@ran-sh/dsh-crew 1.0.1 → 1.0.3

package/src/provider-settings-store.mjs

@@ -0,0 +1,291 @@
+// Structure-aware access to the Crew-owned Harness settings.yaml provider map.
+// Only the known llm-pi-ai.providers mapping is mutable; arbitrary YAML and
+// credential values are never deserialized or returned.
+
+import { createHash } from 'node:crypto';
+import { classifyCredentialReference } from './credential-reference.mjs';
+import { readProviderMaterialization } from './provider-profile-store.mjs';
+
+const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+
+function sha256(value) { return createHash('sha256').update(value, 'utf8').digest('hex'); }
+function indentOf(line) { return (line.match(/^\s*/u) ?? [''])[0].length; }
+function nonBlank(line) { return line.trim() !== '' && !line.trimStart().startsWith('#'); }
+function scalarField(lines, entry, field) {
+  const pattern = new RegExp(`^\\s+${field}:\\s*(.*?)\\s*$`);
+  for (const line of lines.slice(entry.start, entry.end)) {
+    const match = line.match(pattern);
+    if (!match) continue;
+    const value = match[1].trim();
+    if (!value) return null;
+    return value.replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2');
+  }
+  return null;
+}
+
+function parseDefaultModel(source) {
+  if (typeof source !== 'string') return { ok: false, code: 'PROVIDER_SETTINGS_DEFAULT_UNSUPPORTED' };
+  const lines = source.split(/\r?\n/u);
+  const start = lines.findIndex((line) => /^agent-default-model:\s*$/u.test(line));
+  if (start < 0) return { ok: false, code: 'PROVIDER_SETTINGS_DEFAULT_UNSUPPORTED' };
+  let end = lines.length;
+  for (let index = start + 1; index < lines.length; index += 1) {
+    if (indentOf(lines[index]) === 0 && nonBlank(lines[index])) { end = index; break; }
+  }
+  const providerLine = lines.findIndex((line, index) => index > start && index < end && /^ {2}provider:\s*\S.*$/u.test(line));
+  const modelLine = lines.findIndex((line, index) => index > start && index < end && /^ {2}model:\s*\S.*$/u.test(line));
+  const provider = providerLine >= 0 ? lines[providerLine].replace(/^ {2}provider:\s*/u, '').trim() : null;
+  const model = modelLine >= 0 ? lines[modelLine].replace(/^ {2}model:\s*/u, '').trim() : null;
+  if (!provider || !model) return { ok: false, code: 'PROVIDER_SETTINGS_DEFAULT_UNSUPPORTED' };
+  return { ok: true, lines, start, end, providerLine, modelLine, provider, model };
+}
+
+function parseProviderMap(source) {
+  if (typeof source !== 'string') return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+  const lines = source.split(/\r?\n/u);
+  const llmStart = lines.findIndex((line) => /^llm-pi-ai:\s*$/u.test(line));
+  if (llmStart < 0) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+  let blockEnd = lines.length;
+  for (let index = llmStart + 1; index < lines.length; index += 1) {
+    if (indentOf(lines[index]) === 0 && nonBlank(lines[index])) { blockEnd = index; break; }
+  }
+  const providersLine = lines.findIndex((line, index) => index > llmStart && index < blockEnd && /^ {2}providers:\s*(?:\{\s*\})?\s*$/u.test(line));
+  if (providersLine < 0) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+  let providersBlockEnd = blockEnd;
+  for (let index = providersLine + 1; index < blockEnd; index += 1) {
+    if (nonBlank(lines[index]) && indentOf(lines[index]) <= 2) { providersBlockEnd = index; break; }
+  }
+  const providerIndent = 4;
+  const entries = [];
+  for (let index = providersLine + 1; index < blockEnd; index += 1) {
+    const line = lines[index];
+    if (!nonBlank(line)) continue;
+    const indent = indentOf(line);
+    if (indent < providerIndent) {
+      if (indent > 2) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+      break;
+    }
+    if (indent !== providerIndent) continue;
+    const match = line.match(/^ {4}([A-Za-z0-9][A-Za-z0-9._-]*):\s*$/u);
+    if (!match) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+    let end = index + 1;
+    while (end < blockEnd) {
+      const next = lines[end];
+      if (nonBlank(next) && indentOf(next) <= providerIndent) break;
+      end += 1;
+    }
+    entries.push({ id: match[1], start: index, end });
+    index = end - 1;
+  }
+  return { ok: true, lines, llmStart, blockEnd, providersLine, providersBlockEnd, entries };
+}
+
+const SENSITIVE_CREDENTIAL_FIELD = /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|(?:^|[_-])token(?:$|[_-])|secret|password|authorization|credential|private[_-]?key|client[_-]?secret|cookie|bearer|webhook)/iu;
+const REFERENCE_FIELD_SUFFIX = /(?:env|ref|name|handle|id|file|path)$/iu;
+
+function isInlineCredentialLine(line) {
+  const inlineKeys = [...line.matchAll(/["']?([A-Za-z][A-Za-z0-9_.-]*)["']?\s*:/gu)].map((match) => match[1]);
+  if (inlineKeys.some((field) => SENSITIVE_CREDENTIAL_FIELD.test(field) && !REFERENCE_FIELD_SUFFIX.test(field.replace(/[_.-]/gu, '')))) return true;
+  const match = line.match(/^\s*["']?([A-Za-z][A-Za-z0-9_.-]*)["']?\s*:\s*(.*?)\s*$/u);
+  if (!match) return false;
+  const [, field, value] = match;
+  if (!value || /^(?:null|~|\{\}|\[\])$/u.test(value)) return false;
+  const normalized = field.replace(/[_.-]/gu, '');
+  if (SENSITIVE_CREDENTIAL_FIELD.test(field) && !REFERENCE_FIELD_SUFFIX.test(normalized)) return true;
+  return /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization|credential|private[_-]?key|client[_-]?secret|cookie|bearer|webhook)\s*["']?\s*:/iu.test(value);
+}
+
+export function hasInlineProviderCredentials(source, { providerIds = [] } = {}) {
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code };
+  const requested = providerIds.length > 0 ? new Set(providerIds) : null;
+  const providers = parsed.entries.filter((entry) => !requested || requested.has(entry.id));
+  return { ok: true, inline: providers.some((entry) => parsed.lines.slice(entry.start, entry.end).some(isInlineCredentialLine)) };
+}
+
+export function inspectProviderSettings(source) {
+  const revision = typeof source === 'string' ? sha256(source) : null;
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision };
+  return { ok: true, schema: 'harness-settings-llm-pi-ai-v1', providerIds: parsed.entries.map((entry) => entry.id), revision };
+}
+
+export function readProviderSettingsDeclarations(source, { file = 'harness/settings.yaml' } = {}) {
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code };
+  return {
+    ok: true,
+    declarations: parsed.entries.map((entry) => {
+      const rawCredentialRef = scalarField(parsed.lines, entry, 'apiKeyEnv');
+      const credential = classifyCredentialReference(rawCredentialRef, { kind: 'env' });
+      return {
+        id: entry.id,
+        display_name: scalarField(parsed.lines, entry, 'displayName') ?? entry.id,
+        // settings.yaml is the Harness user layer. Crew profile/base
+        // declarations are reported separately by provider-profile-store.
+        origin: 'dynamic',
+        ownership: 'dynamic-user',
+        file,
+        declaration_authority: { kind: 'harness-settings', locator: `llm-pi-ai.providers.${entry.id}` },
+        ...(credential.value ? { credential_ref: { kind: 'env', name_or_handle: credential.value, ownership: 'unknown' } } : {}),
+        ...(credential.redacted ? { credential_status: 'present-redacted' } : {}),
+      };
+    }),
+  };
+}
+
+/** Return the same bounded provider projection as the profile parser, adapted
+ * to the Harness settings indentation. This is used only for rollback CAS and
+ * never exposes credential values. */
+export function readProviderSettingsMaterialization(source, { providerId, file = 'harness/settings.yaml' } = {}) {
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code };
+  const entry = parsed.entries.find((candidate) => candidate.id === providerId);
+  if (!entry) return { ok: false, code: 'PROVIDER_NOT_FOUND' };
+  const block = parsed.lines.slice(entry.start, entry.end).map((line) => `  ${line}`);
+  const synthetic = ['- id: llm-pi-ai', '  config:', '    providers:', ...block, ''].join('\n');
+  const result = readProviderMaterialization(synthetic, { providerId, file });
+  return result.ok ? { ...result, provider: { ...result.provider, source_file: file } } : result;
+}
+
+export function readHarnessDefault(source) {
+  const parsed = parseDefaultModel(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code };
+  return { ok: true, provider: parsed.provider, model: parsed.model, locator: 'agent-default-model' };
+}
+
+function yamlScalar(value, max = 2048) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max || /[\r\n]/u.test(value)) return null;
+  return JSON.stringify(value.trim());
+}
+
+/**
+ * Add one already-sanitized provider projection to the Harness user layer.
+ * The operation is pure and revision-bound; callers perform the atomic write.
+ */
+export function addProviderSettings(source, { provider, expectedRevision } = {}) {
+  const currentRevision = typeof source === 'string' ? sha256(source) : null;
+  if (expectedRevision !== undefined && expectedRevision !== currentRevision) return { ok: false, code: 'PROVIDER_SETTINGS_CHANGED', revision: currentRevision };
+  if (!provider || typeof provider !== 'object' || Array.isArray(provider) || typeof provider.id !== 'string' || !PROVIDER_ID.test(provider.id)) {
+    return { ok: false, code: 'PROVIDER_MATERIALIZATION_INVALID', revision: currentRevision };
+  }
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision: currentRevision };
+  if (parsed.entries.some((entry) => entry.id === provider.id)) return { ok: false, code: 'PROVIDER_SETTINGS_PROVIDER_EXISTS', revision: currentRevision };
+  const displayName = yamlScalar(provider.display_name ?? provider.id, 256);
+  if (!displayName) return { ok: false, code: 'PROVIDER_MATERIALIZATION_INVALID', revision: currentRevision };
+  const lines = [`    ${provider.id}:`, `      displayName: ${displayName}`];
+  const api = yamlScalar(provider.api, 128);
+  const baseUrl = yamlScalar(provider.base_url, 2048);
+  const credential = provider.credential_ref ? classifyCredentialReference(provider.credential_ref, { kind: 'env' }).value : null;
+  if (provider.credential_ref && !credential) return { ok: false, code: 'PROVIDER_CREDENTIAL_REFERENCE_UNSAFE', revision: currentRevision };
+  if (api) lines.push(`      api: ${api}`);
+  if (baseUrl) lines.push(`      baseURL: ${baseUrl}`);
+  if (credential) lines.push(`      apiKeyEnv: ${credential}`);
+  const models = Array.isArray(provider.models) ? provider.models.filter((model) => model && typeof model.id === 'string' && model.id.trim() && model.id.length <= 256).slice(0, 256) : [];
+  if (models.length > 0) {
+    lines.push('      models:');
+    for (const model of models) {
+      const id = yamlScalar(model.id, 256);
+      if (!id) continue;
+      lines.push(`        - id: ${id}`);
+      const name = yamlScalar(model.name, 256);
+      if (name) lines.push(`          name: ${name}`);
+      if (Number.isSafeInteger(model.context_window) && model.context_window > 0) lines.push(`          contextWindow: ${model.context_window}`);
+      if (Number.isSafeInteger(model.max_tokens) && model.max_tokens > 0) lines.push(`          maxTokens: ${model.max_tokens}`);
+      if (Array.isArray(model.input) && model.input.every((value) => value === 'text' || value === 'image')) lines.push(`          input: [${[...new Set(model.input)].join(', ')}]`);
+      if (model.reasoning_efforts && typeof model.reasoning_efforts === 'object' && !Array.isArray(model.reasoning_efforts)) {
+        lines.push('          reasoningEfforts:');
+        for (const [key, value] of Object.entries(model.reasoning_efforts)) if (/^[A-Za-z][A-Za-z0-9_-]*$/u.test(key) && (value === null || yamlScalar(value, 256))) lines.push(`            ${key}: ${value === null ? 'null' : yamlScalar(value, 256)}`);
+      }
+      if (model.compat && typeof model.compat === 'object' && !Array.isArray(model.compat) && Object.keys(model.compat).length === 0) lines.push('          compat: {}');
+    }
+  }
+  const nextLines = [...parsed.lines];
+  const insertAt = parsed.blockEnd;
+  if (/^ {2}providers:\s*\{\s*\}\s*$/u.test(nextLines[parsed.providersLine])) nextLines[parsed.providersLine] = '  providers:';
+  nextLines.splice(insertAt, 0, ...lines);
+  const newline = source.includes('\r\n') ? '\r\n' : '\n';
+  const text = nextLines.join(newline);
+  return { ok: true, text, added: provider.id, revision: sha256(text) };
+}
+
+export function replaceHarnessDefault(source, { provider, model, expectedRevision } = {}) {
+  const currentRevision = typeof source === 'string' ? sha256(source) : null;
+  if (expectedRevision !== undefined && expectedRevision !== currentRevision) return { ok: false, code: 'PROVIDER_SETTINGS_CHANGED', revision: currentRevision };
+  if (typeof provider !== 'string' || !PROVIDER_ID.test(provider) || typeof model !== 'string' || !model.trim()) return { ok: false, code: 'PROVIDER_DEFAULT_REPLACEMENT_REQUIRED', revision: currentRevision };
+  const parsed = parseDefaultModel(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision: currentRevision };
+  const lines = [...parsed.lines];
+  lines[parsed.providerLine] = `  provider: ${provider.trim()}`;
+  lines[parsed.modelLine] = `  model: ${model.trim()}`;
+  const newline = source.includes('\r\n') ? '\r\n' : '\n';
+  const text = lines.join(newline);
+  return { ok: true, text, previous: { provider: parsed.provider, model: parsed.model }, revision: sha256(text) };
+}
+
+/**
+ * Apply all Harness settings mutations needed by one provider-delete plan in
+ * memory, then return one revision-bound text result for a single atomic write.
+ * This prevents replacing agent-default-model and removing its provider from
+ * racing each other on the same settings revision.
+ */
+export function mutateProviderSettings(source, {
+  providerId = null,
+  removeProvider = false,
+  replacementDefault = null,
+  replacementModel = null,
+  expectedRevision,
+} = {}) {
+  const currentRevision = typeof source === 'string' ? sha256(source) : null;
+  if (expectedRevision !== undefined && expectedRevision !== currentRevision) return { ok: false, code: 'PROVIDER_SETTINGS_CHANGED', revision: currentRevision };
+  const parsed = removeProvider ? parseProviderMap(source) : { ok: true, lines: typeof source === 'string' ? source.split(/\r?\n/u) : [] };
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision: currentRevision };
+  let providerEntry = null;
+  if (removeProvider) {
+    if (typeof providerId !== 'string' || !PROVIDER_ID.test(providerId)) return { ok: false, code: 'PROVIDER_NOT_FOUND', revision: currentRevision };
+    providerEntry = parsed.entries.find((entry) => entry.id === providerId) ?? null;
+    if (!providerEntry) return { ok: false, code: 'PROVIDER_NOT_FOUND', revision: currentRevision };
+  }
+  let defaultParsed = null;
+  if (replacementDefault !== null || replacementModel !== null) {
+    if (typeof replacementDefault !== 'string' || !PROVIDER_ID.test(replacementDefault) || typeof replacementModel !== 'string' || !replacementModel.trim()) return { ok: false, code: 'PROVIDER_DEFAULT_REPLACEMENT_REQUIRED', revision: currentRevision };
+    defaultParsed = parseDefaultModel(source);
+    if (!defaultParsed.ok) return { ok: false, code: defaultParsed.code, revision: currentRevision };
+    if (providerId && defaultParsed.provider !== providerId) return { ok: false, code: 'PROVIDER_DEFAULT_AUTHORITY_CHANGED', revision: currentRevision };
+  }
+  const ranges = providerEntry ? [[providerEntry.start, providerEntry.end]] : [];
+  const finalProvider = providerEntry && parsed.entries.length === 1;
+  const nextLines = parsed.lines.map((line, index) => {
+    if (ranges.some(([start, end]) => index >= start && index < end)) return null;
+    if (finalProvider && index === parsed.providersLine) return '  providers: {}';
+    if (defaultParsed?.providerLine === index) return `  provider: ${replacementDefault.trim()}`;
+    if (defaultParsed?.modelLine === index) return `  model: ${replacementModel.trim()}`;
+    return line;
+  }).filter((line) => line !== null);
+  const newline = source.includes('\r\n') ? '\r\n' : '\n';
+  const text = nextLines.join(newline);
+  return {
+    ok: true,
+    text,
+    ...(providerEntry ? { removed: [providerId], remaining: parsed.entries.filter((entry) => entry.id !== providerId).map((entry) => entry.id) } : { removed: [], remaining: parsed.entries?.map((entry) => entry.id) ?? [] }),
+    ...(defaultParsed ? { previous_default: { provider: defaultParsed.provider, model: defaultParsed.model } } : {}),
+    revision: sha256(text),
+  };
+}
+
+export function removeProviderSettings(source, { providerIds = [], expectedRevision } = {}) {
+  const currentRevision = typeof source === 'string' ? sha256(source) : null;
+  if (expectedRevision !== undefined && expectedRevision !== currentRevision) return { ok: false, code: 'PROVIDER_SETTINGS_CHANGED', revision: currentRevision };
+  const requested = [...new Set(providerIds.filter((id) => typeof id === 'string' && PROVIDER_ID.test(id)))];
+  if (requested.length === 0 || requested.length !== providerIds.length) return { ok: false, code: 'PROVIDER_NOT_FOUND', revision: currentRevision };
+  let next = source;
+  const results = [];
+  for (const id of requested) {
+    const result = mutateProviderSettings(next, { providerId: id, removeProvider: true });
+    if (!result.ok) return { ...result, revision: currentRevision };
+    next = result.text;
+    results.push(result);
+  }
+  return { ok: true, text: next, removed: requested, remaining: results.at(-1)?.remaining ?? [], revision: sha256(next) };
+}

package/src/provider-store-lock.mjs

@@ -0,0 +1,67 @@
+// Persistent token-fenced lock shared by every lifecycle operation that can
+// mutate the Harness profile/settings stores. A stale lock is reclaimed only
+// while a serialized claim is held; malformed metadata fails closed.
+
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, resolve as resolvePath } from 'node:path';
+
+function safeToken(value) { return typeof value === 'string' && /^[A-Za-z0-9-]{16,128}$/u.test(value); }
+function readOwner(file) {
+  try {
+    const owner = JSON.parse(readFileSync(file, 'utf8'));
+    if (!owner || typeof owner !== 'object' || Array.isArray(owner) || !Number.isInteger(owner.pid) || owner.pid <= 0 || !safeToken(owner.token)) return { ok: false, malformed: true };
+    return { ok: true, owner };
+  } catch { return { ok: false, malformed: true }; }
+}
+function processAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+
+export async function acquireProviderStoreLock(file) {
+  if (typeof file !== 'string' || !file.trim()) throw Object.assign(new Error('provider store lock path is required'), { code: 'PROVIDER_STORE_LOCK_UNAVAILABLE' });
+  const lockFile = resolvePath(file);
+  mkdirSync(dirname(lockFile), { recursive: true });
+  const claimFile = `${lockFile}.claim`;
+  const token = randomUUID();
+  let claimed = false;
+  try {
+    try { mkdirSync(claimFile); claimed = true; }
+    catch (error) { throw Object.assign(new Error('provider store lock is busy'), { code: error?.code === 'EEXIST' ? 'PROVIDER_STORE_LOCK_BUSY' : 'PROVIDER_STORE_LOCK_UNAVAILABLE' }); }
+    while (true) {
+      try {
+        writeFileSync(lockFile, JSON.stringify({ pid: process.pid, token, created_at: new Date().toISOString() }) + '\n', { flag: 'wx' });
+        return {
+          ok: true,
+          token,
+          release: async () => {
+            const current = readOwner(lockFile);
+            if (current.ok && current.owner.token === token) rmSync(lockFile, { force: true });
+          },
+        };
+      } catch (error) {
+        if (error?.code !== 'EEXIST') throw Object.assign(new Error('provider store lock is unavailable'), { code: 'PROVIDER_STORE_LOCK_UNAVAILABLE' });
+        const current = readOwner(lockFile);
+        if (!current.ok) throw Object.assign(new Error('provider store lock metadata is invalid'), { code: 'PROVIDER_STORE_LOCK_BUSY' });
+        if (processAlive(current.owner.pid)) throw Object.assign(new Error('provider store lock is busy'), { code: 'PROVIDER_STORE_LOCK_BUSY' });
+        rmSync(lockFile, { force: true });
+      }
+    }
+  } finally { if (claimed) rmSync(claimFile, { recursive: true, force: true }); }
+}
+
+export async function recoverProviderStoreLock(file, { confirm = false } = {}) {
+  if (confirm !== true) return { ok: false, code: 'PROVIDER_STORE_LOCK_CONFIRM_REQUIRED' };
+  if (typeof file !== 'string' || !file.trim()) return { ok: false, code: 'PROVIDER_STORE_LOCK_UNAVAILABLE' };
+  const lockFile = resolvePath(file);
+  const claimFile = `${lockFile}.claim`;
+  try { mkdirSync(dirname(lockFile), { recursive: true }); mkdirSync(claimFile); }
+  catch (error) { return { ok: false, code: error?.code === 'EEXIST' ? 'PROVIDER_STORE_LOCK_BUSY' : 'PROVIDER_STORE_LOCK_UNAVAILABLE' }; }
+  try {
+    if (!existsSync(lockFile)) return { ok: true, recovered: false };
+    const current = readOwner(lockFile);
+    if (current.ok && processAlive(current.owner.pid)) return { ok: false, code: 'PROVIDER_STORE_LOCK_BUSY' };
+    rmSync(lockFile, { force: true });
+    return { ok: true, recovered: true };
+  } finally { rmSync(claimFile, { recursive: true, force: true }); }
+}

package/src/runtime-identity.mjs

@@ -5,20 +5,20 @@
 // - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
 //   incompatible.
 //
-// Keep this module dependency-light so Hub, MCP and tests all use the exact
-// same compatibility rules.
-
-import { randomUUID } from 'node:crypto';
-
-// Production Crew execution is intentionally bound to the isolated 3210 Hub.
-// These fields are public provenance only; no credential or session secret is
-// included in the identity contract.
-export const PRODUCTION_EXECUTION_PLANE = 'hub-3210';
-export const PRODUCTION_PROFILE = 'dsh-crew';
-export const PRODUCTION_LISTEN_PORT = 3210;
-const RUNTIME_ID = randomUUID();
-
-export const RUNTIME_VERSION = '1.0.1';
+// Keep this module dependency-light so Hub, MCP and tests all use the exact
+// same compatibility rules.
+
+import { randomUUID } from 'node:crypto';
+
+// Production Crew execution is intentionally bound to the isolated 3210 Hub.
+// These fields are public provenance only; no credential or session secret is
+// included in the identity contract.
+export const PRODUCTION_EXECUTION_PLANE = 'hub-3210';
+export const PRODUCTION_PROFILE = 'dsh-crew';
+export const PRODUCTION_LISTEN_PORT = 3210;
+const RUNTIME_ID = randomUUID();
+
+export const RUNTIME_VERSION = '1.0.3';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([
@@ -33,17 +33,18 @@ export const HUB_CAPABILITIES = Object.freeze([
   'config',
   'canonical-events',
   'evidence',
-  'profiles',
-  'workspace-context',
-  'extension-contract',
-  'provider-inventory',
-  'provider-lifecycle-v1',
-  'provider-health-v1',
-  'provider-probe-stream-v1',
-  'credential-reference-inventory-v1',
-  'credential-purge-v1',
-  'runtime-provenance-v1',
-]);
+  'profiles',
+  'workspace-context',
+  'extension-contract',
+  'provider-inventory',
+  'provider-layer-migration-v1',
+  'provider-lifecycle-v1',
+  'provider-health-v1',
+  'provider-probe-stream-v1',
+  'credential-reference-inventory-v1',
+  'credential-purge-v1',
+  'runtime-provenance-v1',
+]);
 
 // Capabilities the current MCP workflow depends on for full Hub execution.
 // Additional capabilities may be advertised without breaking compatibility.
@@ -60,12 +61,12 @@ export const HUB_COMPATIBILITY_CODES = Object.freeze({
   UNREACHABLE: 'HUB_UNREACHABLE',
   HTTP_ERROR: 'HUB_HTTP_ERROR',
   SERVICE_MISMATCH: 'HUB_SERVICE_MISMATCH',
-  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
-  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
-  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
-  PROVENANCE_MISSING: 'HUB_PROVENANCE_MISSING',
-  EXECUTION_PLANE_MISMATCH: 'HUB_EXECUTION_PLANE_MISMATCH',
-  LISTEN_PORT_MISMATCH: 'HUB_LISTEN_PORT_MISMATCH',
+  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
+  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
+  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
+  PROVENANCE_MISSING: 'HUB_PROVENANCE_MISSING',
+  EXECUTION_PLANE_MISMATCH: 'HUB_EXECUTION_PLANE_MISMATCH',
+  LISTEN_PORT_MISMATCH: 'HUB_LISTEN_PORT_MISMATCH',
 });
 
 function normalizedCapabilities(value) {
@@ -74,17 +75,17 @@ function normalizedCapabilities(value) {
 }
 
 export function getHubRuntimeIdentity() {
-  return {
-    service: 'dsh-crew-hub',
-    surface: 'native-crew-harness',
-    ui_role: 'runtime',
-    runtime_version: RUNTIME_VERSION,
-    protocol_version: HUB_PROTOCOL_VERSION,
-    execution_plane: PRODUCTION_EXECUTION_PLANE,
-    profile: PRODUCTION_PROFILE,
-    listen_port: PRODUCTION_LISTEN_PORT,
-    runtime_id: RUNTIME_ID,
-    capabilities: [...HUB_CAPABILITIES],
+  return {
+    service: 'dsh-crew-hub',
+    surface: 'native-crew-harness',
+    ui_role: 'runtime',
+    runtime_version: RUNTIME_VERSION,
+    protocol_version: HUB_PROTOCOL_VERSION,
+    execution_plane: PRODUCTION_EXECUTION_PLANE,
+    profile: PRODUCTION_PROFILE,
+    listen_port: PRODUCTION_LISTEN_PORT,
+    runtime_id: RUNTIME_ID,
+    capabilities: [...HUB_CAPABILITIES],
   };
 }
 
@@ -95,51 +96,51 @@ export function getHubRuntimeIdentity() {
  * `compatible` means the response is from dsh-crew and satisfies the current
  * protocol + required capability contract.
  */
-export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES, strictProduction = false } = {}) {
+export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES, strictProduction = false } = {}) {
   const capabilities = normalizedCapabilities(body?.capabilities);
   const base = {
     reachable: true,
     compatible: false,
     service: typeof body?.service === 'string' ? body.service : null,
-    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
-    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
-    execution_plane: typeof body?.execution_plane === 'string' ? body.execution_plane : null,
-    profile: typeof body?.profile === 'string' ? body.profile : null,
-    listen_port: Number.isInteger(body?.listen_port) ? body.listen_port : null,
-    runtime_id: typeof body?.runtime_id === 'string' ? body.runtime_id : null,
+    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
+    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
+    execution_plane: typeof body?.execution_plane === 'string' ? body.execution_plane : null,
+    profile: typeof body?.profile === 'string' ? body.profile : null,
+    listen_port: Number.isInteger(body?.listen_port) ? body.listen_port : null,
+    runtime_id: typeof body?.runtime_id === 'string' ? body.runtime_id : null,
     capabilities,
     missing_capabilities: [],
     code: null,
   };
 
-  if (body?.service !== 'dsh-crew-hub') {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
-  }
-
-  // An explicit execution identity that is not the isolated 3210 Crew plane
-  // must never be accepted as the production Hub. Missing legacy fields remain
-  // compatible with the older protocol contract and are handled below.
-  if (body?.execution_plane !== undefined && body.execution_plane !== PRODUCTION_EXECUTION_PLANE) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.EXECUTION_PLANE_MISMATCH };
-  }
-  if (body?.listen_port !== undefined && body.listen_port !== PRODUCTION_LISTEN_PORT) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.LISTEN_PORT_MISMATCH };
-  }
+  if (body?.service !== 'dsh-crew-hub') {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
+  }
+
+  // An explicit execution identity that is not the isolated 3210 Crew plane
+  // must never be accepted as the production Hub. Missing legacy fields remain
+  // compatible with the older protocol contract and are handled below.
+  if (body?.execution_plane !== undefined && body.execution_plane !== PRODUCTION_EXECUTION_PLANE) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.EXECUTION_PLANE_MISMATCH };
+  }
+  if (body?.listen_port !== undefined && body.listen_port !== PRODUCTION_LISTEN_PORT) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.LISTEN_PORT_MISMATCH };
+  }
 
   if (!Number.isInteger(body?.protocol_version)) {
     return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING };
   }
 
-  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
-  }
-
-  if (strictProduction && !(body?.execution_plane === PRODUCTION_EXECUTION_PLANE
-    && body?.profile === PRODUCTION_PROFILE
-    && Number.isInteger(body?.listen_port) && body.listen_port === PRODUCTION_LISTEN_PORT
-    && typeof body?.runtime_id === 'string' && body.runtime_id.trim().length > 0)) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROVENANCE_MISSING };
-  }
+  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
+  }
+
+  if (strictProduction && !(body?.execution_plane === PRODUCTION_EXECUTION_PLANE
+    && body?.profile === PRODUCTION_PROFILE
+    && Number.isInteger(body?.listen_port) && body.listen_port === PRODUCTION_LISTEN_PORT
+    && typeof body?.runtime_id === 'string' && body.runtime_id.trim().length > 0)) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROVENANCE_MISSING };
+  }
 
   const required = normalizedCapabilities(requiredCapabilities);
   const advertised = new Set(capabilities);