@timurproko/a1 0.1.8-dev.259 → 0.1.8-dev.260

package/dist/foundation/release/bootstrap.d.ts

@@ -27,6 +27,8 @@ export interface BootstrapOptions {
 }
 export declare function runBootstrap(options: BootstrapOptions): Promise<number>;
 export declare function certifyMaterializedRelease(release: MaterializedRelease, dataDir: string, verification?: VerifyMaterializedReleaseOptions): Promise<string>;
+/** Persist current-format evidence after an authenticated parent has certified the exact release. */
+export declare function recordParentCertifiedRelease(release: MaterializedRelease, dataDir: string): Promise<string>;
 export interface SupervisorStartupAttempt extends SupervisorStartupAttemptIdentity {
     readonly childOutcome: Promise<{
         readonly exitCode: number | null;

package/dist/foundation/release/bootstrap.js

@@ -193,6 +193,10 @@ export async function certifyMaterializedRelease(release, dataDir, verification
     if (!consumeMaterializationProof(release)) {
         await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"), verification);
     }
+    return await recordParentCertifiedRelease(release, dataDir);
+}
+/** Persist current-format evidence after an authenticated parent has certified the exact release. */
+export async function recordParentCertifiedRelease(release, dataDir) {
     const path = resolve(dataDir, `certification-${release.releaseId}.json`);
     const restartSeal = await createRestartSeal(release, dataDir);
     await chmod(path, 0o600).catch(() => { });

package/dist/foundation/release/dependency-layer.d.ts

@@ -37,6 +37,10 @@ export interface DependencyLayerOperationEvent {
     readonly path: string;
     readonly bytes: number;
 }
+export interface ReadCertifiedDependencyLayerOptions {
+    /** Accept and replace certification written by the immediately preceding updater format. */
+    readonly allowLegacyParentCertification?: boolean;
+}
 export interface SelectedRuntimePayload {
     readonly paths: readonly string[];
     readonly inventory: RuntimePayloadInventory;
@@ -71,7 +75,7 @@ export interface MaterializeDependencyLayerOptions {
 /** Materialize or reuse an exact immutable dependency layer after one source-content pass. */
 export declare function materializeDependencyLayer(packageRoot: string, dataDir: string, paths: readonly string[], options: MaterializeDependencyLayerOptions): Promise<MaterializedDependencyLayer | null>;
 /** Read trusted layer certification and canonical metadata without rereading every payload byte. */
-export declare function readCertifiedDependencyLayer(dataDir: string, layerId: string, expected?: Pick<DependencyLayerIdentity, "layerId" | "contentDigest">): Promise<Omit<MaterializedDependencyLayer, "reused">>;
+export declare function readCertifiedDependencyLayer(dataDir: string, layerId: string, expected?: Pick<DependencyLayerIdentity, "layerId" | "contentDigest">, options?: ReadCertifiedDependencyLayerOptions): Promise<Omit<MaterializedDependencyLayer, "reused">>;
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */
 export declare function verifyDependencyLayer(dataDir: string, reference: DependencyLayerReference, onOperation?: (event: DependencyLayerOperationEvent) => void): Promise<Omit<MaterializedDependencyLayer, "reused">>;
 export declare function dependencyReference(layer: MaterializedDependencyLayer): DependencyLayerReference;

package/dist/foundation/release/dependency-layer.js

@@ -269,7 +269,7 @@ export async function materializeDependencyLayer(packageRoot, dataDir, paths, op
     }
 }
 /** Read trusted layer certification and canonical metadata without rereading every payload byte. */
-export async function readCertifiedDependencyLayer(dataDir, layerId, expected) {
+export async function readCertifiedDependencyLayer(dataDir, layerId, expected, options = {}) {
     const layersRoot = await realpath(resolve(dataDir, "dependency-layers"));
     const layerRoot = await realpath(resolveWithin(layersRoot, layerId));
     assertDirectChild(layersRoot, layerRoot);
@@ -278,14 +278,23 @@ export async function readCertifiedDependencyLayer(dataDir, layerId, expected) {
         throw new Error(`dependency layer is not a managed non-link directory: ${layerId}`);
     const manifest = JSON.parse(await readFile(resolve(layerRoot, DEPENDENCY_LAYER_MANIFEST), "utf8"));
     validateLayerManifest(manifest);
-    const certification = JSON.parse(await readFile(certificationPath(dataDir, layerId), "utf8"));
-    if (certification.schema !== PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema || certification.layerId !== manifest.layerId || certification.contentDigest !== manifest.contentDigest
-        || certification.platform !== process.platform || certification.platformPolicy !== immutablePlatformPolicy()) {
-        throw new Error(`dependency layer certification differs from manifest: ${layerId}`);
-    }
     if (expected && (expected.layerId !== manifest.layerId || expected.contentDigest !== manifest.contentDigest)) {
         throw new Error(`dependency layer identity mismatch: ${layerId}`);
     }
+    const certification = JSON.parse(await readFile(certificationPath(dataDir, layerId), "utf8"));
+    const identityMatches = certification.schema === PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema
+        && certification.layerId === manifest.layerId && certification.contentDigest === manifest.contentDigest;
+    const currentPlatformEvidence = certification.platform === process.platform && certification.platformPolicy === immutablePlatformPolicy();
+    // Compatibility: the updater that introduced layers certified these exact identities but did
+    // not record platform fields. Only an authenticated parent-started supervisor opts into this
+    // transition; durable/reuse readers remain strict and cannot treat the legacy marker as authority.
+    const legacyParentCertification = options.allowLegacyParentCertification === true
+        && certification.platform === undefined && certification.platformPolicy === undefined;
+    if (!identityMatches || (!currentPlatformEvidence && !legacyParentCertification)) {
+        throw new Error(`dependency layer certification differs from manifest: ${layerId}`);
+    }
+    if (legacyParentCertification)
+        await writeLayerCertification(dataDir, manifest);
     return { ...manifest, layerRoot };
 }
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */

package/dist/foundation/release/release-store.d.ts

@@ -1,5 +1,5 @@
 import { type ReleaseIdentity } from "./release.js";
-import { type RuntimePayloadInventory } from "./dependency-layer.js";
+import { type ReadCertifiedDependencyLayerOptions, type RuntimePayloadInventory } from "./dependency-layer.js";
 export declare const RELEASE_MANIFEST_FILENAME: string;
 export interface MaterializedRelease extends ReleaseIdentity {
     readonly releaseRoot: string;
@@ -29,6 +29,8 @@ export interface CertifiedReleaseRecord {
     readonly packageVersion?: string;
     readonly contentDigest: string;
 }
+/** Process-authority compatibility controls for metadata-only release loading. */
+export type ReadCertifiedReleaseManifestOptions = ReadCertifiedDependencyLayerOptions;
 export declare function materializeRelease(packageRoot: string, dataDir: string, options?: MaterializeReleaseOptions): Promise<MaterializedRelease>;
 /** Consume proof that this exact object was freshly materialized or fully verified in this process. */
 export declare function consumeMaterializationProof(release: MaterializedRelease): boolean;
@@ -39,7 +41,7 @@ export declare function readMaterializedRelease(releaseRoot: string, selectedSto
  * establish one of those preconditions; untrusted releases require full
  * verification.
  */
-export declare function readCertifiedReleaseManifest(record: CertifiedReleaseRecord, selectedStoreRoot: string): Promise<MaterializedRelease>;
+export declare function readCertifiedReleaseManifest(record: CertifiedReleaseRecord, selectedStoreRoot: string, options?: ReadCertifiedReleaseManifestOptions): Promise<MaterializedRelease>;
 export declare function verifyMaterializedRelease(releaseRoot: string, expected?: ReleaseIdentity, selectedStoreRoot?: string, options?: VerifyMaterializedReleaseOptions): Promise<MaterializedRelease>;
 export declare function assertImmutableExecutionRoot(release: MaterializedRelease, dataDir: string): Promise<void>;
 export declare function resolveReleaseEntryPoint(release: MaterializedRelease, entryPoint: string): Promise<string>;

package/dist/foundation/release/release-store.js

@@ -106,7 +106,7 @@ export async function readMaterializedRelease(releaseRoot, selectedStoreRoot) {
  * establish one of those preconditions; untrusted releases require full
  * verification.
  */
-export async function readCertifiedReleaseManifest(record, selectedStoreRoot) {
+export async function readCertifiedReleaseManifest(record, selectedStoreRoot, options = {}) {
     const canonical = await realpath(record.releaseRoot);
     const canonicalStoreRoot = await realpath(selectedStoreRoot);
     assertContained(canonicalStoreRoot, canonical, "release root is outside the selected release store");
@@ -118,7 +118,7 @@ export async function readCertifiedReleaseManifest(record, selectedStoreRoot) {
     }
     if (canonical.split(sep).at(-1) !== manifest.releaseId)
         throw new Error(`release directory does not match identity ${manifest.releaseId}`);
-    await verifyReleaseDependencies(canonical, canonicalStoreRoot, manifest.dependencyLayers ?? [], false);
+    await verifyReleaseDependencies(canonical, canonicalStoreRoot, manifest.dependencyLayers ?? [], false, {}, options);
     return { ...manifest, releaseRoot: canonical };
 }
 export async function verifyMaterializedRelease(releaseRoot, expected, selectedStoreRoot, options = {}) {
@@ -162,7 +162,7 @@ export async function resolveReleaseEntryPoint(release, entryPoint) {
     assertContained(release.releaseRoot, canonical, "entry point resolves outside the selected release root");
     return canonical;
 }
-async function verifyReleaseDependencies(releaseRoot, storeRoot, references, fullVerification, options = {}) {
+async function verifyReleaseDependencies(releaseRoot, storeRoot, references, fullVerification, options = {}, certificationOptions = {}) {
     if (references.length === 0)
         return;
     if (references.length !== 1)
@@ -171,7 +171,7 @@ async function verifyReleaseDependencies(releaseRoot, storeRoot, references, ful
     const reference = references[0];
     const layer = fullVerification
         ? await verifyDependencyLayer(dataDir, reference, event => options.onOperation?.({ operation: event.operation, path: event.path, bytes: event.bytes }))
-        : await readCertifiedDependencyLayer(dataDir, reference.layerId, reference);
+        : await readCertifiedDependencyLayer(dataDir, reference.layerId, reference, certificationOptions);
     const binding = resolveWithin(releaseRoot, reference.binding);
     const metadata = await lstat(binding);
     if (!metadata.isSymbolicLink())

package/dist/foundation/supervision/main.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
-import { assertImmutableExecutionRoot, CohortStateStore, readCertifiedReleaseManifest } from "../release/index.js";
+import { assertImmutableExecutionRoot, CohortStateStore, readCertifiedReleaseManifest, recordParentCertifiedRelease } from "../release/index.js";
 import { publishSupervisorStartupResult, supervisorStartupFailure, supervisorStartupReady, supervisorStartupResultPath } from "../lifecycle/index.js";
 import { ControlStore } from "../storage/index.js";
 import { resolveCohortEndpoint, resolveProductPaths } from "./paths.js";
@@ -24,7 +24,10 @@ export async function runSupervisor(arguments_ = []) {
         if (!releaseRoot || !releaseId || !contentDigest)
             throw new Error(PRODUCT_TEXT.diagnostic("supervisor must be launched from a verified immutable release"));
         stage = "release-certification";
-        const release = await readCertifiedReleaseManifest({ releaseRoot, releaseId, contentDigest }, resolve(paths.dataDir, "releases"));
+        const release = await readCertifiedReleaseManifest({ releaseRoot, releaseId, contentDigest }, resolve(paths.dataDir, "releases"), { allowLegacyParentCertification: true });
+        // Compatibility: an older updater may have written release evidence before restart seals
+        // existed, even when its layer certification has already been upgraded by a retry.
+        await recordParentCertifiedRelease(release, paths.dataDir);
         stage = "immutable-root";
         await assertImmutableExecutionRoot(release, paths.dataDir);
         // Protocol: one endpoint per cohort: a superseded cohort keeps serving what it already has while the

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-06T11:53:56.572Z",
+  "builtAt": "2026-09-06T12:29:18.472Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "dc03605e5780e2aeebb4ecafd62868dc673e22ddd38b024a369aff704ff136dc",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-06T11:53:48.191Z",
+  "builtAt": "2026-09-06T12:29:19.551Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "ee8a00eaaf79c707459bbbfb52518e9739314967049fbe5fa625f36ce33db9ee",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-06T11:54:20.386Z",
+  "builtAt": "2026-09-06T12:30:04.599Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "4fc782bdb0b01e3aa12377e9d79d5e8d6222d58b6f0672d60c0dafbef9987586",
+    "sha256": "ce28943a65f5bdd6fd5a2c8b7d513a87402652e9c9089fb3a0b6323083fdd9d2",
     "size": 177664
   },
   "provenance": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.259",
+  "version": "0.1.8-dev.260",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",