@stacksjs/buddy 0.70.163 → 0.70.165

package/dist/commands/protocol/desktop-lifecycle-report.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "bun:test";
+import { validateLifecycleReport } from "./desktop-lifecycle-report";
+const steps = ["install v1", "launch v1", "update to v2", "launch v2", "rollback to v1", "launch rollback", "uninstall", "verify uninstall"], revision = "d".repeat(40);
+describe("desktop lifecycle report validation", () => {
+  it("requires a complete source-pinned lifecycle and two versioned artifacts per format", () => {
+    const report = {
+      revision,
+      status: "passed",
+      installLifecycleExercised: !0,
+      runner: { os: "linux", arch: "x64" },
+      steps: steps.map((name) => ({ name, status: "passed" })),
+      artifacts: [{ format: "deb", sha256: "a".repeat(64) }, { format: "deb", sha256: "b".repeat(64) }]
+    };
+    expect(validateLifecycleReport(report, { revision, platform: "linux", architecture: "x64", formats: ["deb"] })).toEqual([]);
+  });
+  it("rejects missing rollback, wrong source, and invalid artifact evidence", () => {
+    const errors = validateLifecycleReport({
+      revision: "wrong",
+      status: "passed",
+      installLifecycleExercised: !0,
+      runner: { os: "linux", arch: "x64" },
+      steps: steps.filter((name) => name !== "rollback to v1").map((name) => ({ name, status: "passed" })),
+      artifacts: [{ format: "deb", sha256: "short" }]
+    }, { revision, platform: "linux", architecture: "x64", formats: ["deb"] });
+    expect(errors).toEqual(expect.arrayContaining([
+      "Craft source revision mismatch: wrong",
+      "lifecycle step did not pass: rollback to v1",
+      "expected two deb artifacts, found 1",
+      "deb artifact has an invalid digest"
+    ]));
+  });
+});

package/dist/commands/protocol/desktop-support.d.ts

@@ -0,0 +1 @@
+export declare function run(): void;

package/dist/commands/protocol/desktop-support.js

@@ -0,0 +1,32 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { desktopSupportMatrix } from "../../../../desktop/src/support";
+const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, ".github/protocol/evidence/desktop-support.json"), document = {
+  schemaVersion: "1.0.0",
+  generatedFrom: "storage/framework/core/desktop/src/support.ts",
+  stableTargets: desktopSupportMatrix.filter((row) => row.status === "stable").length,
+  externalGates: [
+    "https://github.com/stacksjs/stacks/issues/2059",
+    "https://github.com/stacksjs/stacks/issues/2062",
+    "https://github.com/stacksjs/stacks/issues/2063"
+  ],
+  targets: desktopSupportMatrix
+}, expected = `${JSON.stringify(document, null, 2)}
+`;
+export function run() {
+  if (process.argv.includes("--write")) {
+    writeFileSync(outputPath, expected);
+    console.log(`Wrote desktop support matrix (${document.stableTargets} stable targets)`);
+  } else if (process.argv.includes("--check")) {
+    if (!existsSync(outputPath) || readFileSync(outputPath, "utf8") !== expected)
+      throw Error("desktop support evidence is stale; run buddy protocol:desktop");
+    if (document.targets.some((row) => row.status === "stable" && (!row.installLaunchEvidence || !row.updateRollbackEvidence || row.signing !== "enforced")))
+      throw Error("stable desktop target lacks required evidence");
+    console.log(`Desktop support matrix is current (${document.stableTargets} stable targets)`);
+  } else {
+    console.error("usage: buddy protocol:desktop --write | --check");
+    process.exit(2);
+  }
+}
+if (import.meta.main)
+  run();

package/dist/commands/protocol/desktop-workflow.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/protocol/desktop-workflow.test.js

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "bun:test";
+import { readdirSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+const root = resolve(import.meta.dir, "../../../../../../.."), workflow = readFileSync(resolve(root, ".github/workflows/desktop-lifecycle.yml"), "utf8"), workflowDirectory = resolve(root, ".github/workflows"), repositoryWorkflows = readdirSync(workflowDirectory).filter((path) => path.endsWith(".yml") || path.endsWith(".yaml")).map((path) => readFileSync(resolve(workflowDirectory, path), "utf8")).join(`
+`);
+describe("desktop lifecycle workflow", () => {
+  it("packages Craft before allocating the Stacks dependency graph", () => {
+    const craftInstall = workflow.indexOf("- name: Install Craft dependencies"), lifecycle = workflow.indexOf("- name: Exercise native package lifecycle"), reclaim = workflow.indexOf("- name: Reclaim Craft dependency space"), stacksInstall = workflow.indexOf("- name: Install Stacks dependencies"), stacksTests = workflow.indexOf("- name: Verify Stacks update security contracts");
+    expect([craftInstall, lifecycle, reclaim, stacksInstall, stacksTests].every((index) => index >= 0)).toBe(!0);
+    expect(craftInstall).toBeLessThan(lifecycle);
+    expect(lifecycle).toBeLessThan(reclaim);
+    expect(reclaim).toBeLessThan(stacksInstall);
+    expect(stacksInstall).toBeLessThan(stacksTests);
+    expect(workflow).toContain("rm -rf .craft-contract/node_modules");
+  });
+  it("provisions explicit macOS descriptor capacity for Bun installs", () => {
+    expect(workflow.match(/ulimit -n 65536/g)).toHaveLength(2);
+    expect(workflow).toContain('if [ "$RUNNER_OS" = "macOS" ]');
+  });
+  it("uses a compatible preinstalled WiX 3.14 before installing it", () => {
+    const discovery = workflow.indexOf("$bin = Get-ChildItem"), install = workflow.indexOf("choco install wixtoolset");
+    expect(discovery).toBeGreaterThan(0);
+    expect(discovery).toBeLessThan(install);
+    expect(workflow).toContain("$version.StartsWith('3.14')");
+    expect(workflow).toContain("--allow-downgrade");
+  });
+  it("retains artifacts through maintained Node 24 action runtimes", () => {
+    expect(repositoryWorkflows).not.toMatch(/actions\/upload-artifact@v[1-6]\b/);
+    expect(repositoryWorkflows).not.toMatch(/actions\/download-artifact@v[1-7]\b/);
+    expect(repositoryWorkflows.match(/actions\/upload-artifact@v7\b/g)).toHaveLength(3);
+    expect(repositoryWorkflows.match(/actions\/download-artifact@v8\b/g)).toHaveLength(1);
+  });
+});

package/dist/commands/protocol/driver-registry.d.ts

@@ -0,0 +1 @@
+export declare function run(): Promise<void>;

package/dist/commands/protocol/driver-registry.js

@@ -0,0 +1,71 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { capabilityRegistry } from "../../../../config/src/capabilities";
+const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, ".github/protocol/evidence/drivers.json");
+function validate() {
+  const errors = [], seen = new Set, categories = new Set(["database", "queue", "cache", "storage", "mail", "realtime", "deploy"]);
+  for (const driver of capabilityRegistry) {
+    const id = `${driver.category}/${driver.name}`;
+    if (seen.has(id))
+      errors.push(`${id}: duplicate registry entry`);
+    seen.add(id);
+    if (!categories.has(driver.category))
+      errors.push(`${id}: unknown category`);
+    if (driver.status === "supported" && driver.testEvidence.length === 0)
+      errors.push(`${id}: supported driver has no test evidence`);
+    if (driver.status === "supported" && /client-server|managed|smtp|redis/.test(driver.topology) && !driver.liveServiceContract)
+      errors.push(`${id}: externally hosted driver cannot be supported without a retained live-service contract`);
+    if (driver.liveServiceContract && !existsSync(resolve(root, driver.liveServiceContract.workflow)))
+      errors.push(`${id}: live-service workflow does not exist: ${driver.liveServiceContract.workflow}`);
+    if (driver.status !== "supported" && driver.limitations.length === 0)
+      errors.push(`${id}: non-supported driver must explain its evidence gap`);
+    if (driver.status !== "unsupported" && !driver.implementation)
+      errors.push(`${id}: operational driver has no implementation`);
+    if (driver.implementation && !existsSync(resolve(root, driver.implementation)))
+      errors.push(`${id}: implementation path does not exist`);
+    for (const testPath of driver.testEvidence)
+      if (!existsSync(resolve(root, testPath)))
+        errors.push(`${id}: test evidence does not exist: ${testPath}`);
+  }
+  for (const category of categories)
+    if (!capabilityRegistry.some((driver) => driver.category === category))
+      errors.push(`${category}: no drivers registered`);
+  return errors;
+}
+function render() {
+  const document = {
+    schemaVersion: "1.0.0",
+    generatedFrom: "storage/framework/core/config/src/capabilities.ts",
+    resultSemantics: {
+      supported: "Implemented, selected by configuration, and backed by checked-in automated evidence.",
+      partial: "Implemented, but missing live-service or feature-parity evidence.",
+      experimental: "Implemented for evaluation without a compatibility commitment or complete matrix.",
+      unsupported: "Reserved, planned, or intentionally unavailable; selection must fail loudly."
+    },
+    drivers: [...capabilityRegistry].sort((a, b) => a.category.localeCompare(b.category) || a.name.localeCompare(b.name))
+  };
+  return `${JSON.stringify(document, null, 2)}
+`;
+}
+export async function run() {
+  const errors = validate();
+  if (errors.length > 0) {
+    for (const error of errors)
+      console.error(`error: ${error}`);
+    process.exit(1);
+  }
+  const expected = render();
+  if (process.argv.includes("--write")) {
+    writeFileSync(outputPath, expected);
+    console.log(`Wrote ${capabilityRegistry.length} driver capability records`);
+  } else if (process.argv.includes("--check")) {
+    if (!existsSync(outputPath) || readFileSync(outputPath, "utf8") !== expected)
+      throw Error("driver registry evidence is stale; run bun run protocol:drivers");
+    console.log(`Driver registry is current (${capabilityRegistry.length} records)`);
+  } else {
+    console.error("usage: bun storage/framework/core/buddy/src/commands/protocol/driver-registry.ts --write | --check");
+    process.exit(2);
+  }
+}
+if (import.meta.main)
+  await run();

package/dist/commands/protocol/pantry-evidence.d.ts

@@ -0,0 +1,67 @@
+export declare function validatePantryEvidence(evidence: typeof pantryEvidence): string[];
+export declare function run(): Promise<void>;
+export declare const pantryEvidence: {
+  schemaVersion: 1;
+  status: 'pinned';
+  issue: 'https://github.com/stacksjs/stacks/issues/2066';
+  source: {
+  repository: 'https://github.com/pantry-pm/pantry';
+  version: '0.10.47';
+  tag: 'v0.10.47';
+  revision: 'd738d5fd2e543e3b8380e5fbd5d01ba8936c1790'
+};
+  whitepaper: {
+  repository: 'https://github.com/stacksjs/white-paper';
+  revision: 'ac6d1dfba8cb96cf6e888f3369cbcc3e17cdf202';
+  evidenceLock: 'evidence/pantry/evidence.lock.json'
+};
+  contracts: readonly [{
+  id: 'package-manager';
+  sourcePath: 'docs/package-manager.md';
+  sha256: '03bab0e0373e2405a4f0656745786702a19c3b3a0ffb9be09ca0931f85a5158e';
+  referencePath: 'docs/reference/package-manager.md'
+}, {
+  id: 'registry';
+  sourcePath: 'docs/registry.md';
+  sha256: 'c16a2ef8855d99b34398bddfd6f574e0e3001ce8a769dc6dd6792af418c4724b';
+  referencePath: 'docs/reference/registry.md'
+}];
+  serviceContracts: readonly [{
+  id: 'github-actions-service-interface';
+  sourcePath: 'packages/action/action.yml';
+  sha256: '06f4ac3f3307a474e493abe56f1e8f7d99f7af8ce49cecbf3dfdd2e55333ea13'
+}, {
+  id: 'github-actions-redis-lifecycle';
+  sourcePath: 'packages/action/src/services.ts';
+  sha256: '7e88c89880bf1dc42cfee44f5a741b7659b2c2a1aced7da9c23520ed28a8afe9'
+}, {
+  id: 'github-actions-redis-orchestration';
+  sourcePath: 'packages/action/src/index.ts';
+  sha256: '3fd905facb4109f0a3e65d743c522eb72b934dea466531aeb24c468ab4fc76ab'
+}, {
+  id: 'github-actions-install-mode';
+  sourcePath: 'packages/action/src/install-mode.ts';
+  sha256: 'e3ff33f0197eb9607d9a74efd946d34c76aad21ed4af4b2a89169aa04db30581'
+}, {
+  id: 'github-actions-redis-cleanup';
+  sourcePath: 'packages/action/src/post.ts';
+  sha256: '9dbfa452e86a61ec75da8c461d69d10a4f493765c19523ba999ee4f916ccde54'
+}, {
+  id: 'native-service-readiness';
+  sourcePath: 'packages/zig/src/cli/commands/services.zig';
+  sha256: '7da9d6271b8dc755865db26a366202448cc408e0d2e3b0daa0a3b8cb917fd748'
+}, {
+  id: 'native-redis-definition';
+  sourcePath: 'packages/zig/src/services/definitions.zig';
+  sha256: 'faf362b6a9f037350b6baf7204f424e78b9bfe8704dfdfcf26e1daa1b5dce678'
+}];
+  verification: {
+  documentationContracts: 'bun run docs:contracts:check (54 source-linked markers)';
+  targetedBunTests: '332 passed, 6 skipped, 0 failed';
+  typecheck: 'bun run typecheck';
+  nativeTests: '29 semver tests passed; zig build test completed 32/32 steps';
+  actionRedisService: 'Pantry CI action-redis-service job (Redis 8.8.0)';
+  whitepaperCheck: 'bun run evidence:check'
+};
+  boundaries: readonly ['Pantry system packages, npm-compatible packages, and workspace/local packages use distinct resolution paths.', 'npm fallback is read-only and does not publish npm packages into Pantry.', 'Configured storage and authentication modes do not by themselves prove production readiness.', 'Stacks consumes Pantry as a versioned toolchain boundary and does not redefine Pantry behavior.']
+};

package/dist/commands/protocol/pantry-evidence.js

@@ -0,0 +1,144 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, ".github/protocol/evidence/pantry.json");
+export const pantryEvidence = {
+  schemaVersion: 1,
+  status: "pinned",
+  issue: "https://github.com/stacksjs/stacks/issues/2066",
+  source: {
+    repository: "https://github.com/pantry-pm/pantry",
+    version: "0.10.47",
+    tag: "v0.10.47",
+    revision: "d738d5fd2e543e3b8380e5fbd5d01ba8936c1790"
+  },
+  whitepaper: {
+    repository: "https://github.com/stacksjs/white-paper",
+    revision: "ac6d1dfba8cb96cf6e888f3369cbcc3e17cdf202",
+    evidenceLock: "evidence/pantry/evidence.lock.json"
+  },
+  contracts: [
+    {
+      id: "package-manager",
+      sourcePath: "docs/package-manager.md",
+      sha256: "03bab0e0373e2405a4f0656745786702a19c3b3a0ffb9be09ca0931f85a5158e",
+      referencePath: "docs/reference/package-manager.md"
+    },
+    {
+      id: "registry",
+      sourcePath: "docs/registry.md",
+      sha256: "c16a2ef8855d99b34398bddfd6f574e0e3001ce8a769dc6dd6792af418c4724b",
+      referencePath: "docs/reference/registry.md"
+    }
+  ],
+  serviceContracts: [
+    {
+      id: "github-actions-service-interface",
+      sourcePath: "packages/action/action.yml",
+      sha256: "06f4ac3f3307a474e493abe56f1e8f7d99f7af8ce49cecbf3dfdd2e55333ea13"
+    },
+    {
+      id: "github-actions-redis-lifecycle",
+      sourcePath: "packages/action/src/services.ts",
+      sha256: "7e88c89880bf1dc42cfee44f5a741b7659b2c2a1aced7da9c23520ed28a8afe9"
+    },
+    {
+      id: "github-actions-redis-orchestration",
+      sourcePath: "packages/action/src/index.ts",
+      sha256: "3fd905facb4109f0a3e65d743c522eb72b934dea466531aeb24c468ab4fc76ab"
+    },
+    {
+      id: "github-actions-install-mode",
+      sourcePath: "packages/action/src/install-mode.ts",
+      sha256: "e3ff33f0197eb9607d9a74efd946d34c76aad21ed4af4b2a89169aa04db30581"
+    },
+    {
+      id: "github-actions-redis-cleanup",
+      sourcePath: "packages/action/src/post.ts",
+      sha256: "9dbfa452e86a61ec75da8c461d69d10a4f493765c19523ba999ee4f916ccde54"
+    },
+    {
+      id: "native-service-readiness",
+      sourcePath: "packages/zig/src/cli/commands/services.zig",
+      sha256: "7da9d6271b8dc755865db26a366202448cc408e0d2e3b0daa0a3b8cb917fd748"
+    },
+    {
+      id: "native-redis-definition",
+      sourcePath: "packages/zig/src/services/definitions.zig",
+      sha256: "faf362b6a9f037350b6baf7204f424e78b9bfe8704dfdfcf26e1daa1b5dce678"
+    }
+  ],
+  verification: {
+    documentationContracts: "bun run docs:contracts:check (54 source-linked markers)",
+    targetedBunTests: "332 passed, 6 skipped, 0 failed",
+    typecheck: "bun run typecheck",
+    nativeTests: "29 semver tests passed; zig build test completed 32/32 steps",
+    actionRedisService: "Pantry CI action-redis-service job (Redis 8.8.0)",
+    whitepaperCheck: "bun run evidence:check"
+  },
+  boundaries: [
+    "Pantry system packages, npm-compatible packages, and workspace/local packages use distinct resolution paths.",
+    "npm fallback is read-only and does not publish npm packages into Pantry.",
+    "Configured storage and authentication modes do not by themselves prove production readiness.",
+    "Stacks consumes Pantry as a versioned toolchain boundary and does not redefine Pantry behavior."
+  ]
+};
+export function validatePantryEvidence(evidence) {
+  const errors = [];
+  if (evidence.source.tag !== `v${evidence.source.version}`)
+    errors.push("Pantry tag does not match its version");
+  if (!/^[a-f0-9]{40}$/.test(evidence.source.revision))
+    errors.push("Pantry revision is not a full commit SHA");
+  if (!/^[a-f0-9]{40}$/.test(evidence.whitepaper.revision))
+    errors.push("whitepaper revision is not a full commit SHA");
+  if (evidence.contracts.length !== 2)
+    errors.push("both canonical Pantry contracts must be pinned");
+  for (const contract of evidence.contracts) {
+    if (!/^[a-f0-9]{64}$/.test(contract.sha256))
+      errors.push(`${contract.id}: invalid SHA-256 digest`);
+    if (!contract.sourcePath.endsWith(".md"))
+      errors.push(`${contract.id}: source contract is not Markdown`);
+    if (!contract.referencePath.startsWith("docs/reference/"))
+      errors.push(`${contract.id}: whitepaper reference path is invalid`);
+  }
+  if (evidence.serviceContracts.length !== 7)
+    errors.push("all Pantry Redis service contracts must be pinned");
+  for (const contract of evidence.serviceContracts) {
+    if (!/^[a-f0-9]{64}$/.test(contract.sha256))
+      errors.push(`${contract.id}: invalid SHA-256 digest`);
+    if (!contract.sourcePath.startsWith("packages/"))
+      errors.push(`${contract.id}: source path is outside Pantry packages`);
+  }
+  return errors;
+}
+function serializedEvidence() {
+  return `${JSON.stringify(pantryEvidence, null, 2)}
+`;
+}
+function check() {
+  const errors = validatePantryEvidence(pantryEvidence);
+  if (!existsSync(outputPath))
+    errors.push(".github/protocol/evidence/pantry.json is missing");
+  else if (readFileSync(outputPath, "utf8") !== serializedEvidence())
+    errors.push("Pantry evidence is stale; run bun run protocol:pantry");
+  if (errors.length)
+    throw Error(errors.join(`
+`));
+  console.log(`Pantry evidence pins ${pantryEvidence.source.tag} at ${pantryEvidence.source.revision}`);
+}
+export async function run() {
+  if (process.argv.includes("--write")) {
+    const errors = validatePantryEvidence(pantryEvidence);
+    if (errors.length)
+      throw Error(errors.join(`
+`));
+    writeFileSync(outputPath, serializedEvidence());
+    console.log(`Wrote Pantry evidence for ${pantryEvidence.source.tag}`);
+  } else if (process.argv.includes("--check"))
+    check();
+  else {
+    console.error("usage: bun storage/framework/core/buddy/src/commands/protocol/pantry-evidence.ts --write | --check");
+    process.exit(2);
+  }
+}
+if (import.meta.main)
+  await run();

package/dist/commands/protocol/pantry-evidence.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/protocol/pantry-evidence.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "bun:test";
+import { pantryEvidence, validatePantryEvidence } from "./pantry-evidence";
+describe("Pantry protocol evidence", () => {
+  it("pins both verified upstream contracts", () => {
+    expect(validatePantryEvidence(pantryEvidence)).toEqual([]);
+    expect(pantryEvidence.contracts.map((contract) => contract.id)).toEqual(["package-manager", "registry"]);
+    expect(pantryEvidence.serviceContracts.map((contract) => contract.id)).toEqual([
+      "github-actions-service-interface",
+      "github-actions-redis-lifecycle",
+      "github-actions-redis-orchestration",
+      "github-actions-install-mode",
+      "github-actions-redis-cleanup",
+      "native-service-readiness",
+      "native-redis-definition"
+    ]);
+  });
+  it("rejects an untraceable release or contract digest", () => {
+    const invalid = structuredClone(pantryEvidence);
+    Object.assign(invalid.source, { tag: "latest", revision: "short" });
+    Object.assign(invalid.contracts[0], { sha256: "not-a-digest" });
+    Object.assign(invalid.serviceContracts[0], { sha256: "not-a-digest" });
+    expect(validatePantryEvidence(invalid)).toEqual(expect.arrayContaining([
+      "Pantry tag does not match its version",
+      "Pantry revision is not a full commit SHA",
+      "package-manager: invalid SHA-256 digest",
+      "github-actions-service-interface: invalid SHA-256 digest"
+    ]));
+  });
+});

package/dist/commands/protocol/release-manifest.d.ts

@@ -0,0 +1,30 @@
+export declare function assertReleaseMapping(tag: string, releasePackageVersion?: string): void;
+export declare function buildReleaseManifest(tag: string): ReleaseManifest;
+export declare function renderReleaseManifest(manifest: ReleaseManifest): string;
+export declare function run(): Promise<void>;
+export declare interface ReleasePackageEntry {
+  name: string
+  path: string
+  version: string
+  publishable: boolean
+}
+export declare interface ReleaseManifest {
+  schemaVersion: '1.0.0'
+  repository: string
+  tag: string
+  tagType: 'annotated' | 'lightweight'
+  releaseVersion: string
+  releasePackage: string
+  sourceRevision: string
+  sourceTree: string
+  sourceDigest: string
+  generatedAt: 'derived-from-immutable-git-objects'
+  rootPackage: { name: string, version: string, private: boolean }
+  prerequisites: Record<string, string>
+  packages: ReleasePackageEntry[]
+  policy: {
+    tagMatchesReleasePackageVersion: true
+    rootVersionIsIndependent: true
+    notes: string
+  }
+}

package/dist/commands/protocol/release-manifest.js

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, ".github/protocol/evidence/release-manifest.json");
+function runGit(...arguments_) {
+  try {
+    return execFileSync("git", arguments_, { cwd: root, maxBuffer: 67108864 });
+  } catch (error) {
+    throw Error(`git ${arguments_.join(" ")} failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function showJson(sourceRevision, path) {
+  return JSON.parse(runGit("show", `${sourceRevision}:${path}`).toString());
+}
+function assertReleaseTag(tag) {
+  assertReleaseMapping(tag);
+  try {
+    runGit("show-ref", "--verify", "--quiet", `refs/tags/${tag}`);
+  } catch {
+    throw Error(`release tag does not exist: ${tag}`);
+  }
+  return runGit("rev-parse", `refs/tags/${tag}^{commit}`).toString().trim();
+}
+export function assertReleaseMapping(tag, releasePackageVersion) {
+  if (!/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(tag))
+    throw Error(`release tag must be an exact semantic version tag, received: ${tag}`);
+  if (releasePackageVersion !== void 0 && releasePackageVersion !== tag.slice(1))
+    throw Error(`release tag ${tag} does not match storage/framework/package.json version ${releasePackageVersion}`);
+}
+export function buildReleaseManifest(tag) {
+  const sourceRevision = assertReleaseTag(tag), tagObjectType = runGit("cat-file", "-t", `refs/tags/${tag}`).toString().trim(), tagType = tagObjectType === "tag" ? "annotated" : tagObjectType === "commit" ? "lightweight" : null;
+  if (!tagType)
+    throw Error(`release tag ${tag} points to unsupported Git object type: ${tagObjectType}`);
+  const sourceTree = runGit("rev-parse", `${sourceRevision}^{tree}`).toString().trim(), treeListing = runGit("ls-tree", "-r", "-l", sourceRevision).toString(), packages = treeListing.trim().split(`
+`).filter(Boolean).flatMap((line) => {
+    const path = line.match(/^\d+\s+blob\s+[0-9a-f]+\s+\d+\t(.+)$/)?.[1];
+    return path != null ? [path] : [];
+  }).filter((path) => path === "package.json" || path.endsWith("/package.json")).flatMap((path) => {
+    const pkg = showJson(sourceRevision, path);
+    if (!pkg.name || !pkg.version)
+      return [];
+    return [{ name: pkg.name, path, version: pkg.version, publishable: pkg.private !== !0 }];
+  }).sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)), rootPackage = showJson(sourceRevision, "package.json"), releasePackagePath = "storage/framework/package.json", releasePackage = packages.find((pkg) => pkg.path === releasePackagePath);
+  if (!releasePackage)
+    throw Error(`${releasePackagePath} is missing a name or version at ${sourceRevision}`);
+  const releaseVersion = tag.slice(1);
+  assertReleaseMapping(tag, releasePackage.version);
+  return {
+    schemaVersion: "1.0.0",
+    repository: "https://github.com/stacksjs/stacks",
+    tag,
+    tagType,
+    releaseVersion,
+    releasePackage: releasePackage.name,
+    sourceRevision,
+    sourceTree,
+    sourceDigest: `sha256:${createHash("sha256").update(treeListing).digest("hex")}`,
+    generatedAt: "derived-from-immutable-git-objects",
+    rootPackage: {
+      name: rootPackage.name,
+      version: rootPackage.version,
+      private: rootPackage.private === !0
+    },
+    prerequisites: rootPackage.system || {},
+    packages,
+    policy: {
+      tagMatchesReleasePackageVersion: !0,
+      rootVersionIsIndependent: !0,
+      notes: "The release tag versions stacks-framework. The private root package orchestrates the monorepo and has an independent version. Every versioned package is recorded at the exact tagged commit."
+    }
+  };
+}
+export function renderReleaseManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+export async function run() {
+  const mode = process.argv.includes("--write") ? "write" : process.argv.includes("--check") ? "check" : null;
+  if (!mode) {
+    console.error("usage: bun storage/framework/core/buddy/src/commands/protocol/release-manifest.ts --write --tag <tag> | --check");
+    process.exit(2);
+  }
+  if (mode === "write") {
+    const index = process.argv.indexOf("--tag"), tag = index === -1 ? null : process.argv[index + 1];
+    if (!tag)
+      throw Error("--tag requires an exact release tag");
+    const manifest = buildReleaseManifest(tag);
+    mkdirSync(dirname(outputPath), { recursive: !0 });
+    writeFileSync(outputPath, renderReleaseManifest(manifest));
+    console.log(`Wrote release manifest for ${manifest.tag} at ${manifest.sourceRevision} (${manifest.packages.length} packages)`);
+  } else {
+    if (!existsSync(outputPath))
+      throw Error("release manifest is missing; run bun run protocol:release -- --tag <tag>");
+    const current = JSON.parse(readFileSync(outputPath, "utf8")), expected = renderReleaseManifest(buildReleaseManifest(current.tag));
+    if (readFileSync(outputPath, "utf8") !== expected)
+      throw Error(`release manifest is stale or modified; run bun run protocol:release -- --tag ${current.tag}`);
+    console.log(`Release manifest matches ${current.tag} at ${current.sourceRevision}`);
+  }
+}
+if (import.meta.main)
+  await run();

package/dist/commands/protocol/release-manifest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/protocol/release-manifest.test.js

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "bun:test";
+import { assertReleaseMapping, renderReleaseManifest } from "./release-manifest";
+describe("release manifest", () => {
+  it("requires the framework release version to match the tag", () => {
+    expect(() => assertReleaseMapping("v0.70.161", "0.70.161")).not.toThrow();
+    expect(() => assertReleaseMapping("v0.70.161", "0.70.160")).toThrow("does not match");
+    expect(() => assertReleaseMapping("main")).toThrow("exact semantic version tag");
+  });
+  it("renders deterministically without wall-clock state", () => {
+    const manifest = {
+      schemaVersion: "1.0.0",
+      repository: "https://github.com/stacksjs/stacks",
+      tag: "v0.70.161",
+      tagType: "lightweight",
+      releaseVersion: "0.70.161",
+      releasePackage: "stacks-framework",
+      sourceRevision: "a9eaab647858ee12d891a74341c99923074a6faf",
+      sourceTree: "99ebce98969603c1fa0b0f743efcc04c9de02b98",
+      sourceDigest: "sha256:f20e1dabc57b8b9c0422d6574d756a0fc8ba40b1df2598171e28dcade07e3535",
+      generatedAt: "derived-from-immutable-git-objects",
+      rootPackage: { name: "stacks", version: "0.70.52", private: !0 },
+      prerequisites: { bun: "^1.3.0" },
+      packages: [],
+      policy: {
+        tagMatchesReleasePackageVersion: !0,
+        rootVersionIsIndependent: !0,
+        notes: "test policy"
+      }
+    };
+    expect(manifest.generatedAt).toBe("derived-from-immutable-git-objects");
+    expect(renderReleaseManifest(manifest)).toBe(`${JSON.stringify(manifest, null, 2)}
+`);
+  });
+});

package/dist/commands/protocol/run-conformance.d.ts

@@ -0,0 +1,21 @@
+import { string } from '../../../../validation/src/index';
+export declare function executeSecurityEvidence(revision: string): Evidence;
+export declare function executeConfigEvidence(revision: string): Evidence;
+export declare function executeValidationEvidence(revision: string): Promise<Evidence>;
+export declare function executeConventionsEvidence(revision: string): Evidence;
+export declare function executeLifecycleEvidence(revision: string): Promise<Evidence>;
+export declare function executeQueryEvidence(revision: string): Promise<Evidence>;
+export declare function executeDatabaseEvidence(revision: string): Promise<Evidence>;
+export declare function buildReport(): Promise<Record<string, unknown>>;
+export declare function run(): Promise<void>;
+declare interface Result {
+  requirementId: string
+  status: ResultStatus
+  fixtureId: string | null
+  evidenceUrl: string | null
+  durationMs: number
+  notes?: string
+}
+declare type ResultStatus = 'pass' | 'fail' | 'skipped' | 'unsupported' | 'exception' | 'experimental';
+/** Executable-check evidence keyed by requirement id, merged into the report. */
+declare type Evidence = Map<string, Omit<Result, 'requirementId' | 'fixtureId'>>;