@sentropic/h2a-runtime 0.90.2 → 0.91.0

package/dist/identity-cull/cull.js

@@ -0,0 +1,924 @@
+/**
+ * Read-only DEF identity-cull analysis for SPEC #156.
+ *
+ * This module intentionally has no active-store mutation path.  It does,
+ * however, implement and verify the canonical binding-fence + held-descriptor
+ * CAS needed by a future, separately owner-authorized executor.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+const PIN_ACTORS = [
+    "claude:h2a:e3c21fe83da3",
+    "claude:h2a:c18853e319ea",
+    "claude:h2a:87db03b72762",
+    "e3c21fe8-3da3-4cf3-a837-6fdbadda8d95",
+    "c18853e3-19ea-410f-bba8-88f69d97d9b5",
+    "87db03b7-2762-43fb-8977-8dd67f625c82",
+];
+const LIVE_DEF_CONTROLS = [
+    "claude:h2a:16f6e26295a3",
+    "claude:h2a:c3d1621ed118",
+    "claude:h2a:8b329a6c9c31",
+];
+const IDENTITY_BINDING_FENCE_PROTOCOL = "identity-binding-fence-v1";
+/**
+ * #160 only stages the §4-§6 proof packet. Per SPEC #156 §7.1 and §8, the
+ * executor—not staging—owns the final compare-to-rename critical section.
+ * A real staging-to-executor handoff transfers the held fence and descriptor;
+ * staging must never release and then reacquire that fence around a rename.
+ */
+const EXECUTOR_FENCE_HANDOFF_CONTRACT = {
+    specReference: "SPEC #156 §7.1 and §8",
+    executorScope: "The executor holds the canonical fence exclusively from the final held-descriptor compare through descriptor-relative rename and read-back.",
+    transferRule: "A staging-to-executor handoff transmits the held fence and descriptor; staging must not release and reacquire them around the rename.",
+};
+function sha256(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requiredString(record, key) {
+    const value = record[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function parseBindingLine(bytes, lineNumber) {
+    const fingerprint = sha256(bytes);
+    const exactLineBase64 = bytes.toString("base64");
+    let text = bytes.toString("utf8");
+    if (text.endsWith("\n"))
+        text = text.slice(0, -1);
+    if (text.endsWith("\r"))
+        text = text.slice(0, -1);
+    if (text.length === 0) {
+        return { kind: "malformed", lineNumber, rowFingerprint: fingerprint, exactLineBase64, parseError: "EMPTY_JSONL_ROW" };
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed))
+            throw new Error("JSON_VALUE_NOT_OBJECT");
+        const host = requiredString(parsed, "host");
+        const providerSessionId = requiredString(parsed, "providerSessionId");
+        const workspaceId = requiredString(parsed, "workspaceId");
+        const instance = requiredString(parsed, "instance");
+        const agentUuid = requiredString(parsed, "agentUuid");
+        const at = requiredString(parsed, "at");
+        if (!host || !providerSessionId || !workspaceId || !instance || !agentUuid || !at) {
+            throw new Error("BINDING_SCHEMA_INVALID");
+        }
+        return {
+            kind: "valid",
+            lineNumber,
+            rowFingerprint: fingerprint,
+            exactLineBase64,
+            binding: { host, providerSessionId, workspaceId, instance, agentUuid, at },
+        };
+    }
+    catch (error) {
+        return {
+            kind: "malformed",
+            lineNumber,
+            rowFingerprint: fingerprint,
+            exactLineBase64,
+            parseError: error instanceof Error ? error.message : "JSON_PARSE_FAILED",
+        };
+    }
+}
+function parseExactRows(bytes) {
+    const rows = [];
+    let start = 0;
+    let lineNumber = 1;
+    for (let offset = 0; offset < bytes.length; offset += 1) {
+        if (bytes[offset] !== 0x0a)
+            continue;
+        rows.push(parseBindingLine(bytes.subarray(start, offset + 1), lineNumber));
+        start = offset + 1;
+        lineNumber += 1;
+    }
+    if (start < bytes.length)
+        rows.push(parseBindingLine(bytes.subarray(start), lineNumber));
+    return rows;
+}
+function assertRegularNonSymlink(path, description) {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+        throw new Error(`${description} must be a regular non-symlink file: ${path}`);
+    }
+}
+function captureBindings(root) {
+    const canonicalRoot = realpathSync(root);
+    const identityDir = join(canonicalRoot, "identity");
+    const identityStat = lstatSync(identityDir);
+    if (identityStat.isSymbolicLink() || !identityStat.isDirectory()) {
+        throw new Error(`DEF identity directory must be a real directory: ${identityDir}`);
+    }
+    const bindingsPath = join(identityDir, "bindings.jsonl");
+    assertRegularNonSymlink(bindingsPath, "DEF bindings");
+    const fd = openSync(bindingsPath, "r");
+    try {
+        const before = fstatSync(fd);
+        const bytes = Buffer.alloc(before.size);
+        let read = 0;
+        while (read < bytes.length) {
+            const count = readSync(fd, bytes, read, bytes.length - read, read);
+            if (count === 0)
+                throw new Error("DEF bindings changed while being captured");
+            read += count;
+        }
+        const after = fstatSync(fd);
+        if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size) {
+            throw new Error("DEF bindings descriptor changed while being captured");
+        }
+        return {
+            canonicalPath: realpathSync(bindingsPath),
+            device: Number(before.dev),
+            inode: Number(before.ino),
+            size: before.size,
+            lineCount: parseExactRows(bytes).length,
+            sha256: sha256(bytes),
+            bytes,
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function isInside(path, root) {
+    const result = relative(root, path);
+    return result === "" || (!result.startsWith("..") && !isAbsolute(result));
+}
+function descriptorPath(fd, name) {
+    if (name !== undefined && (name.length === 0 || name.includes(sep) || name === "." || name === "..")) {
+        throw new Error(`unsafe descriptor-relative packet name: ${name}`);
+    }
+    return name === undefined ? `/proc/self/fd/${fd}` : `/proc/self/fd/${fd}/${name}`;
+}
+function openNoFollowDirectory(path) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        if (!fstatSync(fd).isDirectory())
+            throw new Error(`packet path component is not a directory: ${path}`);
+        return fd;
+    }
+    catch (error) {
+        closeSync(fd);
+        throw error;
+    }
+}
+function assertDirectoryOutsideProtectedRoots(fd, defRoot, pinRoot) {
+    const canonicalPath = realpathSync(descriptorPath(fd));
+    if (isInside(canonicalPath, defRoot) || isInside(canonicalPath, pinRoot)) {
+        throw new Error("packet output must be outside both DEF and PIN roots");
+    }
+    return canonicalPath;
+}
+function capturedDirectoryDevice(path, description) {
+    const fd = openNoFollowDirectory(path);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isDirectory())
+            throw new Error(`${description} must be a directory: ${path}`);
+        return Number(stat.dev);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function assertDistinctPacketDevice(packetDevice, defDevice, pinDevice) {
+    if (packetDevice === defDevice || packetDevice === pinDevice) {
+        throw new Error("packet output must be on a filesystem device distinct from both DEF and PIN");
+    }
+}
+/**
+ * A directory descriptor follows its inode across rename. Its device is
+ * therefore a structural boundary: a packet directory on a device distinct
+ * from DEF and PIN cannot be renamed into either protected tree (EXDEV).
+ * Re-fstat the held descriptor before mutations so a visible mount/device
+ * change fails closed; never re-resolve a pathname as a containment check.
+ */
+function assertPacketWriteContainment(directory, kind, name, phase) {
+    const attempt = { kind, name, packetRoot: directory.packetRoot, phase };
+    directory.beforePacketWrite?.(attempt);
+    const device = Number(fstatSync(directory.fd).dev);
+    if (device !== directory.packetDevice) {
+        throw new Error("packet write aborted: held packet directory device changed");
+    }
+    assertDistinctPacketDevice(device, directory.defDevice, directory.pinDevice);
+    directory.afterPacketWriteConfinement?.(attempt);
+}
+/**
+ * Create and pin a fresh packet directory without trusting the supplied path
+ * after traversal begins.  Every component is lstat'd and opened with
+ * O_NOFOLLOW relative to the descriptor for its already-pinned parent; packet
+ * members are subsequently opened relative to the returned descriptor only.
+ */
+function openPacketOutputDirectory(outputDir, defRoot, pinRoot) {
+    const absoluteOutput = resolve(outputDir);
+    const components = relative(sep, absoluteOutput).split(sep).filter(Boolean);
+    if (components.length === 0)
+        throw new Error("packet output directory must be a new non-root directory");
+    const defDevice = capturedDirectoryDevice(defRoot, "DEF root");
+    const pinDevice = capturedDirectoryDevice(pinRoot, "PIN root");
+    let currentFd = openNoFollowDirectory(sep);
+    try {
+        for (const [index, component] of components.entries()) {
+            const componentPath = descriptorPath(currentFd, component);
+            const isFinalComponent = index === components.length - 1;
+            let createdFinalComponent = false;
+            let stat;
+            try {
+                stat = lstatSync(componentPath);
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== "ENOENT" || !isFinalComponent) {
+                    throw new Error(`packet output path has a missing or inaccessible ancestor: ${absoluteOutput}`);
+                }
+                assertDirectoryOutsideProtectedRoots(currentFd, defRoot, pinRoot);
+                assertDistinctPacketDevice(Number(fstatSync(currentFd).dev), defDevice, pinDevice);
+                mkdirSync(componentPath, { recursive: false, mode: 0o700 });
+                createdFinalComponent = true;
+                stat = lstatSync(componentPath);
+            }
+            if (stat.isSymbolicLink()) {
+                throw new Error(`packet output path refuses symlink component: ${component}`);
+            }
+            if (!stat.isDirectory()) {
+                throw new Error(`packet output path component is not a directory: ${component}`);
+            }
+            if (isFinalComponent && !createdFinalComponent) {
+                throw new Error(`packet output directory already exists: ${absoluteOutput}`);
+            }
+            const nextFd = openNoFollowDirectory(componentPath);
+            closeSync(currentFd);
+            currentFd = nextFd;
+        }
+        const canonicalPath = assertDirectoryOutsideProtectedRoots(currentFd, defRoot, pinRoot);
+        const packetDevice = Number(fstatSync(currentFd).dev);
+        assertDistinctPacketDevice(packetDevice, defDevice, pinDevice);
+        return {
+            fd: currentFd,
+            packetRoot: canonicalPath,
+            defRoot,
+            pinRoot,
+            packetDevice,
+            defDevice,
+            pinDevice,
+        };
+    }
+    catch (error) {
+        closeSync(currentFd);
+        throw error;
+    }
+}
+function createPacketDirectory(parent, name) {
+    assertPacketWriteContainment(parent, "directory", name, "before-create");
+    const path = descriptorPath(parent.fd, name);
+    mkdirSync(path, { recursive: false, mode: 0o700 });
+    const fd = openNoFollowDirectory(path);
+    try {
+        const device = Number(fstatSync(fd).dev);
+        if (device !== parent.packetDevice) {
+            throw new Error("packet directory creation aborted: held packet directory device changed");
+        }
+        assertDistinctPacketDevice(device, parent.defDevice, parent.pinDevice);
+        return {
+            fd,
+            packetRoot: parent.packetRoot,
+            defRoot: parent.defRoot,
+            pinRoot: parent.pinRoot,
+            packetDevice: parent.packetDevice,
+            defDevice: parent.defDevice,
+            pinDevice: parent.pinDevice,
+            ...(parent.beforePacketWrite === undefined ? {} : { beforePacketWrite: parent.beforePacketWrite }),
+            ...(parent.afterPacketWriteConfinement === undefined
+                ? {}
+                : { afterPacketWriteConfinement: parent.afterPacketWriteConfinement }),
+        };
+    }
+    catch (error) {
+        closeSync(fd);
+        throw error;
+    }
+}
+function writePacketFile(directory, name, bytes, mode = 0o600) {
+    // Opening with O_CREAT is itself a mutation; enforce structural confinement first.
+    assertPacketWriteContainment(directory, "file", name, "before-create");
+    const fd = openSync(descriptorPath(directory.fd, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode);
+    try {
+        // Re-fstat detects a visible mount/device change before bytes are written.
+        assertPacketWriteContainment(directory, "file", name, "before-write");
+        writeFileSync(fd, bytes);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function readPacketFile(directory, name) {
+    const fd = openSync(descriptorPath(directory.fd, name), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error(`packet member is not a regular file: ${name}`);
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function readOptionalPinBindings(pinRoot) {
+    try {
+        const canonicalPin = realpathSync(pinRoot);
+        const candidates = [
+            join(canonicalPin, "identity", "bindings.jsonl"),
+            join(canonicalPin, ".h2a", "identity", "bindings.jsonl"),
+        ];
+        const path = candidates.find((candidate) => existsSync(candidate));
+        if (!path)
+            return { reason: "PIN_BINDINGS_UNAVAILABLE" };
+        assertRegularNonSymlink(path, "PIN bindings");
+        const root = path.endsWith(join(".h2a", "identity", "bindings.jsonl"))
+            ? join(canonicalPin, ".h2a")
+            : canonicalPin;
+        return { snapshot: captureBindings(root), sourcePath: path };
+    }
+    catch (error) {
+        return { reason: error instanceof Error ? `PIN_BINDINGS_ERROR:${error.message}` : "PIN_BINDINGS_ERROR" };
+    }
+}
+class UnionFind {
+    parent;
+    constructor(size) {
+        this.parent = Array.from({ length: size }, (_value, index) => index);
+    }
+    find(index) {
+        const parent = this.parent[index];
+        if (parent === undefined)
+            throw new Error(`invalid union-find index ${index}`);
+        if (parent === index)
+            return index;
+        const root = this.find(parent);
+        this.parent[index] = root;
+        return root;
+    }
+    union(left, right) {
+        const leftRoot = this.find(left);
+        const rightRoot = this.find(right);
+        if (leftRoot !== rightRoot)
+            this.parent[rightRoot] = leftRoot;
+    }
+}
+function componentize(rows) {
+    const unionFind = new UnionFind(rows.length);
+    const edges = [];
+    const byInstance = new Map();
+    const byUuid = new Map();
+    const byProviderSession = new Map();
+    const joinOn = (kind, key, index, map) => {
+        const first = map.get(key);
+        if (first === undefined) {
+            map.set(key, index);
+            return;
+        }
+        unionFind.union(first, index);
+        edges.push({ kind, leftLine: rows[first].lineNumber, rightLine: rows[index].lineNumber });
+    };
+    for (const [index, row] of rows.entries()) {
+        if (row.kind !== "valid")
+            continue;
+        joinOn("instance", row.binding.instance, index, byInstance);
+        joinOn("agentUuid", row.binding.agentUuid, index, byUuid);
+        joinOn("providerSession", `${row.binding.host}\u0000${row.binding.providerSessionId}`, index, byProviderSession);
+    }
+    const grouped = new Map();
+    for (const [index, row] of rows.entries()) {
+        const root = unionFind.find(index);
+        const members = grouped.get(root);
+        if (members)
+            members.push(row);
+        else
+            grouped.set(root, [row]);
+    }
+    return [...grouped.values()]
+        .map((members) => {
+        const lineNumbers = new Set(members.map((row) => row.lineNumber));
+        const memberEdges = edges.filter((edge) => lineNumbers.has(edge.leftLine) && lineNumbers.has(edge.rightLine));
+        const conflicts = [];
+        const uuidByInstance = new Map();
+        const instanceByUuid = new Map();
+        for (const row of members) {
+            if (row.kind === "malformed") {
+                conflicts.push(`MALFORMED_ROW:${row.lineNumber}`);
+                continue;
+            }
+            const uuids = uuidByInstance.get(row.binding.instance) ?? new Set();
+            uuids.add(row.binding.agentUuid);
+            uuidByInstance.set(row.binding.instance, uuids);
+            const instances = instanceByUuid.get(row.binding.agentUuid) ?? new Set();
+            instances.add(row.binding.instance);
+            instanceByUuid.set(row.binding.agentUuid, instances);
+        }
+        for (const [instance, uuids] of uuidByInstance) {
+            if (uuids.size > 1)
+                conflicts.push(`CONFLICTING_INSTANCE_UUID:${instance}`);
+        }
+        for (const [uuid, instances] of instanceByUuid) {
+            if (instances.size > 1)
+                conflicts.push(`CONFLICTING_UUID_INSTANCE:${uuid}`);
+        }
+        const orderedRows = [...members].sort((left, right) => left.lineNumber - right.lineNumber);
+        return {
+            id: `component:${sha256(orderedRows.map((row) => row.rowFingerprint).join("\n")).slice(7, 31)}`,
+            rows: orderedRows,
+            edges: memberEdges,
+            conflicts: [...new Set(conflicts)].sort(),
+        };
+    })
+        .sort((left, right) => left.rows[0].lineNumber - right.rows[0].lineNumber);
+}
+function componentValues(component) {
+    const values = new Set();
+    for (const row of component.rows) {
+        if (row.kind !== "valid")
+            continue;
+        values.add(row.binding.instance);
+        values.add(row.binding.agentUuid);
+    }
+    return values;
+}
+function gateLife(component, evidence) {
+    const values = componentValues(component);
+    const life = evidence.life;
+    const live = life?.liveReferences?.some((reference) => values.has(reference)) ?? false;
+    if (live)
+        return { verdict: "FAIL", reason: "L_LIVE_EVIDENCE" };
+    if (!life?.complete)
+        return { verdict: "UNKNOWN", reason: "L_EVIDENCE_COVERAGE_MISSING" };
+    if (!life.noLife || !life.twoObservationsAgree || !life.resumeSafe) {
+        return { verdict: "UNKNOWN", reason: "L_POSITIVE_PROOF_MISSING" };
+    }
+    return { verdict: "PASS", reason: "L_POSITIVE_NO_LIFE_PROOF" };
+}
+function gateOwnership(component, evidence) {
+    const values = componentValues(component);
+    const ownership = evidence.ownership;
+    const owned = ownership?.ownedReferences?.some((reference) => values.has(reference)) ?? false;
+    if (owned)
+        return { verdict: "FAIL", reason: "O_OWNED_WORK_REFERENCE" };
+    if (!ownership?.complete)
+        return { verdict: "UNKNOWN", reason: "O_EVIDENCE_COVERAGE_MISSING" };
+    if (!ownership.noOwnedWork)
+        return { verdict: "UNKNOWN", reason: "O_POSITIVE_NO_WORK_PROOF_MISSING" };
+    return { verdict: "PASS", reason: "O_POSITIVE_NO_OWNED_WORK_PROOF" };
+}
+function ownerOrHumanReference(value) {
+    const lower = value.toLowerCase();
+    return lower.includes("focus:local-human") || lower.includes("owner") || lower.includes("human") || lower.includes("principal") || lower.includes("antoinefa");
+}
+function gateProtected(component, protectedValues, ownerAllowlist, pinAvailable, evidence) {
+    const values = componentValues(component);
+    if ([...values].some((value) => protectedValues.has(value))) {
+        return { verdict: "FAIL", reason: "P_PROTECTED_IDENTITY" };
+    }
+    if ([...values].some(ownerOrHumanReference))
+        return { verdict: "FAIL", reason: "P_OWNER_HUMAN_AMBIGUITY" };
+    if (ownerAllowlist.length === 0)
+        return { verdict: "UNKNOWN", reason: "P_OWNER_ALLOWLIST_UNRATIFIED" };
+    if (!pinAvailable)
+        return { verdict: "UNKNOWN", reason: "P_PIN_SNAPSHOT_UNAVAILABLE" };
+    if (!evidence.protectedSetComplete)
+        return { verdict: "UNKNOWN", reason: "P_PROTECTED_SOURCE_COVERAGE_MISSING" };
+    return { verdict: "PASS", reason: "P_POSITIVE_NOT_PROTECTED" };
+}
+function gateChurn(component) {
+    // S_R is intentionally not accepted by this implementation.  A future root
+    // fix must introduce owner-ratified, independently verified continuity edges
+    // before a cull candidate can ever obtain C=PASS.
+    void component;
+    return { verdict: "UNKNOWN", reason: "C_MIGRATION_MAP_MISSING" };
+}
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function writeJson(directory, name, value) {
+    writePacketFile(directory, name, json(value));
+}
+function writeJsonLines(directory, name, records) {
+    writePacketFile(directory, name, records.map((record) => JSON.stringify(record)).join(records.length > 0 ? "\n" : "") + (records.length > 0 ? "\n" : ""));
+}
+function decisionRecord(component, gates) {
+    const decision = Object.values(gates).every((gate) => gate.verdict === "PASS") ? "WOULD_CULL" : "KEEP";
+    const keepReasons = Object.values(gates)
+        .filter((gate) => gate.verdict !== "PASS")
+        .map((gate) => gate.reason);
+    return {
+        componentId: component.id,
+        rows: component.rows.map((row) => row.kind === "valid"
+            ? { lineNumber: row.lineNumber, rowFingerprint: row.rowFingerprint, exactLineBase64: row.exactLineBase64, binding: row.binding }
+            : { lineNumber: row.lineNumber, rowFingerprint: row.rowFingerprint, exactLineBase64: row.exactLineBase64, parseError: row.parseError }),
+        edges: component.edges,
+        conflicts: component.conflicts,
+        gates,
+        evidenceRefs: ["evidence/def-bindings.jsonl", "coverage.json", "dependencies.json"],
+        decision,
+        keepReasons,
+    };
+}
+function makeLookupReplay(rows) {
+    const lastWins = new Map();
+    for (const row of rows) {
+        if (row.kind !== "valid")
+            continue;
+        lastWins.set(`${row.binding.host}\u0000${row.binding.providerSessionId}`, row);
+    }
+    return {
+        semantics: "last-wins(host,providerSessionId)",
+        cullSetEmpty: true,
+        keys: [...lastWins.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([key, row]) => ({
+            key,
+            before: { lineNumber: row.lineNumber, rowFingerprint: row.rowFingerprint, instance: row.binding.instance },
+            after: { lineNumber: row.lineNumber, rowFingerprint: row.rowFingerprint, instance: row.binding.instance },
+            predecessorExposed: false,
+            legacyKeyRetired: false,
+        })),
+    };
+}
+function increment(histogram, reason) {
+    histogram[reason] = (histogram[reason] ?? 0) + 1;
+}
+/**
+ * Produce the analysis packet.  This is intentionally the only runnable path
+ * exposed by the CLI: it reads DEF/PIN and writes a new packet outside both.
+ */
+export function runIdentityCullDryRun(input) {
+    const canonicalDefRoot = realpathSync(input.defRoot);
+    const canonicalPinRoot = realpathSync(input.pinRoot);
+    if (isInside(canonicalDefRoot, canonicalPinRoot) || isInside(canonicalPinRoot, canonicalDefRoot)) {
+        throw new Error("DEF and PIN roots must be distinct non-overlapping canonical paths");
+    }
+    const snapshot = captureBindings(canonicalDefRoot);
+    const rows = parseExactRows(snapshot.bytes);
+    const components = componentize(rows);
+    const pin = readOptionalPinBindings(canonicalPinRoot);
+    const pinRows = "snapshot" in pin ? parseExactRows(pin.snapshot.bytes) : [];
+    const ownerAllowlist = [...(input.ownerAllowlist ?? [])].sort();
+    const protectedValues = new Set([...PIN_ACTORS, ...LIVE_DEF_CONTROLS, ...ownerAllowlist]);
+    for (const row of pinRows) {
+        if (row.kind !== "valid")
+            continue;
+        protectedValues.add(row.binding.instance);
+        protectedValues.add(row.binding.agentUuid);
+    }
+    const evidence = input.evidence ?? {};
+    const records = components.map((component) => decisionRecord(component, {
+        L: gateLife(component, evidence),
+        O: gateOwnership(component, evidence),
+        P: gateProtected(component, protectedValues, ownerAllowlist, "snapshot" in pin, evidence),
+        C: gateChurn(component),
+    }));
+    const wouldCull = records.filter((record) => record.decision === "WOULD_CULL");
+    // An implementation error must never widen a cull set.  C is intentionally
+    // UNKNOWN in this release, but retain this assertion as a hard invariant.
+    if (wouldCull.length > 0)
+        throw new Error("refusing: CULL set is not authorized in this release");
+    const keep = records.filter((record) => record.decision === "KEEP");
+    if (records.length !== components.length || keep.length !== components.length) {
+        throw new Error("packet component reconciliation failed");
+    }
+    const keepReasonHistogram = {};
+    for (const record of keep) {
+        for (const reason of record.keepReasons)
+            increment(keepReasonHistogram, reason);
+    }
+    const packet = openPacketOutputDirectory(input.outputDir, canonicalDefRoot, canonicalPinRoot);
+    const packetWithWriteObserver = {
+        ...packet,
+        ...(input.beforePacketWrite === undefined ? {} : { beforePacketWrite: input.beforePacketWrite }),
+        ...(input.afterPacketWriteConfinement === undefined
+            ? {}
+            : { afterPacketWriteConfinement: input.afterPacketWriteConfinement }),
+    };
+    let evidenceDir;
+    try {
+        const evidence = createPacketDirectory(packetWithWriteObserver, "evidence");
+        evidenceDir = evidence;
+        writePacketFile(evidence, "def-bindings.jsonl", snapshot.bytes, 0o400);
+        if ("snapshot" in pin)
+            writePacketFile(evidence, "pin-bindings.jsonl", pin.snapshot.bytes, 0o400);
+        const now = (input.now ?? (() => new Date()))().toISOString();
+        const coverage = {
+            version: 1,
+            sources: [
+                { id: "def-bindings", status: "COMPLETE", parser: "strict-jsonl-v1", sha256: snapshot.sha256 },
+                { id: "pin-bindings", status: "snapshot" in pin ? "COMPLETE" : "MISSING", reason: "snapshot" in pin ? undefined : pin.reason },
+                { id: "owner-allowlist", status: ownerAllowlist.length > 0 ? "PRESENT_BUT_UNRATIFIED" : "MISSING" },
+                { id: "fleet-presence-process-mcp-resume", status: "MISSING" },
+                { id: "owned-work-and-attribution", status: "MISSING" },
+                { id: "attested-defect-window", status: "MISSING" },
+                { id: "S_R-root-fix-migration-map", status: "MISSING" },
+            ],
+        };
+        const dependencies = {
+            version: 1,
+            gates: {
+                L: ["fleet-presence-process-mcp-resume", "S_R-root-fix-migration-map"],
+                O: ["owned-work-and-attribution"],
+                P: ["pin-bindings", "owner-allowlist"],
+                C: ["attested-defect-window", "S_R-root-fix-migration-map"],
+            },
+            edges: ["instance", "agentUuid", "host+providerSessionId"],
+            expresslyNotEdges: ["name", "workspaceId"],
+        };
+        const runManifest = {
+            version: 1,
+            runId: randomUUID(),
+            capturedAt: now,
+            operator: input.operator ?? process.env.USER ?? "unknown",
+            mode: "dry-run",
+            def: { root: canonicalDefRoot, bindings: { path: snapshot.canonicalPath, device: snapshot.device, inode: snapshot.inode, size: snapshot.size, lineCount: snapshot.lineCount, sha256: snapshot.sha256 } },
+            pin: "snapshot" in pin
+                ? { root: canonicalPinRoot, bindings: { path: pin.sourcePath, sha256: pin.snapshot.sha256 } }
+                : { root: canonicalPinRoot, unavailable: pin.reason },
+            S_R_present: false,
+            executionHardGated: true,
+            fencePrimitiveProvided: true,
+            checkActExecutedByStaging: false,
+            "checkActIsExecutorScopePer_§7_1": true,
+            handoffContract: EXECUTOR_FENCE_HANDOFF_CONTRACT,
+            structuralWriterFence: {
+                protocol: IDENTITY_BINDING_FENCE_PROTOCOL,
+                canonicalLockPath: join(canonicalDefRoot, "identity", ".lock"),
+                epochRequired: true,
+                heldDescriptorCas: "fstat+full-read+fstat size/hash primitive for the executor's immediately-pre-rename check",
+                singleWriterVerification: "required before executor continuation; bypass inventory aborts",
+            },
+            packetWriteConfinement: {
+                strategy: "no-cross-device",
+                packetDevice: packet.packetDevice,
+                defDevice: packet.defDevice,
+                pinDevice: packet.pinDevice,
+                structuralGuarantee: "packet-root st_dev differs from DEF and PIN, so a packet directory or member cannot be renamed into either root",
+                mountChangeDetection: "before each create and byte write, fstat the held packet directory and abort if st_dev differs from its captured value",
+                residual: "Node exposes no openat2 RESOLVE_BENEATH binding; this guarantee covers rename containment while the captured device identities hold, and fstat can only detect mount changes that alter the held descriptor st_dev",
+            },
+            writeSet: ["packet output only"],
+        };
+        const positiveControls = {
+            version: 1,
+            pinActors: PIN_ACTORS.map((identity) => ({ identity, presentInPin: pinRows.some((row) => row.kind === "valid" && (row.binding.instance === identity || row.binding.agentUuid === identity)), absentFromWouldCull: true })),
+            liveDefActors: LIVE_DEF_CONTROLS.map((identity) => ({ identity, presentInDef: rows.some((row) => row.kind === "valid" && row.binding.instance === identity), absentFromWouldCull: true })),
+            ownerAllowlist: { count: ownerAllowlist.length, absentFromWouldCull: true, status: ownerAllowlist.length > 0 ? "UNRATIFIED" : "MISSING" },
+            quietSingleConversationMirror: { requiredResult: "KEEP", observedReason: "C_MIGRATION_MAP_MISSING" },
+            concurrentSameNameWorkspace: { joinRule: "name/workspaceId are not component edges", observedResult: "KEEP" },
+            fallbackAndOutsideWindow: { requiredResult: "KEEP", observedResult: "KEEP" },
+        };
+        const lookupReplay = makeLookupReplay(rows);
+        const summary = {
+            version: 1,
+            componentCount: components.length,
+            componentReconciliation: { decisions: records.length, wouldCull: wouldCull.length, keep: keep.length, reconciled: records.length === wouldCull.length + keep.length },
+            cullSetSize: wouldCull.length,
+            gateCounts: ["L", "O", "P", "C"].reduce((counts, name) => {
+                counts[name] = { PASS: 0, FAIL: 0, UNKNOWN: 0 };
+                for (const record of records) {
+                    const gates = record.gates;
+                    const gate = gates[name];
+                    counts[name][gate.verdict] += 1;
+                }
+                return counts;
+            }, {}),
+            keepReasonHistogram,
+            S_R_present: false,
+            executionHardGated: true,
+        };
+        writeJson(packetWithWriteObserver, "run-manifest.json", runManifest);
+        writeJson(packetWithWriteObserver, "coverage.json", coverage);
+        writeJson(packetWithWriteObserver, "dependencies.json", dependencies);
+        writeJson(evidence, "acquisition.json", { defBindings: { path: snapshot.canonicalPath, sha256: snapshot.sha256, size: snapshot.size }, pinStatus: "snapshot" in pin ? "COMPLETE" : pin.reason });
+        writeJsonLines(packetWithWriteObserver, "decisions.jsonl", records);
+        writeJsonLines(packetWithWriteObserver, "would-cull.jsonl", wouldCull);
+        writeJsonLines(packetWithWriteObserver, "keep.jsonl", keep);
+        writeJson(packetWithWriteObserver, "lookup-replay.json", lookupReplay);
+        writeJson(packetWithWriteObserver, "positive-controls.json", positiveControls);
+        writeJson(packetWithWriteObserver, "summary.json", summary);
+        writePacketFile(packetWithWriteObserver, "report.txt", `DEF identity cull dry-run\ncomponents: ${components.length}\ncull-set: ${wouldCull.length}\nKEEP reasons: ${JSON.stringify(keepReasonHistogram)}\n`);
+        const artifactPaths = [
+            "run-manifest.json", "coverage.json", "dependencies.json", "evidence/def-bindings.jsonl", "evidence/acquisition.json", "decisions.jsonl", "would-cull.jsonl", "keep.jsonl", "lookup-replay.json", "positive-controls.json", "summary.json", "report.txt",
+            ...("snapshot" in pin ? ["evidence/pin-bindings.jsonl"] : []),
+        ];
+        writeJson(packetWithWriteObserver, "member-hashes.json", {
+            version: 1,
+            members: artifactPaths.map((path) => {
+                const [directory, name] = path.startsWith("evidence/")
+                    ? [evidence, path.slice("evidence/".length)]
+                    : [packet, path];
+                return { path, sha256: sha256(readPacketFile(directory, name)) };
+            }),
+        });
+        return {
+            packetDir: packet.packetRoot,
+            componentCount: components.length,
+            cullSetSize: wouldCull.length,
+            keepReasonHistogram,
+            summaryPath: join(packet.packetRoot, "summary.json"),
+            snapshot: { canonicalPath: snapshot.canonicalPath, size: snapshot.size, sha256: snapshot.sha256 },
+        };
+    }
+    finally {
+        if (evidenceDir)
+            closeSync(evidenceDir.fd);
+        closeSync(packetWithWriteObserver.fd);
+    }
+}
+/**
+ * The hard execution gate. It deliberately has no write side effects, even if
+ * supplied fixture values say that every prerequisite is true: this release has
+ * no owner GO and no descriptor-relative Node rename primitive.
+ */
+export function refuseCullExecution(input = {}) {
+    const refusalCodes = [];
+    if (!input.ownerAuthorizationValid)
+        refusalCodes.push("OWNER_AUTHORIZATION_MISSING_OR_INVALID");
+    if (!input.migrationMapRatified)
+        refusalCodes.push("S_R_MISSING_OR_UNRATIFIED");
+    if (!input.verifiedNonEmptyCullSet)
+        refusalCodes.push("VERIFIED_NONEMPTY_CULL_SET_MISSING");
+    if (!input.approvedPacketMatches)
+        refusalCodes.push("APPROVED_PACKET_MISMATCH");
+    if (!input.rootFixDeployedAndObserved)
+        refusalCodes.push("ROOT_FIX_NOT_DEPLOYED_AND_OBSERVED");
+    if (!input.singleWriterInvariant)
+        refusalCodes.push("SINGLE_WRITER_INVARIANT_UNVERIFIED");
+    if (!input.osWriteConfinement)
+        refusalCodes.push("OS_WRITE_CONFINEMENT_UNVERIFIED");
+    if (!input.descriptorRelativeRenameAvailable)
+        refusalCodes.push("DESCRIPTOR_RELATIVE_RENAME_UNAVAILABLE");
+    refusalCodes.push("EXECUTION_DISABLED_PENDING_SEPARATE_OWNER_GO");
+    return { executed: false, refusalCodes };
+}
+/**
+ * Verify rather than construct the root-fix precondition.  The only accepted
+ * binding writer is the deployed `reclaimOrMint` transaction, and every
+ * inventory entry which writes bindings must require this lock + epoch.
+ */
+export function verifySingleWriterPrecondition(inventory) {
+    if (!inventory.complete)
+        return { valid: false, reason: "WRITER_INVENTORY_INCOMPLETE" };
+    const writers = inventory.paths.filter((path) => path.writesBindings);
+    if (writers.some((path) => path.canBypassFence || !path.requiresCanonicalFence || !path.fenceEpochRequired)) {
+        return { valid: false, reason: "BINDING_WRITE_BYPASS_PRESENT" };
+    }
+    if (writers.length !== 1
+        || writers[0].id !== "reclaimOrMint"
+        || writers[0].fenceProtocol !== IDENTITY_BINDING_FENCE_PROTOCOL) {
+        return { valid: false, reason: "CANONICAL_WRITER_PATH_INVALID" };
+    }
+    return { valid: true };
+}
+function compareHeldDescriptor(fd, expectedSize, expectedSha256) {
+    const before = fstatSync(fd);
+    if (before.size !== expectedSize)
+        return { state: "ABORTED", reason: "HELD_DESCRIPTOR_SIZE_MISMATCH" };
+    const bytes = Buffer.alloc(before.size);
+    let read = 0;
+    while (read < bytes.length) {
+        const count = readSync(fd, bytes, read, bytes.length - read, read);
+        if (count === 0)
+            return { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
+        read += count;
+    }
+    const after = fstatSync(fd);
+    if (after.dev !== before.dev || after.ino !== before.ino || after.size !== expectedSize) {
+        return { state: "ABORTED", reason: "HELD_DESCRIPTOR_SIZE_MISMATCH" };
+    }
+    return sha256(bytes) === expectedSha256
+        ? { state: "READY" }
+        : { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
+}
+function fencePayload(fence) {
+    return JSON.stringify({
+        protocol: IDENTITY_BINDING_FENCE_PROTOCOL,
+        fenceEpoch: fence.epoch,
+        pid: process.pid,
+        acquiredAt: new Date().toISOString(),
+    });
+}
+function fenceIsHeld(fence) {
+    try {
+        const stat = lstatSync(fence.lockPath);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            return false;
+        const payload = JSON.parse(readFileSync(fence.lockPath, "utf8"));
+        return isRecord(payload)
+            && payload.protocol === IDENTITY_BINDING_FENCE_PROTOCOL
+            && payload.fenceEpoch === fence.epoch
+            && payload.pid === process.pid;
+    }
+    catch {
+        return false;
+    }
+}
+function acquireCanonicalBindingFence(lockPath) {
+    const fence = { lockPath, epoch: randomUUID() };
+    let fd;
+    try {
+        fd = openSync(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            return undefined;
+        throw error;
+    }
+    try {
+        writeFileSync(fd, fencePayload(fence));
+        fsyncSync(fd);
+    }
+    catch (error) {
+        closeSync(fd);
+        try {
+            unlinkSync(lockPath);
+        }
+        catch {
+            // A failure to clean up an owned fence is safer than proceeding.
+        }
+        throw error;
+    }
+    closeSync(fd);
+    return fence;
+}
+function releaseCanonicalBindingFence(fence) {
+    if (!fenceIsHeld(fence))
+        throw new Error("canonical binding fence ownership was lost");
+    unlinkSync(fence.lockPath);
+}
+/**
+ * Exercises the authoritative len/hash primitive over one held descriptor.
+ * This staging-only verification releases its test fence before it returns and
+ * never authorizes a caller to rename. Per SPEC #156 §7.1 and §8, an executor
+ * must instead retain its own transmitted fence and descriptor from its final
+ * compare through descriptor-relative rename and read-back.
+ */
+export function verifyHeldDescriptorCas(input) {
+    if (!verifySingleWriterPrecondition(input.writerInventory).valid) {
+        return { state: "ABORTED", reason: "SINGLE_WRITER_PRECONDITION_FAILED" };
+    }
+    const canonicalBindingPath = realpathSync(input.bindingPath);
+    const fence = acquireCanonicalBindingFence(join(dirname(canonicalBindingPath), ".lock"));
+    if (!fence)
+        return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_UNAVAILABLE" };
+    try {
+        if (!fenceIsHeld(fence))
+            return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
+        const fd = openSync(canonicalBindingPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            if (!fstatSync(fd).isFile())
+                return { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
+            const preflight = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
+            if (preflight.state === "ABORTED")
+                return preflight;
+            // This seam runs while the canonical fence is held.  A direct append
+            // here models a bypass; the immediately-pre-rename held-fd CAS below
+            // must refuse it before any executor could rename.
+            input.afterPreflight?.();
+            if (!fenceIsHeld(fence))
+                return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
+            const final = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
+            if (final.state === "ABORTED")
+                return final;
+            if (!fenceIsHeld(fence))
+                return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
+            // Never call rename: execution remains hard-gated for this release. This
+            // staging verification releases its fence at return; an executor must not
+            // use it as a released-then-reacquired rename precondition.
+            void input.rename;
+            return { state: "STAGING_VERIFIED" };
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    finally {
+        releaseCanonicalBindingFence(fence);
+    }
+}
+function isValidTail(tail) {
+    if (tail.length === 0)
+        return true;
+    if (tail[tail.length - 1] !== 0x0a)
+        return false;
+    return parseExactRows(tail).every((row) => row.kind === "valid");
+}
+/** Plan, but do not write, B_R || N_pre || N_post restoration bytes. */
+export function planLosslessRestoration(input) {
+    if (input.nPre.length > 0 && input.nPost.length > 0 && !input.tailOrderProven) {
+        return { state: "REFUSED", reason: "TAIL_ORDER_AMBIGUOUS" };
+    }
+    if (!isValidTail(input.nPre) || !isValidTail(input.nPost)) {
+        return { state: "REFUSED", reason: "TAIL_INVALID_JSONL" };
+    }
+    const restored = Buffer.concat([input.original, input.nPre, input.nPost]);
+    return { state: "READY", restored, restoredSha256: sha256(restored) };
+}
+//# sourceMappingURL=cull.js.map