@tiinex/core 0.3.0 → 0.5.0

package/src/tooling/portable/handoff/recipientV2.packageV1.inspect.js

@@ -1,7 +1,9 @@
 import { packageFileByteView, packageFileBytes, sha256Hex } from '../../../export/package.bytes.js';
+import { parseArtifactMarkdown } from '../../../artifacts/artifact.parse.js';
 import { canonicalC14nV2SelfState } from '../../../integrity/integrity.c14nV2.js';
 import { buildHandoffCarrierProjection } from './carrierProjection.js';
-import { buildHandoffWorkspaceByteProvider, inspectStoredWorkspaceArchive } from './workspaceByteProvider.js';
+import { buildHandoffWorkspaceByteProvider, inspectStoredWorkspaceArchive, resolveHandoffWorkspaceEntry } from './workspaceByteProvider.js';
+import { parseWorkspaceQualifiedReference } from './workspaceQualifiedReference.js';
 import { qualifyHandoffWorkspaceTarget } from './workspaceTargetConformance.js';
 import { inspectRecipientV2Artifact, parseRecipientV2ExternalPayload, parseRecipientV2Facts } from './recipientV2.artifacts.js';
 import { RECIPIENT_V2_READ_PATH } from './recipientV2.topology.js';
@@ -16,6 +18,7 @@ import { parseHandoffPackageV1, validatePackageFields, WORKSPACE_PACKAGE_ROLE }
 import { deriveVisibleFacts, validateRouteClosure } from './recipientV2.packageV1.inspect.helpers.js';
 import { workspaceCarrierProjection } from './recipientV2.packageV1.workspaceProjection.js';
 import { byteEqual, currentSchemaId, decodeUtf8, dedupeFindings, deepFreeze, oneFile } from './recipientV2.packageV1.shared.js';
+import { parseTransportEnvelopeV1, qualifyTransportEnvelopeV1Artifact, TRANSPORT_ENVELOPE_V1_ROLE, TRANSPORT_ENVELOPE_V1_SCHEMA_ID } from './transportEnvelopeV1.js';
 
 export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
   const files = Array.isArray(bundle.files) ? bundle.files : [];
@@ -56,13 +59,39 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
   const workspaceParts = [];
   const workspaceDescriptors = [];
   const virtualWorkspaceTargets = [];
+  const sealedWorkspaceBindings = [];
   for (const binding of bindings) {
     const workspaceFile = oneFile(index, binding.workspaceArtifactPath);
-    const archiveFile = oneFile(index, binding.snapshotPath);
-    if (!workspaceFile || !archiveFile) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-unresolved', 'Workspace binding paths must resolve exactly once inside the package.', { workspaceId: binding.workspaceId })); continue; }
-    const workspaceMarkdown = decodeUtf8(packageFileBytes(workspaceFile));
+    if (!workspaceFile) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-unresolved', 'Workspace Artifact path must resolve exactly once inside the package.', { workspaceId: binding.workspaceId })); continue; }
+    const workspaceData = packageFileByteView(workspaceFile);
+    const workspaceMarkdown = decodeUtf8(workspaceData);
     if (currentSchemaId(workspaceMarkdown) !== 'tiinex.workspace.v1') findings.push(finding('error', 'portable.handoff-package-v1.workspace-schema-invalid', 'Workspace Artifact must declare tiinex.workspace.v1.', { workspaceId: binding.workspaceId, path: workspaceFile.path || '' }));
-    if (String(binding.snapshotKind || '') !== 'exact-workspace-byte-tree-archive' || String(binding.coverage || '') !== 'complete' || String(binding.bindingState || '') !== 'verified' || String(binding.integrityMethod || '') !== 'sha256') findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-contract-invalid', 'Qualified package v1 Workspace binding requires exact complete verified sha256 semantics.', { workspaceId: binding.workspaceId }));
+
+    if (String(binding.snapshotKind || '') === 'password-sealed-workspace-byte-tree') {
+      const payloadArtifact = generatedArtifacts.find((item) => item.path === binding.protectedPayloadDescriptorPath && item.schemaId === 'tiinex.external.payload.v1' && item.status === 'qualified') || null;
+      const envelopeArtifact = generatedArtifacts.find((item) => item.path === binding.transportEnvelopePath && item.schemaId === TRANSPORT_ENVELOPE_V1_SCHEMA_ID && item.status === 'qualified') || null;
+      if (!payloadArtifact || !envelopeArtifact) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-binding-unresolved', 'Sealed Workspace binding descriptor and Transport Envelope must each resolve exactly once and qualify.', { workspaceId: binding.workspaceId })); continue; }
+      const payload = parseRecipientV2ExternalPayload(payloadArtifact.markdown);
+      const payloadFile = oneFile(index, payload.location);
+      if (!payloadFile || payload.integrityMethod !== 'sha256' || !/^[0-9a-f]{64}$/.test(String(payload.integrityValue || ''))) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-payload-invalid', 'Protected External Payload descriptor must own one exact package-local ciphertext with SHA-256 integrity.', { workspaceId: binding.workspaceId })); continue; }
+      const protectedBytes = packageFileByteView(payloadFile);
+      if (sha256Hex(protectedBytes) !== payload.integrityValue || Number(payload.bytes || 0) !== protectedBytes.byteLength) findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-payload-byte-mismatch', 'Protected payload descriptor byte identity diverges from exact carried ciphertext.', { workspaceId: binding.workspaceId }));
+      if (binding.byteSize !== null && Number(binding.byteSize) !== protectedBytes.byteLength) findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-size-mismatch', 'Sealed binding Byte Size diverges from protected payload bytes.', { workspaceId: binding.workspaceId }));
+      const envelopeQualification = qualifyTransportEnvelopeV1Artifact(envelopeArtifact.markdown);
+      if (envelopeQualification.status !== 'qualified') findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-envelope-invalid', 'Transport Envelope failed Secure Transport V1 qualification.', { workspaceId: binding.workspaceId, causes: envelopeQualification.findings || [] }));
+      const envelope = envelopeQualification.parsed || parseTransportEnvelopeV1(envelopeArtifact.markdown);
+      if (String(envelope.workspaceArtifactPath || '') !== String(binding.workspaceArtifactPath || '') || String(envelope.protectedPayloadDescriptorPath || '') !== String(binding.protectedPayloadDescriptorPath || '')) findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-envelope-binding-mismatch', 'Transport Envelope must bind the same visible Workspace Artifact and protected External Payload descriptor as the package binding.', { workspaceId: binding.workspaceId }));
+      if (String(envelope.workspaceBindingValue || '') !== sha256Hex(workspaceData)) findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-workspace-binding-mismatch', 'Transport Envelope Workspace Binding Value must equal SHA-256 of exact visible Workspace Artifact bytes.', { workspaceId: binding.workspaceId }));
+      if (String(payloadArtifact.facts?.workspaceId || '') && String(payloadArtifact.facts.workspaceId) !== String(binding.workspaceId || '')) findings.push(finding('error', 'portable.handoff-package-v1.workspace-sealed-payload-workspace-mismatch', 'Protected payload descriptor Workspace Id diverges from package binding.', { workspaceId: binding.workspaceId }));
+      workspaceParts.push({ workspaceId: binding.workspaceId, bindingState: 'sealed', artifact: Object.freeze({ path: workspaceFile.path, sha256: sha256Hex(workspaceData), markdown: workspaceMarkdown }), facts: { workspaceId: binding.workspaceId, sourceWorkspaceTargetInnerPath: '', sourceWorkspaceTargetSha256: sha256Hex(workspaceData) }, archiveFile: null, archive: null, targetQualification: null, protectedPayloadArtifact: payloadArtifact, protectedPayloadFile: payloadFile, transportEnvelopeArtifact: envelopeArtifact });
+      sealedWorkspaceBindings.push(Object.freeze({ workspaceId: binding.workspaceId, workspaceArtifactPath: binding.workspaceArtifactPath, workspaceArtifactSha256: sha256Hex(workspaceData), protectedPayloadDescriptorPath: binding.protectedPayloadDescriptorPath, protectedPayloadPath: payload.location, protectedPayloadSha256: payload.integrityValue, protectedPayloadBytes: protectedBytes.byteLength, transportEnvelopePath: binding.transportEnvelopePath, envelope }));
+      virtualWorkspaceTargets.push(workspaceFile);
+      continue;
+    }
+
+    const archiveFile = oneFile(index, binding.snapshotPath);
+    if (!archiveFile) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-unresolved', 'Clear Workspace Snapshot path must resolve exactly once inside the package.', { workspaceId: binding.workspaceId })); continue; }
+    if (String(binding.snapshotKind || '') !== 'exact-workspace-byte-tree-archive' || String(binding.coverage || '') !== 'complete' || String(binding.bindingState || '') !== 'verified' || String(binding.integrityMethod || '') !== 'sha256') findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-contract-invalid', 'Qualified clear package v1 Workspace binding requires exact complete verified sha256 semantics.', { workspaceId: binding.workspaceId }));
     const archiveData = packageFileByteView(archiveFile);
     const archiveSha = sha256Hex(archiveData);
     if (archiveSha !== binding.integrityValue) findings.push(finding('error', 'portable.handoff-package-v1.workspace-snapshot-digest-mismatch', 'Workspace Snapshot Integrity Value diverges from exact carried bytes.', { workspaceId: binding.workspaceId }));
@@ -71,20 +100,20 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
     if (parsed.state !== 'qualified') { findings.push(finding('error', 'portable.handoff-package-v1.workspace-snapshot-invalid', 'Workspace Snapshot failed safe normalized archive qualification.', { workspaceId: binding.workspaceId })); continue; }
     const inner = (parsed.entries || []).filter((entry) => entry.path === binding.workspaceArtifactInnerPath);
     if (inner.length !== 1) { findings.push(finding('error', 'portable.handoff-package-v1.workspace-inner-unresolved', 'Workspace Artifact Inner Path must resolve exactly once.', { workspaceId: binding.workspaceId, count: inner.length })); continue; }
-    const workspaceData = packageFileByteView(workspaceFile);
     const innerData = packageFileByteView({ data: inner[0].data });
     if (!byteEqual(workspaceData, innerData)) findings.push(finding('error', 'portable.handoff-package-v1.workspace-inner-byte-mismatch', 'Carried Workspace Artifact bytes must exactly equal the selected snapshot inner entry.', { workspaceId: binding.workspaceId }));
     const targetQualification = qualifyHandoffWorkspaceTarget({ targetPath: binding.workspaceArtifactInnerPath, targetData: workspaceData, entries: parsed.entries || [] });
     if (targetQualification.state !== 'qualified') findings.push(finding('error', 'portable.handoff-package-v1.workspace-target-unqualified', 'Exact bound Workspace Artifact does not qualify.', { workspaceId: binding.workspaceId, reasons: targetQualification.reasons || [] }));
     const descriptorPart = recipientWorkspaceDescriptor({ workspaceId: binding.workspaceId, facts: { providerKind: 'package-local-stored-zip-v1' }, representation: { workspaceArtifactInnerPath: binding.workspaceArtifactInnerPath, coverage: 'complete' }, payload: { location: binding.snapshotPath }, entries: parsed.entries || [], targetMarkdown: workspaceMarkdown, targetPackagePath: binding.workspaceArtifactPath, targetFile: { bytes: workspaceData.byteLength, sha256: sha256Hex(workspaceData) }, archiveFile: { path: archiveFile.path, bytes: archiveData.byteLength, sha256: archiveSha } });
     workspaceDescriptors.push(descriptorPart);
-    workspaceParts.push({ workspaceId: binding.workspaceId, artifact: Object.freeze({ path: workspaceFile.path, sha256: sha256Hex(workspaceData), markdown: workspaceMarkdown }), facts: { workspaceId: binding.workspaceId, sourceWorkspaceTargetInnerPath: binding.workspaceArtifactInnerPath, sourceWorkspaceTargetSha256: sha256Hex(workspaceData) }, archiveFile, archive: { archive: parsed, sha256: archiveSha }, targetQualification });
+    workspaceParts.push({ workspaceId: binding.workspaceId, bindingState: 'verified', artifact: Object.freeze({ path: workspaceFile.path, sha256: sha256Hex(workspaceData), markdown: workspaceMarkdown }), facts: { workspaceId: binding.workspaceId, sourceWorkspaceTargetInnerPath: binding.workspaceArtifactInnerPath, sourceWorkspaceTargetSha256: sha256Hex(workspaceData) }, archiveFile, archive: { archive: parsed, sha256: archiveSha }, targetQualification });
     virtualWorkspaceTargets.push(workspaceFile);
   }
 
   const payloadArtifacts = generatedArtifacts.filter((item) => item.schemaId === 'tiinex.external.payload.v1' && item.status === 'qualified');
   const bootstrapArtifacts = payloadArtifacts.filter((item) => item.facts?.role === 'portable Tooling bootstrap runtime for recipient orientation and verification');
   const cacheArtifacts = payloadArtifacts.filter((item) => item.facts?.role === 'workspace-scoped Handoff dependency cache');
+  const protectedWorkspacePayloadArtifacts = payloadArtifacts.filter((item) => item.facts?.role === 'password-sealed Workspace protected payload');
   const forbiddenWorkspacePayloads = payloadArtifacts.filter((item) => item.facts?.role === 'workspace-representation-payload');
   if (forbiddenWorkspacePayloads.length) findings.push(finding('error', 'portable.handoff-package-v1.workspace-payload-redundant', 'Complete package-local Workspace bindings must not carry redundant Workspace External Payload companions.', { count: forbiddenWorkspacePayloads.length }));
   if (generatedArtifacts.some((item) => item.schemaId === 'tiinex.workspace.representation.v1' || item.schemaId === 'tiinex.relation.v1')) findings.push(finding('error', 'portable.handoff-package-v1.workspace-representation-redundant', 'Complete package-local Workspace bindings must not carry redundant Workspace Representation/Relation companions.'));
@@ -142,14 +171,21 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
     inspectRoutePointers(routePointers, carrierProjection, workspaceParts, endpointRolePointers, participantRolePointers, index, findings);
     validateRouteClosure(routePointers, endpointRolePointers, participantRolePointers, caches, workspaceParts, findings);
     if (routePointers.length !== 1) findings.push(finding('error', 'portable.handoff-package-v1.route-count-invalid', 'Qualified Handoff-carrier package-v1 delivery requires exactly one selected Handoff Pointer.', { count: routePointers.length }));
+    const sealedWorkspaceIds = new Set(sealedWorkspaceBindings.map((item) => String(item.workspaceId || '')));
     for (const route of carrierProjection.routes || []) {
-      if (route.requiredClosure?.state !== 'qualified') findings.push(finding('error', 'portable.handoff-package-v1.required-closure-unqualified', 'Authoritative Handoff Required Context is not fully carried by exact Workspace snapshots or bounded cache.', { routeId: route.id || '' }));
+      const unresolved = (route.requiredClosure?.requirements || []).filter((requirement) => requirement.state !== 'qualified');
+      const lockedOnly = unresolved.length > 0 && unresolved.every((requirement) => {
+        const qualified = parseWorkspaceQualifiedReference(String(requirement.referenceTarget || ''));
+        return qualified && sealedWorkspaceIds.has(String(qualified.workspaceId || ''));
+      });
+      if (route.requiredClosure?.state !== 'qualified' && !lockedOnly) findings.push(finding('error', 'portable.handoff-package-v1.required-closure-unqualified', 'Authoritative Handoff Required Context is neither qualified clear material nor an explicitly sealed locked Workspace binding.', { routeId: route.id || '' }));
       for (const requirement of route.requiredClosure?.requirements || []) if (requirement.state === 'qualified' && !['workspace-archive-entry', 'materialized-required-material'].includes(String(requirement.resolution?.kind || ''))) findings.push(finding('error', 'portable.handoff-package-v1.external-closure-asset', 'Selected route closure requires a carrier kind not owned by complete Workspace snapshots or bounded cache.', { routeId: route.id || '', requirementId: requirement.requirementId || '', kind: requirement.resolution?.kind || '' }));
     }
     const allowedCacheRequirementIds = new Set();
     for (const route of carrierProjection.routes || []) for (const requirement of route.requiredClosure?.requirements || []) if (requirement.requirementId) allowedCacheRequirementIds.add(String(requirement.requirementId));
     for (const pointer of endpointRolePointers) if (pointer.facts?.endpointRequirementId) allowedCacheRequirementIds.add(String(pointer.facts.endpointRequirementId));
     for (const pointer of participantRolePointers) if (pointer.facts?.participantRequirementId) allowedCacheRequirementIds.add(String(pointer.facts.participantRequirementId));
+    for (const requirementId of qualifyParentBoundaryCacheRequirementIds(caches, workspaceByteProvider, carrierProjection, findings)) allowedCacheRequirementIds.add(requirementId);
     for (const cache of caches) for (const material of cache.facts?.materials || []) {
       const requirementId = String(material.sourceRequirementId || material.requirementId || '');
       if (!requirementId || !allowedCacheRequirementIds.has(requirementId)) findings.push(finding('error', 'portable.handoff-package-v1.cache-over-expansion', 'Workspace dependency cache contains material not required by the selected Handoff route closure.', { cache: cache.artifact.path, requirementId }));
@@ -159,7 +195,8 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
   const knownPaths = new Set([
     packageFile?.path,
     packageContract?.startPath,
-    ...(bindings || []).flatMap((binding) => [binding.workspaceArtifactPath, binding.snapshotPath]),
+    ...(bindings || []).flatMap((binding) => [binding.workspaceArtifactPath, binding.snapshotPath, binding.protectedPayloadDescriptorPath, binding.transportEnvelopePath]),
+    ...protectedWorkspacePayloadArtifacts.flatMap((artifact) => [artifact.path, parseRecipientV2ExternalPayload(artifact.markdown).location]),
     ...generatedArtifacts.filter((item) => ['recovery-orientation', 'handoff-route', 'endpoint-role', 'participant-role'].includes(String(item.facts?.role || ''))).map((item) => item.path),
     ...bootstrapArtifacts.flatMap((artifact) => [artifact.path, parseRecipientV2ExternalPayload(artifact.markdown).location]),
     ...caches.flatMap((cache) => [cache.artifact.path, cache.file.path])
@@ -175,7 +212,7 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
   return deepFreeze({
     schema: 'tiinex.portable.recipient-facing-handoff-package-v1.inspection.v1', detected: Boolean(packageFile), status, format: RECIPIENT_V2_PACKAGE_V1_FORMAT_ID,
     rootArtifact: packageFile ? Object.freeze({ path: packageFile.path, schemaId: RECIPIENT_V2_PACKAGE_V1_SCHEMA_ID, sha256: sha256Hex(packageFileBytes(packageFile)), carrierLineage: lineage }) : null,
-    readArtifact, workspaces: Object.freeze(workspaceParts.map((item) => Object.freeze({ workspaceId: item.workspaceId, coverage: 'complete', workspaceArtifactPath: item.artifact.path, workspaceArchivePath: item.archiveFile.path, sourceWorkspaceTargetInnerPath: item.facts.sourceWorkspaceTargetInnerPath, sourceWorkspaceTargetSha256: item.facts.sourceWorkspaceTargetSha256 }))),
+    readArtifact, workspaces: Object.freeze(workspaceParts.map((item) => Object.freeze({ workspaceId: item.workspaceId, coverage: 'complete', bindingState: item.bindingState || 'verified', workspaceArtifactPath: item.artifact.path, workspaceArchivePath: item.archiveFile?.path || '', sourceWorkspaceTargetInnerPath: item.facts.sourceWorkspaceTargetInnerPath, sourceWorkspaceTargetSha256: item.facts.sourceWorkspaceTargetSha256 }))), sealedWorkspaces: Object.freeze(sealedWorkspaceBindings),
     routes: projectRecipientV2Routes(routePointers, endpointRolePointers, participantRolePointers), endpointRoles: projectRecipientV2EndpointRoles(endpointRolePointers), participantRoles: projectRecipientV2ParticipantRoles(participantRolePointers),
     caches: Object.freeze(caches.map((cache) => Object.freeze({ workspaceId: String(cache.facts?.workspaceId || ''), artifactPath: cache.artifact.path, archivePath: cache.file.path, materials: cache.facts.materials || [] }))),
     bootstrapInspection, transportManifest: null, artifactFacts: Object.freeze(generatedArtifacts.map((item) => Object.freeze({ path: item.path, facts: item.facts }))), descriptor, workspaceByteProvider, carrierProjection, coldConsumerProjection,
@@ -183,3 +220,78 @@ export function inspectRecipientFacingV2PackageV1(bundle = {}, options = {}) {
     boundary: 'Read-only qualification of tiinex.handoff.package.v1: visible package identity/discovery and complete package-local Workspace bindings are reverified from exact bytes; derived inventories have no authority.'
   });
 }
+
+function qualifyParentBoundaryCacheRequirementIds(caches = [], workspaceByteProvider = {}, carrierProjection = {}, findings = []) {
+  const parentMaterials = [];
+  const targetIndex = new Map();
+  for (const cache of caches) for (const item of cache.facts?.materials || []) {
+    if (String(item.classification || '') !== 'parent-boundary') continue;
+    const entry = (cache.archive?.archive?.entries || []).find((candidate) => String(candidate.path || '') === String(item.archiveEntry || '')) || null;
+    const normalized = Object.freeze({ cache, item, entry, targetKey: `${String(item.targetWorkspaceId || '')}\0${normalizeWorkspacePath(item.targetPath || item.originalPath || '')}` });
+    parentMaterials.push(normalized);
+    const list = targetIndex.get(normalized.targetKey) || [];
+    list.push(normalized);
+    targetIndex.set(normalized.targetKey, list);
+  }
+  const allowed = new Set();
+  for (const candidate of parentMaterials) {
+    const item = candidate.item || {};
+    const requirementId = String(item.requirementId || '');
+    const routeWorkspaceId = String(item.routeWorkspaceId || '');
+    const routePath = normalizeWorkspacePath(item.routePath || '');
+    const sourceWorkspaceId = String(item.sourceWorkspaceId || '');
+    const sourcePath = normalizeWorkspacePath(item.sourcePath || '');
+    const targetWorkspaceId = String(item.targetWorkspaceId || '');
+    const targetPath = normalizeWorkspacePath(item.targetPath || item.originalPath || '');
+    const referenceTarget = String(item.referenceTarget || '').trim();
+    const routeQualified = (carrierProjection.routes || []).some((route) => String(route.state || '') === 'qualified' && String(route.workspaceId || '') === routeWorkspaceId && normalizeWorkspacePath(route.workspaceRelativePath || '') === routePath);
+    let reason = '';
+    if (!requirementId || !routeQualified || !sourceWorkspaceId || !sourcePath || !targetWorkspaceId || !targetPath || !referenceTarget || !candidate.entry) reason = 'parent-boundary-visible-facts-incomplete';
+    if (!reason && targetIndex.get(candidate.targetKey)?.length !== 1) reason = 'parent-boundary-target-ambiguous';
+    if (!reason) {
+      const alreadyCarried = resolveHandoffWorkspaceEntry(workspaceByteProvider, targetWorkspaceId, targetPath);
+      if (alreadyCarried.state === 'qualified') reason = 'parent-boundary-target-redundantly-carried';
+    }
+    let sourceData = null;
+    if (!reason) {
+      const sourceCarried = resolveHandoffWorkspaceEntry(workspaceByteProvider, sourceWorkspaceId, sourcePath);
+      if (sourceCarried.state === 'qualified') sourceData = sourceCarried.data;
+      else {
+        const sourceCandidates = targetIndex.get(`${sourceWorkspaceId}\0${sourcePath}`) || [];
+        if (sourceCandidates.length === 1 && sourceCandidates[0].entry) sourceData = sourceCandidates[0].entry.data;
+        else reason = 'parent-boundary-source-unresolved';
+      }
+    }
+    if (!reason) {
+      const markdown = decodeUtf8(packageFileBytes({ data: sourceData }));
+      let parent = null;
+      try { parent = parseArtifactMarkdown(markdown).envelope?.parent || null; } catch { parent = null; }
+      const declared = String(parent?.trace || (parent?.originEntries || []).find((entry) => String(entry?.label || '').trim() === 'relative')?.target || '').trim();
+      if (!declared || declared !== referenceTarget) reason = 'parent-boundary-reference-mismatch';
+      else {
+        const qualified = parseWorkspaceQualifiedReference(declared);
+        const expectedWorkspaceId = qualified ? String(qualified.workspaceId || '') : sourceWorkspaceId;
+        const expectedPath = qualified ? normalizeWorkspacePath(qualified.path || '') : resolveRelativeWorkspacePath(sourcePath, declared);
+        if (!expectedWorkspaceId || !expectedPath || expectedWorkspaceId !== targetWorkspaceId || expectedPath !== targetPath) reason = 'parent-boundary-target-mismatch';
+      }
+    }
+    if (reason) findings.push(finding('error', 'portable.handoff-package-v1.cache-parent-boundary-unqualified', 'Workspace dependency cache Parent-boundary material is not independently justified by the selected route declared Parent chain.', { requirementId, reason }));
+    else allowed.add(requirementId);
+  }
+  return allowed;
+}
+
+function resolveRelativeWorkspacePath(sourcePath = '', target = '') {
+  let raw;
+  try { raw = decodeURIComponent(String(target || '').split('#')[0].split('?')[0]); } catch { return ''; }
+  if (!raw || raw.startsWith('/') || raw.startsWith('\\') || /^[a-z][a-z0-9+.-]*:/i.test(raw) || raw.startsWith('//')) return '';
+  const parts = normalizeWorkspacePath(sourcePath).split('/').slice(0, -1);
+  for (const part of raw.replace(/\\/g, '/').split('/')) {
+    if (!part || part === '.') continue;
+    if (part === '..') { if (!parts.length) return ''; parts.pop(); }
+    else parts.push(part);
+  }
+  return normalizeWorkspacePath(parts.join('/'));
+}
+
+function normalizeWorkspacePath(value = '') { return String(value || '').trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '').split('/').filter((part) => part && part !== '.').join('/'); }

package/src/tooling/portable/handoff/recipientV2.packageV1.js

@@ -3,8 +3,9 @@ import { RECIPIENT_V2_PACKAGE_V1_SCHEMA_ID } from './recipientV2.packageV1.const
 import { currentSchemaId, decodeUtf8 } from './recipientV2.packageV1.shared.js';
 
 export { RECIPIENT_V2_PACKAGE_V1_FORMAT_ID, RECIPIENT_V2_PACKAGE_V1_ROOT_PATH, RECIPIENT_V2_PACKAGE_V1_SCHEMA_ID, RECIPIENT_V2_PACKAGE_V1_SCHEMA_TARGET } from './recipientV2.packageV1.constants.js';
-export { buildRecipientFacingV2PackageV1 } from './recipientV2.packageV1.build.js';
+export { buildRecipientFacingV2PackageV1, buildRecipientFacingV2PackageV1Secure } from './recipientV2.packageV1.build.js';
 export { inspectRecipientFacingV2PackageV1 } from './recipientV2.packageV1.inspect.js';
+export { inspectRecipientV2PackageV1SealedBinding, openRecipientV2PackageV1SealedWorkspace, replaceRecipientV2PackageV1SealedWorkspaceRecipients } from './recipientV2.packageV1.secure.js';
 export { parseHandoffPackageV1, renderHandoffPackageV1 } from './recipientV2.packageV1.contract.js';
 
 export function isRecipientV2PackageV1Surface(files = []) {

package/src/tooling/portable/handoff/recipientV2.packageV1.secure.js

@@ -0,0 +1,87 @@
+import { packageFileByteView, packageFileBytes, sha256Hex } from '../../../export/package.bytes.js';
+import { openPasswordWorkspacePayload, replacePasswordWorkspaceRecipients } from '../../../transport/secureTransportV1.js';
+import { buildHandoffWorkspaceByteProvider, inspectStoredWorkspaceArchive } from './workspaceByteProvider.js';
+import { qualifyHandoffWorkspaceTarget } from './workspaceTargetConformance.js';
+import { indexRecipientFiles, recipientWorkspaceDescriptor } from './recipientV2.inspect.helpers.js';
+import { parseRecipientV2ExternalPayload } from './recipientV2.artifacts.js';
+import { inspectRecipientFacingV2PackageV1 } from './recipientV2.packageV1.inspect.js';
+import { parseHandoffPackageV1 } from './recipientV2.packageV1.contract.js';
+import { parseTransportEnvelopeV1 } from './transportEnvelopeV1.js';
+import { currentSchemaId, decodeUtf8, oneFile } from './recipientV2.packageV1.shared.js';
+
+export async function openRecipientV2PackageV1SealedWorkspace(bundle = {}, input = {}) {
+  const inspection = inspectRecipientFacingV2PackageV1(bundle);
+  if (inspection.status !== 'valid') return frozen({ state: 'failed', reason: 'package-unqualified', findings: inspection.findings || [] });
+  const workspaceId = String(input.workspaceId || '').trim();
+  const sealed = (inspection.sealedWorkspaces || []).filter((item) => String(item.workspaceId || '') === workspaceId);
+  if (sealed.length !== 1) return frozen({ state: 'locked', reason: sealed.length > 1 ? 'sealed-workspace-ambiguous' : 'sealed-workspace-unresolved' });
+  const target = sealed[0];
+  const files = Array.isArray(bundle.files) ? bundle.files : [];
+  const index = indexRecipientFiles(files, []);
+  const workspaceFile = oneFile(index, target.workspaceArtifactPath);
+  const payloadFile = oneFile(index, target.protectedPayloadPath);
+  const envelopeFile = oneFile(index, target.transportEnvelopePath);
+  if (!workspaceFile || !payloadFile || !envelopeFile) return frozen({ state: 'failed', reason: 'sealed-carrier-material-unresolved' });
+  const envelope = parseTransportEnvelopeV1(decodeUtf8(packageFileBytes(envelopeFile)));
+  const opened = await openPasswordWorkspacePayload({ protectedPayload: packageFileByteView(payloadFile), envelope, password: input.password, slotId: input.slotId, crypto: input.crypto });
+  if (opened.state !== 'opened') return opened;
+
+  const parsed = inspectStoredWorkspaceArchive(opened.plaintext, { ownedBytes: true });
+  if (parsed.state !== 'qualified') return frozen({ state: 'failed', reason: 'recovered-archive-unqualified', findings: parsed.findings || [] });
+  const workspaceBytes = packageFileByteView(workspaceFile);
+  const matches = (parsed.entries || []).filter((entry) => byteEqual(entry.data, workspaceBytes));
+  if (matches.length !== 1) return frozen({ state: 'failed', reason: matches.length > 1 ? 'workspace-artifact-correlation-ambiguous' : 'workspace-artifact-correlation-unresolved', matchCount: matches.length });
+  const innerPath = String(matches[0].path || '');
+  const targetQualification = qualifyHandoffWorkspaceTarget({ targetPath: innerPath, targetData: workspaceBytes, entries: parsed.entries || [] });
+  if (targetQualification.state !== 'qualified') return frozen({ state: 'failed', reason: 'recovered-workspace-unqualified', findings: targetQualification.reasons || [] });
+
+  const transientArchivePath = `tiinex-transient-opened-${safeToken(workspaceId)}.workspace.zip`;
+  const transientArchiveFile = frozen({ path: transientArchivePath, kind: 'transient-opened-workspace-archive', mediaType: 'application/zip', data: opened.plaintext, bytes: opened.plaintext.byteLength, sha256: sha256Hex(opened.plaintext) });
+  const descriptorPart = recipientWorkspaceDescriptor({
+    workspaceId,
+    facts: { providerKind: 'package-local-stored-zip-v1' },
+    representation: { workspaceArtifactInnerPath: innerPath, coverage: 'complete' },
+    payload: { location: transientArchivePath },
+    entries: parsed.entries || [],
+    targetMarkdown: decodeUtf8(workspaceBytes),
+    targetPackagePath: target.workspaceArtifactPath,
+    targetFile: { bytes: workspaceBytes.byteLength, sha256: sha256Hex(workspaceBytes) },
+    archiveFile: { path: transientArchivePath, bytes: opened.plaintext.byteLength, sha256: sha256Hex(opened.plaintext) }
+  });
+  const descriptor = frozen({ schema: 'tiinex.transport.handoff-material-closure-descriptor.v2', version: 2, workspaceMaterializations: [descriptorPart.workspace], workspaceArchiveBindings: [descriptorPart.binding], materialized: [], requirements: { required: [], reference: [], endpointRoles: [], participantRoles: [], dependencies: [] } });
+  const provider = buildHandoffWorkspaceByteProvider({ ...bundle, files: frozen([...files, transientArchiveFile]) }, descriptor);
+  if (provider.status !== 'ready') return frozen({ state: 'failed', reason: 'recovered-provider-unqualified', findings: provider.findings || [] });
+  return frozen({
+    state: 'opened-qualified', workspaceId, slotId: opened.slotId, workspaceArtifactPath: target.workspaceArtifactPath,
+    workspaceArtifactInnerPath: innerPath, workspaceArtifactSha256: sha256Hex(workspaceBytes), archiveSha256: sha256Hex(opened.plaintext),
+    provider, descriptor, targetQualification,
+    boundary: 'Authorized plaintext exists only in this in-memory opened provider/descriptor result unless the caller explicitly writes a destination. Decryption alone did not activate the provider; safe archive, unique Workspace-byte correlation, ordinary Workspace conformance, and integrity qualification all completed first.'
+  });
+}
+
+export async function replaceRecipientV2PackageV1SealedWorkspaceRecipients(bundle = {}, input = {}) {
+  const inspection = inspectRecipientFacingV2PackageV1(bundle);
+  if (inspection.status !== 'valid') return frozen({ state: 'failed', reason: 'package-unqualified', findings: inspection.findings || [] });
+  const workspaceId = String(input.workspaceId || '').trim();
+  const target = (inspection.sealedWorkspaces || []).find((item) => String(item.workspaceId || '') === workspaceId) || null;
+  if (!target) return frozen({ state: 'locked', reason: 'sealed-workspace-unresolved' });
+  const index = indexRecipientFiles(bundle.files || [], []);
+  const payloadFile = oneFile(index, target.protectedPayloadPath);
+  const envelopeFile = oneFile(index, target.transportEnvelopePath);
+  if (!payloadFile || !envelopeFile) return frozen({ state: 'failed', reason: 'sealed-carrier-material-unresolved' });
+  const envelope = parseTransportEnvelopeV1(decodeUtf8(packageFileBytes(envelopeFile)));
+  const changed = await replacePasswordWorkspaceRecipients({ protectedPayload: packageFileByteView(payloadFile), envelope, authorizationPassword: input.authorizationPassword ?? input.password, recipients: input.recipients || [], crypto: input.crypto });
+  if (changed.state !== 'rewrapped') return changed;
+  return frozen({ state: 'rewrapped', protectedPayload: changed.protectedPayload, envelope: changed.envelope, workspaceId, protectedPayloadSha256: sha256Hex(changed.protectedPayload), boundary: 'Returns replacement non-secret envelope metadata and the exact unchanged protected payload bytes; it does not rewrite the package automatically because parent/self-integrity resealing remains a separate carrier manufacture action.' });
+}
+
+export function inspectRecipientV2PackageV1SealedBinding(bundle = {}, workspaceId = '') {
+  const inspection = inspectRecipientFacingV2PackageV1(bundle);
+  const matches = (inspection.sealedWorkspaces || []).filter((item) => String(item.workspaceId || '') === String(workspaceId || ''));
+  return frozen({ state: inspection.status !== 'valid' ? 'failed' : matches.length === 1 ? 'locked-qualified' : matches.length > 1 ? 'ambiguous' : 'unresolved', binding: matches.length === 1 ? matches[0] : null, providerActive: false, packageStatus: inspection.status, findings: inspection.findings || [] });
+}
+
+function byteEqual(a, b) { const left=packageFileByteView({data:a}), right=packageFileByteView({data:b}); if(left.byteLength!==right.byteLength)return false; let diff=0; for(let i=0;i<left.byteLength;i+=1) diff|=left[i]^right[i]; return diff===0; }
+function safeToken(value=''){return String(value||'').trim().toLowerCase().replace(/[^a-z0-9]+/g,'-').replace(/^-+|-+$/g,'').slice(0,80)||'workspace';}
+function frozen(value){return deepFreeze(value);}
+function deepFreeze(value){if(!value||typeof value!=='object'||Object.isFrozen(value))return value;if(ArrayBuffer.isView(value)||value instanceof ArrayBuffer)return value;for(const child of Object.values(value))deepFreeze(child);return Object.freeze(value);}

package/src/tooling/portable/handoff/recipientV2.packageV1.shared.js

@@ -12,7 +12,15 @@ export function oneFile(index, path) { const list = index.get(String(path || '')
 export function validCarrierDimension(value = '') { return /^\d{3}(?:-(?:[1-9]\d*))*$/.test(String(value || '')); }
 export function numericDimension(path = '') { return String(path || '').match(/^(\d{3}(?:-[1-9]\d*)*)-/)?.[1] || ''; }
 export function currentSchemaId(markdown = '') { return String(markdown || '').match(/^\s*-\s+Current Schema:\s*(?:\[)?(tiinex\.[A-Za-z0-9._-]+)(?:\])?/mi)?.[1] || ''; }
-export function sectionText(markdown = '', title = '') { const source = String(markdown || ''); const escaped = title.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); const match = source.match(new RegExp(`^##\\s+${escaped}\\s*$([\\s\\S]*?)(?=^##\\s+|^#\\s+Continuity Integrity\\s*$|\\Z)`, 'mi')); return match ? match[1] : ''; }
+export function sectionText(markdown = '', title = '') {
+  const source = String(markdown || '');
+  const escaped = title.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const heading = new RegExp(`^##\\s+${escaped}\\s*$`, 'mi').exec(source);
+  if (!heading) return '';
+  const rest = source.slice(heading.index + heading[0].length);
+  const next = /^(?:##\s+|#\s+Continuity Integrity\s*$)/mi.exec(rest);
+  return next ? rest.slice(0, next.index) : rest;
+}
 export function field(section = '', label = '') { const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); return String(section || '').match(new RegExp(`^\\s*-\\s+${escaped}:\\s*(.*?)\\s*$`, 'mi'))?.[1]?.trim() || ''; }
 export function markdownTarget(value = '') { const match = String(value || '').match(/\[[^\]]*\]\(([^)]+)\)/); return match ? match[1].trim() : ''; }
 export function unquote(value = '') { const text = String(value || '').trim(); return text.startsWith('`') && text.endsWith('`') ? text.slice(1, -1) : text; }

package/src/tooling/portable/handoff/recipientV2.topology.js

@@ -157,9 +157,9 @@ function buildRecipientFacingV2TopologyLegacy(input = {}) {
       archivePath,
       archiveBytes: cacheFile.bytes,
       archiveSha256: cacheFile.sha256,
-      materials: materials.map((item, index) => ({ requirementId: item.requirementId, classification: item.classification, referenceTarget: item.referenceTarget, routeWorkspaceId: item.routeWorkspaceId, routePath: item.routePath, sourceRequirementId: item.sourceRequirementId, originalPath: item.originalPath, archiveEntry: cacheEntries[index].path, bytes: item.bytes, sha256: item.sha256 }))
+      materials: materials.map((item, index) => ({ requirementId: item.requirementId, classification: item.classification, referenceTarget: item.referenceTarget, routeWorkspaceId: item.routeWorkspaceId, routePath: item.routePath, sourceRequirementId: item.sourceRequirementId, sourceWorkspaceId: item.sourceWorkspaceId, sourcePath: item.sourcePath, targetWorkspaceId: item.targetWorkspaceId, targetPath: item.targetPath, originalPath: item.originalPath, archiveEntry: cacheEntries[index].path, bytes: item.bytes, sha256: item.sha256 }))
     };
-    const cacheArtifact = finalizeFile({ path: artifactPath, kind: 'tiinex-external-payload-artifact', logicalKind: 'recipient-v2-workspace-dependency-cache-reference', mediaType: 'text/markdown', transportFacts: recipientV2TransportFacts('workspace-scoped Handoff dependency cache', cacheFacts), content: renderRecipientV2ExternalPayload({ createdAt, parent: workspace.parent, title: `Workspace Dependency Cache — ${workspace.workspaceId}`, summary: 'Exact recipient-relative dependency bytes not satisfied by any qualified Workspace archive.', label: `${workspace.workspaceId} Handoff dependency cache`, kind: 'zip export', role: 'workspace-scoped Handoff dependency cache', location: archivePath, bytes: cacheFile.bytes, sha256: cacheFile.sha256, facts: cacheFacts }) });
+    const cacheArtifact = finalizeFile({ path: artifactPath, kind: 'tiinex-external-payload-artifact', logicalKind: 'recipient-v2-workspace-dependency-cache-reference', mediaType: 'text/markdown', transportFacts: recipientV2TransportFacts('workspace-scoped Handoff dependency cache', cacheFacts), content: renderRecipientV2ExternalPayload({ createdAt, parent: workspace.parent, title: `Workspace Dependency Cache — ${workspace.workspaceId}`, summary: 'Exact recipient-relative dependency bytes not satisfied by any qualified Workspace archive.', label: `${workspace.workspaceId} Handoff dependency cache`, kind: 'zip export', role: 'workspace-scoped Handoff dependency cache', location: archivePath, bytes: cacheFile.bytes, sha256: cacheFile.sha256, materials: cacheFacts.materials }) });
     files.push(cacheArtifact, cacheFile);
     const projection = Object.freeze({ workspaceId: workspace.workspaceId, artifactPath, archivePath, materials: cacheFacts.materials });
     topology.caches.push(projection);

package/src/tooling/portable/handoff/recipientV2.topology.materials.js

@@ -47,6 +47,13 @@ export function roleMaterialTarget(requirement = {}, descriptor = {}, workspaceB
 
 export function detachedMaterial(descriptor, byPath, findings) {
   const out = [];
+  const requirementById = new Map([
+    ...(descriptor.requirements?.required || []),
+    ...(descriptor.requirements?.reference || []),
+    ...(descriptor.requirements?.endpointRoles || []),
+    ...(descriptor.requirements?.participantRoles || []),
+    ...(descriptor.requirements?.dependencies || [])
+  ].map((item) => [String(item.requirementId || ''), item]));
   for (const material of descriptor.materialized || []) {
     if (String(material.carrierKind || '') === 'workspace-archive-entry') continue;
     const file = oneFile(byPath, material.packagePath, findings, 'detached-material');
@@ -54,7 +61,8 @@ export function detachedMaterial(descriptor, byPath, findings) {
     const data = packageFileBytes(file);
     const sha256 = sha256Hex(data);
     if (Number(material.bytes || 0) !== data.byteLength || String(material.sha256 || '') !== sha256) findings.push(finding('error', 'portable.handoff-v2-surface.cache.material-identity-mismatch', 'Detached material bytes diverge from qualified closure identity.', { requirementId: material.requirementId || '' }));
-    out.push(Object.freeze({ requirementId: String(material.requirementId || ''), classification: String(material.classification || ''), referenceTarget: String(material.referenceTarget || ''), routeWorkspaceId: String(material.routeWorkspaceId || ''), routePath: String(material.routePath || ''), sourceRequirementId: String(material.sourceRequirementId || ''), originalPath: String(material.originalPath || ''), bytes: data.byteLength, sha256, data }));
+    const requirement = requirementById.get(String(material.requirementId || '')) || {};
+    out.push(Object.freeze({ requirementId: String(material.requirementId || ''), classification: String(material.classification || ''), referenceTarget: String(material.referenceTarget || ''), routeWorkspaceId: String(material.routeWorkspaceId || ''), routePath: String(material.routePath || ''), sourceRequirementId: String(material.sourceRequirementId || ''), sourceWorkspaceId: String(requirement.sourceWorkspaceId || ''), sourcePath: String(requirement.sourcePath || ''), targetWorkspaceId: String(requirement.targetWorkspaceId || material.provenance?.workspaceId || ''), targetPath: String(requirement.targetPath || material.originalPath || ''), originalPath: String(material.originalPath || ''), bytes: data.byteLength, sha256, data }));
   }
   return out.sort((a, b) => a.requirementId.localeCompare(b.requirementId));
 }

package/src/tooling/portable/handoff/transportEnvelopeV1.js

@@ -0,0 +1,76 @@
+import { canonicalC14nV2SelfState, sealC14nV2Self } from '../../../integrity/integrity.c14nV2.js';
+import { C14N_V2_VALIDATOR_TARGET } from '../../../integrity/integrity.methodReference.js';
+import { RECIPIENT_V2_ROOT_SCHEMA_TARGET } from './recipientV2.artifacts.js';
+import { field, markdownTarget, sectionText, unquote } from './recipientV2.packageV1.shared.js';
+import { qualifySecureTransportV1Envelope } from '../../../transport/secureTransportV1.js';
+
+export const TRANSPORT_ENVELOPE_V1_SCHEMA_ID = 'tiinex.transport.envelope.v1';
+export const TRANSPORT_ENVELOPE_V1_ROLE = 'password-sealed-workspace-transport-envelope';
+
+export function renderTransportEnvelopeV1(input = {}) {
+  const envelope = input.envelope || {};
+  const q = qualifySecureTransportV1Envelope(envelope);
+  if (q.state !== 'qualified') throw new Error(`secure-transport.envelope-unqualified:${q.state}`);
+  const workspacePath = String(input.workspaceArtifactPath || '').trim();
+  const payloadPath = String(input.protectedPayloadDescriptorPath || '').trim();
+  if (!workspacePath || !payloadPath) throw new Error('secure-transport.envelope-binding-path-missing');
+  const profile = envelope.profile || {};
+  const slots = (envelope.passwordRecipientSlots || []).map((slot) => `- ${slot.slotId}\n  - Slot Id: ${slot.slotId}\n  - Slot Kind: ${slot.slotKind}\n  - KDF Algorithm: ${slot.kdfAlgorithm}\n  - KDF Salt Encoding: ${slot.kdfSaltEncoding}\n  - KDF Salt: ${slot.kdfSalt}\n  - KDF Parameters: \`${stableJson(slot.kdfParameters)}\`\n  - Key Wrap Algorithm: ${slot.keyWrapAlgorithm}\n  - Key Wrap Parameters: \`${stableJson(slot.keyWrapParameters)}\`\n  - Wrapped Content Key Encoding: ${slot.wrappedContentKeyEncoding}\n  - Wrapped Content Key: ${slot.wrappedContentKey}\n  - Slot Verification Rule: ${slot.slotVerificationRule}${slot.recipientHint ? `\n  - Recipient Hint: ${slot.recipientHint}` : ''}`).join('\n');
+  const createdAt = normalizeCreatedAt(input.createdAt || '');
+  const unsigned = `# Continuity Context\n\n- Envelope Schema: [tiinex.root.v1](${RECIPIENT_V2_ROOT_SCHEMA_TARGET})\n${renderParentEnvelope(input.parent)}- Current\n  - Current Schema: ${TRANSPORT_ENVELOPE_V1_SCHEMA_ID}\n  - Created At: ${createdAt}\n  - Summary: Password-sealed Workspace transport envelope with explicit supported profile metadata and independently usable password recipient slots.\n\n---\n\n# Transport Envelope\n\n## Envelope Binding\n\n- Workspace Artifact: [Workspace](${workspacePath})\n- Protected Payload: [Protected Payload](${payloadPath})\n- Envelope Purpose: ${envelope.envelopePurpose}\n- Envelope Version: ${envelope.envelopeVersion}\n- Plaintext Representation Kind: ${envelope.plaintextRepresentationKind}\n- Protected Name Tree: ${envelope.protectedNameTree}\n- Workspace Binding Method: ${envelope.workspaceBindingMethod}\n- Workspace Binding Value: ${envelope.workspaceBindingValue}\n- Content Key Scope: ${envelope.contentKeyScope}\n\n## Payload Protection Profile\n\n- Profile Id: ${profile.profileId}\n- Profile Version: ${profile.profileVersion}\n- Content Encryption Algorithm: ${profile.contentEncryptionAlgorithm}\n- Content Encryption Parameters: \`${stableJson(profile.contentEncryptionParameters)}\`\n- Nonce Or IV Encoding: ${profile.nonceOrIvEncoding}\n- Nonce Or IV: ${profile.nonceOrIv}\n- Payload Authentication Rule: ${profile.payloadAuthenticationRule}\n- Security Metadata Authentication Rule: ${profile.securityMetadataAuthenticationRule}\n- Recipient Change Payload Rule: ${profile.recipientChangePayloadRule}\n\n## Password Recipient Slots\n\n${slots}\n\n## Open And Recovery Contract\n\n- Open Rule: ${envelope.openRule}\n- Wrong Password Result: ${envelope.wrongPasswordResult}\n- Unsupported Profile Result: ${envelope.unsupportedProfileResult}\n- Malformed Metadata Result: ${envelope.malformedMetadataResult}\n- Authentication Failure Result: ${envelope.authenticationFailureResult}\n- Missing Authorized Slot Result: ${envelope.missingAuthorizedSlotResult}\n- Secret Persistence: ${envelope.secretPersistence}\n- Plaintext Persistence: ${envelope.plaintextPersistence}\n- Recovery Rule: ${envelope.recoveryRule}\n- Failure Policy: ${envelope.failurePolicy}\n- Multi-Workspace Isolation: ${envelope.multiWorkspaceIsolation}\n\n## Qualification Boundary\n\n- Payload Byte Integrity Owner: ${envelope.payloadByteIntegrityOwner}\n- Envelope Root Integrity Meaning: ${envelope.envelopeRootIntegrityMeaning}\n- Cryptographic Authentication Meaning: ${envelope.cryptographicAuthenticationMeaning}\n- Provider State While Locked: ${envelope.providerStateWhileLocked}\n- Post-Open Qualification: ${envelope.postOpenQualification}\n- Semantic Authority: ${envelope.semanticAuthority}\n\n## Disclosure Boundary\n\n- Outer Visible Material: ${envelope.outerVisibleMaterial}\n- Must Remain Sealed: ${envelope.mustRemainSealed}\n- Forbidden Durable Secrets: ${envelope.forbiddenDurableSecrets}\n- Privacy Policy Owner: ${envelope.privacyPolicyOwner}\n\n## Interpretation Limits\n\n- Encryption and successful open do not create Workspace identity, Handoff authority, provenance, semantic truth, acceptance, or provider qualification.\n- Passwords, derived keys, wrapping keys, plaintext content keys, and protected Workspace path inventory are not durable envelope material.\n\n---\n\n# Continuity Integrity\n\n${renderParentIntegrity(input.parent)}- [sha256-base64url-c14n-v2](${C14N_V2_VALIDATOR_TARGET})\n  - Towards: self\n  - Value: pending\n`;
+  const sealed = sealC14nV2Self(unsigned);
+  if (sealed.state !== 'sealed') throw new Error(`secure-transport.envelope-self-seal-failed:${sealed.reason || sealed.state}`);
+  return `${sealed.markdown}\n`;
+}
+
+export function parseTransportEnvelopeV1(markdown = '') {
+  const body = String(markdown || '');
+  const binding = sectionText(body, 'Envelope Binding');
+  const profile = sectionText(body, 'Payload Protection Profile');
+  const open = sectionText(body, 'Open And Recovery Contract');
+  const qualification = sectionText(body, 'Qualification Boundary');
+  const disclosure = sectionText(body, 'Disclosure Boundary');
+  return deepFreeze({
+    workspaceArtifactPath: markdownTarget(field(binding, 'Workspace Artifact')),
+    protectedPayloadDescriptorPath: markdownTarget(field(binding, 'Protected Payload')),
+    envelopePurpose: field(binding, 'Envelope Purpose'), envelopeVersion: numberField(binding, 'Envelope Version'), plaintextRepresentationKind: field(binding, 'Plaintext Representation Kind'), protectedNameTree: field(binding, 'Protected Name Tree'), workspaceBindingMethod: field(binding, 'Workspace Binding Method'), workspaceBindingValue: field(binding, 'Workspace Binding Value'), contentKeyScope: field(binding, 'Content Key Scope'),
+    profile: {
+      profileId: field(profile, 'Profile Id'), profileVersion: numberField(profile, 'Profile Version'), contentEncryptionAlgorithm: field(profile, 'Content Encryption Algorithm'), contentEncryptionParameters: jsonObjectField(profile, 'Content Encryption Parameters'), nonceOrIvEncoding: field(profile, 'Nonce Or IV Encoding'), nonceOrIv: field(profile, 'Nonce Or IV'), payloadAuthenticationRule: field(profile, 'Payload Authentication Rule'), securityMetadataAuthenticationRule: field(profile, 'Security Metadata Authentication Rule'), recipientChangePayloadRule: field(profile, 'Recipient Change Payload Rule')
+    },
+    passwordRecipientSlots: parseSlots(sectionText(body, 'Password Recipient Slots')),
+    openRule: field(open, 'Open Rule'), wrongPasswordResult: field(open, 'Wrong Password Result'), unsupportedProfileResult: field(open, 'Unsupported Profile Result'), malformedMetadataResult: field(open, 'Malformed Metadata Result'), authenticationFailureResult: field(open, 'Authentication Failure Result'), missingAuthorizedSlotResult: field(open, 'Missing Authorized Slot Result'), secretPersistence: field(open, 'Secret Persistence'), plaintextPersistence: field(open, 'Plaintext Persistence'), recoveryRule: field(open, 'Recovery Rule'), failurePolicy: field(open, 'Failure Policy'), multiWorkspaceIsolation: field(open, 'Multi-Workspace Isolation'),
+    payloadByteIntegrityOwner: field(qualification, 'Payload Byte Integrity Owner'), envelopeRootIntegrityMeaning: field(qualification, 'Envelope Root Integrity Meaning'), cryptographicAuthenticationMeaning: field(qualification, 'Cryptographic Authentication Meaning'), providerStateWhileLocked: field(qualification, 'Provider State While Locked'), postOpenQualification: field(qualification, 'Post-Open Qualification'), semanticAuthority: field(qualification, 'Semantic Authority'),
+    outerVisibleMaterial: field(disclosure, 'Outer Visible Material'), mustRemainSealed: field(disclosure, 'Must Remain Sealed'), forbiddenDurableSecrets: field(disclosure, 'Forbidden Durable Secrets'), privacyPolicyOwner: field(disclosure, 'Privacy Policy Owner')
+  });
+}
+
+export function qualifyTransportEnvelopeV1Artifact(markdown = '') {
+  const parsed = parseTransportEnvelopeV1(markdown);
+  const findings = [];
+  const self = canonicalC14nV2SelfState(String(markdown || ''));
+  if (self.state !== 'verified') findings.push({ severity: 'error', code: 'secure-transport.envelope.integrity-self-invalid', message: 'Transport Envelope self-integrity does not verify.', reason: self.reason || self.state });
+  const crypto = qualifySecureTransportV1Envelope(parsed);
+  for (const item of crypto.findings || []) findings.push({ severity: item.kind === 'unsupported' ? 'error' : 'error', code: item.code, message: item.message });
+  if (!parsed.workspaceArtifactPath || !parsed.protectedPayloadDescriptorPath) findings.push({ severity: 'error', code: 'secure-transport.envelope.binding-links-invalid', message: 'Transport Envelope Workspace Artifact and Protected Payload links are required.' });
+  return deepFreeze({ status: findings.length ? (crypto.state === 'unsupported' ? 'unsupported' : 'invalid') : 'qualified', parsed, findings });
+}
+
+function parseSlots(text = '') {
+  const out = [];
+  const re = /^-\s+([^\n]+)\n((?:\s{2}-\s+[^\n]+\n?)*)/gm;
+  for (const match of String(text || '').matchAll(re)) {
+    const section = String(match[2] || '');
+    out.push(deepFreeze({
+      slotId: field(section, 'Slot Id'), slotKind: field(section, 'Slot Kind'), kdfAlgorithm: field(section, 'KDF Algorithm'), kdfSaltEncoding: field(section, 'KDF Salt Encoding'), kdfSalt: field(section, 'KDF Salt'), kdfParameters: jsonObjectField(section, 'KDF Parameters'), keyWrapAlgorithm: field(section, 'Key Wrap Algorithm'), keyWrapParameters: jsonObjectField(section, 'Key Wrap Parameters'), wrappedContentKeyEncoding: field(section, 'Wrapped Content Key Encoding'), wrappedContentKey: field(section, 'Wrapped Content Key'), slotVerificationRule: field(section, 'Slot Verification Rule'), ...(field(section, 'Recipient Hint') ? { recipientHint: field(section, 'Recipient Hint') } : {})
+    }));
+  }
+  return Object.freeze(out);
+}
+function jsonObjectField(section, name) { const raw = unquote(field(section, name)); try { const value = JSON.parse(raw); return value && typeof value === 'object' && !Array.isArray(value) ? value : null; } catch { return null; } }
+function numberField(section, name) { const raw = field(section, name); return /^\d+$/.test(raw) ? Number(raw) : null; }
+function renderParentEnvelope(parent = null) { if (!parent) return ''; const path=String(parent.path||'').trim(), label=String(parent.label||path||'Parent'), schemaId=String(parent.schemaId||'').trim(), schemaTarget=String(parent.schemaTarget||'').trim(), createdAt=normalizeCreatedAt(parent.createdAt||''); if(!path||!schemaId||!schemaTarget||!String(parent.selfDigest||'').trim()) throw new Error('secure-transport.parent-authority-incomplete'); return `- Parent\n  - Parent Schema: [${schemaId}](${schemaTarget})\n  - Created At: ${createdAt}\n  - Trace: [${label}](${path})\n  - Origin:\n    - [relative](${path})\n`; }
+function renderParentIntegrity(parent = null) { if(!parent) return ''; const path=String(parent.path||'').trim(), label=String(parent.label||path||'Parent'), digest=String(parent.selfDigest||'').trim(); if(!path||!digest) throw new Error('secure-transport.parent-integrity-incomplete'); return `- [sha256-base64url-c14n-v2](${C14N_V2_VALIDATOR_TARGET})\n  - Towards: [${label}](${path})\n  - Value: ${digest}\n\n`; }
+function normalizeCreatedAt(value=''){const text=String(value||'').trim(); return text ? text.replace('T',' ').replace(/\.\d{3}Z$/,'').replace(/Z$/,'').slice(0,19) : '1970-01-01 00:00:00';}
+function stableJson(value) { return JSON.stringify(sortJson(value)); }
+function sortJson(value) { if (Array.isArray(value)) return value.map(sortJson); if (!value || typeof value !== 'object') return value; return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sortJson(value[key])])); }
+function deepFreeze(value){if(!value||typeof value!=='object'||Object.isFrozen(value))return value;if(ArrayBuffer.isView(value)||value instanceof ArrayBuffer)return value;for(const child of Object.values(value))deepFreeze(child);return Object.freeze(value);}

package/src/tooling/portable/index.js

@@ -50,3 +50,7 @@ export * from './handoff/manufacture.js';
 export * from './handoff/carrierProfile.js';
 export * from './handoff/toolingBootstrap.js';
 export * from './handoff/coldStartQualification.js';
+export * from './handoff/transportEnvelopeV1.js';
+export * from './handoff/recipientV2.packageV1.js';
+
+export * from './comparison/sourceFrontierComparison.js';

package/src/tooling/portable/operation.catalog.js

@@ -38,10 +38,18 @@ import { describePortableColdStartIngress, groundPortableColdConsumer, projectPo
 import { projectPortableOperatingOverview } from './overview/operatingOverview.js';
 import { projectPortableGroundingReadiness } from './grounding/grounding.readiness.js';
 import { createPortablePackageOperationEntries } from './operation.catalog.package.js';
+import { compareOrReconcilePortableSourceFrontiers } from './comparison/sourceFrontierComparison.js';
 
 export const PORTABLE_OPERATION_CATALOG_SCHEMA_ID = 'tiinex.portable.operation.catalog.v1';
 
 export const portableOperationCatalog = Object.freeze({
+  'compare-source-frontiers': operation({
+    name: 'compare-source-frontiers',
+    description: 'Compare normalized exact Workspace source frontiers two-way or reconcile base/incoming/current three-way without merge, semantic inference, remote acquisition, or source mutation.',
+    safety: 'read-only',
+    inputSchema: 'tiinex.portable.source-frontier-comparison.request.v1',
+    handler: (input = {}) => wrapPortableResult('compare-source-frontiers', compareOrReconcilePortableSourceFrontiers(input))
+  }),
   'prepare-task': operation({
     name: 'prepare-task',
     description: 'Orchestrate host discovery, schema/provider resolution, schema guides, artifact planning, draft validation, lineage search, or asset analysis into one explicit next-action response.',

package/src/tooling/portable/operation.catalog.package.js

@@ -11,7 +11,6 @@ import { projectPortableEditorAssistance } from './editor/editor.assistance.js';
 import { projectQualifiedHandoffLeaves } from './handoff/handoffLeafProjection.js';
 import { projectPortableAuthoringParent } from './editor/authoring.parent.js';
 import { projectQualifiedWorkspacePackageSources } from './handoff/workspacePackageSources.js';
-import { compareSourceFrontiers } from './handoff/sourceFrontierComparison.js';
 import { projectPortableHandoffAuthoringPlan } from './handoff/handoffAuthoringPlan.js';
 import { projectQualifiedHandoffEndpoints } from './handoff/handoffEndpointProjection.js';
 import { projectPortableOperatorContext } from './handoff/operatorContextProjection.js';
@@ -96,13 +95,6 @@ export function createPortablePackageOperationEntries({ operation, wrapPortableR
     inputSchema: 'tiinex.portable.input.v1',
     handler: (input = {}) => wrapPortableResult('project-workspace-package-sources', projectQualifiedWorkspacePackageSources(input))
   }),
-  'compare-source-frontiers': operation({
-    name: 'compare-source-frontiers',
-    description: 'Compare one local Workspace root against one carried workspace snapshot bound by a recipient-facing Handoff package.',
-    safety: 'read-only',
-    inputSchema: 'tiinex.portable.input.v1',
-    handler: async (input = {}) => wrapPortableResult('compare-source-frontiers', await compareSourceFrontiers(input))
-  }),
   'project-handoff-authoring-plan': operation({
     name: 'project-handoff-authoring-plan',
     description: 'Project the shared root or continuation path allocation for native Handoff authoring from exact local material without creating an artifact.',