@timurproko/a1 0.1.0 → 0.1.1-dev.1

package/dist/src/product-identity.js

@@ -0,0 +1,149 @@
+import rawIdentity from "./product-identity.json" with { type: "json" };
+const ENVIRONMENT_KEYS = [
+    "certificationTarball",
+    "configDir",
+    "dataDir",
+    "databasePath",
+    "developmentInstanceId",
+    "developmentRoot",
+    "endpoint",
+    "fixture",
+    "fixtureInput",
+    "fixtureToken",
+    "inputAcknowledgement",
+    "internalPackaging",
+    "launchArgumentsJson",
+    "launchProfile",
+    "nativePi",
+    "paneId",
+    "piParityIntentionalMutation",
+    "piPortRoot",
+    "piSourceLedgerPath",
+    "piSourceScanRoot",
+    "probeTrace",
+    "profileHome",
+    "protocolVersion",
+    "releaseDigest",
+    "releaseId",
+    "releaseRoot",
+    "releaseRunnerLabel",
+    "runtimeDir",
+    "structuredFlowLimits",
+    "terminalArgumentsJson",
+    "terminalExecutable",
+    "terminalSessionId",
+];
+const FILESYSTEM_KEYS = ["slug", "windowsDirectory", "unixDirectory", "temporaryPrefix"];
+const STATE_KEYS = ["windowsControlDirectory", "unixControlDirectory", "developmentDirectory", "piAgentProfile", "piVanillaProfile", "piSandboxProfile"];
+const ENDPOINT_KEYS = ["windowsPipeStem", "unixSocketFilename", "metadataFilename", "supervisorLogFilename", "databaseFilename"];
+const MANIFEST_KEYS = ["releaseFilename", "packageFilename"];
+const PROTOCOL_KEYS = ["namespace", "controlEnvelope", "supervisorSchema", "nativeHostSchema", "structuredAgentSchema", "controlStoreSchema", "releaseCohortSchema", "updateJournalSchema"];
+const EVIDENCE_KEYS = ["nativeSpikeSchema", "terminalProvenanceSchema", "terminalProofSchema", "stableReleaseSchema", "previewReleaseSchema", "releaseCertificationSchema", "previewPlatformVerdictSchema", "piSourceLedgerSchema", "piComponentParitySchema", "piEventFrameParitySchema"];
+const ARTIFACT_KEYS = ["cliEntry", "supervisorEntry", "uiEntry", "nativeExecutable", "nativeCrate", "releaseTarballStem", "diagnosticStem"];
+const ROOT_KEYS = ["schema", "displayName", "commandName", "packageName", "filesystem", "environment", "state", "endpoint", "manifest", "protocol", "evidence", "artifacts"];
+export function validateProductIdentity(value) {
+    const root = exactObject(value, ROOT_KEYS, "product identity");
+    const schema = stringValue(root.schema, "product identity schema");
+    const displayName = stringValue(root.displayName, "product display name");
+    const commandName = stringValue(root.commandName, "product command name");
+    const packageName = stringValue(root.packageName, "product package name");
+    const filesystem = stringObject(root.filesystem, FILESYSTEM_KEYS, "filesystem identity");
+    const environment = stringObject(root.environment, ENVIRONMENT_KEYS, "environment identity");
+    const state = stringObject(root.state, STATE_KEYS, "state identity");
+    const endpoint = stringObject(root.endpoint, ENDPOINT_KEYS, "endpoint identity");
+    const manifest = stringObject(root.manifest, MANIFEST_KEYS, "manifest identity");
+    const protocol = stringObject(root.protocol, PROTOCOL_KEYS, "protocol identity");
+    const evidence = stringObject(root.evidence, EVIDENCE_KEYS, "evidence identity");
+    const artifacts = stringObject(root.artifacts, ARTIFACT_KEYS, "artifact identity");
+    if (!/^[a-z][a-z0-9-]*$/.test(commandName))
+        throw new TypeError("product command name must be a lowercase command slug");
+    if (!/^@[a-z0-9-]+\/[a-z0-9-]+$/.test(packageName))
+        throw new TypeError("product package name must be a lowercase scoped npm package");
+    if (displayName.trim() !== displayName || displayName.length === 0)
+        throw new TypeError("product display name must be non-empty without surrounding whitespace");
+    if (schema !== `${commandName}-product-identity-v1`)
+        throw new TypeError("product identity schema must derive from the command name");
+    if (filesystem.slug !== commandName || filesystem.unixDirectory !== filesystem.slug || filesystem.windowsDirectory !== displayName) {
+        throw new TypeError("product filesystem identity must derive from display and command names");
+    }
+    if (filesystem.temporaryPrefix !== `${filesystem.slug}-`)
+        throw new TypeError("product temporary prefix must derive from the filesystem slug");
+    if (state.windowsControlDirectory !== filesystem.windowsDirectory || state.unixControlDirectory !== filesystem.unixDirectory) {
+        throw new TypeError("product state directories must match the filesystem identity");
+    }
+    if (endpoint.windowsPipeStem !== filesystem.slug)
+        throw new TypeError("product endpoint stem must match the filesystem slug");
+    if (protocol.namespace !== commandName)
+        throw new TypeError("product protocol namespace must match the command name");
+    if (artifacts.diagnosticStem !== filesystem.slug)
+        throw new TypeError("product diagnostic stem must match the filesystem slug");
+    const environmentPrefix = `${commandName.toUpperCase()}_`;
+    const environmentValues = Object.values(environment);
+    if (new Set(environmentValues).size !== environmentValues.length)
+        throw new TypeError("product environment keys must be unique");
+    for (const key of environmentValues) {
+        if (!key.startsWith(environmentPrefix) || !/^[A-Z][A-Z0-9_]+$/.test(key)) {
+            throw new TypeError(`product environment key must use ${environmentPrefix}: ${key}`);
+        }
+    }
+    for (const [name, identifier] of Object.entries(protocol)) {
+        if (name !== "namespace" && !identifier.startsWith(`${protocol.namespace}-`)) {
+            throw new TypeError(`product protocol identifier must use ${protocol.namespace}: ${identifier}`);
+        }
+    }
+    for (const identifier of Object.values(evidence)) {
+        if (!identifier.startsWith(`${protocol.namespace}-`))
+            throw new TypeError(`product evidence identifier must use ${protocol.namespace}: ${identifier}`);
+    }
+    return deepFreeze({
+        schema,
+        displayName,
+        commandName,
+        packageName,
+        filesystem,
+        environment,
+        state,
+        endpoint,
+        manifest,
+        protocol,
+        evidence,
+        artifacts,
+    });
+}
+export function createProductIdentityText(identity) {
+    return Object.freeze({
+        displayName: identity.displayName,
+        commandName: identity.commandName,
+        packageName: identity.packageName,
+        diagnostic: (message) => `${identity.displayName} ${message}`,
+        usage: (forms) => `Usage: ${forms.map(form => `${identity.commandName}${form ? ` ${form}` : ""}`).join(" | ")}`,
+    });
+}
+export const PRODUCT_IDENTITY = validateProductIdentity(rawIdentity);
+export const PRODUCT_TEXT = createProductIdentityText(PRODUCT_IDENTITY);
+function exactObject(value, keys, name) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new TypeError(`${name} must be an object`);
+    const actualKeys = Object.keys(value).sort();
+    const expectedKeys = [...keys].sort();
+    if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+        throw new TypeError(`${name} must contain exactly: ${expectedKeys.join(", ")}`);
+    }
+    return value;
+}
+function stringObject(value, keys, name) {
+    const object = exactObject(value, keys, name);
+    return Object.fromEntries(keys.map((key) => [key, stringValue(object[key], `${name}.${key}`)]));
+}
+function stringValue(value, name) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new TypeError(`${name} must be a non-empty string`);
+    return value;
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}

package/dist/src/product-identity.json

@@ -0,0 +1,96 @@
+{
+    "schema": "a1-product-identity-v1",
+    "displayName": "A1",
+    "commandName": "a1",
+    "packageName": "@timurproko/a1",
+    "filesystem": {
+        "slug": "a1",
+        "windowsDirectory": "A1",
+        "unixDirectory": "a1",
+        "temporaryPrefix": "a1-"
+    },
+    "environment": {
+        "certificationTarball": "A1_CERTIFICATION_TARBALL",
+        "configDir": "A1_CONFIG_DIR",
+        "dataDir": "A1_DATA_DIR",
+        "databasePath": "A1_DATABASE_PATH",
+        "developmentInstanceId": "A1_DEV_INSTANCE_ID",
+        "developmentRoot": "A1_DEV_ROOT",
+        "endpoint": "A1_ENDPOINT",
+        "fixture": "A1_FIXTURE",
+        "fixtureInput": "A1_FIXTURE_INPUT",
+        "fixtureToken": "A1_FIXTURE_TOKEN",
+        "inputAcknowledgement": "A1_INPUT_ACK",
+        "internalPackaging": "A1_INTERNAL_PACKAGING",
+        "launchArgumentsJson": "A1_LAUNCH_ARGUMENTS_JSON",
+        "launchProfile": "A1_LAUNCH_PROFILE",
+        "nativePi": "A1_NATIVE_PI",
+        "paneId": "A1_PANE_ID",
+        "piParityIntentionalMutation": "A1_PI_PARITY_INTENTIONAL_MUTATION",
+        "piPortRoot": "A1_PI_PORT_ROOT",
+        "piSourceLedgerPath": "A1_PI_SOURCE_LEDGER_PATH",
+        "piSourceScanRoot": "A1_PI_SOURCE_SCAN_ROOT",
+        "probeTrace": "A1_PROBE_TRACE",
+        "profileHome": "A1_PROFILE_HOME",
+        "protocolVersion": "A1_PROTOCOL_VERSION",
+        "releaseDigest": "A1_RELEASE_DIGEST",
+        "releaseId": "A1_RELEASE_ID",
+        "releaseRoot": "A1_RELEASE_ROOT",
+        "releaseRunnerLabel": "A1_RELEASE_RUNNER_LABEL",
+        "runtimeDir": "A1_RUNTIME_DIR",
+        "structuredFlowLimits": "A1_STRUCTURED_FLOW_LIMITS",
+        "terminalArgumentsJson": "A1_TERMINAL_ARGUMENTS_JSON",
+        "terminalExecutable": "A1_TERMINAL_EXECUTABLE",
+        "terminalSessionId": "A1_TERMINAL_SESSION_ID"
+    },
+    "state": {
+        "windowsControlDirectory": "A1",
+        "unixControlDirectory": "a1",
+        "developmentDirectory": "a1-development",
+        "piAgentProfile": ".a1/agent",
+        "piVanillaProfile": ".pi/agent",
+        "piSandboxProfile": ".a1/sandbox"
+    },
+    "endpoint": {
+        "windowsPipeStem": "a1",
+        "unixSocketFilename": "supervisor.sock",
+        "metadataFilename": "supervisor.json",
+        "supervisorLogFilename": "supervisor.log",
+        "databaseFilename": "control.sqlite3"
+    },
+    "manifest": {
+        "releaseFilename": ".a1-release.json",
+        "packageFilename": "package.json"
+    },
+    "protocol": {
+        "namespace": "a1",
+        "controlEnvelope": "a1-control-envelope",
+        "supervisorSchema": "a1-supervisor-v1",
+        "nativeHostSchema": "a1-native-host-v1",
+        "structuredAgentSchema": "a1-structured-agent-v1",
+        "controlStoreSchema": "a1-control-store-v1",
+        "releaseCohortSchema": "a1-release-cohort-v1",
+        "updateJournalSchema": "a1-update-journal-v1"
+    },
+    "evidence": {
+        "nativeSpikeSchema": "a1-native-host-spike-evidence-v1",
+        "terminalProvenanceSchema": "a1-terminal-host-provenance-v1",
+        "terminalProofSchema": "a1-terminal-host-proof-v1",
+        "stableReleaseSchema": "a1-stable-release-v1",
+        "previewReleaseSchema": "a1-preview-release-v1",
+        "releaseCertificationSchema": "a1-release-certification-v1",
+        "previewPlatformVerdictSchema": "a1-development-preview-platform-verdict-v2",
+        "piSourceLedgerSchema": "a1-pinned-pi-source-port-ledger-v1",
+        "piComponentParitySchema": "a1-pi-static-component-parity-v1",
+        "piEventFrameParitySchema": "a1-pi-event-frame-parity-v1"
+    },
+    "artifacts": {
+        "cliEntry": "bin/a1.js",
+        "supervisorEntry": "bin/a1-supervisor.js",
+        "uiEntry": "bin/a1-ui.js",
+        "nativeExecutable": "a1-terminal-host",
+        "nativeCrate": "a1-terminal-host",
+        "releaseTarballStem": "timurproko-a1",
+        "diagnosticStem": "a1"
+    }
+}

package/docs/architecture/boundaries.md

@@ -11,9 +11,9 @@ mutable a1 entry
   -> child with inherited physical terminal handles
 ```
 
-After handoff, AddOne does not read ordinary terminal input, parse child output, render cells, infer frames, synthesize terminal responses, or emit display control. The child and physical terminal own terminal behavior. AddOne owns validated launch intent, one exclusive foreground lease, native process identity, lifecycle outcome, and bounded cleanup.
+After handoff, A1 does not read ordinary terminal input, parse child output, render cells, infer frames, synthesize terminal responses, or emit display control. The child and physical terminal own terminal behavior. A1 owns validated launch intent, one exclusive foreground lease, native process identity, lifecycle outcome, and bounded cleanup.
 
-Transparent mode has no AddOne-authoritative terminal surface, internal pane, virtual scrollback, inactive resident tab, or visual reconnection. A future feature that requires those properties must introduce and certify a separate composed-terminal authority; it must not weaken or silently intercept transparent mode.
+Transparent mode has no A1-authoritative terminal surface, internal pane, virtual scrollback, inactive resident tab, or visual reconnection. A future feature that requires those properties must introduce and certify a separate composed-terminal authority; it must not weaken or silently intercept transparent mode.
 
 ## Current module responsibilities
 

package/docs/architecture/project-structure.md

@@ -74,8 +74,8 @@ Build output belongs in ignored `dist/`; release/test evidence belongs in ignore
 
 ## Terminal capability boundary
 
-Transparent terminal attachment owns one foreground child and no AddOne surface. It cannot retain inactive terminal state or switch among arbitrary interactive CLIs inside AddOne. Bare-`a1` multi-agent UX may use structured/RPC surfaces without terminal emulation, but arbitrary-CLI tabs require a separate composed-terminal capability with PTY, authoritative terminal state, rendering, input routing, inactive-surface lifecycle, reconnection, and cross-platform certification. That future capability must not silently intercept or replace the transparent path. Explicit launch profiles and transparent fallback must not import, initialize, launch, or connect to composed terminal-host infrastructure.
+Transparent terminal attachment owns one foreground child and no A1 surface. It cannot retain inactive terminal state or switch among arbitrary interactive CLIs inside A1. Bare-`a1` multi-agent UX may use structured/RPC surfaces without terminal emulation, but arbitrary-CLI tabs require a separate composed-terminal capability with PTY, authoritative terminal state, rendering, input routing, inactive-surface lifecycle, reconnection, and cross-platform certification. That future capability must not silently intercept or replace the transparent path. Explicit launch profiles and transparent fallback must not import, initialize, launch, or connect to composed terminal-host infrastructure.
 
-Composed terminals use a console terminal host that runs inside the user's existing terminal. The host owns pseudoterminal bytes, retained terminal state, keyboard/text/mouse/IME encoding, frame scheduling, and presentation to the containing terminal. AddOne's JavaScript control plane may exchange typed identity, topology revision, capability, lifecycle, status, and recovery messages only; it must not relay terminal output, per-event child input, or rendered cells. A desktop-native window, GPU renderer, Ghostty GUI runtime, Winghostty Win32 runtime, Metal, GTK, and AppKit are postponed and are not required for the in-terminal product.
+Composed terminals use a console terminal host that runs inside the user's existing terminal. The host owns pseudoterminal bytes, retained terminal state, keyboard/text/mouse/IME encoding, frame scheduling, and presentation to the containing terminal. A1's JavaScript control plane may exchange typed identity, topology revision, capability, lifecycle, status, and recovery messages only; it must not relay terminal output, per-event child input, or rendered cells. A desktop-native window, GPU renderer, Ghostty GUI runtime, Winghostty Win32 runtime, Metal, GTK, and AppKit are postponed and are not required for the in-terminal product.
 
 A tab owns a revisioned split tree. Each leaf pane references one PTY-backed terminal session. Structured/RPC agents remain semantically separate and may not derive state from ANSI text, terminal timing, or screen content. Native source ownership lives outside `src/` when introduced; packaged host selection is governed by release/package owners. Existing architecture tests reject terminal-host hot-path bytes in JavaScript protocol code, terminal inference in structured runtime code, composed imports from explicit launch modes, and replacement lightweight terminal parsers/renderers.

package/docs/architecture/resource-and-data-policy.md

@@ -32,7 +32,7 @@ Every asynchronous consumer must implement a finite queue or window. Backpressur
 |---|---|---|
 | Workspace metadata | IDs, names, lifecycle, capability versions, topology revisions, recovery references | May persist in the control store |
 | Structured payloads | Messages, tool calls, snapshots, attachments | Bound and process; persist only under a future typed retention policy |
-| Terminal content | PTY bytes, scrollback, selection, rendered cells | Never persist in AddOne's control store or diagnostics |
+| Terminal content | PTY bytes, scrollback, selection, rendered cells | Never persist in A1's control store or diagnostics |
 | Host topology metadata | Window/tab/pane/session IDs, layout shape, dimensions, revision | May persist; not terminal content |
 | Native proof evidence | Artifact hashes, source revisions, workloads, latency/resource measurements, paint diagnostics | May persist in versioned evidence files without terminal content |
 | Environment values | `PATH`, profile overrides, arbitrary launch environment | Do not persist; treat as potentially sensitive |

package/docs/architecture/terminal-host-proof-gate.md

@@ -1,6 +1,6 @@
 # In-terminal 2×2 proof gate
 
-The composed-terminal proof is a stop/go gate. AddOne must not merge or productize composed terminal panes until the exact in-terminal spike artifact passes both technical and physical acceptance.
+The composed-terminal proof is a stop/go gate. A1 must not merge or productize composed terminal panes until the exact in-terminal spike artifact passes both technical and physical acceptance.
 
 ## Go criteria
 
@@ -8,7 +8,7 @@ A `go` decision requires all of the following:
 
 1. Every mandatory workload in the terminal-host evidence schema passes.
 2. The proof runs inside an existing terminal without creating a desktop window.
-3. The exact artifact is tied to pinned AddOne and terminal-component revisions.
+3. The exact artifact is tied to pinned A1 and terminal-component revisions.
 4. Automated evidence came from an isolated worker.
 5. The physical verdict is `accepted` through user-controlled manual validation or an attested isolated disposable worker.
 6. Input-to-process p95 latency is at most 16 ms.

package/docs/architecture/terminal-host-provenance.md

@@ -10,7 +10,7 @@ The composed-terminal proof uses a small console-hosted stack. It runs inside th
 | `portable-pty` | version `0.9.0` | ConPTY/Unix PTY and process ownership | MIT |
 | Crossterm | version `0.29.0` | Outer-terminal raw mode and host input events | MIT-compatible candidate; notice must be vendored before packaging |
 
-A buffered AddOne-owned frame composer is the initial presentation layer. Ratatui is an optional evaluation candidate only if the narrow composer increases rendering risk; it is not selected by default.
+A buffered A1-owned frame composer is the initial presentation layer. Ratatui is an optional evaluation candidate only if the narrow composer increases rendering risk; it is not selected by default.
 
 ## Explicitly excluded
 
@@ -44,7 +44,7 @@ Do not patch terminal semantics to support a specific CLI. Report unsupported ge
 
 The console proof requires:
 
-- Rust/Cargo for the AddOne terminal host;
+- Rust/Cargo for the A1 terminal host;
 - Zig `0.15.x` with patch `>= 0.15.2` to build `libghostty-vt`;
 - the platform C/C++ build toolchain required by Rust and the PTY/input crates (Visual Studio 2022 Build Tools/MSVC on Windows);
 - Windows 10/11 x64 or ARM64 for the first proof;
@@ -58,7 +58,7 @@ No GUI SDK, OpenGL runtime, Win32 window pipeline, Metal, GTK, or AppKit runtime
 Every spike or production host artifact must record:
 
 - artifact path, SHA-256, size, signature status, and build timestamp;
-- AddOne source commit and protocol version;
+- A1 source commit and protocol version;
 - `libghostty-vt`, PTY, input, and renderer component identities;
 - retained/adapted component manifest;
 - compiler/toolchain versions and target triple;

package/docs/architecture/terminal-host-spike-evidence.md

@@ -1,6 +1,6 @@
 # In-terminal 2×2 spike evidence
 
-The spike must produce machine-readable evidence with schema `addone-native-host-spike-evidence-v1`. Evidence is valid only when it names the exact artifact, hashes, pinned source commits, isolated worker environment, all mandatory workloads, measurements, paint diagnostics, resources, and physical/manual verdict. The artifact is a console terminal host that runs inside an existing terminal and does not open a desktop window.
+The spike must produce machine-readable evidence with schema `a1-native-host-spike-evidence-v1`. Evidence is valid only when it names the exact artifact, hashes, pinned source commits, isolated worker environment, all mandatory workloads, measurements, paint diagnostics, resources, and physical/manual verdict. The artifact is a console terminal host that runs inside an existing terminal and does not open a desktop window.
 
 ## Mandatory workloads
 

package/docs/architecture/toolchain.md

@@ -45,22 +45,48 @@ npm run test:release
 
 `check:deprecated` verifies the complete lockfile graph against registry metadata. The release gate exercises durable stable/preview update transitions and writes an ignored machine-readable verdict under `artifacts/release-verdicts/`.
 
+## Pi maintenance workflows
+
+Engine compatibility and presentation synchronization are intentionally separate:
+
+```sh
+npm run test:pi-engine-conformance
+```
+
+This mandatory candidate workflow checks documented package-root exports and the owned engine integration. It does not read private interactive source, compare source maps, regenerate UI fixtures, or require presentation provenance to match a candidate package.
+
+```sh
+npm run sync:pi-ui
+```
+
+This optional, mutating presentation-maintenance workflow regenerates component and event-frame parity evidence when maintainers deliberately adopt upstream UI changes. Review generated diffs, attribution, source-ledger records, and terminal parity before committing them. It is never an engine candidate acceptance gate and is not run by `check`, `prepack`, or release publication.
+
+`npm run test:pi-terminal-parity` remains an explicit presentation acceptance command. `node scripts/check-pinned-pi-source-ledger.mjs` validates accepted provenance; its `--engine-only` mode validates the ownership partition without comparing private upstream source.
+
 ## Preview publication
 
 A preview candidate must use a unique `-dev.N` version and exact manually accepted bytes. Publication packs once, binds evidence to source commit/version/integrity, runs applicable non-desktop gates, publishes under npm `next`, and verifies registry identity. It must keep `latest` unchanged and record physical/cross-platform certification as deferred.
 
 The GitHub trusted-publishing workflow is `.github/workflows/publish-next.yml`. Stable publication remains a separate release process from a clean tagged `master` commit after all mandatory platform gates pass.
 
-## AddOne state paths
+## A1 state paths
 
-These paths are AddOne control and release state, not Pi profile roots. All are overrideable for hermetic tests.
+These paths are A1 control and release state, not Pi profile roots. All are overrideable for hermetic tests.
 
 | Purpose | Override | Windows default | Unix default |
 |---|---|---|---|
-| Config | `ADDONE_CONFIG_DIR` | `%APPDATA%\\AddOne` | `$XDG_CONFIG_HOME/addone` or `~/.config/addone` |
-| Durable data | `ADDONE_DATA_DIR` | `%LOCALAPPDATA%\\AddOne` | `$XDG_DATA_HOME/addone` or `~/.local/share/addone` |
-| Runtime | `ADDONE_RUNTIME_DIR` | `%LOCALAPPDATA%\\AddOne\\runtime` | `$XDG_RUNTIME_DIR/addone` or `<data>/runtime` |
-| Database | `ADDONE_DATABASE_PATH` | `<data>/control.sqlite3` | `<data>/control.sqlite3` |
-| Endpoint | `ADDONE_ENDPOINT` | runtime-scoped named pipe | `<runtime>/supervisor.sock` |
+| Config | `A1_CONFIG_DIR` | `%APPDATA%\\A1` | `$XDG_CONFIG_HOME/a1` or `~/.config/a1` |
+| Durable data | `A1_DATA_DIR` | `%LOCALAPPDATA%\\A1` | `$XDG_DATA_HOME/a1` or `~/.local/share/a1` |
+| Runtime | `A1_RUNTIME_DIR` | `%LOCALAPPDATA%\\A1\\runtime` | `$XDG_RUNTIME_DIR/a1` or `<data>/runtime` |
+| Database | `A1_DATABASE_PATH` | `<data>/control.sqlite3` | `<data>/control.sqlite3` |
+| Endpoint | `A1_ENDPOINT` | runtime-scoped `a1-*` named pipe | `<runtime>/supervisor.sock` |
+
+### Identity hard cut and cleanup
+
+A1 does not read or migrate legacy `ADDONE_*` variables, `AddOne`/`addone` control-state directories, release manifests, database schemas, endpoint records, or protocol frames. Remove obsolete control state only after stopping old processes: `%APPDATA%\\AddOne` and `%LOCALAPPDATA%\\AddOne` on Windows, or the former `addone` directories under XDG config, data, and runtime roots on Unix. This cleanup is manual and never imports data into A1.
+
+Do **not** remove `~/.a1/agent` or `~/.a1/sandbox`; those are current Pi profile roots and are intentionally preserved. `~/.pi/agent` remains the vanilla Pi profile.
+
+The obsolete npm package `@timurproko/addone` is deprecated with the registry message `This package is obsolete. Use @timurproko/a1 instead.` It is not a current identity, compatibility channel, or rollback source. Whole-package unpublication was rejected by npm policy; any later removal is owner-controlled registry administration and does not change the A1 runtime contract.
 
 The launch-profile feature separately owns Pi roots: `~/.a1/agent`, ordinary `~/.pi/agent`, and `~/.a1/sandbox`.

package/docs/features/launch-profiles.md

@@ -4,7 +4,7 @@
 
 | Command | Purpose | Pi user profile |
 |---|---|---|
-| `a1` | AddOne-owned Pi-compatible UI | `~/.a1/agent` |
+| `a1` | A1-owned Pi-compatible UI | `~/.a1/agent` |
 | `a1 pi` | Untouched vanilla Pi fallback and comparison oracle | ordinary `~/.pi/agent` |
 | `a1 sandbox` | Unchanged isolated vanilla Pi profile for experiments | `~/.a1/sandbox` |
 
@@ -12,7 +12,7 @@ There is no `a1 agent` command. The former `a1 ui` subcommand is removed. Bare `
 
 ## First launch
 
-For AddOne-owned profiles, AddOne creates only the selected profile root and empty `extensions`, `skills`, `prompts`, and `themes` directories. Existing content is preserved. AddOne does not copy, link, merge, or delete settings, credentials, sessions, packages, trust decisions, or resources from another profile.
+For A1-owned profiles, A1 creates only the selected profile root and empty `extensions`, `skills`, `prompts`, and `themes` directories. Existing content is preserved. A1 does not copy, link, merge, or delete settings, credentials, sessions, packages, trust decisions, or resources from another profile.
 
 Pi owns files within the selected root. Common locations are:
 
@@ -31,7 +31,7 @@ Run Pi’s normal `/login` independently in each profile that needs stored authe
 
 ## Vanilla Pi
 
-`a1 pi` bypasses the AddOne-owned UI and launches the untouched pinned Pi CLI. It also removes AddOne’s Pi configuration-root override, so Pi uses its normal `~/.pi/agent` settings, authentication, sessions, resources, packages, and trust decisions. This is both the comparison oracle and the recovery fallback when diagnosing the owned UI.
+`a1 pi` bypasses the A1-owned UI and launches the untouched pinned Pi CLI. It also removes A1’s Pi configuration-root override, so Pi uses its normal `~/.pi/agent` settings, authentication, sessions, resources, packages, and trust decisions. This is both the comparison oracle and the recovery fallback when diagnosing the owned UI.
 
 ## Sandbox profile
 
@@ -41,10 +41,10 @@ Run Pi’s normal `/login` independently in each profile that needs stored authe
 
 ## Terminal behavior
 
-Bare `a1` runs the AddOne-owned full-viewport TUI over public Pi engine, component, and terminal APIs. AddOne owns composition, input routing, modal focus, selection behavior, scrolling, and restoration without inserting a PTY or terminal-byte relay. Its default presentation is pinned to vanilla Pi parity; structured tabs and AddOne-specific visual customization are not enabled.
+Bare `a1` runs the A1-owned full-viewport TUI over public Pi engine, component, and terminal APIs. A1 owns composition, input routing, modal focus, selection behavior, scrolling, and restoration without inserting a PTY or terminal-byte relay. Its default presentation is pinned to vanilla Pi parity; structured tabs and A1-specific visual customization are not enabled.
 
-`a1 pi` and `a1 sandbox` retain transparent direct attachment. In those profiles, one untouched Pi process and the physical terminal own rendering, input, selection, clipboard, scrollback, and terminal modes; AddOne owns foreground lease and lifecycle only.
+`a1 pi` and `a1 sandbox` retain transparent direct attachment. In those profiles, one untouched Pi process and the physical terminal own rendering, input, selection, clipboard, scrollback, and terminal modes; A1 owns foreground lease and lifecycle only.
 
 ## Recovery and comparison
 
-If bare `a1` cannot start or a UI workflow diverges, run `a1 pi` from the same working directory and compare the behavior. Profile data is intentionally separate, so authentication or settings may need to be configured independently. Use `a1 version` to record the installed AddOne release before reporting a difference. `a1 sandbox` is for isolated profile experiments, not recovery from the owned UI and not a security boundary.
+If bare `a1` cannot start or a UI workflow diverges, run `a1 pi` from the same working directory and compare the behavior. Profile data is intentionally separate, so authentication or settings may need to be configured independently. Use `a1 version` to record the installed A1 release before reporting a difference. `a1 sandbox` is for isolated profile experiments, not recovery from the owned UI and not a security boundary.

package/docs/manual-pi-boundary-candidate.md

@@ -0,0 +1,33 @@
+# Manual Pi-boundary candidate checkpoint
+
+This checkpoint is user-controlled. Do not automate it on an active workstation, send synthetic desktop input, or claim a pass without a person completing the observations.
+
+## Prepare the exact local candidate
+
+From a clean checkout of the candidate commit:
+
+```powershell
+npm ci
+npm run check
+npm pack --ignore-scripts --pack-destination artifacts/manual-pi-boundary
+npm install --global --prefix artifacts/manual-pi-boundary/install artifacts/manual-pi-boundary/timurproko-a1-*.tgz --ignore-scripts
+$Candidate = Resolve-Path artifacts/manual-pi-boundary/install/a1.cmd
+```
+
+Use the exact generated filename if wildcard expansion is unavailable.
+
+## User-controlled checks
+
+1. **Bare owned UI:** run `& $Candidate`. Confirm startup, typing, submission, transcript streaming, selector focus, mouse/keyboard scrolling, and ordinary shutdown.
+2. **Extension surfaces:** in bare UI use `/reload`, then exercise configured extension notification, select, confirm, input, editor, replacement custom surface, and overlay custom surface. Confirm cancellation restores editor focus.
+3. **Vanilla oracle:** run `& $Candidate pi`. Confirm untouched Pi uses the ordinary `~/.pi/agent` profile and does not show owned-UI or workspace surfaces.
+4. **Isolated profile:** run `& $Candidate sandbox`. Confirm Pi uses `~/.a1/sandbox` and starts with project approval disabled for that run.
+5. **Resize and input:** while each mode is active, narrow and widen the terminal, enter Unicode and multiline text, use history/navigation keys, and scroll in both directions.
+6. **Shutdown:** exit normally, then repeat and use Ctrl+C during work. Confirm the parent prompt remains usable and no child remains attached.
+7. **Recovery:** after any owned-UI failure, run `& $Candidate pi`; confirm the vanilla oracle remains available. Restart bare UI and confirm its normal profile remains intact.
+
+Do not remove `~/.a1/agent`, `~/.pi/agent`, or `~/.a1/sandbox` during this checkpoint.
+
+## Verdict recording
+
+Before a person performs these commands, the verdict is **READY, MANUAL EXECUTION PENDING**. After execution, record candidate commit, tarball SHA-256, platform, terminal, each observation, and an explicit pass/fail. A preview publication may remain Windows-only and uncertified; this checkpoint does not establish stable cross-platform support.

package/docs/manual-transparent-checkpoint.md

@@ -13,40 +13,40 @@ npm pack --ignore-scripts --pack-destination artifacts/manual-transparent
 npm install --prefix artifacts/manual-transparent/install --ignore-scripts artifacts/manual-transparent/<exact-tarball>.tgz
 ```
 
-Use isolated AddOne control state:
+Use isolated A1 control state:
 
 ```powershell
 $manualRoot = (Resolve-Path "artifacts/manual-transparent").Path
-$env:ADDONE_CONFIG_DIR = "$manualRoot\state\config"
-$env:ADDONE_DATA_DIR = "$manualRoot\state\data"
-$env:ADDONE_RUNTIME_DIR = "$manualRoot\state\runtime"
-$env:ADDONE_DATABASE_PATH = "$manualRoot\state\data\control.sqlite3"
+$env:A1_CONFIG_DIR = "$manualRoot\state\config"
+$env:A1_DATA_DIR = "$manualRoot\state\data"
+$env:A1_RUNTIME_DIR = "$manualRoot\state\runtime"
+$env:A1_DATABASE_PATH = "$manualRoot\state\data\control.sqlite3"
 ```
 
 Run the installed candidate yourself:
 
 ```powershell
-& "artifacts/manual-transparent/install/node_modules/.bin/addone.cmd"
+& "artifacts/manual-transparent/install/node_modules/.bin/a1.cmd"
 ```
 
-Test each installed launch form separately: bare `a1` (the owned UI), `a1 pi` (the untouched comparison oracle), and `a1 sandbox` (the unchanged isolated vanilla profile). Confirm that files created through `/settings`, `/login`, sessions, and resource directories remain under the selected profile root. Generic transparent-fallback testing may set `ADDONE_TERMINAL_EXECUTABLE` and a JSON array in `ADDONE_TERMINAL_ARGUMENTS_JSON`.
+Test each installed launch form separately: bare `a1` (the owned UI), `a1 pi` (the untouched comparison oracle), and `a1 sandbox` (the unchanged isolated vanilla profile). Confirm that files created through `/settings`, `/login`, sessions, and resource directories remain under the selected profile root. Generic transparent-fallback testing may set `A1_TERMINAL_EXECUTABLE` and a JSON array in `A1_TERMINAL_ARGUMENTS_JSON`.
 
 Physical automation is not part of this repository baseline. Future certification tooling may run only on dedicated disposable workers or VMs with exclusive test desktops, never on this workstation.
 
-## Compare bare AddOne with `a1 pi`
+## Compare bare A1 with `a1 pi`
 
-Use the same terminal, working directory, dimensions, environment, and equivalent profile resources. Bare AddOne and the untouched oracle intentionally use separate profile roots.
+Use the same terminal, working directory, dimensions, environment, and equivalent profile resources. Bare A1 and the untouched oracle intentionally use separate profile roots.
 
 - [ ] Startup resources, logo, notices, spacing, editor, and footer match.
 - [ ] Text, Unicode, emoji, styles, cursor, and layout match.
-- [ ] Rapid typing has no visible AddOne delay or dropped/duplicated characters.
+- [ ] Rapid typing has no visible A1 delay or dropped/duplicated characters.
 - [ ] Ctrl+C, Ctrl+P, arrows, paste, focus, dialogs, mouse, and wheel match.
 - [ ] Selection, copy, clipboard, scrollback, and resize match.
 - [ ] Normal and error exits preserve child output and return a usable parent prompt.
 - [ ] Parent typing, cursor movement, Backspace, Delete, and submission work after exit.
 - [ ] A missing executable reports a concise spawn failure without affecting other applications.
 
-Report failures with direct-versus-AddOne behavior, platform/terminal versions, exact command, reproducibility, and optional manually captured evidence.
+Report failures with direct-versus-A1 behavior, platform/terminal versions, exact command, reproducibility, and optional manually captured evidence.
 
 For recovery, use `a1 pi`; do not use the removed `a1 ui` command. `a1 sandbox` remains profile isolation rather than a security boundary.
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.0",
+  "version": "0.1.1-dev.1",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",
   "bin": {
-    "a1": "bin/addone.js"
+    "a1": "bin/a1.js"
   },
   "files": [
     "bin",
@@ -21,7 +21,7 @@
     "clean": "node scripts/clean.mjs",
     "build": "npm run clean && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "check:architecture": "node scripts/check-architecture.mjs && node scripts/check-package-identity.mjs && node scripts/check-pinned-pi-source-ledger.mjs && node scripts/check-terminal-host-provenance.mjs",
+    "check:architecture": "node scripts/check-architecture.mjs && node scripts/product-identifier-policy.mjs --check && node scripts/check-product-identity-boundaries.mjs && node scripts/check-package-identity.mjs && node scripts/check-pinned-pi-source-ledger.mjs && node scripts/check-terminal-host-provenance.mjs",
     "check:customization-ready": "node scripts/check-owned-ui-customization-prerequisites.mjs",
     "check:deprecated": "node scripts/check-deprecated-dependencies.mjs",
     "check": "npm run typecheck && npm run check:architecture && npm run check:customization-ready && npm run check:deprecated && npm test && npm run test:release",
@@ -33,6 +33,9 @@
     "test:release": "node scripts/run-release-gates.mjs",
     "test:terminal-host": "node scripts/run-terminal-host-probe.mjs",
     "test:pi-terminal-parity": "npm run build --silent && node scripts/run-pi-terminal-parity.mjs",
+    "test:pi-engine-conformance": "vitest run test/foundation/pi-engine-adapter/conformance.test.ts test/foundation/pi-engine-adapter/runtime-integration.test.ts test/foundation/pi-engine-adapter/session-integration.test.ts",
+    "report:pi-engine-conformance": "npm run build --silent && node scripts/run-pi-engine-conformance.mjs",
+    "sync:pi-ui": "npm run update:pi-component-parity && npm run update:pi-event-frame-parity",
     "update:pi-component-parity": "tsx scripts/update-pi-component-parity.ts",
     "update:pi-event-frame-parity": "tsx scripts/update-pi-event-frame-parity.ts",
     "proof:terminal-host": "node scripts/run-terminal-host.mjs",
@@ -67,6 +70,10 @@
   ],
   "author": "Timur Prokopiev",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/timurproko/a1"
+  },
   "publishConfig": {
     "access": "public"
   }

package/bin/addone-ui.js

@@ -1,20 +0,0 @@
-#!/usr/bin/env node
-
-const { runSelectedInteractiveRuntime } = await import("../dist/src/features/launch/index.js");
-
-runSelectedInteractiveRuntime(process.env.ADDONE_LAUNCH_PROFILE ?? "addone", {
-  ownedUi: async () => {
-    const { runOwnedUi } = await import("../dist/src/features/owned-ui/index.js");
-    return await runOwnedUi({ cwd: process.cwd() });
-  },
-  transparent: async profileId => {
-    const { runTransparentForeground } = await import("../dist/src/foundation/transparent-terminal/main.js");
-    return await runTransparentForeground({ profileId });
-  },
-}).then(
-  code => { process.exitCode = code; },
-  error => {
-    console.error(error instanceof Error ? error.stack ?? error.message : String(error));
-    process.exitCode = 1;
-  },
-);

package/dist/src/cli/dispatch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/cli/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,uBAAuB,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE1H,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,eAAO,MAAM,YAAY,6EAA6E,CAAC;AAEvG,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAW/E"}

package/dist/src/cli/dispatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/cli/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAsD,MAAM,6BAA6B,CAAC;AAc1H,MAAM,CAAC,MAAM,YAAY,GAAG,0EAA0E,CAAC;AAEvG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA6B,EAC7B,QAAqB,EACrB,MAAiB;IAEjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IAChE,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAAC,UAA6B;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACpH,MAAM,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC7F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IACxH,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACvE,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1E,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC;IACpI,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC;AAChF,CAAC"}

package/dist/src/cli/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}

package/dist/src/cli/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}

package/dist/src/cli/version-stats.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"version-stats.d.ts","sourceRoot":"","sources":["../../../src/cli/version-stats.ts"],"names":[],"mappings":"AAOA,UAAU,oBAAoB;IAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxF,KAAK,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAC9G,UAAU,aAAa;IAAG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAExF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAOD,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBnF"}