@smartmemory/compose 0.4.0 → 0.5.0

package/server/maya-routes.js

@@ -44,7 +44,9 @@ import {
   MayaWorkspaceCollisionError,
 } from '../lib/maya-identity.js';
 import { ideaboxContext } from '../lib/fluid/ideabox-ops.js';
-import { composeColleagueContext } from '../lib/colleague/context.js';
+import { composeColleagueContext, composePortfolioContext, toMayaContext } from '../lib/colleague/context.js';
+import { openPortfolio, recallAcrossPortfolio, assertMemberWorkspacesDistinct } from '../lib/fluid/portfolio.js';
+import { parsePortfolioConfig } from '../lib/fluid/factory.js';
 import { writebackReply } from '../lib/colleague/writeback.js';
 
 /**
@@ -67,11 +69,51 @@ const CAPABILITIES = Object.freeze({
 // `author:'maya'` plus the embedded msg marker. `ui:ideabox` is the cockpit
 // door these contexts genuinely come through; a colleague-specific origin
 // joins the contract enum only when the panel gains a record-creating op.
-async function defaultComposeContext(root, { focusId }) {
+async function defaultComposeContext(root, { focusId, scope, text }) {
+  if (scope === 'portfolio') {
+    // The declaring root's ideabox context is NOT built here. A portfolio turn
+    // reads through the members' own providers, so constructing this first made
+    // a failure in the declaring root's provider abort the turn before a single
+    // member was asked — the one product being broken silencing the other N,
+    // which is the whole failure mode this feature exists to avoid.
+    // The portfolio path is a separate composer, not a widened one: the
+    // project-scoped turn must stay byte-identical so a portfolio bug can never
+    // degrade the ordinary one.
+    const portfolio = await openPortfolio(root);
+    return composePortfolioContext({ text }, { portfolio, recallAcross: recallAcrossPortfolio });
+  }
   const ctx = await ideaboxContext(root, { origin: 'ui:ideabox' });
   return composeColleagueContext(ctx, { focusId });
 }
 
+/**
+ * Is a portfolio declared here at all, and is it valid?
+ *
+ * Read through the AUTHORITATIVE validating parser, never the lenient
+ * `maya-config` reader: a portfolio with a typo in it must refuse, not come back
+ * as "none declared" and quietly answer for one product.
+ */
+function portfolioDeclared(root) {
+  try {
+    return parsePortfolioConfig(root) !== null;
+  } catch {
+    // Invalid is not absent. Let the caller name the real reason.
+    return false;
+  }
+}
+
+/** The exact reason, so the funnel points at the setting that is actually wrong. */
+function portfolioMisconfigReason(root) {
+  try {
+    if (parsePortfolioConfig(root) === null) {
+      return 'this project declares no fluid.portfolio, so a portfolio turn has no members to ask';
+    }
+  } catch (e) {
+    return `fluid.portfolio is declared but invalid — ${shortReason(e)}`;
+  }
+  return 'fluid.portfolio is declared but unusable';
+}
+
 /** The real write-back (S4): reconcile-then-append through the shared ops
  *  module. Returns an OUTCOME, never throws (lib/colleague/writeback.js). */
 async function defaultPerformWriteback(root, args) {
@@ -168,6 +210,54 @@ export function attachMayaRoutes(app, {
     }
     const focusId = req.body?.focusId ? String(req.body.focusId) : null;
 
+    // A CLOSED enum. Without this a typo ('portoflio') falls through to a
+    // project-scoped answer that looks exactly like a correct one — the silent
+    // downgrade this feature exists to refuse, arriving through the door left
+    // open by not checking.
+    // Validated as the RAW value. Coercing first made `null` look like "absent"
+    // (silently selecting project scope) and turned `["portfolio"]` into the
+    // string "portfolio" — both of which are the silent widening/downgrade this
+    // enum exists to refuse, arriving through the coercion rather than the check.
+    const rawScope = req.body?.scope;
+    const turnScope = rawScope === undefined ? undefined : rawScope;
+    if (turnScope !== undefined && turnScope !== 'project' && turnScope !== 'portfolio') {
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'invalid',
+            message: `unknown scope ${JSON.stringify(turnScope)} — expected "project" or "portfolio"`,
+          },
+        },
+      };
+    }
+    if (turnScope === 'portfolio' && focusId) {
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'invalid',
+            message: 'a portfolio turn spans products and cannot also be focused on one idea',
+          },
+        },
+      };
+    }
+
+    if (turnScope === 'portfolio' && !portfolioDeclared(root)) {
+      // Named, never a silent downgrade. Without its own branch this surfaces as
+      // the generic `context` funnel, which tells the user nothing about
+      // membership — and a portfolio question answered for one product looks
+      // exactly like a correct answer.
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'misconfigured',
+            message: portfolioMisconfigReason(root),
+          },
+        },
+      };
+    }
     try {
       if (!hasSmartmemoryFluidProvider(root)) {
         return { errorBody: { ok: false, error: { kind: 'connect-smartmemory' } } };
@@ -204,11 +294,25 @@ export function attachMayaRoutes(app, {
         await ensureIdentity(root, { smBaseUrl: getSmartmemoryConfig(root)?.baseUrl, mode });
       }
 
+      // BEFORE composition, not after. Composition is what fans out to the
+      // members, so checking afterwards let a member configured at Maya's own
+      // workspace be READ and only then refused — the guard reported a refusal
+      // for an access that had already happened, which is not a guard.
+      if (turnScope === 'portfolio') {
+        try {
+          assertMemberWorkspacesDistinct(root, workspaceClaimOf(identity));
+        } catch (e) {
+          return {
+            errorBody: { ok: false, error: { kind: 'workspace-collision', message: e.message } },
+          };
+        }
+      }
+
       // Context composition is load-bearing: a failure here is a funnel, never
       // a silent fall-through to plain chat (COLLEAGUE-ALL-IN).
       let context;
       try {
-        context = await composeContext(root, { focusId });
+        context = await composeContext(root, { focusId, scope: turnScope, text });
       } catch (e) {
         return {
           errorBody: {
@@ -315,7 +419,7 @@ export function attachMayaRoutes(app, {
 
     if (req.query?.stream !== '1') {
       try {
-        const reply = await client.chat({ message: text, channelContext: context.blocks });
+        const reply = await client.chat({ message: text, channelContext: toMayaContext(context.blocks) });
 
         // Write-back (S4): the chat result is AUTHORITATIVE — her reply renders
         // whatever happens here, and a write-back failure is an outcome field,
@@ -332,7 +436,7 @@ export function attachMayaRoutes(app, {
           memory_available: reply.memory_available ?? null,
           writeback,
           context: {
-            sent: context.blocks.map((b) => b.author),
+            sent: [...new Set(context.blocks.map((b) => b.author))],
             omissions: context.omissions,
             // The composed blocks themselves — the panel's findings accordion
             // renders these (design §4); authors carry the provenance labels.
@@ -382,7 +486,7 @@ export function attachMayaRoutes(app, {
     try {
       const reply = await client.chatStream({
         message: text,
-        channelContext: context.blocks,
+        channelContext: toMayaContext(context.blocks),
         onToken: (token) => {
           openStream();
           writeEvent('token', { text: token });
@@ -395,7 +499,7 @@ export function attachMayaRoutes(app, {
         message_id: reply.message_id,
         memory_available: reply.memory_available ?? null,
         context: {
-          sent: context.blocks.map((b) => b.author),
+          sent: [...new Set(context.blocks.map((b) => b.author))],
           omissions: context.omissions,
           blocks: context.blocks,
         },

package/server/mcp-tool-defs.js

@@ -527,31 +527,6 @@ export const TOOLS = [
       },
     },
   },
-  // -------------------------------------------------------------------------
-  // Canon override — COMP-CANON-OVERRIDE (COMP-CANON-GUARD Decision 4)
-  // -------------------------------------------------------------------------
-  {
-    name: 'canon_override_grant',
-    effect: 'mutating',
-    writes: ["override-ledger", "override-attest", "override-grants"],
-    description:
-      'Mint a single-use, path-scoped grant permitting ONE direct write to a guarded canon path. '
-      + 'The bypass row is appended to .compose/canon-overrides.jsonl BEFORE the grant exists, so a grant '
-      + 'cannot be unrecorded. The token expires in 5 minutes and is burned by the first write. '
-      + 'Governance state (the bypass ledger, its baseline, the grant directory) is deliberately NOT grantable. '
-      + 'SCOPE: this is audit and careless-drift tooling for the Claude Write/Edit path — it is not enforcement. '
-      + 'Bash and Codex writes never reach the guard, and `operation` is a declared label recorded for later '
-      + 'analysis, never verified against the write that follows.',
-    inputSchema: {
-      type: 'object',
-      required: ['path', 'reason'],
-      properties: {
-        path: { type: 'string', description: 'Repo-relative path to grant one write for. Must be guarded at the write-time hook and override-eligible.' },
-        reason: { type: 'string', description: 'Why the bypass is justified. Empty or whitespace-only is rejected — the recorded reason is the point.' },
-        operation: { type: 'string', description: 'Caller-declared intent label (e.g. "repair-malformed-record"). Recorded for analysis; unverifiable by construction.' },
-      },
-    },
-  },
   {
     name: 'get_changelog_entries',
     effect: 'read',

package/server/mcp-tool-policy.js

@@ -26,18 +26,12 @@ export const SETUP_TOOLS = new Set([
 /**
  * Management/approval/completion tools an implementer context must not wield.
  *
- * COMP-COVERAGE-GATE (2026-08-24) added the last two, found by
+ * COMP-COVERAGE-GATE (2026-08-24) added `roadmap_xref_push`, found by
  * `checkAuthorizationCoverage`'s C4 check — mutating tools this list had never
- * been asked about. Both postdate COMP-MCP-ENFORCE-1's charter ("cannot
- * self-approve, self-complete, or mutate roadmap status") and no design ever
- * ruled that an implementer may call them:
+ * been asked about. It postdates COMP-MCP-ENFORCE-1's charter ("cannot
+ * self-approve, self-complete, or mutate roadmap status"), and no design ever
+ * ruled that an implementer may call it:
  *
- *  - `canon_override_grant` — the escape hatch FROM canon enforcement was
- *    callable by the profile SUBJECT to it. COMP-CANON-OVERRIDE already reasoned
- *    that the override must not be grantable for its own governance state
- *    (`overrideEligible: false`); this is the same argument one level up, at the
- *    caller instead of the target. An implementer that hits a canon block must
- *    escalate, not self-authorise.
  *  - `roadmap_xref_push` — writes EXTERNAL trackers (github issues, sibling
  *    repos). An implementer session should not be reaching outside the repo.
  *
@@ -47,8 +41,8 @@ export const SETUP_TOOLS = new Set([
  * recorded decision, not an omission. That ruling is now recorded machine-side
  * in `C4_EXCEPTIONS` (lib/coverage-gate.js) so the gate stops re-raising it.
  *
- * Verified before adding the two: no pipeline spec, prompt template or server
- * flow invokes either from an implementer-profile session.
+ * Verified before adding it: no pipeline spec, prompt template or server flow
+ * invokes it from an implementer-profile session.
  */
 const IMPLEMENTER_DENY = [
   'approve_gate', 'complete_feature', 'kill_feature',
@@ -56,7 +50,6 @@ const IMPLEMENTER_DENY = [
   // COMP-LIFECYCLE-BACKFILL: a completion is a management act, backfilled or not.
   'backfill_completion',
   // ── added by COMP-COVERAGE-GATE C4 ──
-  'canon_override_grant',
   'roadmap_xref_push',
 ];
 

package/server/stratum-client.js

@@ -7,7 +7,7 @@
  *
  * Contract:
  *   - Query calls:   5s timeout, 1 retry on timeout, no retry on error
- *   - Mutation calls: 10s timeout, no retry (mutations are not idempotent to retry)
+ *   - Mutation calls: 30s timeout, no retry (mutations are not idempotent to retry)
  *   - Exit 0  → parse stdout as JSON, return result
  *   - Exit 2  → conflict (idempotency), return { conflict: true, ... }
  *   - Non-zero → log stderr internally, return { error: { code, message, detail } }
@@ -22,7 +22,13 @@ import { resolveStratumBin, resolveStratumEngine as resolveEngine } from '../lib
 let _execFile = _execFileDefault;
 export function _testOnly_setExecFile(fn) { _execFile = fn; }
 const QUERY_TIMEOUT_MS = 5_000;
-const MUTATION_TIMEOUT_MS = 10_000;
+// Measured 2026-09-07 on this seam: a `guard transition` subprocess costs
+// 1.5-3.9 s idle (node startup + the stratum CLI module graph + guard store IO).
+// A 10 s budget left under 3x headroom, and under full-suite load 6 of 200
+// lifecycle-guard-e2e runs blew it; at 30 s the same probe under the same load
+// was 0 of 200. A mutation timeout is a fail-closed refusal to the caller, so
+// the budget must clear a loaded machine, not just an idle one.
+const MUTATION_TIMEOUT_MS = 30_000;
 
 // ---------------------------------------------------------------------------
 // Engine selection (COMP-STRATUM-TS)
@@ -81,8 +87,28 @@ function _spawnResult(bin, err, out, err2) {
   const stdout = out || '';
   let stderr = err2 || '';
   let code;
-  if (err?.code === 'ETIMEDOUT') code = -1;
-  else if (typeof err?.code === 'number') code = err.code;
+  // A timeout kill NEVER reaches the execFile CALLBACK as `code: 'ETIMEDOUT'` —
+  // node kills the child and reports `{ code: null, killed: true, signal:
+  // 'SIGTERM' }`. Matching only on ETIMEDOUT left every real timeout falling
+  // through to the generic `code = 1` branch below, so the TIMEOUT arms of
+  // runQuery/runMutation/runGuard (and runQuery's retry) were unreachable and a
+  // timed-out guard transition surfaced as `UNKNOWN` — rendered by the lifecycle
+  // routes as "transition refused by guard", i.e. an infrastructure timeout
+  // claiming the evidence was evaluated and rejected. Measured 2026-09-07:
+  // 6/200 lifecycle-guard-e2e runs under full-suite load, every one this shape.
+  // (`ETIMEDOUT` is still matched: execFileSync/spawnSync do set it, and
+  // probeStratumBin in lib/stratum-engine.js already checks all three.)
+  // `killed` is set only when NODE killed the child (timeout). A child that
+  // died to an outside signal reports `signal` with `killed: false`; that is
+  // not a timeout and is named as what it was rather than relabelled.
+  if (err?.code === 'ETIMEDOUT' || err?.killed === true) {
+    code = -1;
+    stderr = stderr || err.message || String(err);
+  } else if (typeof err?.code === 'number') code = err.code;
+  else if (err?.signal != null) {
+    code = 1;
+    stderr = stderr || `stratum child killed by ${err.signal}`;
+  }
   else if (typeof err?.code === 'string' && _SPAWN_CODES.has(err.code)) {
     code = -2;
     stderr = _spawnRemedy(bin, err.code);
@@ -102,6 +128,18 @@ function _spawnRemedy(bin, code) {
   return `${bin} (TS stratum engine) failed to spawn (${code}). Install @smartmemory/stratum or set COMPOSE_STRATUM_TS_CLI_BIN`;
 }
 
+/**
+ * A bounded, diagnosable tail of what the subprocess actually produced. The
+ * TIMEOUT/PARSE_ERROR envelopes used to carry `detail: ''`, which made every
+ * such failure indistinguishable from every other one in a log. stderr is not
+ * forwarded to REST callers (see the module contract) — this detail is the
+ * process-level shape (exit code + a stdout excerpt), not the child's stderr.
+ */
+function _detail(result) {
+  const out = String(result?.stdout ?? '').trim();
+  return `exit=${result?.code}${out ? ` stdout=${JSON.stringify(out.slice(0, 400))}` : ' stdout=<empty>'}`;
+}
+
 /**
  * Run a query command (read-only). Retries once on timeout.
  *
@@ -115,7 +153,7 @@ async function runQuery(args) {
     // Retry once on timeout
     result = await spawnStratum(args, QUERY_TIMEOUT_MS, bin);
     if (result.code === -1) {
-      return { error: { code: 'TIMEOUT', message: 'Stratum query timed out', detail: '' } };
+      return { error: { code: 'TIMEOUT', message: 'Stratum query timed out', detail: _detail(result) } };
     }
   }
 
@@ -136,7 +174,7 @@ async function runQuery(args) {
   try {
     return JSON.parse(result.stdout);
   } catch {
-    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: '' } };
+    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: _detail(result) } };
   }
 }
 
@@ -149,7 +187,7 @@ async function runMutation(args) {
   const result = await spawnStratum(args, MUTATION_TIMEOUT_MS, flowGateBin());
 
   if (result.code === -1) {
-    return { error: { code: 'TIMEOUT', message: 'Stratum gate timed out', detail: '' } };
+    return { error: { code: 'TIMEOUT', message: 'Stratum gate timed out', detail: _detail(result) } };
   }
 
   if (result.code === -2) {
@@ -177,7 +215,7 @@ async function runMutation(args) {
   try {
     return JSON.parse(result.stdout);
   } catch {
-    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: '' } };
+    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: _detail(result) } };
   }
 }
 
@@ -226,7 +264,7 @@ async function runGuard(action, kwargs, timeoutMs = MUTATION_TIMEOUT_MS, extraEn
   const result = await spawnStratumStdin(['guard', action], JSON.stringify(kwargs), timeoutMs, flowGateBin(), extraEnv);
 
   if (result.code === -1) {
-    return { error: { code: 'TIMEOUT', message: 'Stratum guard timed out', detail: '' } };
+    return { error: { code: 'TIMEOUT', message: 'Stratum guard timed out', detail: _detail(result) } };
   }
   if (result.code === -2) {
     console.error('[stratum-client] guard spawn failure:', result.stderr);
@@ -247,7 +285,7 @@ async function runGuard(action, kwargs, timeoutMs = MUTATION_TIMEOUT_MS, extraEn
   try {
     return JSON.parse(result.stdout);
   } catch {
-    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: '' } };
+    return { error: { code: 'PARSE_ERROR', message: 'Stratum returned invalid JSON', detail: _detail(result) } };
   }
 }
 
@@ -367,17 +405,25 @@ export async function guardTransition({ resourceId, fromState, toState, artifact
 }
 
 /**
- * The single sanctioned bypass of predicate verification. Requires an
- * out-of-band override token (server env STRATUM_GUARD_OVERRIDE_TOKEN), a human
- * resolver, and a rationale. Records a 'deviation' ledger entry.
+ * The single sanctioned bypass of predicate verification. Requires a signed
+ * one-shot AUTHORIZATION, a human resolver, and a rationale. Records a
+ * 'deviation' ledger entry.
+ *
+ * Corrected 2026-09-07: this wrapper sent `override_token`, the shared secret
+ * stratum retired in STRAT-GUARD-AUTHZ @3647b4c. Stratum now reads
+ * `authorization` (`ts/src/mcp/server.ts:270`) — an sshsig over a payload it
+ * reconstructs, bound to the resource's ledger head — so every call this wrapper
+ * could have made was destined to fail on a missing authorization. It has no
+ * production caller; the field name is fixed so the first one does not inherit
+ * the break.
  * @returns {Promise<{status:string,ledger_ref:string,current_state:string}|ErrorResult>}
  */
-export async function guardOverride({ resourceId, fromState, toState, overrideToken, rationale, resolvedBy = 'human' }) {
+export async function guardOverride({ resourceId, fromState, toState, authorization, rationale, resolvedBy = 'human' }) {
   return runGuard('override', _compact({
     resource_id: resourceId,
     from_state: fromState,
     to_state: toState,
-    override_token: overrideToken,
+    authorization,
     rationale,
     resolved_by: resolvedBy,
   }));

package/server/supervisor.js

@@ -22,6 +22,8 @@ import { COMPOSE_HOME, getTargetRoot, ensureDataDir } from './project-root.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 console.log('[supervisor] Target project:', getTargetRoot());
 const PID_FILE = path.join(COMPOSE_HOME, '.compose-supervisor.pid');
+const VITE_BIN = path.join(COMPOSE_HOME, 'node_modules', '.bin', 'vite');
+const IS_SOURCE_CHECKOUT = fs.existsSync(path.join(COMPOSE_HOME, '.git'));
 
 const PROCESSES = [
   {
@@ -36,13 +38,25 @@ const PROCESSES = [
     port: process.env.AGENT_PORT || 4002,
     type: 'fork',
   },
-  {
+];
+
+if (IS_SOURCE_CHECKOUT) {
+  delete process.env.COMPOSE_PACKAGED_UI;
+  if (!fs.existsSync(VITE_BIN)) {
+    console.error(`[supervisor] Vite is required in a Compose source checkout but was not found at ${VITE_BIN}`);
+    console.error(`[supervisor] Run \`npm install\` in ${COMPOSE_HOME}, then retry \`compose start\`.`);
+    process.exit(1);
+  }
+  PROCESSES.push({
     name: 'vite',
-    command: path.join(COMPOSE_HOME, 'node_modules', '.bin', 'vite'),
+    command: VITE_BIN,
     port: process.env.VITE_PORT || 5195,
     type: 'spawn',
-  },
-];
+  });
+} else {
+  process.env.COMPOSE_PACKAGED_UI = '1';
+  console.log('[supervisor] Packaged install: serving cockpit from dist/ through the API server');
+}
 
 const MIN_BACKOFF = 500;
 const MAX_BACKOFF = 10_000;

package/server/vision-routes.js

@@ -53,7 +53,7 @@ import { addOpenLoop, resolveOpenLoop, listOpenLoops } from './open-loops-store.
 import {
   TERMINAL,
   guardedTransition, ensureGuard, projectFeatureStatus,
-  verifyCompletionEvidence, guardTestCommand,
+  verifyCompletionEvidence, guardTestCommand, isGuardInfraError,
 } from './lifecycle-guard.js';
 import {
   transitionsOf, skippableOf, completablePhaseOf, getMode, resolveMode,
@@ -85,6 +85,12 @@ export function attachVisionRoutes(app, { store, scheduleBroadcast, broadcastMes
   // COMP-MCP-ENFORCE: when enabled, lifecycle transitions are verdict-gated by
   // stratum's STRAT-GUARD (fail-closed). Default OFF — legacy behavior intact.
   const guardEnabled = () => capabilities?.guard === true;
+  // A guard that never answered is 503 "guard unavailable"; a guard that
+  // answered no is 422 "transition refused by guard". Collapsing them told the
+  // user their evidence was rejected when the subprocess had merely timed out.
+  const guardFailure = (res, g, from, to) => isGuardInfraError(g)
+    ? res.status(503).json({ error: 'guard unavailable', from, to, guardError: g.error })
+    : res.status(422).json({ error: 'transition refused by guard', from, to, verdict: g.verdict, guardError: g.error });
 
   // COMP-MCP-ENFORCE Slice 4: opt-in loopback REST auth on vision MUTATION
   // endpoints (lifecycle transitions, iterations, gate resolve, item CRUD,
@@ -404,7 +410,7 @@ export function attachVisionRoutes(app, { store, scheduleBroadcast, broadcastMes
       // COMP-MCP-ENFORCE: verdict-gate the transition (fail-closed) before mutating.
       if (guardEnabled()) {
         const g = await guardedTransition({ featureCode: item.lifecycle.featureCode, from, to: targetPhase, workspaceRoot: projectRoot, resolvedBy: 'agent', mode: modeOf(item) });
-        if (!g.applied) return res.status(422).json({ error: 'transition refused by guard', from, to: targetPhase, verdict: g.verdict, guardError: g.error });
+        if (!g.applied) return guardFailure(res, g, from, targetPhase);
       }
 
       item.lifecycle.currentPhase = targetPhase;
@@ -446,7 +452,7 @@ export function attachVisionRoutes(app, { store, scheduleBroadcast, broadcastMes
       // COMP-MCP-ENFORCE: verdict-gate the skip (fail-closed) before mutating.
       if (guardEnabled()) {
         const g = await guardedTransition({ featureCode: item.lifecycle.featureCode, from, to: targetPhase, workspaceRoot: projectRoot, resolvedBy: 'agent', mode: modeOf(item) });
-        if (!g.applied) return res.status(422).json({ error: 'transition refused by guard', from, to: targetPhase, verdict: g.verdict, guardError: g.error });
+        if (!g.applied) return guardFailure(res, g, from, targetPhase);
       }
 
       item.lifecycle.currentPhase = targetPhase;

package/dist/assets/channel-SnZzzh7k.js

@@ -1 +0,0 @@
-import{aq as o,ar as n}from"./App-Z4MU-H_F.js";const t=(r,a)=>o.lang.round(n.parse(r)[a]);export{t as c};

package/dist/assets/classDiagram-6PBFFD2Q-CBu92dSH.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-4TB4RGXK-JytR14a9.js";import{_ as i}from"./App-Z4MU-H_F.js";import"./chunk-FMBD7UC4-C9s7KR9m.js";import"./chunk-YZCP3GAM-iE_tzriw.js";import"./chunk-55IACEB6-B4Q97BCP.js";import"./chunk-EDXVE4YY-R_qarkSf.js";import"./mobile-B7m9EO9D.js";import"./index-BEfrNBp8.js";import"./graph-CI_1htl0.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};

package/dist/assets/classDiagram-v2-HSJHXN6E-CBu92dSH.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-4TB4RGXK-JytR14a9.js";import{_ as i}from"./App-Z4MU-H_F.js";import"./chunk-FMBD7UC4-C9s7KR9m.js";import"./chunk-YZCP3GAM-iE_tzriw.js";import"./chunk-55IACEB6-B4Q97BCP.js";import"./chunk-EDXVE4YY-R_qarkSf.js";import"./mobile-B7m9EO9D.js";import"./index-BEfrNBp8.js";import"./graph-CI_1htl0.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};

package/dist/assets/clone-DgklGjHm.js

@@ -1 +0,0 @@
-import{b as r}from"./graph-BNzKGvoy.js";var e=4;function a(o){return r(o,e)}export{a as c};

package/dist/assets/stateDiagram-v2-QKLJ7IA2-DkVLzHbY.js

@@ -1 +0,0 @@
-import{s as r,b as e,a,S as s}from"./chunk-OYMX7WX6-BySQzVxc.js";import{_ as i}from"./App-Z4MU-H_F.js";import"./chunk-55IACEB6-B4Q97BCP.js";import"./chunk-EDXVE4YY-R_qarkSf.js";import"./mobile-B7m9EO9D.js";import"./index-BEfrNBp8.js";import"./graph-CI_1htl0.js";var n={parser:a,get db(){return new s(2)},renderer:e,styles:r,init:i(t=>{t.state||(t.state={}),t.state.arrowMarkerAbsolute=t.arrowMarkerAbsolute},"init")};export{n as diagram};

package/lib/append-integrity.js

@@ -1,81 +0,0 @@
-/**
- * append-integrity.js — integrity for append-only canon files.
- *
- * COMP-CANON-OVERRIDE S1. Shared with COMP-CANON-ATTEST, which needs the same
- * primitive for `docs/judgment/records/ledger.jsonl`.
- *
- * A whole-file hash over an append-only file churns on every append and so
- * carries no signal about history. The useful question is narrower: **is the
- * prefix we previously attested still byte-identical?** That is what
- * `{length, prefix_hash}` answers — `prefix_hash` is sha256 over
- * `bytes[0, length)`, so a legitimate append (which only extends) verifies
- * clean while any rewrite of earlier content does not.
- *
- * A `{length, tail_hash}` variant was tried first and rejected: hashing the
- * trailing bytes says nothing about the prefix, so an in-place edit of an
- * early row that preserves total byte length — the shape a careless
- * `sed -i 's/park/ship/'` takes — produced a byte-identical attestation.
- *
- * SCOPE: this is drift detection, not enforcement. It catches careless and
- * accidental corruption. A deliberate actor who rewrites the file AND
- * recomputes the baseline passes, because both live in the workspace the
- * actor can write. See design.md, "The in-workspace ceiling".
- *
- * Pure — no I/O. Callers own reading the file and storing the baseline.
- */
-import { createHash } from 'node:crypto';
-
-/** @typedef {{ length: number, prefix_hash: string }} AppendBaseline */
-/** @typedef {{ ok: boolean, kind: 'clean'|'shrunk'|'prefix_changed'|'malformed_baseline' }} AppendVerdict */
-
-const HEX64 = /^[0-9a-f]{64}$/;
-
-function toBuffer(bytes) {
-  return Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes ?? '');
-}
-
-function sha256(buf) {
-  return createHash('sha256').update(buf).digest('hex');
-}
-
-/**
- * Capture the attestable state of an append-only file.
- *
- * @param {Buffer|string} bytes current file contents
- * @returns {AppendBaseline}
- */
-export function baselineFor(bytes) {
-  const buf = toBuffer(bytes);
-  return { length: buf.length, prefix_hash: sha256(buf) };
-}
-
-/**
- * Verify that `bytes` is `baseline` plus zero or more appended bytes.
- *
- * Fails closed on a malformed baseline: a missing or nonsensical baseline is
- * never treated as "nothing to check". That mirrors the malformed-record rule
- * the judgment attestation already follows (S5 R4).
- *
- * @param {Buffer|string} bytes current file contents
- * @param {AppendBaseline} baseline previously attested state
- * @returns {AppendVerdict}
- */
-export function verifyAppend(bytes, baseline) {
-  if (
-    !baseline
-    || typeof baseline !== 'object'
-    || !Number.isInteger(baseline.length)
-    || baseline.length < 0
-    || typeof baseline.prefix_hash !== 'string'
-    || !HEX64.test(baseline.prefix_hash)
-  ) {
-    return { ok: false, kind: 'malformed_baseline' };
-  }
-
-  const buf = toBuffer(bytes);
-  if (buf.length < baseline.length) return { ok: false, kind: 'shrunk' };
-  if (sha256(buf.subarray(0, baseline.length)) !== baseline.prefix_hash) {
-    return { ok: false, kind: 'prefix_changed' };
-  }
-  return { ok: true, kind: 'clean' };
-}