@remodex/rmx 1.0.2

package/src/codex/native-profile-processes.ts

@@ -0,0 +1,121 @@
+import { execFile } from "node:child_process";
+import { basename } from "node:path";
+import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
+
+const PROCESS_LIST_MAX_BUFFER = 16 * 1024 * 1024;
+const DIRECT_CODEX_BASENAMES = new Set(["codex", "codex.exe"]);
+const CODEX_INTERPRETER_BASENAMES = new Set(["node", "nodejs", "bun"]);
+const CODEX_ENTRYPOINT_BASENAMES = new Set([
+  "codex",
+  "codex.js",
+  "codex.mjs",
+  "codex.cjs",
+  "codex.ts",
+]);
+
+export interface NativeProcessExecOptions {
+  encoding: "utf8";
+  timeout: number;
+  maxBuffer: number;
+  windowsHide?: boolean;
+  shell: false;
+  killSignal: "SIGKILL";
+}
+
+export type NativeProcessExecutor = (
+  file: string,
+  args: string[],
+  options: NativeProcessExecOptions,
+) => Promise<string>;
+
+export interface NativeCodexProcessProbeOptions {
+  platform?: NodeJS.Platform;
+  execFile?: NativeProcessExecutor;
+  pid?: number;
+}
+
+export type NativeCodexProcessProbe =
+  | { status: "clear"; count: 0 }
+  | { status: "busy"; count: number }
+  | { status: "unknown"; count: 0 };
+
+/** Async, shell-free child execution with runtime-enforced timeout and output bounds. */
+export const executeNativeProcess: NativeProcessExecutor = (file, args, options) => new Promise((resolve, reject) => {
+  execFile(file, args, {
+    encoding: options.encoding,
+    timeout: options.timeout,
+    maxBuffer: options.maxBuffer,
+    windowsHide: options.windowsHide,
+    shell: false,
+    killSignal: options.killSignal,
+  }, (error, stdout) => {
+    if (error) {
+      reject(error);
+      return;
+    }
+    resolve(stdout);
+  });
+});
+
+async function windowsProcessCount(run: NativeProcessExecutor): Promise<number> {
+  const powershell = resolveTrustedWindowsPowerShellExe();
+  const script = [
+    "$ErrorActionPreference='Stop';",
+    "$self=$PID;",
+    "$items=Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $self -and ($_.Name -match '^(?i:codex)(?:\\.exe)?$' -or $_.CommandLine -match '(?i)(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd)?(?:[\"\\s]|$)') };",
+    "@($items).Count",
+  ].join(" ");
+  const output = (await run(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8",
+    timeout: 12_000,
+    maxBuffer: PROCESS_LIST_MAX_BUFFER,
+    windowsHide: true,
+    shell: false,
+    killSignal: "SIGKILL",
+  })).trim();
+  if (!/^\d+$/.test(output)) throw new Error("invalid process count");
+  const count = Number(output);
+  if (!Number.isSafeInteger(count)) throw new Error("invalid process count");
+  return count;
+}
+
+async function unixProcessCount(run: NativeProcessExecutor, pid: number): Promise<number> {
+  const output = await run("ps", ["-eo", "pid=,comm=,args="], {
+    encoding: "utf8",
+    timeout: 5_000,
+    maxBuffer: PROCESS_LIST_MAX_BUFFER,
+    shell: false,
+    killSignal: "SIGKILL",
+  });
+  let count = 0;
+  for (const line of output.split("\n")) {
+    const match = line.trim().match(/^(\d+)\s+(\S+)\s*(.*)$/);
+    if (!match || Number(match[1]) === pid) continue;
+    const command = basename(match[2]!).toLowerCase();
+    const [rawArgv0 = "", rawEntrypoint = ""] = match[3]!.trim().split(/\s+/, 2);
+    const argv0 = basename(rawArgv0).toLowerCase();
+    const entrypoint = basename(rawEntrypoint).toLowerCase();
+    const isDirectCodex = DIRECT_CODEX_BASENAMES.has(command)
+      || DIRECT_CODEX_BASENAMES.has(argv0);
+    const isInterpreterWrappedCodex = CODEX_INTERPRETER_BASENAMES.has(argv0)
+      && CODEX_ENTRYPOINT_BASENAMES.has(entrypoint);
+    if (isDirectCodex || isInterpreterWrappedCodex) count += 1;
+  }
+  return count;
+}
+
+/** Best-effort, read-only process probe. It never terminates a user process. */
+export async function probeNativeCodexProcesses({
+  platform = process.platform,
+  execFile: run = executeNativeProcess,
+  pid = process.pid,
+}: NativeCodexProcessProbeOptions = {}): Promise<NativeCodexProcessProbe> {
+  try {
+    const count = await (platform === "win32"
+      ? windowsProcessCount(run)
+      : unixProcessCount(run, pid));
+    return count > 0 ? { status: "busy", count } : { status: "clear", count: 0 };
+  } catch {
+    return { status: "unknown", count: 0 };
+  }
+}

package/src/codex/native-profile-recovery.ts

@@ -0,0 +1,99 @@
+/**
+ * Pure recovery decision model for the native-main profile design spike.
+ *
+ * This module deliberately performs no credential, vault, or filesystem I/O.
+ * The eventual transaction runner must make its observations first, then apply
+ * exactly one decision returned here while holding the home-scoped lock.
+ */
+
+import type { NativeProfileJournalPhase } from "./native-profile-types";
+
+export type { NativeProfileJournalPhase } from "./native-profile-types";
+
+export type NativeProfileAuthObservation =
+  | {
+      identity: "source";
+      digest: "exact" | "changed";
+    }
+  | {
+      identity: "target";
+      digest: "exact" | "changed";
+    }
+  | {
+      identity: "unknown" | "other";
+      digest: "unknown";
+    };
+
+export type NativeProfileRecoveryDecision =
+  | {
+      action: "rollback-source";
+      publishRuntimeTransition: false;
+      externallyRefreshed: boolean;
+      reason: "source-active";
+    }
+  | {
+      action: "commit-target";
+      publishRuntimeTransition: true;
+      externallyRefreshed: boolean;
+      reason: "target-active-vault-pending";
+    }
+  | {
+      action: "finalize-target";
+      publishRuntimeTransition: true;
+      externallyRefreshed: boolean;
+      reason: "target-active-vault-committed";
+    }
+  | {
+      action: "manual-recovery";
+      publishRuntimeTransition: false;
+      externallyRefreshed: false;
+      reason: "auth-unconfirmed" | "third-identity";
+    };
+
+export function decideNativeProfileRecovery(
+  phase: NativeProfileJournalPhase,
+  observation: NativeProfileAuthObservation,
+): NativeProfileRecoveryDecision {
+  if (observation.identity === "unknown") {
+    return {
+      action: "manual-recovery",
+      publishRuntimeTransition: false,
+      externallyRefreshed: false,
+      reason: "auth-unconfirmed",
+    };
+  }
+
+  if (observation.identity === "other") {
+    return {
+      action: "manual-recovery",
+      publishRuntimeTransition: false,
+      externallyRefreshed: false,
+      reason: "third-identity",
+    };
+  }
+
+  if (observation.identity === "source") {
+    return {
+      action: "rollback-source",
+      publishRuntimeTransition: false,
+      externallyRefreshed: observation.digest === "changed",
+      reason: "source-active",
+    };
+  }
+
+  if (phase === "vault-committed") {
+    return {
+      action: "finalize-target",
+      publishRuntimeTransition: true,
+      externallyRefreshed: observation.digest === "changed",
+      reason: "target-active-vault-committed",
+    };
+  }
+
+  return {
+    action: "commit-target",
+    publishRuntimeTransition: true,
+    externallyRefreshed: observation.digest === "changed",
+    reason: "target-active-vault-pending",
+  };
+}

package/src/codex/native-profile-stage-store.ts

@@ -0,0 +1,387 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+} from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+export const NATIVE_STAGE_LEASE_MS = 30 * 60_000;
+export const NATIVE_STAGE_HEARTBEAT_INTERVAL_MS = 60_000;
+export const NATIVE_STAGE_SWEEP_INTERVAL_MS = 60_000;
+const MAX_STAGE_REGISTRY_BYTES = 1024 * 1024;
+const MAX_STAGES = 32;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const HASH_RE = /^[0-9a-f]{64}$/;
+const TOKEN_DOMAIN = "opencodex-native-stage-writer-v1\0";
+
+export type NativeStageState = "creating" | "open" | "cleanup-required";
+export type NativeStageTerminalOutcome = null | "imported" | "rejected" | "cancelled" | "expired";
+
+export interface NativeStageRecordV1 {
+  stageId: string;
+  leaseId: string;
+  writerTokenHash: string;
+  creatorInstanceId: string;
+  stagingRoot: string;
+  stagingRootDev: string;
+  stagingRootIno: string;
+  stageDev: string | null;
+  stageIno: string | null;
+  state: NativeStageState;
+  terminalOutcome: NativeStageTerminalOutcome;
+  createdAt: number;
+  lastHeartbeatAt: number;
+  leaseExpiresAt: number;
+}
+
+interface NativeStageRegistryV1 {
+  version: 1;
+  revision: number;
+  homeId: string;
+  stages: NativeStageRecordV1[];
+}
+
+export interface NativeStageProof {
+  record: NativeStageRecordV1;
+  path: string;
+  identity: { dev: bigint; ino: bigint };
+  expired: boolean;
+}
+
+export interface NativeStageReservation {
+  stageId: string;
+  leaseId: string;
+  writerToken: string;
+  stagingCodexHome: string;
+  leaseExpiresAt: number;
+}
+
+type AtomicWriter = (path: string, content: string) => Promise<void>;
+
+export interface NativeStageStoreOptions {
+  context: NativeProfileContext;
+  now: () => number;
+  randomUUID: () => string;
+  atomicWrite: AtomicWriter;
+  hardenPath: (path: string) => Promise<void>;
+  leaseMs?: number;
+}
+
+function storageUnsafe(message: string): NativeProfileError {
+  return new NativeProfileError("PROFILE_STORAGE_UNSAFE", message, 409, false, true, true);
+}
+
+function pathIdentity(path: string): { dev: bigint; ino: bigint } {
+  const entry = lstatSync(path, { bigint: true });
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function sameIdentity(entry: { dev: bigint; ino: bigint }, dev: string, ino: string): boolean {
+  return entry.dev.toString() === dev && entry.ino.toString() === ino;
+}
+
+function boundedRead(path: string): string {
+  let fd: number | undefined;
+  try {
+    const flags = process.platform === "win32"
+      ? fsConstants.O_RDONLY
+      : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    const linked = lstatSync(path, { bigint: true });
+    if (
+      !opened.isFile()
+      || !linked.isFile()
+      || linked.isSymbolicLink()
+      || opened.dev !== linked.dev
+      || opened.ino !== linked.ino
+      || opened.size > BigInt(MAX_STAGE_REGISTRY_BYTES)
+    ) throw storageUnsafe("The native-login stage registry is not a bounded private file.");
+    return readFileSync(fd, "utf8");
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+function isInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function parseRecord(value: unknown): NativeStageRecordV1 {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("record");
+  const record = value as Record<string, unknown>;
+  const state = record.state;
+  const terminal = record.terminalOutcome;
+  if (
+    typeof record.stageId !== "string" || !UUID_RE.test(record.stageId)
+    || typeof record.leaseId !== "string" || !UUID_RE.test(record.leaseId)
+    || typeof record.writerTokenHash !== "string" || !HASH_RE.test(record.writerTokenHash)
+    || typeof record.creatorInstanceId !== "string" || !HASH_RE.test(record.creatorInstanceId)
+    || typeof record.stagingRoot !== "string" || !isAbsolute(record.stagingRoot)
+    || typeof record.stagingRootDev !== "string" || !/^\d+$/.test(record.stagingRootDev)
+    || typeof record.stagingRootIno !== "string" || !/^\d+$/.test(record.stagingRootIno)
+    || (record.stageDev !== null && (typeof record.stageDev !== "string" || !/^\d+$/.test(record.stageDev)))
+    || (record.stageIno !== null && (typeof record.stageIno !== "string" || !/^\d+$/.test(record.stageIno)))
+    || !["creating", "open", "cleanup-required"].includes(String(state))
+    || ![null, "imported", "rejected", "cancelled", "expired"].includes(terminal as never)
+    || !isInteger(record.createdAt)
+    || !isInteger(record.lastHeartbeatAt)
+    || !isInteger(record.leaseExpiresAt)
+    || record.lastHeartbeatAt < record.createdAt
+    || record.leaseExpiresAt < record.lastHeartbeatAt
+  ) throw new Error("record");
+  if (state === "open" && (record.stageDev === null || record.stageIno === null || terminal !== null)) throw new Error("record state");
+  if (state === "creating" && terminal !== null) throw new Error("record state");
+  if (state === "cleanup-required" && terminal === null) throw new Error("record state");
+  return record as unknown as NativeStageRecordV1;
+}
+
+function serializeRegistry(registry: NativeStageRegistryV1): string {
+  return `${JSON.stringify(registry, null, 2)}\n`;
+}
+
+function tokenHash(context: NativeProfileContext, stageId: string, leaseId: string, token: string): Buffer {
+  return createHash("sha256")
+    .update(TOKEN_DOMAIN)
+    .update(context.homeId)
+    .update("\0")
+    .update(stageId)
+    .update("\0")
+    .update(leaseId)
+    .update("\0")
+    .update(token)
+    .digest();
+}
+
+export class NativeProfileStageStore {
+  // Trust boundary: an authenticated OS user can rewrite their own files and is
+  // not treated as an adversarial tenant. Any link, type, or inode ambiguity
+  // that this process actually observes still fails closed before credential IO.
+  private readonly context: NativeProfileContext;
+  private readonly now: () => number;
+  private readonly uuid: () => string;
+  private readonly atomicWrite: AtomicWriter;
+  private readonly hardenPath: (path: string) => Promise<void>;
+  private readonly leaseMs: number;
+
+  constructor(options: NativeStageStoreOptions) {
+    this.context = options.context;
+    this.now = options.now;
+    this.uuid = options.randomUUID;
+    this.atomicWrite = options.atomicWrite;
+    this.hardenPath = options.hardenPath;
+    this.leaseMs = Math.max(1_000, options.leaseMs ?? NATIVE_STAGE_LEASE_MS);
+  }
+
+  private read(): NativeStageRegistryV1 {
+    if (!existsSync(this.context.stageRegistryPath)) {
+      return { version: 1, revision: 0, homeId: this.context.homeId, stages: [] };
+    }
+    try {
+      const parsed = JSON.parse(boundedRead(this.context.stageRegistryPath)) as Record<string, unknown>;
+      if (
+        parsed.version !== 1
+        || !isInteger(parsed.revision)
+        || parsed.homeId !== this.context.homeId
+        || !Array.isArray(parsed.stages)
+        || parsed.stages.length > MAX_STAGES
+      ) throw new Error("registry");
+      const stages = parsed.stages.map(parseRecord);
+      if (new Set(stages.map(stage => stage.stageId)).size !== stages.length) throw new Error("duplicate stage");
+      return { version: 1, revision: parsed.revision, homeId: this.context.homeId, stages };
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      throw storageUnsafe("The native-login stage registry is invalid.");
+    }
+  }
+
+  private async write(registry: NativeStageRegistryV1): Promise<void> {
+    registry.revision += 1;
+    await this.atomicWrite(this.context.stageRegistryPath, serializeRegistry(registry));
+    await this.hardenPath(this.context.stageRegistryPath);
+  }
+
+  private record(registry: NativeStageRegistryV1, stageId: string): NativeStageRecordV1 | undefined {
+    return registry.stages.find(stage => stage.stageId === stageId);
+  }
+
+  private assertToken(record: NativeStageRecordV1 | undefined, token: string): NativeStageRecordV1 {
+    const expected = record ? Buffer.from(record.writerTokenHash, "hex") : Buffer.alloc(32);
+    const actual = tokenHash(this.context, record?.stageId ?? "00000000-0000-4000-8000-000000000000", record?.leaseId ?? "00000000-0000-4000-8000-000000000000", token);
+    const valid = timingSafeEqual(expected, actual);
+    expected.fill(0);
+    actual.fill(0);
+    if (!record || !valid) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    return record;
+  }
+
+  private assertRoot(record: NativeStageRecordV1): void {
+    try {
+      const entry = lstatSync(record.stagingRoot, { bigint: true });
+      if (
+        !entry.isDirectory()
+        || entry.isSymbolicLink()
+        || resolve(realpathSync.native(record.stagingRoot)) !== resolve(record.stagingRoot)
+        || !sameIdentity({ dev: entry.dev, ino: entry.ino }, record.stagingRootDev, record.stagingRootIno)
+      ) throw new Error("root identity");
+    } catch {
+      throw storageUnsafe("The native-login staging root changed identity.");
+    }
+  }
+
+  stagePath(record: NativeStageRecordV1): string {
+    const path = resolve(join(record.stagingRoot, record.stageId));
+    const rel = relative(resolve(record.stagingRoot), path);
+    if (!rel || rel.startsWith("..") || rel.includes(sep)) throw storageUnsafe("The native-login staging path escaped its registered root.");
+    return path;
+  }
+
+  proofForRecord(record: NativeStageRecordV1, allowPartial = false): NativeStageProof | null {
+    this.assertRoot(record);
+    const path = this.stagePath(record);
+    if (!existsSync(path)) return null;
+    try {
+      const entry = lstatSync(path, { bigint: true });
+      if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("stage type");
+      if (record.stageDev !== null && record.stageIno !== null && !sameIdentity({ dev: entry.dev, ino: entry.ino }, record.stageDev, record.stageIno)) {
+        throw new Error("stage identity");
+      }
+      if (!allowPartial) {
+        const markerPath = join(path, "stage.json");
+        const markerBefore = lstatSync(markerPath, { bigint: true });
+        if (!markerBefore.isFile() || markerBefore.isSymbolicLink() || markerBefore.size > 4096n) throw new Error("stage marker type");
+        const marker = JSON.parse(readFileSync(markerPath, "utf8")) as Record<string, unknown>;
+        const markerAfter = lstatSync(markerPath, { bigint: true });
+        if (markerAfter.dev !== markerBefore.dev || markerAfter.ino !== markerBefore.ino) throw new Error("stage marker identity");
+        if (
+          marker.version !== 2
+          || marker.stageId !== record.stageId
+          || marker.leaseId !== record.leaseId
+          || marker.homeId !== this.context.homeId
+        ) throw new Error("stage marker");
+      }
+      return {
+        record,
+        path,
+        identity: { dev: entry.dev, ino: entry.ino },
+        expired: this.now() > record.leaseExpiresAt,
+      };
+    } catch {
+      throw storageUnsafe("The native-login staging directory changed identity.");
+    }
+  }
+
+  async reserve(stagingRoot: string): Promise<NativeStageReservation> {
+    const registry = this.read();
+    if (registry.stages.length >= MAX_STAGES) throw new NativeProfileError("INVALID_REQUEST", "Native-login staging is limited to 32 concurrent sessions.", 400);
+    const canonicalRoot = resolve(realpathSync.native(stagingRoot));
+    const root = lstatSync(canonicalRoot, { bigint: true });
+    if (!root.isDirectory() || root.isSymbolicLink()) throw storageUnsafe("The native-login staging root is not a private directory.");
+    let stageId = this.uuid();
+    while (this.record(registry, stageId)) stageId = this.uuid();
+    const leaseId = this.uuid();
+    const writerToken = randomBytes(32).toString("base64url");
+    const now = this.now();
+    const digest = tokenHash(this.context, stageId, leaseId, writerToken);
+    const record: NativeStageRecordV1 = {
+      stageId,
+      leaseId,
+      writerTokenHash: digest.toString("hex"),
+      creatorInstanceId: this.context.instanceId,
+      stagingRoot: canonicalRoot,
+      stagingRootDev: root.dev.toString(),
+      stagingRootIno: root.ino.toString(),
+      stageDev: null,
+      stageIno: null,
+      state: "creating",
+      terminalOutcome: null,
+      createdAt: now,
+      lastHeartbeatAt: now,
+      leaseExpiresAt: now + this.leaseMs,
+    };
+    digest.fill(0);
+    registry.stages.push(record);
+    await this.write(registry);
+    return { stageId, leaseId, writerToken, stagingCodexHome: this.stagePath(record), leaseExpiresAt: record.leaseExpiresAt };
+  }
+
+  async activate(reservation: NativeStageReservation): Promise<void> {
+    const registry = this.read();
+    const record = this.assertToken(this.record(registry, reservation.stageId), reservation.writerToken);
+    if (record.state !== "creating" || record.leaseId !== reservation.leaseId) throw storageUnsafe("The native-login stage reservation changed state.");
+    const path = this.stagePath(record);
+    const identity = pathIdentity(path);
+    record.stageDev = identity.dev.toString();
+    record.stageIno = identity.ino.toString();
+    record.state = "open";
+    await this.write(registry);
+  }
+
+  verify(
+    stageId: string,
+    writerToken: string,
+    allowCleanupRequired = false,
+    allowInvalidMarker = false,
+  ): NativeStageProof {
+    if (!UUID_RE.test(stageId) || typeof writerToken !== "string" || writerToken.length < 32) {
+      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    }
+    const registry = this.read();
+    const record = this.assertToken(this.record(registry, stageId), writerToken);
+    if (record.creatorInstanceId !== this.context.instanceId) {
+      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    }
+    if (record.state === "creating" || (!allowCleanupRequired && record.state !== "open")) {
+      throw new NativeProfileError("STAGING_TERMINAL", "The native-login staging session is no longer writable.", 409, false, record.state === "cleanup-required" ? true : undefined, record.state === "cleanup-required" ? true : undefined);
+    }
+    const proof = this.proofForRecord(record, allowInvalidMarker);
+    if (!proof) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    return proof;
+  }
+
+  async heartbeat(proof: NativeStageProof): Promise<number> {
+    const registry = this.read();
+    const record = this.record(registry, proof.record.stageId);
+    if (!record || record.leaseId !== proof.record.leaseId || record.state !== "open") throw storageUnsafe("The native-login stage lease changed during heartbeat.");
+    const now = this.now();
+    record.lastHeartbeatAt = now;
+    record.leaseExpiresAt = now + this.leaseMs;
+    await this.write(registry);
+    this.proofForRecord(record);
+    return record.leaseExpiresAt;
+  }
+
+  async markCleanupRequired(proof: Pick<NativeStageProof, "record">, outcome: Exclude<NativeStageTerminalOutcome, null>): Promise<void> {
+    const registry = this.read();
+    const record = this.record(registry, proof.record.stageId);
+    if (!record || record.leaseId !== proof.record.leaseId) return;
+    record.state = "cleanup-required";
+    record.terminalOutcome = outcome;
+    await this.write(registry);
+  }
+
+  async remove(proof: Pick<NativeStageProof, "record">): Promise<void> {
+    const registry = this.read();
+    const index = registry.stages.findIndex(stage => stage.stageId === proof.record.stageId && stage.leaseId === proof.record.leaseId);
+    if (index < 0) return;
+    registry.stages.splice(index, 1);
+    await this.write(registry);
+  }
+
+  records(): NativeStageRecordV1[] {
+    return this.read().stages;
+  }
+
+  recordForStage(stageId: string): NativeStageRecordV1 | undefined {
+    return this.read().stages.find(stage => stage.stageId === stageId);
+  }
+}