPluginRegistration({ home = homedir(), root, name } = {}) {
-  return ensurePluginRegistration({ profileRoot: crewProfileDir({ home }), root, name });
-}
+export function ensureCrewPluginRegistration({ home = homedir(), root, name } = {}) {
+  const result = ensurePluginRegistration({ profileRoot: crewProfileDir({ home }), root, name });
+  if (!result.ok) return result;
+  const reconciled = reconcileCrewProfileProviders({ home, profileRoot: result.profileRoot });
+  if (!reconciled.ok) return reconciled;
+  return { ...result, changed: result.changed || reconciled.changed, provider_reconciliation: reconciled.removed ?? [] };
+}
 
 /**
  * Remove one Crew plugin registration without invoking a package manager.

package/src/extension-contract.mjs

@@ -2,7 +2,7 @@
 // describes only DSH Crew and deliberately never advertises itself as a top-
 // level Executor or control plane.
 
-export const EXTENSION_CONTRACT_SCHEMA_VERSION = 1;
+export const EXTENSION_CONTRACT_SCHEMA_VERSION = 1;
 
 function row(matrix, id) {
   return Array.isArray(matrix?.rows) ? matrix.rows.find((entry) => entry?.id === id) : undefined;
@@ -34,14 +34,15 @@ function readinessFromRow(entry, { pass = 'READY', notRun = 'DEGRADED' } = {}) {
   return component('UNAVAILABLE', entry.reason_code ?? 'CHECK_FAILED');
 }
 
-export function buildExtensionContract({ config = {}, readinessMatrix = {}, workspace = null, profiles = null, runtime = null } = {}) {
+export function buildExtensionContract({ config = {}, readinessMatrix = {}, readinessSnapshot = null, workspace = null, profiles = null, runtime = null } = {}) {
+  const matrix = readinessSnapshot?.readiness_matrix ?? readinessMatrix;
   const workerEnabled = config.subagents_enabled !== false && config.worker_state !== 'disabled';
   const reviewerEnabled = config.subagents_enabled !== false && config.review_state !== 'disabled';
   const realModelEvidence = ['worker_primary_callable', 'model_execution', 'worker_escalation_callable', 'deepseek_flash', 'deepseek_pro']
-    .map((id) => row(readinessMatrix, id))
+    .map((id) => row(matrix, id))
     .find((entry) => entry?.status === 'PASS');
-  const catalogEvidence = row(readinessMatrix, 'provider_catalog');
-  const lifecycleEvidence = row(readinessMatrix, 'provider_lifecycle_consistent');
+  const catalogEvidence = row(matrix, 'provider_catalog');
+  const lifecycleEvidence = row(matrix, 'provider_lifecycle_consistent');
   const modelReadiness = catalogEvidence?.status === 'FAIL'
     ? readinessFromRow(catalogEvidence)
     : realModelEvidence
@@ -50,14 +51,14 @@ export function buildExtensionContract({ config = {}, readinessMatrix = {}, work
         ? component('DEGRADED', 'MODEL_CATALOG_ONLY')
         : component('UNAVAILABLE', catalogEvidence?.reason_code ?? 'NO_EVIDENCE');
   const components = {
-    harness: readinessFromRow(row(readinessMatrix, 'hub_compatibility')),
+    harness: readinessFromRow(row(matrix, 'hub_compatibility')),
     provider_lifecycle: lifecycleEvidence
       ? readinessFromRow(lifecycleEvidence, { notRun: 'DEGRADED' })
       : component('DEGRADED', 'PROVIDER_LIFECYCLE_NOT_CHECKED'),
     model: modelReadiness,
     workspace: workspaceComponent(workspace),
     reviewer: reviewerEnabled
-      ? readinessFromRow(row(readinessMatrix, 'reviewer_pipeline'))
+      ? readinessFromRow(row(matrix, 'reviewer_pipeline'))
       : component('DEGRADED', 'REVIEWER_DISABLED'),
   };
   const states = Object.values(components).map((entry) => entry.status);
@@ -65,7 +66,8 @@ export function buildExtensionContract({ config = {}, readinessMatrix = {}, work
   return {
     schema_version: EXTENSION_CONTRACT_SCHEMA_VERSION,
     kind: 'dsh-crew-extension',
-    runtime: runtime ?? null,
+    runtime: runtime ?? null,
+    ...(readinessSnapshot ? { readiness_snapshot: readinessSnapshot } : {}),
     capabilities: {
       'deepseek.worker': workerEnabled,
       'deepseek.reviewer': reviewerEnabled,