@timurproko/a1 0.1.8-dev.299 → 0.1.8-dev.322

package/README.md

@@ -45,13 +45,25 @@ a1 pi                                   # vanilla Pi oracle: ~/.pi/agent
 Unsupported commands exit quietly without launching anything. The removed
 `update:<preview>` forms are not aliases; use `update --develop`.
 
+## Prompt suggestions
+
+Bare A1's `/settings` → Agent → Prompt suggestions controls faint next-prompt
+predictions. It is enabled by default and uses one additional background request
+with the selected model for eligible turns. Disabling it takes effect immediately.
+Tab accepts a suggestion as editable text; Enter submits it afterward. The setting
+remains stored in A1's profile, and `a1 pi` is unchanged.
+
 ## Prompt history
 
 Bare A1 recalls recent unique prompts across sessions with Up/Down. History is
-stored in a separate profile-local SQLite database under A1's application-data
-root, not `~/.a1/agent` or disposable caches. `/settings` → History controls
-persistence and the 10-100-entry limit (default 100), effective on next start.
-History is unencrypted user text; images are not reattached. See
+stored in a separate profile-local SQLite database at
+`~/.a1/data/history/<profile-id>.sqlite3`, or under `<A1_DATA_DIR>/history` when
+explicitly overridden. Other application data stays in its existing location.
+`/settings` → History controls persistence and the 10-100-entry limit (default
+100), effective on next start. The new default starts fresh: old platform history
+is neither imported nor automatically deleted. Ordinary upgrades and npm
+uninstall/reinstall preserve saved history. History is unencrypted user text;
+images are not reattached. See
 [prompt history](docs/features/prompt-history.md) for privacy, storage, and removal.
 
 ## Extensions

package/bin/guardian.js

@@ -3,13 +3,14 @@
 const startup = await import("../dist/foundation/startup/index.js");
 startup.enableEnvironmentCompileCache(process.env);
 await startup.markStartupPhase(process.env, "guardian-start");
-const { fileURLToPath } = await import("node:url");
 const { resolve } = await import("node:path");
 const { parseSessionSelection } = await import("../dist/foundation/lifecycle/index.js");
 const { runLaunchGuardian } = await import("../dist/foundation/launch-guardian/index.js");
 
-const releaseRoot = process.env.A1_RELEASE_ROOT ?? fileURLToPath(new URL("..", import.meta.url));
-const profileId = process.env.A1_LAUNCH_PROFILE ?? "a1";
+const { readLaunchContext } = await import("../dist/foundation/launch-context/index.js");
+const launchContext = readLaunchContext(process.env, "release");
+const releaseRoot = launchContext.releaseRoot;
+const profileId = readLaunchContext(process.env, "profile").launchProfile;
 
 Promise.resolve().then(() => runLaunchGuardian({
   sessionSelection: parseSessionSelection(process.argv.slice(2)),

package/bin/ui.js

@@ -2,14 +2,16 @@
 
 const startup = await import("../dist/foundation/startup/index.js");
 startup.enableEnvironmentCompileCache(process.env);
-const profile = process.env.A1_LAUNCH_PROFILE ?? "a1";
+const { readLaunchContext } = await import("../dist/foundation/launch-context/index.js");
+const launchContext = readLaunchContext(process.env, "profile");
+const profile = launchContext.launchProfile;
 const { installFatalExit } = await import("../dist/foundation/terminal-cleanup/index.js");
 const { resolveProductPaths } = await import("../dist/foundation/lifecycle/index.js");
 const { join } = await import("node:path");
 let runningApplication;
 const fatal = profile === "a1" ? installFatalExit({
   directory: join(resolveProductPaths().runtimeDir, "crashes"),
-  releaseId: process.env.A1_RELEASE_ID,
+  releaseId: launchContext.releaseId,
   dispose: () => runningApplication?.dispose(),
 }) : undefined;
 // Performance: begin the exact launch graph together while the trace write is pending.

package/bin/update-recovery.js

@@ -140,6 +140,7 @@ async function runRecoveredCommand(value, arguments_) {
 
 async function readCapsule(path) {
   const value = JSON.parse(await readFile(path, "utf8"));
+  if (value.launchContract !== "neutral-launch-v1") throw new Error("Unsupported private recovery contract; stop existing processes and install directly with npm. Preserve settings, sessions, and history.");
   if (value.schema !== SCHEMA || typeof value.transactionId !== "string" || typeof value.packageName !== "string"
     || typeof value.packageName !== "string" || !value.packageName.includes("/") || typeof value.targetVersion !== "string" || typeof value.packageRoot !== "string" || typeof value.globalRoot !== "string"
     || typeof value.launcherRoot !== "string" || !Array.isArray(value.launchers) || typeof value.priorReleaseId !== "string" || typeof value.priorReleaseRoot !== "string"
@@ -178,6 +179,7 @@ async function readCapsule(path) {
   assertDirectChild(releasesRoot, priorReleaseRoot);
   if (priorReleaseRoot.split(sep).at(-1) !== value.priorReleaseId) throw new Error("A1 update recovery prior release identity is invalid");
   const priorManifest = JSON.parse(await readFile(resolve(priorReleaseRoot, value.releaseManifestName), "utf8"));
+  if (priorManifest.launchContract !== "neutral-launch-v1") throw new Error("Unsupported prior private launch contract; manual cutover is required.");
   if (priorManifest.releaseId !== value.priorReleaseId || priorManifest.contentDigest !== value.priorContentDigest) {
     throw new Error("A1 update recovery prior release manifest is invalid");
   }
@@ -190,7 +192,7 @@ async function installedTargetEntry(value) {
   try {
     const manifest = JSON.parse(await readFile(resolve(value.packageRoot, "package.json"), "utf8"));
     const entry = resolve(value.packageRoot, "bin", "cli.js");
-    if (manifest.name !== value.packageName || manifest.version !== value.targetVersion || !(await lstat(entry)).isFile()) return null;
+    if (manifest.privateLaunchContract !== "neutral-launch-v1" || manifest.name !== value.packageName || manifest.version !== value.targetVersion || !(await lstat(entry)).isFile()) return null;
     return entry;
   } catch { return null; }
 }

package/dist/composition/owned-ui.js

@@ -1,4 +1,5 @@
 import { PromptHistoryService } from "../features/prompt-history/index.js";
+import { resolvePromptHistoryDataDir } from "../features/launch/index.js";
 import { resolveProductPaths } from "../foundation/lifecycle/index.js";
 import { applyConfiguredPiTheme, getAvailablePiThemes, loadHistoryEditor } from "../integrations/pi/components/index.js";
 import { createPiEngineAdapter, } from "../integrations/pi/engine/index.js";
@@ -47,7 +48,7 @@ export async function composeOwnedUi(options = {}) {
     const promptHistory = settings === null || !ownedSurfaces || settings.value("promptHistoryEnabled") === false ? null : {
         limit: typeof historyLimit === "number" ? historyLimit : 100,
         store: new PromptHistoryService({
-            dataDir: resolveProductPaths().dataDir,
+            dataDir: resolvePromptHistoryDataDir(),
             profileRoot: adapter.agentDir,
             limit: typeof historyLimit === "number" ? historyLimit : 100,
         }),

package/dist/features/launch/profile-paths.d.ts

@@ -11,4 +11,6 @@ export interface LaunchProfilePathOptions {
     readonly platform?: NodeJS.Platform;
 }
 export declare function resolveLaunchProfilePaths(options?: LaunchProfilePathOptions): LaunchProfilePaths;
+/** Select history storage without relocating control state or probing former stores. */
+export declare function resolvePromptHistoryDataDir(options?: LaunchProfilePathOptions): string;
 export declare function configurationRootForProfile(profileId: LaunchProfileId, paths: LaunchProfilePaths): string | null;

package/dist/features/launch/profile-paths.js

@@ -1,6 +1,7 @@
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { resolveProductPaths } from "../../foundation/lifecycle/index.js";
 export function resolveLaunchProfilePaths(options = {}) {
     const environment = options.environment ?? process.env;
     const path = options.platform === "win32" || (options.platform === undefined && process.platform === "win32") ? win32 : posix;
@@ -13,6 +14,16 @@ export function resolveLaunchProfilePaths(options = {}) {
         agentProfile,
     });
 }
+/** Select history storage without relocating control state or probing former stores. */
+export function resolvePromptHistoryDataDir(options = {}) {
+    const environment = options.environment ?? process.env;
+    const platform = options.platform ?? process.platform;
+    if (environment[PRODUCT_IDENTITY.environment.dataDir] !== undefined) {
+        return resolveProductPaths(environment, platform).dataDir;
+    }
+    const path = platform === "win32" ? win32 : posix;
+    return path.join(resolveLaunchProfilePaths(options).managedStateRoot, "data");
+}
 export function configurationRootForProfile(profileId, paths) {
     return profileId === "a1" ? paths.agentProfile : null;
 }

package/dist/foundation/launch-context/index.d.ts

@@ -0,0 +1,29 @@
+/** The one supported private process contract; public settings remain product identity data. */
+export declare const PRIVATE_LAUNCH_CONTRACT = "neutral-launch-v1";
+export declare const PRIVATE_ENVIRONMENT: Readonly<{
+    releaseRoot: "LAUNCH_CONTEXT_RELEASE_ROOT";
+    releaseId: "LAUNCH_CONTEXT_RELEASE_ID";
+    releaseDigest: "LAUNCH_CONTEXT_RELEASE_DIGEST";
+    releaseLayers: "LAUNCH_CONTEXT_RELEASE_LAYERS";
+    launchProfile: "LAUNCH_CONTEXT_PROFILE";
+    immutableWarmup: "LAUNCH_CONTEXT_WARMUP";
+}>;
+export interface LaunchContext {
+    readonly releaseRoot?: string;
+    readonly releaseId?: string;
+    readonly releaseDigest?: string;
+    readonly releaseLayers?: string;
+    readonly launchProfile?: "a1" | "pi";
+    readonly immutableWarmup?: "1";
+}
+export type LaunchContextRequirement = "optional" | "profile" | "release" | "warmup";
+/** Read current private keys only, with entry-specific required fields and bounded diagnostics. */
+export declare function readLaunchContext(environment: NodeJS.ProcessEnv, requirement?: LaunchContextRequirement, platform?: NodeJS.Platform): LaunchContext;
+/** Rebuild owned context without inheriting a prior session's private selection. */
+export declare function withLaunchContext(environment: NodeJS.ProcessEnv, context: LaunchContext, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Remove only this implementation's private keys, leaving user and integration settings intact. */
+export declare function withoutLaunchContext(environment: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Reject unsupported target metadata instead of negotiating or rewriting an older contract. */
+export declare function assertCurrentLaunchContract(value: {
+    readonly launchContract?: unknown;
+}): void;

package/dist/foundation/launch-context/index.js

@@ -0,0 +1,83 @@
+/** The one supported private process contract; public settings remain product identity data. */
+export const PRIVATE_LAUNCH_CONTRACT = "neutral-launch-v1";
+export const PRIVATE_ENVIRONMENT = Object.freeze({
+    releaseRoot: "LAUNCH_CONTEXT_RELEASE_ROOT",
+    releaseId: "LAUNCH_CONTEXT_RELEASE_ID",
+    releaseDigest: "LAUNCH_CONTEXT_RELEASE_DIGEST",
+    releaseLayers: "LAUNCH_CONTEXT_RELEASE_LAYERS",
+    launchProfile: "LAUNCH_CONTEXT_PROFILE",
+    immutableWarmup: "LAUNCH_CONTEXT_WARMUP",
+});
+const PRIVATE_ENTRIES = Object.entries(PRIVATE_ENVIRONMENT);
+const PRIVATE_KEYS = new Set(Object.values(PRIVATE_ENVIRONMENT));
+const LOGICAL_KEYS = new Map(PRIVATE_ENTRIES.map(([logical, key]) => [key, logical]));
+/** Read current private keys only, with entry-specific required fields and bounded diagnostics. */
+export function readLaunchContext(environment, requirement = "optional", platform = process.platform) {
+    const values = {};
+    // Performance: enumerate names only for Windows casing; never fetch unrelated environment values.
+    if (platform === "win32") {
+        for (const name of Object.keys(environment)) {
+            const logical = LOGICAL_KEYS.get(name.toUpperCase());
+            if (logical !== undefined)
+                acceptValue(values, logical, environment[name]);
+        }
+    }
+    else {
+        for (const [logical, key] of PRIVATE_ENTRIES) {
+            if (Object.prototype.propertyIsEnumerable.call(environment, key))
+                acceptValue(values, logical, environment[key]);
+        }
+    }
+    if (values.launchProfile !== undefined && values.launchProfile !== "a1" && values.launchProfile !== "pi") {
+        throw invalidContext("launchProfile", "unsupported profile");
+    }
+    if (values.immutableWarmup !== undefined && values.immutableWarmup !== "1")
+        throw invalidContext("immutableWarmup", "invalid permission flag");
+    if (values.releaseDigest !== undefined && !/^[a-f0-9]{64}$/.test(values.releaseDigest))
+        throw invalidContext("releaseDigest", "invalid digest");
+    if (requirement === "profile")
+        requireFields(values, ["launchProfile"]);
+    if (requirement === "release" || requirement === "warmup")
+        requireFields(values, ["releaseRoot", "releaseId", "releaseDigest", "releaseLayers"]);
+    if (requirement === "warmup")
+        requireFields(values, ["immutableWarmup"]);
+    return Object.freeze(values);
+}
+/** Rebuild owned context without inheriting a prior session's private selection. */
+export function withLaunchContext(environment, context, platform = process.platform) {
+    const result = withoutLaunchContext(environment, platform);
+    for (const [logical, key] of PRIVATE_ENTRIES) {
+        const value = context[logical];
+        if (value !== undefined)
+            result[key] = value;
+    }
+    readLaunchContext(result, "optional", platform);
+    return result;
+}
+/** Remove only this implementation's private keys, leaving user and integration settings intact. */
+export function withoutLaunchContext(environment, platform = process.platform) {
+    return Object.fromEntries(Object.entries(environment).filter(([key]) => !PRIVATE_KEYS.has(platform === "win32" ? key.toUpperCase() : key)));
+}
+/** Reject unsupported target metadata instead of negotiating or rewriting an older contract. */
+export function assertCurrentLaunchContract(value) {
+    if (value.launchContract !== PRIVATE_LAUNCH_CONTRACT) {
+        throw new Error("Unsupported private launch contract. Stop existing processes and install the current package directly with npm; review disposable runtime/release state before any manual reset. User settings, sessions, and history must be preserved.");
+    }
+}
+function acceptValue(values, logical, value) {
+    if (value === undefined)
+        return;
+    if (values[logical] !== undefined && values[logical] !== value)
+        throw invalidContext(logical, "conflicting environment key casing");
+    if (typeof value !== "string" || value.includes("\0") || (value.length === 0 && logical !== "releaseLayers"))
+        throw invalidContext(logical, "invalid value");
+    values[logical] = value;
+}
+function requireFields(values, fields) {
+    for (const field of fields)
+        if (values[field] === undefined)
+            throw invalidContext(field, "required current-contract field is missing");
+}
+function invalidContext(logical, reason) {
+    return new Error(`Invalid private launch context (${logical}): ${reason}`);
+}

package/dist/foundation/launch-guardian/main.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { readLaunchContext } from "../launch-context/index.js";
 import { resolve } from "node:path";
 import { assertLaunchProfileId, sessionSelectionArguments } from "../lifecycle/index.js";
 import { closeVerifiedContainment, DarwinNativeProcessInspector, LinuxNativeProcessInspector, NativeGuardianContainment, resolveProcessGuardianPath, verifyProcessGuardianArtifact, WindowsNativeProcessInspector, } from "../process-containment/index.js";
@@ -20,10 +20,11 @@ export async function runLaunchGuardian(options) {
     const guardianIdentity = await inspector.observe(process.pid);
     if (!guardianIdentity)
         throw diagnosticError("launch guardian cannot verify its own native process identity", "PROCESS_IDENTITY_UNAVAILABLE");
-    const client = options.control ?? new SupervisorClient(environment[PRODUCT_IDENTITY.environment.releaseId]);
+    const context = readLaunchContext(environment);
+    const client = options.control ?? new SupervisorClient(context.releaseId);
     // Invariant: an instance belongs to the cohort that launched it and talks to that cohort's endpoint
     // for its whole life, whatever release becomes the active one meanwhile.
-    const releaseId = environment[PRODUCT_IDENTITY.environment.releaseId];
+    const releaseId = context.releaseId;
     const endpoint = releaseId
         ? resolveCohortEndpoint(paths, releaseId, environment).endpoint
         : paths.endpoint;

package/dist/foundation/release/bootstrap.d.ts

@@ -36,7 +36,7 @@ export interface SupervisorStartupAttempt extends SupervisorStartupAttemptIdenti
     }>;
 }
 export declare function startSupervisor(release: MaterializedRelease, environment: NodeJS.ProcessEnv): Promise<SupervisorStartupAttempt>;
-export declare function releaseEnvironment(environment: NodeJS.ProcessEnv, release: MaterializedRelease): NodeJS.ProcessEnv;
+export declare function releaseEnvironment(environment: NodeJS.ProcessEnv, release: MaterializedRelease, profile?: LaunchProfileId): NodeJS.ProcessEnv;
 export declare function waitForVerifiedEndpoint(path: string, release: MaterializedRelease, timeoutMs: number, startup?: SupervisorStartupAttempt): Promise<void>;
 export declare function readEndpointMetadata(path: string): Promise<SupervisorEndpointMetadata | null>;
 export declare function probeOwnership(metadata: SupervisorEndpointMetadata): Promise<OwnershipProbe>;

package/dist/foundation/release/bootstrap.js

@@ -15,20 +15,23 @@ import { scheduleReleaseCleanup } from "./release-gc.js";
 import { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDocument } from "./restart-certification.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { markStartupPhase } from "../startup/index.js";
+import { assertCurrentLaunchContract, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
 export async function runBootstrap(options) {
-    const environment = { ...(options.environment ?? process.env) };
+    const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: options.launchIntent?.profileId ?? "a1" });
     await markStartupPhase(environment, "bootstrap-start");
     const launchProfileId = options.launchIntent?.profileId ?? "a1";
     assertLaunchProfileId(launchProfileId);
     const sessionArgs = sessionSelectionArguments(options.launchIntent?.sessionSelection);
     if (sessionArgs.length > 0 && launchProfileId !== "a1")
         throw new Error("session selection requires the normal A1 profile");
-    environment[PRODUCT_IDENTITY.environment.launchProfile] = launchProfileId;
     const output = options.output ?? process.stderr;
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
     const stateStore = new CohortStateStore(paths.dataDir);
     let state = await stateStore.read();
+    const activeRecord = state.references.active === null ? undefined : state.releases[state.references.active];
+    if (activeRecord)
+        assertCurrentLaunchContract(activeRecord);
     // Invariant: records left by cohorts whose processes are gone say nothing about ownership, and there
     // can now be several of them. Clearing them first keeps the decision below about what is
     // actually running.
@@ -191,6 +194,7 @@ async function readInstalledVersion(packageRoot) {
     return manifest.version;
 }
 export async function certifyMaterializedRelease(release, dataDir, verification = {}) {
+    assertCurrentLaunchContract(release);
     if (!consumeMaterializationProof(release)) {
         await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"), verification);
     }
@@ -198,6 +202,7 @@ export async function certifyMaterializedRelease(release, dataDir, verification
 }
 /** Persist current-format evidence after an authenticated parent has certified the exact release. */
 export async function recordParentCertifiedRelease(release, dataDir) {
+    assertCurrentLaunchContract(release);
     const path = resolve(dataDir, `certification-${release.releaseId}.json`);
     const restartSeal = await createRestartSeal(release, dataDir);
     await chmod(path, 0o600).catch(() => { });
@@ -230,22 +235,23 @@ async function launchUi(release, environment, sessionArgs) {
     const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
     return await new Promise((resolvePromise, rejectPromise) => {
         const child = spawn(process.execPath, [entry, ...sessionArgs], {
-            env: releaseEnvironment(environment, release),
+            env: releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile),
             stdio: "inherit",
             windowsHide: false,
         });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => resolvePromise(restoreAfterOwnedExit(environment[PRODUCT_IDENTITY.environment.launchProfile] === "a1", code, signal)));
+        child.once("close", (code, signal) => resolvePromise(restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal)));
     });
 }
-export function releaseEnvironment(environment, release) {
-    return {
-        ...environment,
-        [PRODUCT_IDENTITY.environment.releaseId]: release.releaseId,
-        [PRODUCT_IDENTITY.environment.releaseLayers]: (release.dependencyLayers ?? []).map(layer => layer.layerId).join(","),
-        [PRODUCT_IDENTITY.environment.releaseRoot]: release.releaseRoot,
-        [PRODUCT_IDENTITY.environment.releaseDigest]: release.contentDigest,
-    };
+export function releaseEnvironment(environment, release, profile) {
+    assertCurrentLaunchContract(release);
+    return withLaunchContext(environment, {
+        releaseId: release.releaseId,
+        releaseLayers: (release.dependencyLayers ?? []).map(layer => layer.layerId).join(","),
+        releaseRoot: release.releaseRoot,
+        releaseDigest: release.contentDigest,
+        ...(profile === undefined ? {} : { launchProfile: profile }),
+    });
 }
 export async function waitForVerifiedEndpoint(path, release, timeoutMs, startup) {
     const deadline = Date.now() + timeoutMs;

package/dist/foundation/release/cohort-state.d.ts

@@ -6,6 +6,7 @@ export interface ReleaseRecord {
     readonly releaseRoot: string;
     readonly packageVersion: string;
     readonly contentDigest: string;
+    readonly launchContract?: string;
     readonly approval: ReleaseApproval;
     readonly materializedAt: string;
     readonly certifiedAt: string | null;

package/dist/foundation/release/cohort-state.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { assertCurrentLaunchContract } from "../launch-context/index.js";
 export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
 /**
@@ -89,6 +90,7 @@ export class CohortStateStore {
                 releaseRoot: release.releaseRoot,
                 packageVersion: release.packageVersion,
                 contentDigest: release.contentDigest,
+                ...(release.launchContract === undefined ? {} : { launchContract: release.launchContract }),
                 approval: "candidate",
                 materializedAt: new Date().toISOString(),
                 certifiedAt: null,
@@ -120,6 +122,7 @@ export class CohortStateStore {
             const release = requiredRelease(current, releaseId);
             if (release.approval !== "approved")
                 throw new Error(`cannot activate unverified release ${releaseId}`);
+            assertCurrentLaunchContract(release);
             const prior = current.references.active;
             return {
                 ...current,
@@ -147,6 +150,7 @@ export class CohortStateStore {
             const rollback = requiredRelease(current, rollbackId);
             if (rollback.approval !== "approved")
                 throw new Error(`cannot roll back to unverified release ${rollbackId}`);
+            assertCurrentLaunchContract(rollback);
             return {
                 ...current,
                 references: {

package/dist/foundation/release/release-gc.js

@@ -17,8 +17,8 @@ const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
 const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
 const DEFAULT_NO_PROGRESS_BATCHES = 5;
 const DEFAULT_RETRY_DELAY_MS = 500;
-const WORKER_HOLDS_ENV = "A1_RELEASE_CLEANUP_HOLDS";
-const WORKER_RUN_ID_ENV = "A1_RELEASE_CLEANUP_RUN_ID";
+const WORKER_HOLDS_ENV = "RELEASE_CLEANUP_HOLDS";
+const WORKER_RUN_ID_ENV = "RELEASE_CLEANUP_RUN_ID";
 const WORKER_LEASE_FILENAME = "release-cleanup-worker.lock";
 /**
  * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.

package/dist/foundation/release/release-store.js

@@ -3,6 +3,7 @@ import { chmod, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_PACKAGE_NAME, createReleaseIdentity, discoverReleasePayload, releaseFileIdentity, resolveWithin, } from "./release.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
+import { assertCurrentLaunchContract, readLaunchContext } from "../launch-context/index.js";
 import { mapWithConcurrency } from "./concurrency.js";
 import { assertImmutableFileMode } from "./immutable-platform.js";
 import { dependencyReference, materializeDependencyLayer, readCertifiedDependencyLayer, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
@@ -13,6 +14,7 @@ export async function materializeRelease(packageRoot, dataDir, options = {}) {
     const payload = await discoverReleasePayload(packageRoot, {
         onSourceRead: (path, bytes) => options.onOperation?.({ operation: "source-read", path, bytes }),
     });
+    assertCurrentLaunchContract(payload);
     const storeRoot = resolve(dataDir, "releases");
     await mkdir(storeRoot, { recursive: true, mode: 0o700 });
     const dependencyPaths = payload.paths.filter(path => path.startsWith("node_modules/"));
@@ -60,7 +62,7 @@ export async function materializeRelease(packageRoot, dataDir, options = {}) {
             options.onOperation?.({ operation: "candidate-write", path, bytes: bytes.length });
             return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
         });
-        const identity = createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, layerReferences);
+        const identity = createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, layerReferences, payload.launchContract);
         if (layer !== null) {
             const binding = resolveWithin(candidate, "node_modules");
             const target = resolveWithin(layer.layerRoot, "node_modules");
@@ -137,7 +139,7 @@ export async function verifyMaterializedRelease(releaseRoot, expected, selectedS
     await mapWithConcurrency(manifest.files, RELEASE_FILE_IO_CONCURRENCY, async (file) => {
         await verifyFile(canonical, file, options);
     });
-    const recomputed = createReleaseIdentity(manifest.packageRoot, manifest.packageVersion, manifest.files, manifest.dependencyLayers ?? []).contentDigest;
+    const recomputed = createReleaseIdentity(manifest.packageRoot, manifest.packageVersion, manifest.files, manifest.dependencyLayers ?? [], manifest.launchContract).contentDigest;
     if (recomputed !== manifest.contentDigest)
         throw new Error(`release content digest mismatch for ${manifest.releaseId}`);
     await verifyReleaseDependencies(canonical, canonicalStoreRoot, manifest.dependencyLayers ?? [], true, options);
@@ -146,7 +148,7 @@ export async function verifyMaterializedRelease(releaseRoot, expected, selectedS
 export async function assertImmutableExecutionRoot(release, dataDir) {
     const storeRoot = await realpath(resolve(dataDir, "releases"));
     assertContained(storeRoot, release.releaseRoot, "release root is outside the selected release store");
-    const selectedRoot = process.env[PRODUCT_IDENTITY.environment.releaseRoot];
+    const selectedRoot = readLaunchContext(process.env, "release").releaseRoot;
     if (!selectedRoot)
         throw new Error(PRODUCT_TEXT.diagnostic("persistent process has no immutable release root"));
     const selected = await realpath(selectedRoot);
@@ -154,6 +156,7 @@ export async function assertImmutableExecutionRoot(release, dataDir) {
         throw new Error(PRODUCT_TEXT.diagnostic("persistent process selected a different immutable release root"));
 }
 export async function resolveReleaseEntryPoint(release, entryPoint) {
+    assertCurrentLaunchContract(release);
     const normalized = entryPoint.split("\\").join("/").replace(/^\.\//, "");
     if (!release.files.some(file => file.path === normalized))
         throw new Error(`entry point is not in the verified release manifest: ${entryPoint}`);
@@ -200,6 +203,7 @@ function certificationReadyRelease(release) {
     return release;
 }
 function validateManifest(value) {
+    assertCurrentLaunchContract(value);
     if (value.packageName !== PRODUCT_PACKAGE_NAME || typeof value.packageVersion !== "string")
         throw new Error(PRODUCT_TEXT.diagnostic("release manifest metadata is invalid"));
     if (!/^[a-f0-9]{64}$/.test(value.contentDigest) || !/^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/.test(value.releaseId))
@@ -218,6 +222,9 @@ function validateManifest(value) {
         if (!Number.isSafeInteger(file.bytes) || file.bytes < 0 || !/^[a-f0-9]{64}$/.test(file.sha256))
             throw new Error(`invalid release manifest file identity: ${file.path}`);
     }
+    const expected = createReleaseIdentity(value.packageRoot, value.packageVersion, value.files, value.dependencyLayers ?? [], value.launchContract);
+    if (expected.contentDigest !== value.contentDigest)
+        throw new Error("release manifest content/contract digest mismatch");
 }
 function assertContained(parent, child, message) {
     const fromParent = relative(parent, child);

package/dist/foundation/release/release.d.ts

@@ -12,6 +12,7 @@ export interface ReleaseIdentity {
     readonly contentDigest: string;
     readonly releaseId: string;
     readonly packageRoot: string;
+    readonly launchContract?: string;
     readonly files: readonly ReleaseFileIdentity[];
     /** Absent for legacy full-copy releases. */
     readonly dependencyLayers?: readonly DependencyLayerReference[];
@@ -20,6 +21,7 @@ export interface DiscoveredReleasePayload {
     readonly packageRoot: string;
     readonly packageVersion: string;
     readonly paths: readonly string[];
+    readonly launchContract?: string;
     /** Package manifests already read to discover the dependency closure. */
     readonly cachedFiles: ReadonlyMap<string, Buffer>;
 }
@@ -34,7 +36,7 @@ export declare function discoverReleasePayload(packageRoot: string, options?: Di
  * content.
  */
 export declare function deriveReleaseIdentity(packageRoot: string): Promise<ReleaseIdentity>;
-export declare function createReleaseIdentity(packageRoot: string, packageVersion: string, files: readonly ReleaseFileIdentity[], dependencyLayers?: readonly DependencyLayerReference[]): ReleaseIdentity;
+export declare function createReleaseIdentity(packageRoot: string, packageVersion: string, files: readonly ReleaseFileIdentity[], dependencyLayers?: readonly DependencyLayerReference[], launchContract?: string): ReleaseIdentity;
 export declare function releaseFileIdentity(path: string, bytes: Uint8Array, executable: boolean): ReleaseFileIdentity;
 export declare function digestManifestFiles(files: readonly ReleaseFileIdentity[]): string;
 export declare function resolveWithin(root: string, candidate: string): string;

package/dist/foundation/release/release.js

@@ -31,6 +31,7 @@ export async function discoverReleasePayload(packageRoot, options = {}) {
         packageRoot: canonicalRoot,
         packageVersion: manifest.version,
         paths: [...paths].sort(),
+        ...(typeof manifest.privateLaunchContract === "string" ? { launchContract: manifest.privateLaunchContract } : {}),
         cachedFiles,
     };
 }
@@ -49,10 +50,12 @@ export async function deriveReleaseIdentity(packageRoot) {
         const bytes = payload.cachedFiles.get(path) ?? await readFile(absolute);
         return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
     });
-    return createReleaseIdentity(payload.packageRoot, payload.packageVersion, files);
+    return createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, [], payload.launchContract);
 }
-export function createReleaseIdentity(packageRoot, packageVersion, files, dependencyLayers = []) {
-    const productDigest = digestManifestFiles(files);
+export function createReleaseIdentity(packageRoot, packageVersion, files, dependencyLayers = [], launchContract) {
+    const fileDigest = digestManifestFiles(files);
+    const productDigest = launchContract === undefined ? fileDigest
+        : createHash("sha256").update(`launch-contract\0${launchContract}\0${fileDigest}`).digest("hex");
     const contentDigest = dependencyLayers.length === 0
         ? productDigest
         : createHash("sha256")
@@ -65,6 +68,7 @@ export function createReleaseIdentity(packageRoot, packageVersion, files, depend
         contentDigest,
         releaseId: `${packageVersion}-${contentDigest.slice(0, 20)}`,
         packageRoot,
+        ...(launchContract === undefined ? {} : { launchContract }),
         files: [...files].sort(compareReleaseFiles),
         ...(dependencyLayers.length === 0 ? {} : { dependencyLayers: [...dependencyLayers] }),
     };

package/dist/foundation/release/restart-certification.d.ts

@@ -25,6 +25,7 @@ interface LayerRestartEvidence extends DependencyLayerReference {
 }
 interface RestartSealCore {
     readonly version: typeof RESTART_SEAL_VERSION;
+    readonly launchContract: string;
     readonly platform: NodeJS.Platform;
     readonly platformPolicy: ImmutablePlatformPolicy;
     readonly releaseId: string;

package/dist/foundation/release/restart-certification.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, realpath, stat } from "node:fs/promises";
 import { basename, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { assertCurrentLaunchContract } from "../launch-context/index.js";
 import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath } from "./dependency-layer.js";
 import { immutablePlatformPolicy } from "./immutable-platform.js";
 import { PRODUCT_PACKAGE_NAME } from "./release.js";
@@ -11,6 +12,7 @@ const RESTART_SEAL_VERSION = 1;
 const REQUIRED_LAUNCH_ENTRIES = ["bin/supervisor.js", "bin/guardian.js"];
 /** Build compact restart authority after complete content verification established read-only payload files. */
 export async function createRestartSeal(release, dataDir) {
+    assertCurrentLaunchContract(release);
     const policy = immutablePlatformPolicy();
     if (policy === null)
         return null;
@@ -45,6 +47,7 @@ export async function createRestartSeal(release, dataDir) {
     }));
     const core = {
         version: RESTART_SEAL_VERSION,
+        launchContract: release.launchContract,
         platform: process.platform,
         platformPolicy: policy,
         releaseId: release.releaseId,
@@ -81,6 +84,7 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
         throw new Error("restart certification differs from the approved release record");
     }
     const seal = normalizeRestartSeal(certification.restartSeal);
+    assertCurrentLaunchContract(seal);
     if (seal.platform !== process.platform || seal.platformPolicy !== immutablePlatformPolicy()) {
         throw new Error("restart certification platform immutability evidence is unsupported");
     }
@@ -129,6 +133,7 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
     }
     return {
         packageName: PRODUCT_PACKAGE_NAME,
+        launchContract: seal.launchContract,
         packageVersion: seal.packageVersion,
         contentDigest: seal.contentDigest,
         releaseId: seal.releaseId,

package/dist/foundation/release/update-recovery.d.ts

@@ -1,7 +1,9 @@
+import { PRIVATE_LAUNCH_CONTRACT } from "../launch-context/index.js";
 import type { UpdateTransaction, UpdateRecoveryState } from "./update-transaction.js";
 export declare const UPDATE_RECOVERY_SCHEMA: "a1-update-recovery-v1";
 export interface UpdateRecoveryCapsule {
     readonly schema: typeof UPDATE_RECOVERY_SCHEMA;
+    readonly launchContract: typeof PRIVATE_LAUNCH_CONTRACT;
     readonly transactionId: string;
     readonly packageName: string;
     readonly targetVersion: string;