@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/scripts/prove-clone-isolation.ts

@@ -0,0 +1,506 @@
+#!/usr/bin/env node
+/**
+ * Deterministic, offline proof for the tokenoftrust.com GTM-migration clone.
+ *
+ * This program deliberately has no configuration, network client, secret reader,
+ * renderer, GTM loader, or production binding. It exercises the supported
+ * tenant-key layouts against in-memory KV/R2 destinations, records sanitized
+ * hashes for the source before and after clone work, then applies the same
+ * bounded-prefix ownership rules as the diagnostic clone reaper.
+ */
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import {
+  cloneKvKeyPrefixes,
+  reapClone,
+} from "../src/lib/preview/clone-reap.js";
+import { reconcileTraceKey } from "../src/lib/preview/reconcileTrace.js";
+import { releaseTruthKey as releaseKey } from "../src/lib/change/store/aggregate-release-store.js";
+import { DEFAULT_AGGREGATE_ID } from "../src/lib/change/orchestrators/integration-queue.js";
+import {
+  assetsPointerKey,
+  customizationArtifactKey as artifactKey,
+  customizationPointerKey as contentPointerKey,
+  previewStateKey,
+  reviewEnvironmentIndexKey as candidateIndexKey,
+  reviewEnvironmentKey as candidateKey,
+  siteVersionIndexKey as versionsKey,
+  siteVersionKey as versionKey,
+  tenantAssetKey as assetKey,
+} from "@tot/public-runtime";
+import {
+  V84_REPLAY_SESSION_ID,
+  type V84CleanCloneReplayContext,
+} from "../src/lib/apps/v84CleanCloneReplayContext.js";
+
+export const SOURCE_TENANT = "tokenoftrust.com";
+export const CLONE_TENANT = "tokenoftrust.com~clone~gtm-migration-v84";
+
+const SOURCE_VERSION = "1".repeat(40);
+const CLONE_VERSION = "2".repeat(40);
+const SOURCE_DESIRED = "3".repeat(40);
+const CLONE_ARTIFACT = "4".repeat(64);
+// Keep this aligned with DEFAULT_AGGREGATE_ID in integration-queue.ts: the
+// source release invariant is meaningful only when it hashes the canonical
+// release-truth namespace used by reconcile/aggregate shipping.
+const AGGREGATE = DEFAULT_AGGREGATE_ID;
+const CANDIDATE = "gtm-migration-proof";
+const FIXED_AT = "2026-08-29T00:00:00.000Z";
+
+function stable(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, child]) => [key, stable(child)]),
+    );
+  }
+  return value;
+}
+
+function digest(value: unknown): string {
+  return `sha256:${createHash("sha256").update(JSON.stringify(stable(value))).digest("hex")}`;
+}
+
+function json(value: unknown): string {
+  return JSON.stringify(value);
+}
+
+class MemoryKv {
+  store = new Map<string, string>();
+  reads: string[] = [];
+  writes: string[] = [];
+
+  seed(key: string, value: unknown): void {
+    this.store.set(key, typeof value === "string" ? value : json(value));
+  }
+  get(key: string): string | null {
+    this.reads.push(key);
+    return this.store.get(key) ?? null;
+  }
+  put(key: string, value: unknown): void {
+    this.writes.push(key);
+    this.store.set(key, typeof value === "string" ? value : json(value));
+  }
+  async list({ prefix = "" }: { prefix?: string; cursor?: string; limit?: number } = {}) {
+    const keys = [...this.store.keys()]
+      .filter((key) => key.startsWith(prefix))
+      .sort()
+      .map((name) => ({ name }));
+    return { keys, list_complete: true };
+  }
+  async delete(key: string): Promise<void> {
+    this.writes.push(key);
+    this.store.delete(key);
+  }
+}
+
+class MemoryR2 {
+  store = new Map<string, Uint8Array>();
+  writes: string[] = [];
+  deletes: string[] = [];
+  put(key: string, bytes: readonly number[]): void {
+    this.writes.push(key);
+    this.store.set(key, Uint8Array.from(bytes));
+  }
+  async list({ prefix = "" }: { prefix?: string; cursor?: string } = {}) {
+    const objects = [...this.store.keys()]
+      .filter((key) => key.startsWith(prefix))
+      .sort()
+      .map((key) => ({ key }));
+    return { objects, truncated: false };
+  }
+  async delete(keys: string | string[]): Promise<void> {
+    for (const key of Array.isArray(keys) ? keys : [keys]) {
+      this.deletes.push(key);
+      this.store.delete(key);
+    }
+  }
+}
+
+function ownedKvKey(key: string, tenantId: string): boolean {
+  return cloneKvKeyPrefixes(tenantId)
+    .some((bound) => key === bound || key.startsWith(`${bound}:`));
+}
+
+/**
+ * Scan the fake KV independently of the reaper registry. The tenant must be a
+ * complete colon-delimited key component, so a source tenant never matches its
+ * clone and one clone label never matches a sibling with a longer label.
+ */
+function exactTenantKvKey(key: string, tenantId: string): boolean {
+  const marker = `:${tenantId}`;
+  let offset = key.indexOf(marker);
+  while (offset >= 0) {
+    const end = offset + marker.length;
+    if (end === key.length || key[end] === ":") return true;
+    offset = key.indexOf(marker, offset + 1);
+  }
+  return false;
+}
+
+function tenantKvKeys(kv: MemoryKv, tenantId: string): string[] {
+  return [...kv.store.keys()].filter((key) => exactTenantKvKey(key, tenantId)).sort();
+}
+
+function tenantR2Keys(r2: MemoryR2, tenantId: string): string[] {
+  const prefix = `tenants/${tenantId}/`;
+  return [...r2.store.keys()].filter((key) => key.startsWith(prefix)).sort();
+}
+
+function parseRecord(kv: MemoryKv, key: string): Record<string, unknown> {
+  const raw = kv.get(key);
+  if (raw === null) throw new Error(`missing proof fixture record: ${key}`);
+  return JSON.parse(raw);
+}
+
+function captureSource(kv: MemoryKv) {
+  const preview = parseRecord(kv, previewStateKey(SOURCE_TENANT));
+  const releaseTruthKey = releaseKey(SOURCE_TENANT, AGGREGATE);
+  const release = parseRecord(kv, releaseTruthKey);
+  return {
+    tenant: SOURCE_TENANT,
+    releaseTruthKey,
+    desired: digest(preview.target),
+    actual: digest(preview.actual),
+    release: digest({ liveReceiptId: release.liveReceiptId, lastGreenRunId: release.lastGreenRunId }),
+    combined: digest({
+      desired: preview.target,
+      actual: preview.actual,
+      releaseTruthKey,
+      release: { liveReceiptId: release.liveReceiptId, lastGreenRunId: release.lastGreenRunId },
+    }),
+  };
+}
+
+function captureCloneBefore(kv: MemoryKv, r2: MemoryR2) {
+  const kvKeys = tenantKvKeys(kv, CLONE_TENANT);
+  const r2Keys = tenantR2Keys(r2, CLONE_TENANT);
+  return {
+    tenant: CLONE_TENANT,
+    kvKeyCount: kvKeys.length,
+    r2ObjectCount: r2Keys.length,
+    namespace: digest({ kvKeys, r2Keys }),
+    state: "absent",
+  };
+}
+
+function copyPointer(kv: MemoryKv, fromKey: string, toKey: string): void {
+  const source = parseRecord(kv, fromKey);
+  kv.put(toKey, { ...source, tenantId: CLONE_TENANT });
+}
+
+function provisionClone(kv: MemoryKv): void {
+  copyPointer(kv, previewStateKey(SOURCE_TENANT), previewStateKey(CLONE_TENANT));
+  copyPointer(kv, contentPointerKey(SOURCE_TENANT), contentPointerKey(CLONE_TENANT));
+  copyPointer(kv, assetsPointerKey(SOURCE_TENANT), assetsPointerKey(CLONE_TENANT));
+  kv.put(`cust:diag-clone:${CLONE_TENANT}`, {
+    cloneId: CLONE_TENANT,
+    base: SOURCE_TENANT,
+    label: "gtm-migration-v84",
+    mode: "offline-proof",
+  });
+}
+
+function reconcileCloneLocally(kv: MemoryKv, r2: MemoryR2): void {
+  kv.put(previewStateKey(CLONE_TENANT), {
+    tenantId: CLONE_TENANT,
+    target: CLONE_VERSION,
+    actual: CLONE_VERSION,
+    lastError: null,
+    lastReconcileAt: FIXED_AT,
+  });
+  kv.put(contentPointerKey(CLONE_TENANT), {
+    tenantId: CLONE_TENANT,
+    rev: 8,
+    live: {},
+    test: {},
+    channels: { live: SOURCE_VERSION, preview: CLONE_VERSION },
+  });
+  kv.put(assetsPointerKey(CLONE_TENANT), {
+    tenantId: CLONE_TENANT,
+    rev: 8,
+    live: SOURCE_VERSION,
+    test: CLONE_VERSION,
+  });
+  kv.put(versionKey(CLONE_TENANT, CLONE_VERSION), {
+    tenantId: CLONE_TENANT,
+    versionId: CLONE_VERSION,
+    source: "commit",
+    createdAt: FIXED_AT,
+    artifacts: { "content/home.html": CLONE_ARTIFACT },
+    assets: { versionId: CLONE_VERSION, count: 1 },
+  });
+  kv.put(versionsKey(CLONE_TENANT), [{
+    versionId: CLONE_VERSION,
+    source: "commit",
+    createdAt: FIXED_AT,
+    artifactCount: 1,
+  }]);
+  kv.put(artifactKey(CLONE_TENANT, CLONE_ARTIFACT), "<sanitized-offline-artifact>");
+  kv.put(candidateKey(CLONE_TENANT, CANDIDATE), {
+    tenantId: CLONE_TENANT,
+    changeId: CANDIDATE,
+    prNumber: null,
+    branch: null,
+    headSha: CLONE_VERSION,
+    baseSha: null,
+    versionId: CLONE_VERSION,
+    status: "ready",
+    previewUrl: null,
+    evidence: null,
+    mergeable: false,
+    lastError: null,
+    updatedAt: FIXED_AT,
+  });
+  kv.put(candidateIndexKey(CLONE_TENANT), [CANDIDATE]);
+  kv.put(reconcileTraceKey(CLONE_TENANT, CLONE_VERSION), {
+    tenantId: CLONE_TENANT,
+    stage: "done",
+    mode: "offline-proof",
+  });
+  r2.put(
+    assetKey(CLONE_TENANT, CLONE_VERSION, "apps/managed-analytics/proof.js"),
+    [111, 102, 102, 108, 105, 110, 101],
+  );
+}
+
+function assertProof(condition: unknown, message: string): asserts condition {
+  if (!condition) throw new Error(`clone isolation proof failed: ${message}`);
+}
+
+const COMPLETE_REPLAY_STAGES = ["import", "native", "dogfood", "lifecycle"] as const;
+type CompleteReplayStage = (typeof COMPLETE_REPLAY_STAGES)[number];
+
+/** Create one supported fake clone state that remains active across replay stages. */
+export function createOfflineCloneReplaySession() {
+  const kv = new MemoryKv();
+  const r2 = new MemoryR2();
+  assertProof(
+    exactTenantKvKey(`cust:future-proof:${CLONE_TENANT}:child`, CLONE_TENANT),
+    "independent residual scan missed an unknown clone prefix",
+  );
+  assertProof(
+    !exactTenantKvKey(`cust:future-proof:${CLONE_TENANT}x:child`, CLONE_TENANT),
+    "independent residual scan crossed a sibling clone boundary",
+  );
+
+  kv.seed(previewStateKey(SOURCE_TENANT), {
+    tenantId: SOURCE_TENANT,
+    target: SOURCE_DESIRED,
+    actual: SOURCE_VERSION,
+    lastError: null,
+    lastReconcileAt: FIXED_AT,
+  });
+  kv.seed(contentPointerKey(SOURCE_TENANT), {
+    tenantId: SOURCE_TENANT,
+    rev: 7,
+    live: {},
+    test: {},
+    channels: { live: SOURCE_VERSION, preview: SOURCE_VERSION },
+  });
+  kv.seed(assetsPointerKey(SOURCE_TENANT), {
+    tenantId: SOURCE_TENANT,
+    rev: 7,
+    live: SOURCE_VERSION,
+    test: SOURCE_VERSION,
+  });
+  kv.seed(versionKey(SOURCE_TENANT, SOURCE_VERSION), {
+    tenantId: SOURCE_TENANT,
+    versionId: SOURCE_VERSION,
+    source: "commit",
+    createdAt: FIXED_AT,
+    artifacts: {},
+  });
+  kv.seed(releaseKey(SOURCE_TENANT, AGGREGATE), {
+    tenantId: SOURCE_TENANT,
+    aggregateId: AGGREGATE,
+    liveReceiptId: "receipt-source-6",
+    lastGreenRunId: "run-source-7",
+    rev: 6,
+    updatedAt: FIXED_AT,
+  });
+  r2.put(assetKey(SOURCE_TENANT, SOURCE_VERSION, "assets/source.css"), [115, 114, 99]);
+  const before = {
+    source: captureSource(kv),
+    clone: captureCloneBefore(kv, r2),
+  };
+  const writeAuditStart = kv.writes.length;
+  const readAuditStart = kv.reads.length;
+  const r2WriteAuditStart = r2.writes.length;
+  let state: "absent" | "active" | "cleaned" = "absent";
+  const sessionId = V84_REPLAY_SESSION_ID;
+  const sharedStatePrefix = `cust:diag-clone:${CLONE_TENANT}:shared-state:`;
+  let activeStage: CompleteReplayStage | null = null;
+  const context: V84CleanCloneReplayContext = Object.freeze({
+    sessionId,
+    cloneTenant: CLONE_TENANT,
+    read<T>(key: string): T | undefined {
+      assertProof(state === "active", "shared replay state was read outside the active session");
+      const raw = kv.get(`${sharedStatePrefix}${key}`);
+      return raw === null ? undefined : JSON.parse(raw) as T;
+    },
+    write(key: string, value: unknown): void {
+      assertProof(state === "active" && activeStage !== null, "shared replay state was written outside a stage");
+      assertProof(key.startsWith(`stage/${activeStage}/`), "stage wrote outside its shared replay namespace");
+      kv.put(`${sharedStatePrefix}${key}`, json(value));
+    },
+    delete(key: string): void {
+      assertProof(state === "active" && activeStage !== null, "shared replay state was deleted outside a stage");
+      assertProof(key.startsWith(`stage/${activeStage}/`), "stage deleted outside its shared replay namespace");
+      kv.writes.push(`${sharedStatePrefix}${key}`);
+      kv.store.delete(`${sharedStatePrefix}${key}`);
+    },
+    keys(prefix = ""): readonly string[] {
+      assertProof(state === "active", "shared replay state was listed outside the active session");
+      return [...kv.store.keys()]
+        .filter((key) => key.startsWith(`${sharedStatePrefix}${prefix}`))
+        .map((key) => key.slice(sharedStatePrefix.length))
+        .sort();
+    },
+  });
+  const stageLedger: {
+    stage: CompleteReplayStage;
+    evidenceSha256: string;
+    cloneTenant: typeof CLONE_TENANT;
+    cloneState: "active";
+    sessionId: typeof sessionId;
+    sharedStateKeyCount: number;
+  }[] = [];
+
+  return {
+    provisionAndReconcile() {
+      assertProof(state === "absent", "clone session did not start absent");
+      provisionClone(kv);
+      reconcileCloneLocally(kv, r2);
+      state = "active";
+      return {
+        state,
+        cloneTenant: CLONE_TENANT,
+        kvKeys: tenantKvKeys(kv, CLONE_TENANT),
+        r2Keys: tenantR2Keys(r2, CLONE_TENANT),
+      };
+    },
+    async runStage<T>(stage: CompleteReplayStage, operation: (context: V84CleanCloneReplayContext) => T | Promise<T>) {
+      assertProof(state === "active", "stage executed outside the active clone session");
+      assertProof(COMPLETE_REPLAY_STAGES[stageLedger.length] === stage, "complete replay stage order changed");
+      activeStage = stage;
+      let evidence: T;
+      try {
+        evidence = await operation(context);
+      } finally {
+        activeStage = null;
+      }
+      assertProof(state === "active", "stage changed the shared clone-session lifecycle");
+      const evidenceSha256 = `sha256:${createHash("sha256").update(JSON.stringify(evidence)).digest("hex")}`;
+      const sharedHandoff = context.read<T>(`stage/${stage}/handoff`);
+      assertProof(sharedHandoff !== undefined, "stage did not persist its handoff in shared clone state");
+      assertProof(
+        JSON.stringify(sharedHandoff) === JSON.stringify(evidence),
+        "stage shared-state handoff did not match its returned evidence",
+      );
+      const sharedStateKeyCount = context.keys(`stage/${stage}/`).length;
+      assertProof(sharedStateKeyCount > 0, "stage did not use the shared clone-state adapter");
+      const record: (typeof stageLedger)[number] = {
+        stage, evidenceSha256, cloneTenant: CLONE_TENANT, cloneState: "active", sessionId,
+        sharedStateKeyCount,
+      };
+      stageLedger.push(record);
+      kv.put(`cust:diag-clone:${CLONE_TENANT}:stage:${stageLedger.length}:${stage}`, record);
+      return { evidence, handoff: { ...record, ordinal: stageLedger.length } };
+    },
+    activeSnapshot() {
+      assertProof(state === "active", "clone session is not active");
+      return {
+        state,
+        cloneTenant: CLONE_TENANT,
+        stageLedger: stageLedger.map((record) => ({ ...record })),
+        kvKeys: tenantKvKeys(kv, CLONE_TENANT),
+        r2Keys: tenantR2Keys(r2, CLONE_TENANT),
+        source: captureSource(kv),
+      };
+    },
+    async cleanup(requireCompleteReplay = false) {
+      assertProof(state === "active", "cleanup requires one active clone session");
+      if (requireCompleteReplay) {
+        assertProof(stageLedger.length === COMPLETE_REPLAY_STAGES.length, "complete replay stage ledger is partial");
+      }
+      const materializedKvKeys = tenantKvKeys(kv, CLONE_TENANT);
+      const materializedR2Keys = tenantR2Keys(r2, CLONE_TENANT);
+      const sourceAfterCloneWork = captureSource(kv);
+      const sourceWrites = kv.writes.slice(writeAuditStart).filter((key) => exactTenantKvKey(key, SOURCE_TENANT));
+      const sourceReads = kv.reads.slice(readAuditStart).filter((key) => exactTenantKvKey(key, SOURCE_TENANT));
+      const sourceR2Writes = r2.writes.slice(r2WriteAuditStart)
+        .filter((key) => key.startsWith(`tenants/${SOURCE_TENANT}/`));
+      assertProof(before.source.combined === sourceAfterCloneWork.combined, "source state hash changed");
+      assertProof(sourceWrites.length === 0, "source namespace received a write");
+      assertProof(sourceR2Writes.length === 0, "source R2 namespace received a write");
+      assertProof(materializedKvKeys.every((key) => ownedKvKey(key, CLONE_TENANT)), "foreign KV key in clone set");
+      assertProof(materializedR2Keys.every((key) => key.startsWith(`tenants/${CLONE_TENANT}/`)), "foreign R2 key in clone set");
+      const cleanup = await reapClone({ kv, bucket: r2, cloneId: CLONE_TENANT });
+      state = "cleaned";
+      const sourceFinal = captureSource(kv);
+      const cloneResidual = { kvKeys: tenantKvKeys(kv, CLONE_TENANT), r2Keys: tenantR2Keys(r2, CLONE_TENANT) };
+      assertProof(sourceFinal.combined === before.source.combined, "source changed during cleanup");
+      assertProof(cloneResidual.kvKeys.length === 0 && cloneResidual.r2Keys.length === 0, "clone residual remains");
+      return {
+        schemaVersion: 1,
+        proof: "ws3-prove-source-clone-isolation",
+        constraints: {
+          mode: "offline-in-memory-only", sourceAccess: "read-only", network: "none",
+          secrets: "none", pii: "none", gtmExecution: "forbidden", rendering: "forbidden",
+          production: "forbidden",
+        },
+        before,
+        sourceInvariant: {
+          before: before.source, afterCloneWork: sourceAfterCloneWork, afterCleanup: sourceFinal,
+          readsObserved: sourceReads.length, kvWritesObserved: sourceWrites.length,
+          r2WritesObserved: sourceR2Writes.length, unchanged: true,
+        },
+        cloneIsolation: {
+          tenant: CLONE_TENANT,
+          kv: { keys: materializedKvKeys, distinctFromSource: true },
+          r2: { keys: materializedR2Keys, prefix: `tenants/${CLONE_TENANT}/`, distinctFromSource: true },
+          revisionVersion: {
+            versionKey: versionKey(CLONE_TENANT, CLONE_VERSION),
+            versionIndexKey: versionsKey(CLONE_TENANT),
+            artifactKey: artifactKey(CLONE_TENANT, CLONE_ARTIFACT),
+          },
+          candidateStaged: {
+            candidateKey: candidateKey(CLONE_TENANT, CANDIDATE),
+            candidateIndexKey: candidateIndexKey(CLONE_TENANT),
+            stagedContentPointerKey: contentPointerKey(CLONE_TENANT),
+            stagedAssetsPointerKey: assetsPointerKey(CLONE_TENANT),
+          },
+          sharedStageLedger: stageLedger.map((record) => ({ ...record })),
+        },
+        cleanup: {
+          ownership: "supported reapClone exact-tenant KV bounds and exact R2 tenant prefix",
+          kvKeysDeleted: cleanup.kvKeysDeleted, r2KeysDeleted: materializedR2Keys,
+          r2ObjectsDeleted: cleanup.r2ObjectsDeleted, cloneResidual, sourcePreserved: true,
+        },
+        result: "pass",
+      };
+    },
+  };
+}
+
+/** Run the fixed, fake-only proof and return a sanitized evidence record. */
+export async function runOfflineCloneIsolationProof() {
+  const session = createOfflineCloneReplaySession();
+  session.provisionAndReconcile();
+  return session.cleanup();
+}
+
+const invokedPath = import.meta.url.startsWith("file:") && process.argv[1]
+  ? fileURLToPath(import.meta.url) === process.argv[1]
+  : false;
+if (invokedPath) {
+  if (process.argv.length !== 2) {
+    process.stderr.write("usage: pnpm run diag:prove-clone-isolation\n");
+    process.exitCode = 64;
+  } else {
+    process.stdout.write(`${JSON.stringify(await runOfflineCloneIsolationProof(), null, 2)}\n`);
+  }
+}

package/apps/storefront/scripts/replay-v84-clean-clone-pass.ts

@@ -0,0 +1,148 @@
+/** One composed v84 replay pass over one active supported fake clone session. */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import type { GetAdapterDefinitionRequest, GetAdapterDefinitionResponse } from "@tot/public-runtime";
+import { buildV84CloneMigrationEvidence } from "../src/lib/apps/v84CloneMigrationEvidence.js";
+import { buildV84CloneLifecycleEvidence } from "../src/lib/apps/v84CloneLifecycleEvidence.js";
+import { buildV84NonportableRouteDogfood } from "../src/lib/apps/v84NonportableRouteDogfood.js";
+import { v84PublicAdapterDefinitions } from "../src/lib/apps/v84CloneNativeInstallEvidence.js";
+import { buildFixedV84NativeInstallEvidence } from "./install-v84-native-through-ws1.js";
+import { createOfflineCloneReplaySession } from "./prove-clone-isolation.js";
+import {
+  V84_CLEAN_CLONE_GRAPH_COUNT,
+  V84_CLEAN_CLONE_GRAPH_SHA256,
+  type V84CleanCloneGraphIdentity,
+} from "./v84CleanCloneGraphPin.js";
+
+const SOURCE = "tokenoftrust.com";
+const CLONE = "tokenoftrust.com~clone~gtm-migration-v84";
+const FIXTURE_SHA256 = "57d28f3ed5da4215599bfb4b74f984d8b0cd8bf7d8b31e0e1172877308e9b688";
+
+function assertPass(condition: unknown): asserts condition {
+  if (!condition) throw new Error("The composed clean-clone pass failed safely.");
+}
+
+/** Run import -> native -> dogfood -> lifecycle before reaping the same clone. */
+export async function buildComposedV84CleanClonePass(
+  options: {
+    readonly resolveGraph: () => V84CleanCloneGraphIdentity;
+    readonly fixtureText?: string;
+    readonly executionSnapshotSha256?: string;
+  },
+) {
+  const fixturePath = options.fixtureText === undefined ? fileURLToPath(new URL(
+    "../../../packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.redacted.json",
+    import.meta.url,
+  )) : undefined;
+  const fixture = options.fixtureText ?? readFileSync(fixturePath!, "utf8");
+  const fixtureBefore = createHash("sha256").update(fixture).digest("hex");
+  assertPass(fixtureBefore === FIXTURE_SHA256);
+  const graph = options.resolveGraph();
+  assertPass(graph.count === V84_CLEAN_CLONE_GRAPH_COUNT && graph.sha256 === V84_CLEAN_CLONE_GRAPH_SHA256);
+  const executionSnapshotSha256 = options.executionSnapshotSha256 ?? "source-module-test";
+  assertPass(executionSnapshotSha256 === "source-module-test" || /^[a-f0-9]{64}$/.test(executionSnapshotSha256));
+
+  const definitions = v84PublicAdapterDefinitions();
+  const catalog = {
+    async getAdapterDefinition(request: GetAdapterDefinitionRequest): Promise<GetAdapterDefinitionResponse> {
+      const found = definitions.find((definition) => definition.adapterId === request.query.adapterId);
+      if (!found) {
+        return { apiVersion: "v1", requestId: "req-composed-missing", error: { code: "not_found", message: "The requested adapter was not found." } };
+      }
+      return { apiVersion: "v1", requestId: "req-composed-catalog", data: found };
+    },
+  };
+  const session = createOfflineCloneReplaySession();
+  const provisioned = session.provisionAndReconcile();
+  assertPass(provisioned.state === "active" && provisioned.cloneTenant === CLONE);
+
+  const executionLedger: Array<{
+    stage: "import" | "native" | "dogfood" | "lifecycle";
+    sourceGraphCount: number;
+    sourceGraphSha256: string;
+    executionSnapshotSha256: string;
+  }> = [];
+  const runVerifiedStage = async <T>(
+    stage: (typeof executionLedger)[number]["stage"],
+    operation: () => T | Promise<T>,
+  ): Promise<T> => {
+    const result = await operation();
+    executionLedger.push({
+      stage,
+      sourceGraphCount: graph.count,
+      sourceGraphSha256: graph.sha256,
+      executionSnapshotSha256,
+    });
+    return result;
+  };
+
+  const importStage = await runVerifiedStage("import",
+    () => session.runStage("import", (context) => buildV84CloneMigrationEvidence(fixture, catalog, context)),
+  );
+  const nativeStage = await runVerifiedStage("native",
+    () => session.runStage("native", (context) => buildFixedV84NativeInstallEvidence(importStage.evidence, context)),
+  );
+  const dogfoodStage = await runVerifiedStage("dogfood",
+    () => session.runStage("dogfood", (context) => buildV84NonportableRouteDogfood(
+      importStage.evidence,
+      definitions.map((item) => item.adapterId),
+      context,
+    )),
+  );
+  const lifecycleStage = await runVerifiedStage("lifecycle",
+    () => session.runStage("lifecycle", (context) =>
+      buildV84CloneLifecycleEvidence(nativeStage.evidence, undefined, context)),
+  );
+
+  const activeAfterStages = session.activeSnapshot();
+  assertPass(activeAfterStages.stageLedger.length === 4);
+  const isolation = await session.cleanup(true);
+  const fixtureAfter = createHash("sha256")
+    .update(fixturePath === undefined ? fixture : readFileSync(fixturePath, "utf8"))
+    .digest("hex");
+  assertPass(fixtureAfter === fixtureBefore);
+
+  return {
+    schemaVersion: 1 as const,
+    proof: "ws3-composed-clean-clone-pass" as const,
+    scope: {
+      sourceTenant: SOURCE,
+      sourceMode: "read-only-fixed-fixture" as const,
+      cloneTenant: CLONE,
+      destinationMode: "offline-in-memory-fake-local-only" as const,
+    },
+    stateHandoff: {
+      startsAbsent: isolation.before.clone.state === "absent",
+      provisioned,
+      stageLedger: activeAfterStages.stageLedger,
+      immutableExecution: {
+        exactBytesReadOnceAndExecuted: executionSnapshotSha256 !== "source-module-test",
+        sourceGraphCount: graph.count,
+        sourceGraphSha256: graph.sha256,
+        executionSnapshotSha256,
+        ledger: executionLedger,
+      },
+      activeThroughFinalStage: activeAfterStages.state === "active",
+      sourceAtFinalStage: activeAfterStages.source,
+      cleanup: isolation.cleanup,
+    },
+    stages: {
+      import: { evidenceSha256: importStage.handoff.evidenceSha256, evidence: importStage.evidence },
+      native: { evidenceSha256: nativeStage.handoff.evidenceSha256, evidence: nativeStage.evidence },
+      dogfood: { evidenceSha256: dogfoodStage.handoff.evidenceSha256, evidence: dogfoodStage.evidence },
+      lifecycle: { evidenceSha256: lifecycleStage.handoff.evidenceSha256, evidence: lifecycleStage.evidence },
+    },
+    isolation,
+    sourceInvariant: {
+      fixtureSha256Before: fixtureBefore,
+      fixtureSha256After: fixtureAfter,
+      sourceStateBefore: isolation.sourceInvariant.before.combined,
+      sourceStateAtFinalStage: activeAfterStages.source.combined,
+      sourceStateAfterCleanup: isolation.sourceInvariant.afterCleanup.combined,
+      sourceWrites: isolation.sourceInvariant.kvWritesObserved + isolation.sourceInvariant.r2WritesObserved,
+      unchanged: isolation.sourceInvariant.unchanged,
+    },
+    result: "pass" as const,
+  };
+}

package/apps/storefront/scripts/replay-v84-clean-clone-standalone.ts

@@ -0,0 +1,35 @@
+/** Build the exact replay entirely from the single launcher-attested bundle snapshot. */
+import { installV84CleanCloneStandaloneCapabilityBoundary } from "./deny-v84-clean-clone-standalone-capabilities.mjs";
+import { buildComposedV84CleanClonePass } from "./replay-v84-clean-clone-pass.js";
+import { composeV84CleanCloneReplayEvidence } from "./replay-v84-clean-clone.js";
+import {
+  V84_CLEAN_CLONE_GRAPH_COUNT,
+  V84_CLEAN_CLONE_GRAPH_SHA256,
+} from "./v84CleanCloneGraphPin.js";
+
+declare const __V84_FIXED_FIXTURE_TEXT__: string;
+
+const snapshotSha256 = process.env.V84_REPLAY_SNAPSHOT_SHA256;
+if (typeof snapshotSha256 !== "string" || !/^[a-f0-9]{64}$/.test(snapshotSha256)) {
+  throw new Error("The fixed clean-clone replay failed safely.");
+}
+if (Object.keys(process.env).some((key) => /^(?:NODE_|ESBUILD_|NPM_|PNPM_)/i.test(key))) {
+  throw new Error("The fixed clean-clone replay failed safely.");
+}
+
+const writeOutput = process.stdout.write.bind(process.stdout);
+await installV84CleanCloneStandaloneCapabilityBoundary();
+const graph = Object.freeze({
+  paths: Object.freeze([] as string[]),
+  count: V84_CLEAN_CLONE_GRAPH_COUNT,
+  sha256: V84_CLEAN_CLONE_GRAPH_SHA256,
+});
+const passOptions = Object.freeze({
+  resolveGraph: () => graph,
+  fixtureText: __V84_FIXED_FIXTURE_TEXT__,
+  executionSnapshotSha256: snapshotSha256,
+});
+const first = await buildComposedV84CleanClonePass(passOptions);
+const second = await buildComposedV84CleanClonePass(passOptions);
+const evidence = composeV84CleanCloneReplayEvidence(first, second, graph, snapshotSha256);
+writeOutput(`${JSON.stringify(evidence, null, 2)}\n`);