@rpamis/comet 0.4.0-beta.10 → 0.4.0-beta.11

package/assets/skills/comet/scripts/comet-hook-router.mjs

@@ -126,17 +126,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path21) {
-      const ctrl = callVisitor(key, node, visitor, path21);
+    function visit_(key, node, visitor, path19) {
+      const ctrl = callVisitor(key, node, visitor, path19);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path21, ctrl);
-        return visit_(key, ctrl, visitor, path21);
+        replaceNode(key, path19, ctrl);
+        return visit_(key, ctrl, visitor, path19);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path21 = Object.freeze(path21.concat(node));
+          path19 = Object.freeze(path19.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path21);
+            const ci = visit_(i, node.items[i], visitor, path19);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -147,13 +147,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path21 = Object.freeze(path21.concat(node));
-          const ck = visit_("key", node.key, visitor, path21);
+          path19 = Object.freeze(path19.concat(node));
+          const ck = visit_("key", node.key, visitor, path19);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path21);
+          const cv = visit_("value", node.value, visitor, path19);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -174,17 +174,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path21) {
-      const ctrl = await callVisitor(key, node, visitor, path21);
+    async function visitAsync_(key, node, visitor, path19) {
+      const ctrl = await callVisitor(key, node, visitor, path19);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path21, ctrl);
-        return visitAsync_(key, ctrl, visitor, path21);
+        replaceNode(key, path19, ctrl);
+        return visitAsync_(key, ctrl, visitor, path19);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path21 = Object.freeze(path21.concat(node));
+          path19 = Object.freeze(path19.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path21);
+            const ci = await visitAsync_(i, node.items[i], visitor, path19);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -195,13 +195,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path21 = Object.freeze(path21.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path21);
+          path19 = Object.freeze(path19.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path19);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path21);
+          const cv = await visitAsync_("value", node.value, visitor, path19);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -228,23 +228,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path21) {
+    function callVisitor(key, node, visitor, path19) {
       if (typeof visitor === "function")
-        return visitor(key, node, path21);
+        return visitor(key, node, path19);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path21);
+        return visitor.Map?.(key, node, path19);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path21);
+        return visitor.Seq?.(key, node, path19);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path21);
+        return visitor.Pair?.(key, node, path19);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path21);
+        return visitor.Scalar?.(key, node, path19);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path21);
+        return visitor.Alias?.(key, node, path19);
       return void 0;
     }
-    function replaceNode(key, path21, node) {
-      const parent = path21[path21.length - 1];
+    function replaceNode(key, path19, node) {
+      const parent = path19[path19.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -854,10 +854,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path21, value) {
+    function collectionFromPath(schema, path19, value) {
       let v = value;
-      for (let i = path21.length - 1; i >= 0; --i) {
-        const k = path21[i];
+      for (let i = path19.length - 1; i >= 0; --i) {
+        const k = path19[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -876,7 +876,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path21) => path21 == null || typeof path21 === "object" && !!path21[Symbol.iterator]().next().done;
+    var isEmptyPath = (path19) => path19 == null || typeof path19 === "object" && !!path19[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -906,11 +906,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path21, value) {
-        if (isEmptyPath(path21))
+      addIn(path19, value) {
+        if (isEmptyPath(path19))
           this.add(value);
         else {
-          const [key, ...rest] = path21;
+          const [key, ...rest] = path19;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -924,8 +924,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path21) {
-        const [key, ...rest] = path21;
+      deleteIn(path19) {
+        const [key, ...rest] = path19;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -939,8 +939,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path21, keepScalar) {
-        const [key, ...rest] = path21;
+      getIn(path19, keepScalar) {
+        const [key, ...rest] = path19;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -958,8 +958,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path21) {
-        const [key, ...rest] = path21;
+      hasIn(path19) {
+        const [key, ...rest] = path19;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -969,8 +969,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path21, value) {
-        const [key, ...rest] = path21;
+      setIn(path19, value) {
+        const [key, ...rest] = path19;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3485,9 +3485,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path21, value) {
+      addIn(path19, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path21, value);
+          this.contents.addIn(path19, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3562,14 +3562,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path21) {
-        if (Collection.isEmptyPath(path21)) {
+      deleteIn(path19) {
+        if (Collection.isEmptyPath(path19)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path21) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path19) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3584,10 +3584,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path21, keepScalar) {
-        if (Collection.isEmptyPath(path21))
+      getIn(path19, keepScalar) {
+        if (Collection.isEmptyPath(path19))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path21, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path19, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3598,10 +3598,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path21) {
-        if (Collection.isEmptyPath(path21))
+      hasIn(path19) {
+        if (Collection.isEmptyPath(path19))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path21) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path19) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3618,13 +3618,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path21, value) {
-        if (Collection.isEmptyPath(path21)) {
+      setIn(path19, value) {
+        if (Collection.isEmptyPath(path19)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path21), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path19), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path21, value);
+          this.contents.setIn(path19, value);
         }
       }
       /**
@@ -5584,9 +5584,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path21) => {
+    visit.itemAtPath = (cst, path19) => {
       let item = cst;
-      for (const [field2, index] of path21) {
+      for (const [field2, index] of path19) {
         const tok = item?.[field2];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5595,23 +5595,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path21) => {
-      const parent = visit.itemAtPath(cst, path21.slice(0, -1));
-      const field2 = path21[path21.length - 1][0];
+    visit.parentCollection = (cst, path19) => {
+      const parent = visit.itemAtPath(cst, path19.slice(0, -1));
+      const field2 = path19[path19.length - 1][0];
       const coll = parent?.[field2];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path21, item, visitor) {
-      let ctrl = visitor(item, path21);
+    function _visit(path19, item, visitor) {
+      let ctrl = visitor(item, path19);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field2 of ["key", "value"]) {
         const token = item[field2];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path21.concat([[field2, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path19.concat([[field2, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5622,10 +5622,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field2 === "key")
-            ctrl = ctrl(item, path21);
+            ctrl = ctrl(item, path19);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path21) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path19) : ctrl;
     }
     exports.visit = visit;
   }
@@ -6927,14 +6927,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs16 = this.flowScalar(this.type);
+              const fs14 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs16, sep: [] });
+                map.items.push({ start, key: fs14, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs16);
+                this.stack.push(fs14);
               } else {
-                Object.assign(it, { key: fs16, sep: [] });
+                Object.assign(it, { key: fs14, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7062,13 +7062,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs16 = this.flowScalar(this.type);
+              const fs14 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs16, sep: [] });
+                fc.items.push({ start: [], key: fs14, sep: [] });
               else if (it.sep)
-                this.stack.push(fs16);
+                this.stack.push(fs14);
               else
-                Object.assign(it, { key: fs16, sep: [] });
+                Object.assign(it, { key: fs14, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -7398,7 +7398,7 @@ function normalizeWorkflowArtifactRoot(value) {
   const segments = projectRelativeSegments(value, "native.artifact_root");
   return segments.length === 0 ? "." : segments.join("/");
 }
-function normalizeClassicArtifactLayout(value, fallback = "legacy") {
+function normalizeClassicArtifactLayout(value, fallback = "docs") {
   const resolved = value ?? fallback;
   if (resolved !== "legacy" && resolved !== "docs") {
     throw new Error("classic.artifact_layout must be legacy or docs");
@@ -8475,8 +8475,8 @@ var init_state = __esm({
 });
 
 // domains/comet-entry/hook-router-entry.ts
-import path20 from "path";
-import { promises as fs15 } from "fs";
+import path18 from "path";
+import { promises as fs13 } from "fs";
 
 // domains/comet-native/native-paths.ts
 init_project_config();
@@ -8939,12 +8939,12 @@ function addTarget(targets, value) {
 function collectTargets(input, args) {
   const targets = [];
   const records = [args, input].filter(isRecord);
-  for (const record7 of records) {
-    for (const key of SINGULAR_PATH_KEYS) addTarget(targets, record7[key]);
-    for (const key of PLURAL_PATH_KEYS) addTarget(targets, record7[key]);
-    for (const key of NESTED_TARGET_KEYS) addTarget(targets, record7[key]);
+  for (const record3 of records) {
+    for (const key of SINGULAR_PATH_KEYS) addTarget(targets, record3[key]);
+    for (const key of PLURAL_PATH_KEYS) addTarget(targets, record3[key]);
+    for (const key of NESTED_TARGET_KEYS) addTarget(targets, record3[key]);
     for (const key of PATCH_KEYS) {
-      const value = record7[key];
+      const value = record3[key];
       if (typeof value === "string") targets.push(...patchTargets(value));
     }
   }
@@ -9147,9 +9147,9 @@ async function resolveBranchBinding(changeDir, options) {
   if (document.errors.length > 0) {
     throw new Error(`Invalid .comet.yaml: ${document.errors[0].message}`);
   }
-  const record7 = document.toJS() ?? {};
-  const isolation = typeof record7.isolation === "string" ? record7.isolation : null;
-  const boundBranch = typeof record7.bound_branch === "string" && record7.bound_branch !== "" ? record7.bound_branch : null;
+  const record3 = document.toJS() ?? {};
+  const isolation = typeof record3.isolation === "string" ? record3.isolation : null;
+  const boundBranch = typeof record3.bound_branch === "string" && record3.bound_branch !== "" ? record3.bound_branch : null;
   const bindingRequired = requiresBranchBinding(isolation);
   const currentBranch = liveGitBranch(options.cwd);
   const gitWorkTree = bindingRequired && boundBranch === null && currentBranch === null ? isGitWorkTree(options.cwd) : true;
@@ -10232,14 +10232,13 @@ async function inspectClassicHookGuard(projectRoot, changeName, request) {
 }
 
 // domains/comet-native/native-hook-guard.ts
-import { promises as fs14 } from "fs";
-import path19 from "path";
+import { promises as fs12 } from "fs";
+import path17 from "path";
 
 // domains/comet-native/native-change.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { createHash as createHash7 } from "node:crypto";
-import { promises as fs13 } from "fs";
-import path18 from "path";
+import { promises as fs11 } from "fs";
+import path16 from "path";
 
 // domains/comet-native/native-bounded-file.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -10451,528 +10450,6 @@ async function readNativeBoundedTextFile(options) {
   }
 }
 
-// domains/comet-native/native-canonical-hash.ts
-import { createHash as createHash3 } from "crypto";
-function invalidCanonicalJson(detail) {
-  throw new TypeError(`Value is not valid canonical JSON: ${detail}`);
-}
-function canonicalArray(value, ancestors) {
-  if (ancestors.has(value)) invalidCanonicalJson("cyclic structures are not supported");
-  ancestors.add(value);
-  try {
-    const enumerableKeys = Object.keys(value);
-    for (let index = 0; index < value.length; index += 1) {
-      if (!Object.prototype.hasOwnProperty.call(value, index)) {
-        invalidCanonicalJson("sparse arrays are not supported");
-      }
-    }
-    if (enumerableKeys.length !== value.length || enumerableKeys.some((key, index) => key !== String(index))) {
-      invalidCanonicalJson("arrays must not have named enumerable properties");
-    }
-    if (Object.getOwnPropertySymbols(value).length > 0) {
-      invalidCanonicalJson("symbol properties are not supported");
-    }
-    return `[${value.map((entry) => canonicalValue(entry, ancestors)).join(",")}]`;
-  } finally {
-    ancestors.delete(value);
-  }
-}
-function canonicalObject(value, ancestors) {
-  const prototype = Object.getPrototypeOf(value);
-  if (prototype !== Object.prototype && prototype !== null) {
-    invalidCanonicalJson("only plain objects are supported");
-  }
-  if (ancestors.has(value)) invalidCanonicalJson("cyclic structures are not supported");
-  if (Object.getOwnPropertySymbols(value).length > 0) {
-    invalidCanonicalJson("symbol properties are not supported");
-  }
-  ancestors.add(value);
-  try {
-    const descriptors = Object.getOwnPropertyDescriptors(value);
-    const keys = Object.keys(value).sort();
-    const fields = keys.map((key) => {
-      const descriptor = descriptors[key];
-      if (!descriptor || !("value" in descriptor)) {
-        invalidCanonicalJson("accessor properties are not supported");
-      }
-      return `${JSON.stringify(key)}:${canonicalValue(descriptor.value, ancestors)}`;
-    });
-    return `{${fields.join(",")}}`;
-  } finally {
-    ancestors.delete(value);
-  }
-}
-function canonicalValue(value, ancestors) {
-  if (value === null) return "null";
-  switch (typeof value) {
-    case "boolean":
-      return value ? "true" : "false";
-    case "string":
-      return JSON.stringify(value);
-    case "number":
-      if (!Number.isFinite(value)) invalidCanonicalJson("numbers must be finite");
-      return JSON.stringify(Object.is(value, -0) ? 0 : value);
-    case "object":
-      return Array.isArray(value) ? canonicalArray(value, ancestors) : canonicalObject(value, ancestors);
-    case "bigint":
-    case "function":
-    case "symbol":
-    case "undefined":
-      return invalidCanonicalJson(`${typeof value} values are not supported`);
-  }
-  return invalidCanonicalJson("unsupported value type");
-}
-function canonicalJson(value) {
-  return canonicalValue(value, /* @__PURE__ */ new Set());
-}
-function canonicalHash(tag, value) {
-  if (tag.length === 0) throw new TypeError("Canonical hash tag must be non-empty");
-  if (/[\r\n]/u.test(tag)) {
-    throw new TypeError("Canonical hash tag must not contain a line break");
-  }
-  return createHash3("sha256").update(`${tag}
-${canonicalJson(value)}`).digest("hex");
-}
-
-// domains/comet-native/native-controller-trust.ts
-init_race_safe_read();
-import { promises as fs11 } from "node:fs";
-import os2 from "node:os";
-import path15 from "node:path";
-
-// platform/fs/trusted-readonly-file.ts
-import { constants as fsConstants2, promises as fs10 } from "node:fs";
-import path14 from "node:path";
-function trustedReadonlyPosixFactsIssue(facts) {
-  if (facts.fileUid === facts.currentUid) {
-    return "Trusted file must be owned by a different host identity";
-  }
-  if ((facts.fileMode & 18) !== 0 || facts.fileWritable) {
-    return "Trusted file is writable by the current process";
-  }
-  if (facts.parents.some(
-    (parent) => parent.uid === facts.currentUid || (parent.mode & 18) !== 0 || parent.writable
-  )) {
-    return "Trusted file parent chain is writable by the current process";
-  }
-  return null;
-}
-var testHostIsolatedFiles = /* @__PURE__ */ new Set();
-function sameIdentity(left, right) {
-  return left.realPath === right.realPath && left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
-}
-async function currentProcessCanWrite(file) {
-  try {
-    await fs10.access(file, fsConstants2.W_OK);
-    return true;
-  } catch (error) {
-    if (error.code === "EACCES" || error.code === "EPERM") {
-      return false;
-    }
-    throw error;
-  }
-}
-async function inspectIdentity(file) {
-  const [stat, realPath] = await Promise.all([fs10.lstat(file), fs10.realpath(file)]);
-  if (!stat.isFile() || stat.isSymbolicLink()) {
-    throw new Error("Trusted file capability requires a regular non-symlink file");
-  }
-  return {
-    realPath,
-    dev: stat.dev,
-    ino: stat.ino,
-    size: stat.size,
-    mtimeMs: stat.mtimeMs
-  };
-}
-async function assertTrustedReadonlyFile(options) {
-  const identity = await inspectIdentity(options.file);
-  if (options.previous && !sameIdentity(options.previous, identity)) {
-    throw new Error("Trusted file identity changed while reading");
-  }
-  if (process.env.NODE_ENV === "test" && testHostIsolatedFiles.has(path14.resolve(options.file))) {
-    return identity;
-  }
-  if (process.platform === "win32") {
-    throw new Error(
-      "Trusted file isolation cannot be proven from Windows file mode; use a host read-only mount capability"
-    );
-  }
-  const currentUid = process.geteuid?.() ?? process.getuid?.();
-  if (currentUid === void 0) {
-    throw new Error("Trusted file owner isolation is unavailable on this platform");
-  }
-  const fileStat = await fs10.stat(identity.realPath);
-  const parents = [];
-  let directory = path14.dirname(identity.realPath);
-  for (; ; ) {
-    const stat = await fs10.lstat(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-      throw new Error("Trusted file parent chain is not a physical directory chain");
-    }
-    parents.push({
-      uid: stat.uid,
-      mode: stat.mode,
-      writable: await currentProcessCanWrite(directory)
-    });
-    const parent = path14.dirname(directory);
-    if (parent === directory) break;
-    directory = parent;
-  }
-  const issue = trustedReadonlyPosixFactsIssue({
-    currentUid,
-    fileUid: fileStat.uid,
-    fileMode: fileStat.mode,
-    fileWritable: await currentProcessCanWrite(identity.realPath),
-    parents
-  });
-  if (issue) throw new Error(issue);
-  return identity;
-}
-
-// domains/comet-native/native-review-identity.ts
-import {
-  createHash as createHash4,
-  createPrivateKey,
-  createPublicKey,
-  generateKeyPairSync,
-  sign as cryptoSign,
-  verify as cryptoVerify
-} from "node:crypto";
-var NATIVE_REVIEW_IDENTITY_SCHEMA = "comet.native.review-identity.v1";
-var NATIVE_REVIEW_SIGNATURE_SCHEMA = "comet.native.review-signature.v1";
-var ALGORITHM = "ed25519";
-var HASH_PATTERN = /^[a-f0-9]{64}$/u;
-var MAX_PUBLIC_KEY_TEXT = 512;
-var MAX_SIGNATURE_TEXT = 256;
-var SIGNATURE_CONTEXT = Buffer.from("comet.native.review-payload.v1\0", "utf8");
-function record(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function exactKeys(value, expected, label) {
-  const actual = Object.keys(value).sort();
-  const canonical = [...expected].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(canonical)) {
-    throw new Error(`${label} fields are invalid`);
-  }
-}
-function sha2562(value) {
-  return createHash4("sha256").update(value).digest("hex");
-}
-function payloadHash(value, label = "Native review payloadHash") {
-  if (typeof value !== "string" || !HASH_PATTERN.test(value)) {
-    throw new Error(`${label} must be a lowercase SHA-256 hash`);
-  }
-  return value;
-}
-function canonicalBase64(value, label, maxCharacters, expectedBytes) {
-  if (typeof value !== "string" || value.length === 0 || value.length > maxCharacters || value.length % 4 !== 0) {
-    throw new Error(`${label} is invalid`);
-  }
-  const bytes = Buffer.from(value, "base64");
-  if (bytes.length === 0 || bytes.toString("base64") !== value || expectedBytes !== void 0 && bytes.length !== expectedBytes) {
-    throw new Error(`${label} must use canonical base64`);
-  }
-  return bytes;
-}
-function publicKeyMaterial(value) {
-  const supplied = canonicalBase64(value, "Native review public key", MAX_PUBLIC_KEY_TEXT);
-  let key;
-  try {
-    key = createPublicKey({ key: supplied, format: "der", type: "spki" });
-  } catch (error) {
-    throw new Error("Native review public key is invalid", { cause: error });
-  }
-  if (key.type !== "public" || key.asymmetricKeyType !== "ed25519") {
-    throw new Error("Native review public key must be Ed25519");
-  }
-  const der = key.export({ format: "der", type: "spki" });
-  if (!Buffer.isBuffer(der) || !supplied.equals(der)) {
-    throw new Error("Native review public key must use canonical SPKI DER");
-  }
-  return { key, der, text: der.toString("base64") };
-}
-function signaturePayload(hash) {
-  return Buffer.concat([SIGNATURE_CONTEXT, Buffer.from(hash, "hex")]);
-}
-function parseNativeReviewSignature(value) {
-  const root = record(value, "Native review signature");
-  exactKeys(
-    root,
-    ["schema", "algorithm", "keyId", "payloadHash", "signature"],
-    "Native review signature"
-  );
-  if (root.schema !== NATIVE_REVIEW_SIGNATURE_SCHEMA || root.algorithm !== ALGORITHM || typeof root.keyId !== "string" || !HASH_PATTERN.test(root.keyId)) {
-    throw new Error("Native review signature identity is invalid");
-  }
-  const hash = payloadHash(root.payloadHash);
-  const signature = canonicalBase64(
-    root.signature,
-    "Native review signature",
-    MAX_SIGNATURE_TEXT,
-    64
-  ).toString("base64");
-  return {
-    schema: NATIVE_REVIEW_SIGNATURE_SCHEMA,
-    algorithm: ALGORITHM,
-    keyId: root.keyId,
-    payloadHash: hash,
-    signature
-  };
-}
-function parseNativeReviewIdentity(value) {
-  const root = record(value, "Native review identity");
-  exactKeys(root, ["schema", "algorithm", "keyId", "publicKey"], "Native review identity");
-  if (root.schema !== NATIVE_REVIEW_IDENTITY_SCHEMA || root.algorithm !== ALGORITHM || typeof root.keyId !== "string" || !HASH_PATTERN.test(root.keyId)) {
-    throw new Error("Native review identity keyId is invalid");
-  }
-  const publicKey = publicKeyMaterial(root.publicKey);
-  const keyId = sha2562(publicKey.der);
-  if (root.keyId !== keyId) {
-    throw new Error("Native review identity keyId does not match its public key");
-  }
-  return {
-    schema: NATIVE_REVIEW_IDENTITY_SCHEMA,
-    algorithm: ALGORITHM,
-    keyId,
-    publicKey: publicKey.text
-  };
-}
-function verifyNativeReviewPayloadHash(options) {
-  const identity = parseNativeReviewIdentity(options.identity);
-  const hash = payloadHash(options.payloadHash);
-  const proof = parseNativeReviewSignature(options.proof);
-  if (proof.payloadHash !== hash) {
-    throw new Error("Native review signature payloadHash does not match the expected payloadHash");
-  }
-  if (proof.keyId !== identity.keyId) {
-    throw new Error("Native review signature keyId does not match the public identity");
-  }
-  const signature = canonicalBase64(
-    proof.signature,
-    "Native review signature",
-    MAX_SIGNATURE_TEXT,
-    64
-  );
-  const publicKey = publicKeyMaterial(identity.publicKey);
-  if (!cryptoVerify(null, signaturePayload(hash), publicKey.key, signature)) {
-    throw new Error("Native review signature is invalid");
-  }
-  return proof;
-}
-
-// domains/comet-native/native-controller-trust.ts
-var NATIVE_CONTROLLER_TRUST_STORE_SCHEMA = "comet.native.controller-trust-store.v1";
-var NATIVE_CONTROLLER_TRUST_STORE_TEST_ENV = "COMET_NATIVE_CONTROLLER_TRUST_STORE_TEST_PATH";
-var PROJECT_ROOT_HASH_TAG = "comet.native.controller-project-root.v1";
-var MAX_STORE_BYTES = 256 * 1024;
-var HASH_PATTERN2 = /^[a-f0-9]{64}$/u;
-var CHANGE_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
-function record2(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function exactKeys2(value, keys, label) {
-  const actual = Object.keys(value).sort();
-  const expected = [...keys].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-    throw new Error(`${label} fields are invalid`);
-  }
-}
-function isInside4(parent, target) {
-  const relative = path15.relative(parent, target);
-  return relative === "" || !path15.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path15.sep}`);
-}
-function normalizedPhysicalRoot(root) {
-  const normalized2 = path15.normalize(root).replaceAll("\\", "/");
-  return process.platform === "win32" ? normalized2.toLowerCase() : normalized2;
-}
-async function nativeControllerProjectRootHash(projectRoot) {
-  return canonicalHash(
-    PROJECT_ROOT_HASH_TAG,
-    normalizedPhysicalRoot(await fs11.realpath(projectRoot))
-  );
-}
-function parseNativeControllerTrustStore(value) {
-  const root = record2(value, "Native controller trust store");
-  exactKeys2(root, ["schema", "projects"], "Native controller trust store");
-  if (root.schema !== NATIVE_CONTROLLER_TRUST_STORE_SCHEMA || !Array.isArray(root.projects) || root.projects.length === 0 || root.projects.length > 1024) {
-    throw new Error("Native controller trust store is invalid");
-  }
-  const projects = root.projects.map((value2, index) => {
-    const project = record2(value2, `Native controller trust project ${index}`);
-    exactKeys2(
-      project,
-      ["projectRootHash", "controllerIdentity", "legacyChanges"],
-      `Native controller trust project ${index}`
-    );
-    if (typeof project.projectRootHash !== "string" || !HASH_PATTERN2.test(project.projectRootHash) || !Array.isArray(project.legacyChanges)) {
-      throw new Error(`Native controller trust project ${index} is invalid`);
-    }
-    const legacyChanges = project.legacyChanges.map((change) => {
-      if (typeof change !== "string" || !CHANGE_NAME_PATTERN.test(change)) {
-        throw new Error(`Native controller trust project ${index} legacy change is invalid`);
-      }
-      return change;
-    });
-    if (JSON.stringify(legacyChanges) !== JSON.stringify(
-      [...new Set(legacyChanges)].sort((left, right) => left.localeCompare(right, "en"))
-    )) {
-      throw new Error(`Native controller trust project ${index} legacy changes must be sorted`);
-    }
-    return {
-      projectRootHash: project.projectRootHash,
-      controllerIdentity: parseNativeReviewIdentity(project.controllerIdentity),
-      legacyChanges
-    };
-  });
-  if (JSON.stringify(projects.map((project) => project.projectRootHash)) !== JSON.stringify(
-    [...new Set(projects.map((project) => project.projectRootHash))].sort(
-      (left, right) => left.localeCompare(right, "en")
-    )
-  )) {
-    throw new Error("Native controller trust projects must be sorted and unique");
-  }
-  return { schema: NATIVE_CONTROLLER_TRUST_STORE_SCHEMA, projects };
-}
-function nativeControllerTrustStorePath() {
-  const testPath = process.env.NODE_ENV === "test" ? process.env[NATIVE_CONTROLLER_TRUST_STORE_TEST_ENV] : void 0;
-  return path15.resolve(
-    testPath ?? path15.join(os2.homedir(), ".comet", "native-controller-trust.json")
-  );
-}
-async function readNativeControllerTrustProject(projectRoot) {
-  const storePath = nativeControllerTrustStorePath();
-  let physicalProjectRoot;
-  try {
-    physicalProjectRoot = await fs11.realpath(projectRoot);
-  } catch (error) {
-    throw new Error("Native project root is unavailable for controller trust", { cause: error });
-  }
-  let trustedIdentity;
-  try {
-    trustedIdentity = await assertTrustedReadonlyFile({ file: storePath });
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw new Error("Native controller trust store is not host-isolated read-only", {
-      cause: error
-    });
-  }
-  let result2;
-  try {
-    result2 = await readFileRaceSafe(storePath, MAX_STORE_BYTES, {
-      label: "Native controller trust store",
-      verify: (_checkpoint, context) => {
-        if (isInside4(physicalProjectRoot, context.realPath)) {
-          throw new Error("Native controller trust store must resolve outside the project");
-        }
-      }
-    });
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  try {
-    await assertTrustedReadonlyFile({
-      file: storePath,
-      previous: trustedIdentity
-    });
-  } catch (error) {
-    throw new Error("Native controller trust store isolation changed while reading", {
-      cause: error
-    });
-  }
-  let parsed;
-  try {
-    parsed = parseNativeControllerTrustStore(JSON.parse(result2.bytes.toString("utf8")));
-  } catch (error) {
-    throw new Error("Native controller trust store is not valid canonical JSON", {
-      cause: error
-    });
-  }
-  const projectRootHash = await nativeControllerProjectRootHash(projectRoot);
-  return parsed.projects.find((project) => project.projectRootHash === projectRootHash) ?? null;
-}
-
-// domains/comet-native/native-creation-authorization.ts
-var NATIVE_CREATION_AUTHORIZATION_SCHEMA = "comet.native.creation-authorization.v1";
-var HASH_PATTERN3 = /^[a-f0-9]{64}$/u;
-var CHANGE_NAME_PATTERN2 = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
-function record3(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function exactKeys3(value, expected, label) {
-  const actual = Object.keys(value).sort();
-  const canonical = [...expected].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(canonical)) {
-    throw new Error(`${label} fields are invalid`);
-  }
-}
-function parseNativeCreationAuthorization(value) {
-  const root = record3(value, "Native creation authorization");
-  exactKeys3(
-    root,
-    [
-      "schema",
-      "controllerKeyId",
-      "projectRootHash",
-      "policyHash",
-      "protocol",
-      "change",
-      "issuedAt",
-      "authorizationHash",
-      "controllerSignature"
-    ],
-    "Native creation authorization"
-  );
-  if (root.schema !== NATIVE_CREATION_AUTHORIZATION_SCHEMA || typeof root.controllerKeyId !== "string" || !HASH_PATTERN3.test(root.controllerKeyId) || typeof root.projectRootHash !== "string" || !HASH_PATTERN3.test(root.projectRootHash) || typeof root.policyHash !== "string" || !HASH_PATTERN3.test(root.policyHash) || root.protocol !== "signed-v2" || typeof root.change !== "string" || !CHANGE_NAME_PATTERN2.test(root.change) || typeof root.issuedAt !== "string" || Number.isNaN(Date.parse(root.issuedAt)) || typeof root.authorizationHash !== "string" || !HASH_PATTERN3.test(root.authorizationHash)) {
-    throw new Error("Native creation authorization is invalid");
-  }
-  const content = {
-    schema: NATIVE_CREATION_AUTHORIZATION_SCHEMA,
-    controllerKeyId: root.controllerKeyId,
-    projectRootHash: root.projectRootHash,
-    policyHash: root.policyHash,
-    protocol: "signed-v2",
-    change: root.change,
-    issuedAt: root.issuedAt
-  };
-  const authorizationHash = canonicalHash(NATIVE_CREATION_AUTHORIZATION_SCHEMA, content);
-  if (authorizationHash !== root.authorizationHash) {
-    throw new Error("Native creation authorization hash mismatch");
-  }
-  const controllerSignature = parseNativeReviewSignature(root.controllerSignature);
-  if (controllerSignature.keyId !== root.controllerKeyId || controllerSignature.payloadHash !== authorizationHash) {
-    throw new Error("Native creation authorization signature binding is invalid");
-  }
-  return { ...content, authorizationHash, controllerSignature };
-}
-async function verifyNativeCreationAuthorization(options) {
-  const controllerTrust = await readNativeControllerTrustProject(options.paths.projectRoot);
-  if (!controllerTrust) {
-    throw new Error("Native project has no controller-owned trust root");
-  }
-  const authorization = parseNativeCreationAuthorization(options.authorization);
-  const projectRootHash = await nativeControllerProjectRootHash(options.paths.projectRoot);
-  if (authorization.controllerKeyId !== controllerTrust.controllerIdentity.keyId || authorization.projectRootHash !== projectRootHash || authorization.policyHash !== options.policyHash || authorization.change !== options.change) {
-    throw new Error("Native creation authorization does not match the trusted project/change");
-  }
-  verifyNativeReviewPayloadHash({
-    identity: controllerTrust.controllerIdentity,
-    payloadHash: authorization.authorizationHash,
-    proof: authorization.controllerSignature
-  });
-  return authorization;
-}
-
 // domains/comet-native/native-config.ts
 init_project_config();
 init_project_config_reader();
@@ -10994,13 +10471,13 @@ var nativeLockCoordinator = new AsyncLocalStorage();
 import { TextDecoder as TextDecoder4 } from "util";
 
 // domains/comet-native/native-protected-file.ts
-import { createHash as createHash5 } from "node:crypto";
-import { constants as fsConstants3, promises as fs12 } from "node:fs";
-import path16 from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { constants as fsConstants2, promises as fs10 } from "node:fs";
+import path14 from "node:path";
 import { TextDecoder as TextDecoder3 } from "node:util";
-function isInside5(parent, target) {
-  const relative = path16.relative(parent, target);
-  return relative === "" || !path16.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path16.sep}`);
+function isInside4(parent, target) {
+  const relative = path14.relative(parent, target);
+  return relative === "" || !path14.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path14.sep}`);
 }
 function positiveLimit2(value) {
   if (!Number.isSafeInteger(value) || value < 1) {
@@ -11037,31 +10514,31 @@ function sameFileIdentity3(expected, actual) {
   ) && expected.birthtimeMs === actual.birthtimeMs && expected.ctimeMs === actual.ctimeMs && expected.mtimeMs === actual.mtimeMs && expected.size === actual.size;
 }
 async function captureDirectoryIdentity2(directory, label) {
-  const stat = await fs12.lstat(directory);
+  const stat = await fs10.lstat(directory);
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
     throw new Error(`${label} parent must be a real directory: ${directory}`);
   }
   return {
     path: directory,
-    realPath: await fs12.realpath(directory),
+    realPath: await fs10.realpath(directory),
     dev: stat.dev,
     ino: stat.ino,
     birthtimeMs: stat.birthtimeMs
   };
 }
 async function captureDirectoryChain2(root, directory, label) {
-  const lexicalRoot = path16.resolve(root);
-  const lexicalDirectory = path16.resolve(directory);
-  if (!isInside5(lexicalRoot, lexicalDirectory)) {
+  const lexicalRoot = path14.resolve(root);
+  const lexicalDirectory = path14.resolve(directory);
+  if (!isInside4(lexicalRoot, lexicalDirectory)) {
     throw new Error(`${label} is outside its managed root`);
   }
   const chain = [await captureDirectoryIdentity2(lexicalRoot, label)];
   let cursor = lexicalRoot;
-  for (const segment of path16.relative(lexicalRoot, lexicalDirectory).split(path16.sep).filter(Boolean)) {
+  for (const segment of path14.relative(lexicalRoot, lexicalDirectory).split(path14.sep).filter(Boolean)) {
     await verifyDirectoryChain3(chain, label);
-    cursor = path16.join(cursor, segment);
+    cursor = path14.join(cursor, segment);
     const identity = await captureDirectoryIdentity2(cursor, label);
-    if (!isInside5(chain[0].realPath, identity.realPath)) {
+    if (!isInside4(chain[0].realPath, identity.realPath)) {
       throw new Error(`${label} parent resolves outside its managed root: ${cursor}`);
     }
     chain.push(identity);
@@ -11071,8 +10548,8 @@ async function captureDirectoryChain2(root, directory, label) {
 }
 async function verifyDirectoryChain3(chain, label) {
   for (const identity of chain) {
-    const stat = await fs12.lstat(identity.path);
-    if (!stat.isDirectory() || stat.isSymbolicLink() || !sameDirectoryIdentity3(identity, stat) || await fs12.realpath(identity.path) !== identity.realPath) {
+    const stat = await fs10.lstat(identity.path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || !sameDirectoryIdentity3(identity, stat) || await fs10.realpath(identity.path) !== identity.realPath) {
       throw new Error(`${label} parent changed during I/O: ${identity.path}`);
     }
   }
@@ -11093,36 +10570,36 @@ async function readHandleBounded(handle, maxBytes, label) {
 }
 async function readNativeProtectedFile(options) {
   const maxBytes = positiveLimit2(options.maxBytes);
-  const file = path16.resolve(options.file);
-  const chain = await captureDirectoryChain2(options.root, path16.dirname(file), options.label);
+  const file = path14.resolve(options.file);
+  const chain = await captureDirectoryChain2(options.root, path14.dirname(file), options.label);
   const forbidden = await Promise.all(
     (options.forbiddenRoots ?? []).map(
-      (root) => captureDirectoryIdentity2(path16.resolve(root), options.label)
+      (root) => captureDirectoryIdentity2(path14.resolve(root), options.label)
     )
   );
   await options.hooks?.afterParentChainCaptured?.();
   await verifyDirectoryChain3(chain, options.label);
-  const before = await fs12.lstat(file);
+  const before = await fs10.lstat(file);
   if (!before.isFile() || before.isSymbolicLink()) {
     throw new Error(`${options.label} must be a regular file`);
   }
   if (before.size > maxBytes) throw new Error(`${options.label} exceeds ${maxBytes} bytes`);
   const beforeIdentity = asFileIdentity(before);
-  const beforeRealPath = await fs12.realpath(file);
-  if (!isInside5(chain[0].realPath, beforeRealPath)) {
+  const beforeRealPath = await fs10.realpath(file);
+  if (!isInside4(chain[0].realPath, beforeRealPath)) {
     throw new Error(`${options.label} resolves outside its managed root`);
   }
-  if (forbidden.some((identity) => isInside5(identity.realPath, beforeRealPath))) {
+  if (forbidden.some((identity) => isInside4(identity.realPath, beforeRealPath))) {
     throw new Error(`${options.label} resolves inside an excluded root`);
   }
-  const flags = process.platform === "win32" ? fsConstants3.O_RDONLY : fsConstants3.O_RDONLY | fsConstants3.O_NOFOLLOW | fsConstants3.O_NONBLOCK;
-  const handle = await fs12.open(file, flags);
+  const flags = process.platform === "win32" ? fsConstants2.O_RDONLY : fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW | fsConstants2.O_NONBLOCK;
+  const handle = await fs10.open(file, flags);
   try {
     const opened = await handle.stat();
     await options.hooks?.afterOpen?.();
     const [pathAfterOpen, realPathAfterOpen] = await Promise.all([
-      fs12.lstat(file),
-      fs12.realpath(file)
+      fs10.lstat(file),
+      fs10.realpath(file)
     ]);
     await verifyDirectoryChain3(chain, options.label);
     await verifyDirectoryChain3(forbidden, options.label);
@@ -11134,8 +10611,8 @@ async function readNativeProtectedFile(options) {
     await options.hooks?.beforeFinalCheck?.();
     const [afterHandle, afterPath, afterRealPath] = await Promise.all([
       handle.stat(),
-      fs12.lstat(file),
-      fs12.realpath(file)
+      fs10.lstat(file),
+      fs10.realpath(file)
     ]);
     await verifyDirectoryChain3(chain, options.label);
     await verifyDirectoryChain3(forbidden, options.label);
@@ -11144,7 +10621,7 @@ async function readNativeProtectedFile(options) {
     }
     return {
       bytes,
-      hash: createHash5("sha256").update(bytes).digest("hex"),
+      hash: createHash3("sha256").update(bytes).digest("hex"),
       size: bytes.length
     };
   } finally {
@@ -11169,104 +10646,13 @@ var NATIVE_TRANSACTION_EVENT_MAX_BYTES = 16 * 1024;
 var NATIVE_LEGACY_TRANSACTION_FILE_MAX_BYTES = 64 * 1024 * 1024;
 var UTF8_DECODER = new TextDecoder4("utf-8", { fatal: true });
 
-// domains/comet-native/native-review-trust.ts
-var NATIVE_REVIEW_TRUST_POLICY_SCHEMA = "comet.native.review-trust-policy.v2";
-var POLICY_HASH_TAG = NATIVE_REVIEW_TRUST_POLICY_SCHEMA;
-var MAX_POLICY_BYTES = 64 * 1024;
-var HASH_PATTERN4 = /^[a-f0-9]{64}$/u;
-function record4(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function exactKeys4(value, expected, label) {
-  const actual = Object.keys(value).sort();
-  const canonical = [...expected].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(canonical)) {
-    throw new Error(`${label} fields are invalid`);
-  }
-}
-function identities(value, label) {
-  if (!Array.isArray(value) || value.length === 0 || value.length > 64) {
-    throw new Error(`${label} must be a bounded non-empty array`);
-  }
-  const parsed = value.map(parseNativeReviewIdentity).sort((left, right) => left.keyId.localeCompare(right.keyId, "en"));
-  if (new Set(parsed.map((identity) => identity.keyId)).size !== parsed.length || JSON.stringify(value) !== JSON.stringify(parsed)) {
-    throw new Error(`${label} must be sorted and unique`);
-  }
-  return parsed;
-}
-function parseNativeReviewTrustPolicy(value) {
-  const root = record4(value, "Native review trust policy");
-  exactKeys4(
-    root,
-    [
-      "schema",
-      "controllerKeyId",
-      "implementationKeyId",
-      "trustedReviewers",
-      "trustedWaiverSigners",
-      "policyHash",
-      "controllerSignature"
-    ],
-    "Native review trust policy"
-  );
-  if (root.schema !== NATIVE_REVIEW_TRUST_POLICY_SCHEMA || typeof root.controllerKeyId !== "string" || !HASH_PATTERN4.test(root.controllerKeyId) || typeof root.implementationKeyId !== "string" || !HASH_PATTERN4.test(root.implementationKeyId) || typeof root.policyHash !== "string" || !HASH_PATTERN4.test(root.policyHash)) {
-    throw new Error("Native review trust policy identity or hash is invalid");
-  }
-  const trustedReviewers = identities(root.trustedReviewers, "Native trusted reviewers");
-  const trustedWaiverSigners = identities(
-    root.trustedWaiverSigners,
-    "Native trusted waiver signers"
-  );
-  if (trustedReviewers.some((identity) => identity.keyId === root.implementationKeyId) || trustedWaiverSigners.some((identity) => identity.keyId === root.implementationKeyId) || (/* @__PURE__ */ new Set([
-    root.controllerKeyId,
-    root.implementationKeyId,
-    ...trustedReviewers.map((identity) => identity.keyId),
-    ...trustedWaiverSigners.map((identity) => identity.keyId)
-  ])).size !== 2 + trustedReviewers.length + trustedWaiverSigners.length) {
-    throw new Error(
-      "Native controller, implementation, reviewer, and waiver signer identities must be globally distinct"
-    );
-  }
-  const content = {
-    schema: NATIVE_REVIEW_TRUST_POLICY_SCHEMA,
-    controllerKeyId: root.controllerKeyId,
-    implementationKeyId: root.implementationKeyId,
-    trustedReviewers,
-    trustedWaiverSigners
-  };
-  const policyHash = canonicalHash(POLICY_HASH_TAG, content);
-  if (policyHash !== root.policyHash) {
-    throw new Error("Native review trust policy hash mismatch");
-  }
-  const controllerSignature = parseNativeReviewSignature(root.controllerSignature);
-  if (controllerSignature.keyId !== root.controllerKeyId || controllerSignature.payloadHash !== policyHash) {
-    throw new Error("Native review trust policy controller signature binding is invalid");
-  }
-  return { ...content, policyHash, controllerSignature };
-}
-function verifyNativeReviewTrustPolicy(value, controllerIdentity) {
-  const policy = parseNativeReviewTrustPolicy(value);
-  if (policy.controllerKeyId !== controllerIdentity.keyId) {
-    throw new Error("Native review trust policy controller is not host-trusted");
-  }
-  verifyNativeReviewPayloadHash({
-    identity: controllerIdentity,
-    payloadHash: policy.policyHash,
-    proof: policy.controllerSignature
-  });
-  return policy;
-}
-
 // domains/comet-native/native-snapshot.ts
-import path17 from "path";
+import path15 from "path";
 
 // domains/comet-native/native-hash.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function sha256Text(content) {
-  return createHash6("sha256").update(content).digest("hex");
+  return createHash4("sha256").update(content).digest("hex");
 }
 
 // domains/comet-native/native-snapshot.ts
@@ -11278,11 +10664,10 @@ var DEFAULT_NATIVE_SNAPSHOT_LIMITS = {
 };
 var MAX_RECORDED_OMISSIONS = 1e3;
 var NATIVE_SNAPSHOT_MANIFEST_HARD_MAX_BYTES = 8 * 1024 * 1024;
-var CHANGE_NAME_PATTERN3 = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+var CHANGE_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
 var MANIFEST_KEYS = /* @__PURE__ */ new Set([
   "schema",
   "origin",
-  "creation",
   "capture",
   "createdAt",
   "complete",
@@ -11302,14 +10687,6 @@ var LIMIT_KEYS = /* @__PURE__ */ new Set([
 ]);
 var POLICY_KEYS = /* @__PURE__ */ new Set(["schema", "include", "exclude", "hash"]);
 var CAPTURE_KEYS = /* @__PURE__ */ new Set(["provider", "gitSelection", "physicalSelection", "projection"]);
-var CREATION_KEYS = /* @__PURE__ */ new Set([
-  "schema",
-  "protocol",
-  "policyHash",
-  "policySnapshotRef",
-  "policySnapshotHash",
-  "authorization"
-]);
 var GIT_PROJECTION_KEYS = /* @__PURE__ */ new Set(["provider", "selection"]);
 var GIT_SELECTION_KEYS = /* @__PURE__ */ new Set([
   "schema",
@@ -11363,7 +10740,7 @@ var OMISSION_REASONS = /* @__PURE__ */ new Set([
   "physical-enumeration-limit",
   "physical-selection-changed"
 ]);
-var HASH_PATTERN5 = /^[a-f0-9]{64}$/u;
+var HASH_PATTERN = /^[a-f0-9]{64}$/u;
 var GIT_LIST_STDERR_LIMIT = 64 * 1024;
 var GIT_TEXT_STDOUT_LIMIT = 64 * 1024;
 var DEFAULT_NATIVE_GIT_SELECTION_LIMITS = {
@@ -11495,7 +10872,7 @@ function resolveSnapshotPolicy(value) {
     excludeMatchers: exclude.map(compileNativeSnapshotPattern)
   };
 }
-function record5(value, label) {
+function record(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${label} must be an object`);
   }
@@ -11521,17 +10898,17 @@ function snapshotPath(value, label) {
   if (typeof value !== "string" || value.length === 0 || value.includes("\\") || value.includes("\0")) {
     throw new Error(`${label} must be a normalized project-relative path`);
   }
-  const normalized2 = path17.posix.normalize(value);
-  if (normalized2 !== value || path17.posix.isAbsolute(value) || normalized2 === ".." || normalized2.startsWith("../")) {
+  const normalized2 = path15.posix.normalize(value);
+  if (normalized2 !== value || path15.posix.isAbsolute(value) || normalized2 === ".." || normalized2.startsWith("../")) {
     throw new Error(`${label} must stay inside the project root`);
   }
   return value;
 }
 function parseEntry(value, index) {
-  const entry = record5(value, `Native snapshot entry ${index}`);
+  const entry = record(value, `Native snapshot entry ${index}`);
   rejectUnknown(entry, ENTRY_KEYS, `Native snapshot entry ${index}`);
   const entryPath = snapshotPath(entry.path, `Native snapshot entry ${index} path`);
-  if (typeof entry.hash !== "string" || !HASH_PATTERN5.test(entry.hash)) {
+  if (typeof entry.hash !== "string" || !HASH_PATTERN.test(entry.hash)) {
     throw new Error(`Native snapshot entry ${index} hash is invalid`);
   }
   if (entry.type !== "file") throw new Error(`Native snapshot entry ${index} type is invalid`);
@@ -11543,7 +10920,7 @@ function parseEntry(value, index) {
   };
 }
 function parseOmission(value, index) {
-  const omission = record5(value, `Native snapshot omission ${index}`);
+  const omission = record(value, `Native snapshot omission ${index}`);
   rejectUnknown(omission, OMISSION_KEYS, `Native snapshot omission ${index}`);
   if (!OMISSION_TYPES.has(omission.type)) {
     throw new Error(`Native snapshot omission ${index} type is invalid`);
@@ -11559,9 +10936,9 @@ function parseOmission(value, index) {
   };
 }
 function parseOmissionOverflow(value) {
-  const overflow = record5(value, "Native snapshot omission overflow");
+  const overflow = record(value, "Native snapshot omission overflow");
   rejectUnknown(overflow, OMISSION_OVERFLOW_KEYS, "Native snapshot omission overflow");
-  if (typeof overflow.hash !== "string" || !HASH_PATTERN5.test(overflow.hash)) {
+  if (typeof overflow.hash !== "string" || !HASH_PATTERN.test(overflow.hash)) {
     throw new Error("Native snapshot omission overflow hash is invalid");
   }
   const expectedRef = `native-snapshot://omitted-overflow/${overflow.hash}`;
@@ -11575,9 +10952,9 @@ function parseOmissionOverflow(value) {
   };
 }
 function parseGitSelectionStreamEvidence(value, label) {
-  const stream = record5(value, label);
+  const stream = record(value, label);
   rejectUnknown(stream, GIT_SELECTION_STREAM_KEYS, label);
-  if (typeof stream.hash !== "string" || !HASH_PATTERN5.test(stream.hash)) {
+  if (typeof stream.hash !== "string" || !HASH_PATTERN.test(stream.hash)) {
     throw new Error(`${label} hash is invalid`);
   }
   if (typeof stream.overflow !== "boolean") {
@@ -11601,7 +10978,7 @@ function parseGitSelectionStreamEvidence(value, label) {
   };
 }
 function parseGitSelectionEvidence(value) {
-  const selection = record5(value, "Native Git selection evidence");
+  const selection = record(value, "Native Git selection evidence");
   rejectUnknown(selection, GIT_SELECTION_KEYS, "Native Git selection evidence");
   if (selection.schema !== "comet.native.git-selection.v1") {
     throw new Error("Native Git selection evidence schema is invalid");
@@ -11661,9 +11038,9 @@ function parseGitSelectionEvidence(value) {
   };
 }
 function parsePhysicalSelectionStreamEvidence(value, label) {
-  const stream = record5(value, label);
+  const stream = record(value, label);
   rejectUnknown(stream, PHYSICAL_SELECTION_STREAM_KEYS, label);
-  if (typeof stream.hash !== "string" || !HASH_PATTERN5.test(stream.hash)) {
+  if (typeof stream.hash !== "string" || !HASH_PATTERN.test(stream.hash)) {
     throw new Error(`${label} hash is invalid`);
   }
   if (typeof stream.overflow !== "boolean" || typeof stream.unstable !== "boolean") {
@@ -11690,7 +11067,7 @@ function parsePhysicalSelectionStreamEvidence(value, label) {
   };
 }
 function parsePhysicalSelectionEvidence(value) {
-  const selection = record5(value, "Native physical selection evidence");
+  const selection = record(value, "Native physical selection evidence");
   rejectUnknown(selection, PHYSICAL_SELECTION_KEYS, "Native physical selection evidence");
   if (selection.schema !== "comet.native.physical-selection.v1") {
     throw new Error("Native physical selection evidence schema is invalid");
@@ -11723,7 +11100,7 @@ function parsePhysicalSelectionEvidence(value) {
   };
 }
 function parseNativeContentSnapshotManifest(value) {
-  const manifest = record5(value, "Native content snapshot manifest");
+  const manifest = record(value, "Native content snapshot manifest");
   rejectUnknown(manifest, MANIFEST_KEYS, "Native content snapshot manifest");
   if (manifest.schema !== "comet.native.content-snapshot.v1") {
     throw new Error("Unsupported Native content snapshot schema");
@@ -11731,28 +11108,9 @@ function parseNativeContentSnapshotManifest(value) {
   if (!SNAPSHOT_ORIGINS.has(manifest.origin)) {
     throw new Error("Native content snapshot origin is invalid");
   }
-  let creation;
-  if (manifest.creation !== void 0) {
-    const value2 = record5(manifest.creation, "Native change creation binding");
-    rejectUnknown(value2, CREATION_KEYS, "Native change creation binding");
-    if (value2.schema !== "comet.native.change-creation-binding.v1" || value2.protocol !== "signed-v2" || typeof value2.policyHash !== "string" || !HASH_PATTERN5.test(value2.policyHash) || typeof value2.policySnapshotHash !== "string" || !HASH_PATTERN5.test(value2.policySnapshotHash) || typeof value2.policySnapshotRef !== "string" || !/^runtime\/trust\/review-policy-[a-f0-9]{64}\.json$/u.test(value2.policySnapshotRef)) {
-      throw new Error("Native change creation binding is invalid");
-    }
-    creation = {
-      schema: "comet.native.change-creation-binding.v1",
-      protocol: "signed-v2",
-      policyHash: value2.policyHash,
-      policySnapshotRef: value2.policySnapshotRef,
-      policySnapshotHash: value2.policySnapshotHash,
-      authorization: parseNativeCreationAuthorization(value2.authorization)
-    };
-  }
-  if (manifest.origin !== "change-created" && creation !== void 0) {
-    throw new Error("Native change creation binding does not match snapshot origin");
-  }
   let capture;
   if (manifest.capture !== void 0) {
-    const captureValue = record5(manifest.capture, "Native content snapshot capture");
+    const captureValue = record(manifest.capture, "Native content snapshot capture");
     rejectUnknown(captureValue, CAPTURE_KEYS, "Native content snapshot capture");
     if (captureValue.provider !== "git" && captureValue.provider !== "physical-tree") {
       throw new Error("Native content snapshot capture provider is invalid");
@@ -11761,7 +11119,7 @@ function parseNativeContentSnapshotManifest(value) {
     const physicalSelection2 = captureValue.physicalSelection === void 0 ? void 0 : parsePhysicalSelectionEvidence(captureValue.physicalSelection);
     let projection = null;
     if (captureValue.projection !== void 0) {
-      const projectionValue = record5(captureValue.projection, "Native content snapshot projection");
+      const projectionValue = record(captureValue.projection, "Native content snapshot projection");
       rejectUnknown(projectionValue, GIT_PROJECTION_KEYS, "Native content snapshot projection");
       if (projectionValue.provider !== "git") {
         throw new Error("Native content snapshot projection provider is invalid");
@@ -11798,7 +11156,7 @@ function parseNativeContentSnapshotManifest(value) {
   if (typeof manifest.complete !== "boolean") {
     throw new Error("Native content snapshot complete flag is invalid");
   }
-  const limitValue = record5(manifest.limits, "Native content snapshot limits");
+  const limitValue = record(manifest.limits, "Native content snapshot limits");
   rejectUnknown(limitValue, LIMIT_KEYS, "Native content snapshot limits");
   const limits = {
     maxFiles: positiveInteger(limitValue.maxFiles, "Native snapshot maxFiles"),
@@ -11814,7 +11172,7 @@ function parseNativeContentSnapshotManifest(value) {
   };
   let policy;
   if (manifest.policy !== void 0) {
-    const policyValue = record5(manifest.policy, "Native snapshot policy");
+    const policyValue = record(manifest.policy, "Native snapshot policy");
     rejectUnknown(policyValue, POLICY_KEYS, "Native snapshot policy");
     if (policyValue.schema !== "comet.native.snapshot-policy.v1") {
       throw new Error("Native snapshot policy schema is invalid");
@@ -11907,7 +11265,6 @@ function parseNativeContentSnapshotManifest(value) {
   const parsed = {
     schema: "comet.native.content-snapshot.v1",
     origin: manifest.origin,
-    ...creation ? { creation } : {},
     ...capture ? { capture } : {},
     createdAt: manifest.createdAt,
     complete: manifest.complete,
@@ -11924,10 +11281,10 @@ function parseNativeContentSnapshotManifest(value) {
   return parsed;
 }
 function nativeBaselineManifestFile(paths, name) {
-  if (!CHANGE_NAME_PATTERN3.test(name)) throw new Error(`Invalid Native change name: ${name}`);
-  const changeDir = path17.join(paths.changesDir, name);
+  if (!CHANGE_NAME_PATTERN.test(name)) throw new Error(`Invalid Native change name: ${name}`);
+  const changeDir = path15.join(paths.changesDir, name);
   if (!isInsidePath(paths.changesDir, changeDir)) throw new Error("Native change path escaped");
-  return path17.join(changeDir, "runtime", "baseline-manifest.json");
+  return path15.join(changeDir, "runtime", "baseline-manifest.json");
 }
 async function readNativeBaselineManifest(paths, name) {
   const file = nativeBaselineManifestFile(paths, name);
@@ -12000,7 +11357,7 @@ var PHASES2 = /* @__PURE__ */ new Set(["shape", "build", "verify", "archive"]);
 var APPROVALS = /* @__PURE__ */ new Set(["implicit", "confirmed"]);
 var VERIFY_RESULTS2 = /* @__PURE__ */ new Set(["pending", "pass", "fail"]);
 var NATIVE_CHANGE_STATE_FILE = "comet-state.yaml";
-var HASH_PATTERN6 = /^[a-f0-9]{64}$/u;
+var HASH_PATTERN2 = /^[a-f0-9]{64}$/u;
 var NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
 var CONTENT_ADDRESSED_REF_PATTERN = /^runtime\/evidence\/(scopes|allowances|verifications)\/([a-f0-9]{64})\.json$/u;
 var NativeSchemaMigrationRequiredError = class extends Error {
@@ -12047,7 +11404,7 @@ var NATIVE_BRIEF_TEMPLATE = [
   "# Verification expectations",
   ""
 ].join("\n");
-function record6(value, label) {
+function record2(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${label} must be a mapping`);
   }
@@ -12064,12 +11421,12 @@ function assertCapabilityId(value) {
   if (!NAME_PATTERN.test(value)) throw new Error(`Invalid Native capability id: ${value}`);
 }
 function assertRelativeRef(value, label) {
-  if (value.length === 0 || path18.isAbsolute(value) || /^(?:[A-Za-z]:|~|[\\/])/u.test(value) || value.split(/[\\/]/u).includes("..")) {
+  if (value.length === 0 || path16.isAbsolute(value) || /^(?:[A-Za-z]:|~|[\\/])/u.test(value) || value.split(/[\\/]/u).includes("..")) {
     throw new Error(`${label} must stay inside the Native change`);
   }
 }
 function parseSpecChange(value, index) {
-  const item = record6(value, `spec_changes[${index}]`);
+  const item = record2(value, `spec_changes[${index}]`);
   rejectUnknown2(item, SPEC_CHANGE_KEYS, `spec_changes[${index}]`);
   if (typeof item.capability !== "string") throw new Error("spec change capability is required");
   assertCapabilityId(item.capability);
@@ -12088,12 +11445,12 @@ function parseSpecChange(value, index) {
       throw new Error(`Create spec ${item.capability} requires null base_hash`);
   } else if (item.operation === "replace") {
     if (!source) throw new Error(`Replace spec ${item.capability} requires source`);
-    if (typeof baseHash !== "string" || !HASH_PATTERN6.test(baseHash)) {
+    if (typeof baseHash !== "string" || !HASH_PATTERN2.test(baseHash)) {
       throw new Error(`Replace spec ${item.capability} requires a SHA-256 base_hash`);
     }
   } else {
     if (source !== void 0) throw new Error(`Remove spec ${item.capability} forbids source`);
-    if (typeof baseHash !== "string" || !HASH_PATTERN6.test(baseHash)) {
+    if (typeof baseHash !== "string" || !HASH_PATTERN2.test(baseHash)) {
       throw new Error(`Remove spec ${item.capability} requires a SHA-256 base_hash`);
     }
   }
@@ -12161,7 +11518,7 @@ function parseChangeFields(root, knownKeys) {
   };
 }
 function parseLegacyNativeChangeValue(value) {
-  const root = record6(value, NATIVE_CHANGE_STATE_FILE);
+  const root = record2(value, NATIVE_CHANGE_STATE_FILE);
   if (root.schema !== NATIVE_LEGACY_CHANGE_SCHEMA) {
     throw new Error(`Expected ${NATIVE_LEGACY_CHANGE_SCHEMA}`);
   }
@@ -12188,20 +11545,20 @@ function contentAddressedRef(value, label, kind) {
 }
 function approvedContractHash(value) {
   if (value === void 0 || value === null) return null;
-  if (typeof value !== "string" || !HASH_PATTERN6.test(value)) {
+  if (typeof value !== "string" || !HASH_PATTERN2.test(value)) {
     throw new Error("Native approved_contract_hash must be null or a SHA-256 hash");
   }
   return value;
 }
 function verificationProtocol(value) {
   if (value === void 0) return "legacy-v1";
-  if (value !== "legacy-v1" && value !== "signed-v2") {
-    throw new Error("Native verification_protocol must be legacy-v1 or signed-v2");
+  if (value !== "legacy-v1") {
+    throw new Error("Native verification_protocol must be legacy-v1");
   }
   return value;
 }
 function parseV2NativeChangeValue(value) {
-  const root = record6(value, NATIVE_CHANGE_STATE_FILE);
+  const root = record2(value, NATIVE_CHANGE_STATE_FILE);
   if (root.schema !== NATIVE_V2_CHANGE_SCHEMA) {
     throw new Error(`Expected ${NATIVE_V2_CHANGE_SCHEMA}`);
   }
@@ -12220,7 +11577,7 @@ function parseV2NativeChangeValue(value) {
   };
 }
 function parseNativeChangeValue(value) {
-  const root = record6(value, NATIVE_CHANGE_STATE_FILE);
+  const root = record2(value, NATIVE_CHANGE_STATE_FILE);
   if (root.schema !== NATIVE_CHANGE_SCHEMA) {
     if (root.schema === NATIVE_LEGACY_CHANGE_SCHEMA || root.schema === NATIVE_V2_CHANGE_SCHEMA) {
       const previous = root.schema === NATIVE_LEGACY_CHANGE_SCHEMA ? parseLegacyNativeChangeValue(root) : parseV2NativeChangeValue(root);
@@ -12274,7 +11631,7 @@ function parseNativeChangeValue(value) {
   };
 }
 function inspectNativeChangeValue(value) {
-  const root = record6(value, NATIVE_CHANGE_STATE_FILE);
+  const root = record2(value, NATIVE_CHANGE_STATE_FILE);
   if (root.schema === NATIVE_LEGACY_CHANGE_SCHEMA) {
     const state2 = parseLegacyNativeChangeValue(root);
     return {
@@ -12331,15 +11688,15 @@ function inspectNativeChangeValue(value) {
 }
 function nativeChangeDir(paths, name) {
   assertNativeName(name);
-  const target = path18.join(paths.changesDir, name);
+  const target = path16.join(paths.changesDir, name);
   if (!isInsidePath(paths.changesDir, target)) throw new Error("Native change path escaped");
   return target;
 }
 async function hasPendingNativeSchemaMigration(paths, name) {
-  const file = path18.join(nativeChangeDir(paths, name), "runtime", "schema-migration.json");
+  const file = path16.join(nativeChangeDir(paths, name), "runtime", "schema-migration.json");
   await resolveContainedNativePath(paths.nativeRoot, file);
   try {
-    await fs13.lstat(file);
+    await fs11.lstat(file);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -12347,8 +11704,8 @@ async function hasPendingNativeSchemaMigration(paths, name) {
   }
 }
 var NATIVE_CHANGE_DOCUMENT_MAX_BYTES = 256 * 1024;
-async function readChangeDocumentFile(file, root = path18.dirname(file)) {
-  const ref = path18.relative(root, file).split(path18.sep).join("/");
+async function readChangeDocumentFile(file, root = path16.dirname(file)) {
+  const ref = path16.relative(root, file).split(path16.sep).join("/");
   const source = await readNativeBoundedTextFile({
     root,
     ref,
@@ -12361,7 +11718,7 @@ async function readChangeDocumentFile(file, root = path18.dirname(file)) {
   return document.toJS();
 }
 async function inspectNativeChange(paths, name) {
-  const file = path18.join(nativeChangeDir(paths, name), NATIVE_CHANGE_STATE_FILE);
+  const file = path16.join(nativeChangeDir(paths, name), NATIVE_CHANGE_STATE_FILE);
   await resolveContainedNativePath(paths.nativeRoot, file);
   const inspection = inspectNativeChangeValue(await readChangeDocumentFile(file, paths.nativeRoot));
   if (inspection.state && inspection.state.name !== name) {
@@ -12382,67 +11739,10 @@ async function inspectNativeChange(paths, name) {
   return inspection;
 }
 async function assertNativeVerificationProtocolBinding(paths, state) {
-  const controllerTrust = await readNativeControllerTrustProject(paths.projectRoot);
-  const controllerRequiresSigned = controllerTrust !== null && !controllerTrust.legacyChanges.includes(state.name);
-  if (controllerRequiresSigned && state.verification_protocol !== "signed-v2") {
-    throw new Error(
-      `Native verification protocol does not match its creation baseline (controller-backed): expected signed-v2 for ${state.name}`
-    );
-  }
-  if (controllerTrust !== null && controllerTrust.legacyChanges.includes(state.name) && state.verification_protocol !== "legacy-v1") {
-    throw new Error(`Native controller trust marks ${state.name} as legacy-v1`);
-  }
   const baseline = await readNativeBaselineManifest(paths, state.name);
-  if (baseline === null) {
-    if (state.verification_protocol === "signed-v2" || controllerRequiresSigned) {
-      throw new Error(
-        `Native signed-v2 verification protocol has no creation baseline: ${state.name}`
-      );
-    }
-    return;
-  }
-  const expectedProtocol = baseline.creation ? "signed-v2" : "legacy-v1";
-  if (state.verification_protocol !== expectedProtocol) {
-    throw new Error(
-      `Native verification protocol does not match its creation baseline: expected ${expectedProtocol}, got ${state.verification_protocol}`
-    );
-  }
-  if (expectedProtocol === "signed-v2") {
-    if (!controllerTrust) {
-      throw new Error("Native signed-v2 creation has no controller-owned trust root");
-    }
-    const creation = baseline.creation;
-    const changeDir = nativeChangeDir(paths, state.name);
-    const snapshot = await readNativeProtectedTextFile({
-      root: nativeChangeDir(paths, state.name),
-      file: path18.join(changeDir, ...creation.policySnapshotRef.split("/")),
-      maxBytes: 64 * 1024,
-      label: "Native creation-time trust policy snapshot"
-    });
-    if (createHash7("sha256").update(snapshot.text).digest("hex") !== creation.policySnapshotHash) {
-      throw new Error("Native creation-time trust policy snapshot hash mismatch");
-    }
-    let policy;
-    try {
-      policy = JSON.parse(snapshot.text);
-    } catch (error) {
-      throw new Error("Native creation-time trust policy snapshot is invalid JSON", {
-        cause: error
-      });
-    }
-    const verifiedPolicy = verifyNativeReviewTrustPolicy(
-      policy,
-      controllerTrust.controllerIdentity
-    );
-    if (verifiedPolicy.policyHash !== creation.policyHash) {
-      throw new Error("Native creation-time trust policy snapshot does not match its binding");
-    }
-    await verifyNativeCreationAuthorization({
-      paths,
-      policyHash: creation.policyHash,
-      authorization: creation.authorization,
-      change: state.name
-    });
+  if (baseline === null) return;
+  if (state.verification_protocol !== "legacy-v1") {
+    throw new Error(`Native verification protocol is unsupported: ${state.verification_protocol}`);
   }
 }
 async function readNativeChange(paths, name) {
@@ -12473,14 +11773,14 @@ async function resolveSelectedNativeChange(paths) {
 
 // domains/comet-native/native-hook-guard.ts
 function isWithin(parent, target) {
-  const relative = path19.relative(parent, target);
-  return relative === "" || !relative.startsWith("..") && !path19.isAbsolute(relative);
+  const relative = path17.relative(parent, target);
+  return relative === "" || !relative.startsWith("..") && !path17.isAbsolute(relative);
 }
 function requestTargetsAreControlOnly(projectRoot, nativeRoot, request) {
   return request.targets.length > 0 && request.targets.every((targetPath) => {
-    const target = path19.resolve(projectRoot, targetPath);
+    const target = path17.resolve(projectRoot, targetPath);
     if (!isWithin(projectRoot, target)) return true;
-    const relative = path19.relative(projectRoot, target).replaceAll("\\", "/");
+    const relative = path17.relative(projectRoot, target).replaceAll("\\", "/");
     return relative === ".comet/config.yaml" || isWithin(nativeRoot, target);
   });
 }
@@ -12490,7 +11790,7 @@ async function activeNativeContext(projectRoot) {
   const paths = await nativeProjectPaths(projectRoot, config.native.artifact_root);
   let entries;
   try {
-    entries = await fs14.readdir(paths.changesDir, { withFileTypes: true });
+    entries = await fs12.readdir(paths.changesDir, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return { paths, changes: [] };
     throw error;
@@ -12568,12 +11868,12 @@ async function inspectNativeHookGuard(projectRoot, request, selectedChangeName)
   let controlTarget = false;
   let externalTarget = false;
   for (const targetPath of request.targets) {
-    const target = path19.resolve(projectRoot, targetPath);
+    const target = path17.resolve(projectRoot, targetPath);
     if (!isWithin(projectRoot, target)) {
       externalTarget = true;
       continue;
     }
-    const relative = path19.relative(projectRoot, target).replaceAll("\\", "/");
+    const relative = path17.relative(projectRoot, target).replaceAll("\\", "/");
     if (relative === ".comet/config.yaml" || isWithin(context.paths.nativeRoot, target)) {
       controlTarget = true;
       continue;
@@ -12731,14 +12031,14 @@ function parseArgs(args) {
     throw new Error(`unsupported Hook platform: ${platformId}`);
   }
   if (projectRoot?.startsWith("--")) throw new Error("--project-root requires a value");
-  return { platformId, ...projectRoot ? { projectRoot: path20.resolve(projectRoot) } : {} };
+  return { platformId, ...projectRoot ? { projectRoot: path18.resolve(projectRoot) } : {} };
 }
 async function projectRootFrom(parsed) {
   if (parsed.projectRoot) return parsed.projectRoot;
   const discovered = await discoverNativeProject(process.cwd());
   for (const marker of [[".comet", "config.yaml"], [".git"]]) {
     try {
-      await fs15.lstat(path20.join(discovered, ...marker));
+      await fs13.lstat(path18.join(discovered, ...marker));
       return discovered;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -12747,7 +12047,7 @@ async function projectRootFrom(parsed) {
   const classic = await discoverClassicProject(process.cwd());
   const layout = await assertClassicLayoutReadable(classic);
   try {
-    await fs15.lstat(layout.changesDir);
+    await fs13.lstat(layout.changesDir);
     return classic;
   } catch (error) {
     if (error.code !== "ENOENT") throw error;