@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/scripts/replay-v84-clean-clone.ts

@@ -0,0 +1,214 @@
+/** Validate and compose two exact passes produced by one attested immutable execution snapshot. */
+import { createHash } from "node:crypto";
+import {
+  V84_CLEAN_CLONE_GRAPH_COUNT,
+  V84_CLEAN_CLONE_GRAPH_SHA256,
+  V84_CLEAN_CLONE_LAUNCHER_ENTRY,
+  type V84CleanCloneGraphIdentity,
+} from "./v84CleanCloneGraphPin.js";
+
+const SOURCE = "tokenoftrust.com";
+const CLONE = "tokenoftrust.com~clone~gtm-migration-v84";
+const SESSION = "offline-v84-shared-clone-session";
+const FAILURE = "The fixed clean-clone replay failed safely.";
+const STAGE_ORDER = ["import", "native", "dogfood", "lifecycle"] as const;
+
+type Json = null | boolean | number | string | Json[] | { [key: string]: Json };
+function digest(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+function assertSafe(condition: unknown): asserts condition {
+  if (!condition) throw new Error(FAILURE);
+}
+function validateJson(value: unknown): asserts value is Json {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number") return assertSafe(Number.isFinite(value));
+  assertSafe(typeof value === "object");
+  if (Array.isArray(value)) return value.forEach(validateJson);
+  assertSafe(Object.getPrototypeOf(value) === Object.prototype);
+  for (const [key, child] of Object.entries(value)) {
+    assertSafe(!["__proto__", "prototype", "constructor"].includes(key));
+    validateJson(child);
+  }
+}
+function object(value: unknown): Record<string, Json> {
+  validateJson(value);
+  assertSafe(value !== null && !Array.isArray(value) && typeof value === "object");
+  return value;
+}
+function at(root: unknown, ...keys: readonly (string | number)[]): Json {
+  let current = root as Json;
+  for (const key of keys) {
+    if (typeof key === "number") {
+      assertSafe(Array.isArray(current) && key in current);
+      current = current[key]!;
+    } else {
+      assertSafe(current !== null && !Array.isArray(current) && typeof current === "object" && key in current);
+      current = current[key]!;
+    }
+  }
+  return current;
+}
+function arrayAt(root: unknown, ...keys: readonly (string | number)[]): Json[] {
+  const value = at(root, ...keys);
+  assertSafe(Array.isArray(value));
+  return value;
+}
+function validateSanitized(canonical: string): void {
+  assertSafe(!/(?:\/Users\/|\\Users\\|\/home\/|storefront-issue-|[A-Z]:\\)/i.test(canonical));
+  assertSafe(!/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i.test(canonical));
+  assertSafe(!/(?:-----BEGIN [A-Z ]+ PRIVATE KEY-----|\bBearer\s+[A-Za-z0-9._~-]+)/i.test(canonical));
+}
+function validateScope(evidence: Json, sourceMode: string, destinationMode: string): void {
+  assertSafe(at(evidence, "scope", "sourceTenant") === SOURCE);
+  assertSafe(at(evidence, "scope", "sourceMode") === sourceMode);
+  assertSafe(at(evidence, "scope", "cloneTenant") === CLONE);
+  assertSafe(at(evidence, "scope", "destinationMode") === destinationMode);
+}
+
+/** Validate that all product evidence belongs to one active, ordered clone session. */
+export function validateComposedV84Pass(unsafe: unknown): asserts unsafe is Json {
+  const evidence = object(unsafe);
+  validateScope(evidence, "read-only-fixed-fixture", "offline-in-memory-fake-local-only");
+  assertSafe(at(evidence, "proof") === "ws3-composed-clean-clone-pass");
+  assertSafe(at(evidence, "stateHandoff", "startsAbsent") === true);
+  assertSafe(at(evidence, "stateHandoff", "provisioned", "state") === "active");
+  assertSafe(at(evidence, "stateHandoff", "provisioned", "cloneTenant") === CLONE);
+  assertSafe(at(evidence, "stateHandoff", "activeThroughFinalStage") === true);
+  const immutable = at(evidence, "stateHandoff", "immutableExecution");
+  assertSafe(at(immutable, "exactBytesReadOnceAndExecuted") === true);
+  assertSafe(at(immutable, "sourceGraphCount") === V84_CLEAN_CLONE_GRAPH_COUNT);
+  assertSafe(at(immutable, "sourceGraphSha256") === V84_CLEAN_CLONE_GRAPH_SHA256);
+  const snapshotSha256 = at(immutable, "executionSnapshotSha256");
+  assertSafe(typeof snapshotSha256 === "string" && /^[a-f0-9]{64}$/.test(snapshotSha256));
+  const executionLedger = arrayAt(immutable, "ledger");
+  assertSafe(executionLedger.length === STAGE_ORDER.length);
+  const ledger = arrayAt(evidence, "stateHandoff", "stageLedger");
+  assertSafe(ledger.length === STAGE_ORDER.length);
+  for (let index = 0; index < STAGE_ORDER.length; index += 1) {
+    const row = ledger[index]!;
+    const stage = STAGE_ORDER[index]!;
+    const executionRow = executionLedger[index]!;
+    assertSafe(at(executionRow, "stage") === stage);
+    assertSafe(at(executionRow, "sourceGraphCount") === V84_CLEAN_CLONE_GRAPH_COUNT);
+    assertSafe(at(executionRow, "sourceGraphSha256") === V84_CLEAN_CLONE_GRAPH_SHA256);
+    assertSafe(at(executionRow, "executionSnapshotSha256") === snapshotSha256);
+    assertSafe(at(row, "stage") === stage);
+    assertSafe(at(row, "cloneTenant") === CLONE);
+    assertSafe(at(row, "cloneState") === "active");
+    assertSafe(at(row, "sessionId") === SESSION);
+    assertSafe(at(row, "sharedStateKeyCount") === [1, 5, 9, 4][index]);
+    assertSafe(at(row, "evidenceSha256") === at(evidence, "stages", stage, "evidenceSha256"));
+    const stageEvidence = at(evidence, "stages", stage, "evidence");
+    assertSafe(at(row, "evidenceSha256") === `sha256:${digest(JSON.stringify(stageEvidence))}`);
+  }
+  assertSafe(arrayAt(evidence, "stateHandoff", "cleanup", "cloneResidual", "kvKeys").length === 0);
+  assertSafe(arrayAt(evidence, "stateHandoff", "cleanup", "cloneResidual", "r2Keys").length === 0);
+  assertSafe(at(evidence, "stateHandoff", "cleanup", "sourcePreserved") === true);
+  const deletedKvKeys = arrayAt(evidence, "stateHandoff", "cleanup", "kvKeysDeleted");
+  for (const required of [
+    "shared-state:stage/import/handoff",
+    "shared-state:stage/native/drafts/",
+    "shared-state:stage/native/installs/",
+    "shared-state:stage/native/handoff",
+    "shared-state:stage/dogfood/artifacts/",
+    "shared-state:stage/dogfood/handoff",
+    "shared-state:stage/lifecycle/materialization/",
+    "shared-state:stage/lifecycle/cache/",
+    "shared-state:stage/lifecycle/handoff",
+  ]) {
+    assertSafe(deletedKvKeys.some((key) => typeof key === "string" && key.includes(required)));
+  }
+  assertSafe(at(evidence, "sourceInvariant", "fixtureSha256Before") === at(evidence, "sourceInvariant", "fixtureSha256After"));
+  assertSafe(at(evidence, "sourceInvariant", "sourceStateBefore") === at(evidence, "sourceInvariant", "sourceStateAtFinalStage"));
+  assertSafe(at(evidence, "sourceInvariant", "sourceStateBefore") === at(evidence, "sourceInvariant", "sourceStateAfterCleanup"));
+  assertSafe(at(evidence, "sourceInvariant", "sourceWrites") === 0);
+  assertSafe(at(evidence, "sourceInvariant", "unchanged") === true);
+  const imported = at(evidence, "stages", "import", "evidence");
+  validateScope(imported, "read-only-fixture", "offline-in-memory-only");
+  assertSafe(at(imported, "accounting", "accountedTotal") === 89);
+  assertSafe(arrayAt(imported, "codeExecutionUnsupported").length === 8);
+  assertSafe(at(imported, "safety", "sourceMutationCount") === 0);
+  assertSafe(at(imported, "safety", "networkRequestCount") === 0);
+  assertSafe(at(imported, "safety", "importedCodeExecuted") === false);
+  const native = at(evidence, "stages", "native", "evidence");
+  validateScope(native, "read-only", "offline-in-memory-fake-only");
+  assertSafe(arrayAt(native, "installations").length === 2);
+  assertSafe(at(native, "safety", "liveDestinationCount") === 0);
+  assertSafe(at(native, "safety", "externalNetworkRequestCount") === 0);
+  assertSafe(at(native, "operationCounts", "publish") === 0);
+  const dogfood = at(evidence, "stages", "dogfood", "evidence");
+  validateScope(dogfood, "read-only-fixture", "fake-local-only");
+  assertSafe(arrayAt(dogfood, "ledger").length === 8);
+  assertSafe(at(dogfood, "summary", "retired") === 3);
+  assertSafe(at(dogfood, "summary", "evidenceRejected") === 5);
+  assertSafe(at(dogfood, "summary", "unexplainedNotInstalled") === 0);
+  assertSafe(at(dogfood, "safety", "externalNetworkRequests") === 0);
+  assertSafe(at(dogfood, "safety", "dataLayerTouched") === false);
+  const lifecycle = at(evidence, "stages", "lifecycle", "evidence");
+  validateScope(lifecycle, "read-only", "offline-in-memory-callback-only");
+  assertSafe(at(lifecycle, "disabledDrafts", "materializedCount") === 0);
+  assertSafe(at(lifecycle, "operationCounts", "sourceWrites") === 0);
+  assertSafe(at(lifecycle, "operationCounts", "externalNetworkRequests") === 0);
+  assertSafe(at(lifecycle, "operationCounts", "lifecycleMutations") === 0);
+  assertSafe(at(lifecycle, "operationCounts", "publishes") === 0);
+  assertSafe(at(evidence, "result") === "pass");
+}
+
+export function composeV84CleanCloneReplayEvidence(
+  firstUnsafe: unknown,
+  secondUnsafe: unknown,
+  graph: V84CleanCloneGraphIdentity,
+  executionSnapshotSha256: string,
+) {
+  const firstCanonical = JSON.stringify(firstUnsafe);
+  const secondCanonical = JSON.stringify(secondUnsafe);
+  const first = object(JSON.parse(firstCanonical) as unknown);
+  const second = object(JSON.parse(secondCanonical) as unknown);
+  validateSanitized(firstCanonical);
+  validateSanitized(secondCanonical);
+  validateComposedV84Pass(first);
+  validateComposedV84Pass(second);
+  assertSafe(firstCanonical === secondCanonical);
+  assertSafe(graph.count === V84_CLEAN_CLONE_GRAPH_COUNT && graph.sha256 === V84_CLEAN_CLONE_GRAPH_SHA256);
+  assertSafe(/^[a-f0-9]{64}$/.test(executionSnapshotSha256));
+  assertSafe(at(first, "stateHandoff", "immutableExecution", "executionSnapshotSha256") === executionSnapshotSha256);
+  const passEvidenceSha256 = digest(firstCanonical);
+  const pass = first;
+  return {
+    schemaVersion: 2 as const,
+    proof: "ws3-composed-clean-clone-complete-replay" as const,
+    scope: at(pass, "scope"),
+    commandPin: {
+      entry: V84_CLEAN_CLONE_LAUNCHER_ENTRY,
+      resolvedSourceCount: graph.count,
+      resolvedSourceGraphSha256: graph.sha256,
+      executionSnapshotSha256,
+      composedPassEvidenceSha256: passEvidenceSha256,
+      exactBytesReadOnceAndExecuted: true as const,
+      runtimeTooling: "none" as const,
+    },
+    replay: { passes: 2 as const, exact: true as const },
+    stateHandoff: at(pass, "stateHandoff"),
+    sourceInvariant: at(pass, "sourceInvariant"),
+    accounting: at(pass, "stages", "import", "evidence", "accounting"),
+    nativeInstallSummary: {
+      count: arrayAt(pass, "stages", "native", "evidence", "installations").length,
+      lifecycle: at(pass, "stages", "native", "evidence", "safety", "lifecycle"),
+      liveDestinationCount: at(pass, "stages", "native", "evidence", "safety", "liveDestinationCount"),
+    },
+    eightRouteLedger: at(pass, "stages", "dogfood", "evidence", "ledger"),
+    eightRouteSummary: at(pass, "stages", "dogfood", "evidence", "summary"),
+    lifecycleSummary: {
+      disabledDrafts: at(pass, "stages", "lifecycle", "evidence", "disabledDrafts"),
+      operationCounts: at(pass, "stages", "lifecycle", "evidence", "operationCounts"),
+    },
+    safety: {
+      externalNetworkRequests: 0 as const, liveSecretsUsed: 0 as const,
+      productionActions: 0 as const, sourceMutations: 0 as const,
+      importedCodeExecuted: false as const, originalMarkupRendered: false as const,
+      runtimeLoaderInitialized: false as const, dataLayerTouched: false as const,
+    },
+    result: "pass" as const,
+  };
+}

package/apps/storefront/scripts/run-fixed-v84-native-install-producer.mjs

@@ -0,0 +1,18 @@
+/** Trusted plain-JavaScript bootstrap for the frozen v84 native-install producer. */
+if (process.argv.length !== 2) {
+  process.stderr.write("refused: fixed-input native-install evidence accepts no arguments\n");
+  process.exitCode = 64;
+} else try {
+  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
+  sanitizeV84ProofEnvironment();
+  await import("tsx");
+  const { tsImport } = await import("tsx/esm/api");
+  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
+  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
+  await import("./deny-v84-lifecycle-capabilities.mjs");
+  const producer = await tsImport("./install-v84-native-through-ws1.ts", import.meta.url);
+  process.stdout.write(`${JSON.stringify(await producer.buildFixedV84NativeInstallEvidence(), null, 2)}\n`);
+} catch {
+  process.stderr.write("refused: fixed native-install evidence unavailable\n");
+  process.exitCode = 70;
+}

package/apps/storefront/scripts/run-v84-clone-isolation-proof.mjs

@@ -0,0 +1,18 @@
+/** Capability-denied bootstrap for the fixed offline clone isolation proof. */
+if (process.argv.length !== 2) {
+  process.stderr.write("refused: fixed-input clone-isolation command accepts no arguments\n");
+  process.exitCode = 64;
+} else try {
+  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
+  sanitizeV84ProofEnvironment();
+  await import("tsx");
+  const { tsImport } = await import("tsx/esm/api");
+  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
+  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
+  await import("./deny-v84-lifecycle-capabilities.mjs");
+  const proof = await tsImport("./prove-clone-isolation.ts", import.meta.url);
+  process.stdout.write(`${JSON.stringify(await proof.runOfflineCloneIsolationProof(), null, 2)}\n`);
+} catch {
+  process.stderr.write("refused: fixed clone-isolation evidence unavailable\n");
+  process.exitCode = 70;
+}

package/apps/storefront/scripts/run-v84-clone-lifecycle-proof.mjs

@@ -0,0 +1,18 @@
+/** Trusted plain-JavaScript bootstrap for the fixed v84 lifecycle proof. */
+try {
+  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
+  sanitizeV84ProofEnvironment();
+  await import("tsx");
+  const { tsImport } = await import("tsx/esm/api");
+  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
+  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
+  Object.defineProperty(globalThis, Symbol.for("tot.v84.lifecycle-producer-capability"), {
+    configurable: true,
+    value: "allow-exact-native-install-producer",
+  });
+  await import("./deny-v84-lifecycle-capabilities.mjs");
+  await tsImport("./validate-v84-clone-lifecycle.ts", import.meta.url);
+} catch {
+  process.stderr.write("refused: fixed lifecycle evidence unavailable\n");
+  process.exitCode = 70;
+}

package/apps/storefront/scripts/run-v84-import-through-ws2-proof.mjs

@@ -0,0 +1,17 @@
+/** Capability-denied bootstrap for the fixed offline WS2 import proof. */
+if (process.argv.length !== 2) {
+  process.stderr.write("refused: fixed-input WS2 import command accepts no arguments\n");
+  process.exitCode = 64;
+} else try {
+  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
+  sanitizeV84ProofEnvironment();
+  await import("tsx");
+  const { tsImport } = await import("tsx/esm/api");
+  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
+  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
+  await import("./deny-v84-lifecycle-capabilities.mjs");
+  await tsImport("./import-v84-through-ws2.ts", import.meta.url);
+} catch {
+  process.stderr.write("refused: fixed WS2 import evidence unavailable\n");
+  process.exitCode = 70;
+}

package/apps/storefront/scripts/run-v84-nonportable-route-dogfood.mjs

@@ -0,0 +1,15 @@
+/** Capability-denied bootstrap for the fixed v84 eight-route dogfood proof. */
+try {
+  // No caller environment survives into the proof; live secrets cannot be read.
+  const { sanitizeV84ProofEnvironment } = await import("./sanitize-v84-proof-environment.mjs");
+  sanitizeV84ProofEnvironment();
+  await import("tsx");
+  const { tsImport } = await import("tsx/esm/api");
+  const tooling = await tsImport("./initialize-v84-lifecycle-tooling.ts", import.meta.url);
+  if (tooling.V84_LIFECYCLE_TOOLING_READY !== true) throw new Error("tooling unavailable");
+  await import("./deny-v84-dogfood-capabilities.mjs");
+  await tsImport("./dogfood-v84-nonportable-routes.ts", import.meta.url);
+} catch {
+  process.stderr.write("refused: fixed nonportable-route dogfood unavailable\n");
+  process.exitCode = 70;
+}

package/apps/storefront/scripts/sanitize-v84-proof-environment.mjs

@@ -0,0 +1,21 @@
+/** Reduce the native process environment to the one fixed proof setting. */
+export function sanitizeV84ProofEnvironment() {
+  const environment = process.env;
+  const inheritedKeys = Reflect.ownKeys(environment);
+  for (const key of inheritedKeys) {
+    if (typeof key !== "string" || !Reflect.deleteProperty(environment, key)) {
+      throw new Error("proof environment unavailable");
+    }
+  }
+  if (Reflect.ownKeys(environment).length !== 0) {
+    throw new Error("proof environment unavailable");
+  }
+  environment.TSX_DISABLE_CACHE = "1";
+  const descriptors = Object.getOwnPropertyDescriptors(environment);
+  const keys = Reflect.ownKeys(descriptors);
+  const descriptor = descriptors.TSX_DISABLE_CACHE;
+  if (keys.length !== 1 || keys[0] !== "TSX_DISABLE_CACHE" || descriptor === undefined ||
+      !("value" in descriptor) || descriptor.value !== "1") {
+    throw new Error("proof environment unavailable");
+  }
+}

package/apps/storefront/scripts/v84CleanCloneGraphPin.ts

@@ -0,0 +1,42 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveV84CleanCloneSourceGraph } from "./v84CleanCloneSourceGraph.js";
+
+export const V84_CLEAN_CLONE_LAUNCHER_ENTRY =
+  "scripts/diag/rerun-v84-clean-clone.sh" as const;
+export const V84_CLEAN_CLONE_BOOTSTRAP_ENTRY =
+  "scripts/diag/run-v84-clean-clone-attested.cjs" as const;
+export const V84_CLEAN_CLONE_STANDALONE_SOURCE_ENTRY =
+  "apps/storefront/scripts/replay-v84-clean-clone-standalone.ts" as const;
+export const V84_CLEAN_CLONE_BUILD_ENTRY =
+  "apps/storefront/scripts/build-v84-clean-clone-standalone.mjs" as const;
+export const V84_CLEAN_CLONE_GRAPH_COUNT = 191;
+export const V84_CLEAN_CLONE_GRAPH_SHA256 =
+  "e284ebf9bd5f0795bee4126c5b2e36cf7cbade05fcbcc9b716a35fa9800fa377" as const;
+
+export interface V84CleanCloneGraphIdentity {
+  readonly paths: readonly string[];
+  readonly count: number;
+  readonly sha256: string;
+}
+
+export function resolvePinnedV84CleanCloneGraph(): V84CleanCloneGraphIdentity {
+  const storefrontDir = dirname(dirname(fileURLToPath(import.meta.url)));
+  const repositoryRoot = resolve(storefrontDir, "../..");
+  return resolveV84CleanCloneSourceGraph(repositoryRoot, [
+    V84_CLEAN_CLONE_LAUNCHER_ENTRY,
+    V84_CLEAN_CLONE_BOOTSTRAP_ENTRY,
+    V84_CLEAN_CLONE_STANDALONE_SOURCE_ENTRY,
+    V84_CLEAN_CLONE_BUILD_ENTRY,
+  ]);
+}
+
+export function assertPinnedV84CleanCloneGraph(
+  resolveGraph: () => V84CleanCloneGraphIdentity = resolvePinnedV84CleanCloneGraph,
+): V84CleanCloneGraphIdentity {
+  const graph = resolveGraph();
+  if (graph.count !== V84_CLEAN_CLONE_GRAPH_COUNT || graph.sha256 !== V84_CLEAN_CLONE_GRAPH_SHA256) {
+    throw new Error("The fixed clean-clone graph changed.");
+  }
+  return graph;
+}

package/apps/storefront/scripts/v84CleanCloneSourceGraph.ts

@@ -0,0 +1,145 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, extname, relative, resolve, sep } from "node:path";
+
+const TOOLCHAIN_FILES = [
+  "package.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "apps/storefront/package.json",
+  "apps/storefront/tsconfig.json",
+] as const;
+const IMPORT_PATTERN = /(?:from\s+|import\s*(?:\(\s*)?|tsImport\s*\(\s*|require(?:\.resolve)?\s*\(\s*)["'`]([^"'`]+)["'`]/g;
+const URL_PATTERN = /new\s+URL\s*\(\s*["'`]([^"'`]+)["'`]\s*,\s*import\.meta\.url\s*\)/g;
+
+function sha256(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function canonicalSource(path: string, repositoryRoot: string): string {
+  const source = readFileSync(path, "utf8");
+  const relativePath = relative(repositoryRoot, path).split(sep).join("/");
+  if (relativePath === "apps/storefront/scripts/v84CleanCloneGraphPin.ts") {
+    const canonical = source.replace(
+      /(V84_CLEAN_CLONE_GRAPH_SHA256\s*=\s*")[a-f0-9]{64}("\s+as const)/,
+      "$1<self-pinned-graph-sha256>$2",
+    );
+    if (canonical === source) throw new Error("The clean-clone graph self-pin could not be canonicalized.");
+    return canonical;
+  }
+  if (relativePath === "scripts/diag/rerun-v84-clean-clone.sh") {
+    const canonical = source.replace(
+      /(expected_artifact_sha256=)[a-f0-9]{64}/,
+      "$1<self-pinned-replay-artifact-sha256>",
+    );
+    if (canonical === source) throw new Error("The clean-clone replay artifact pin could not be canonicalized.");
+    return canonical;
+  }
+  if (relativePath === "scripts/diag/run-v84-clean-clone-attested.cjs") {
+    const canonical = source.replace(
+      /(const expected = ")[a-f0-9]{64}(";)/,
+      "$1<self-pinned-execution-snapshot-sha256>$2",
+    );
+    if (canonical === source) throw new Error("The clean-clone bootstrap snapshot pin could not be canonicalized.");
+    return canonical;
+  }
+  return source;
+}
+
+function workspacePackages(repositoryRoot: string) {
+  const packages = new Map<string, { root: string; packageJson: string; manifest: Record<string, unknown> }>();
+  for (const parent of ["apps", "packages"]) {
+    const parentPath = resolve(repositoryRoot, parent);
+    for (const child of readdirSync(parentPath, { withFileTypes: true })) {
+      if (!child.isDirectory()) continue;
+      const root = resolve(parentPath, child.name);
+      const packageJson = resolve(root, "package.json");
+      if (!existsSync(packageJson)) continue;
+      const manifest = JSON.parse(readFileSync(packageJson, "utf8")) as Record<string, unknown>;
+      if (typeof manifest.name === "string") packages.set(manifest.name, { root, packageJson, manifest });
+    }
+  }
+  return packages;
+}
+
+function candidatePaths(target: string): string[] {
+  const extension = extname(target);
+  if (extension === ".js") return [target, `${target.slice(0, -3)}.ts`, `${target.slice(0, -3)}.mjs`];
+  if (extension) return [target];
+  return [target, `${target}.ts`, `${target}.mjs`, `${target}.js`, `${target}.json`, resolve(target, "index.ts")];
+}
+
+function exactFile(target: string): string {
+  const found = candidatePaths(target).find((path) => existsSync(path) && statSync(path).isFile());
+  if (!found) throw new Error("The clean-clone executable import graph could not be resolved.");
+  return found;
+}
+
+function exportTarget(exportsValue: unknown, key: string): string | null {
+  if (typeof exportsValue === "string" && key === ".") return exportsValue;
+  if (!exportsValue || typeof exportsValue !== "object" || Array.isArray(exportsValue)) return null;
+  const selected = (exportsValue as Record<string, unknown>)[key];
+  if (typeof selected === "string") return selected;
+  if (!selected || typeof selected !== "object" || Array.isArray(selected)) return null;
+  const conditions = selected as Record<string, unknown>;
+  for (const condition of ["import", "default", "types"]) {
+    if (typeof conditions[condition] === "string") return conditions[condition];
+  }
+  return null;
+}
+
+function resolveSpecifier(
+  specifier: string,
+  importer: string,
+  repositoryRoot: string,
+  packages: ReturnType<typeof workspacePackages>,
+): string[] {
+  const clean = specifier.split(/[?#]/, 1)[0]!;
+  if (clean.startsWith("node:") || /^[a-z]+:/i.test(clean)) return [];
+  if (clean.startsWith(".")) return [exactFile(resolve(dirname(importer), clean))];
+  if (clean.startsWith("@/")) return [exactFile(resolve(repositoryRoot, "apps/storefront/src", clean.slice(2)))];
+  const matched = [...packages.entries()]
+    .sort(([left], [right]) => right.length - left.length)
+    .find(([name]) => clean === name || clean.startsWith(`${name}/`));
+  if (!matched) return [];
+  const [name, workspace] = matched;
+  const subpath = clean === name ? "." : `.${clean.slice(name.length)}`;
+  const target = exportTarget(workspace.manifest.exports, subpath) ??
+    (subpath === "." && typeof workspace.manifest.main === "string" ? workspace.manifest.main : null);
+  if (!target) throw new Error("The clean-clone workspace barrel could not be resolved.");
+  return [workspace.packageJson, exactFile(resolve(workspace.root, target))];
+}
+
+function insideRepository(path: string, repositoryRoot: string): boolean {
+  const tail = relative(repositoryRoot, path);
+  return tail !== "" && tail !== ".." && !tail.startsWith(`..${sep}`) && !resolve(path).includes(`${sep}node_modules${sep}`);
+}
+
+export function resolveV84CleanCloneSourceGraph(repositoryRoot: string, entries: readonly string[]) {
+  const packages = workspacePackages(repositoryRoot);
+  const seen = new Set<string>();
+  const pending = [
+    ...TOOLCHAIN_FILES.map((path) => resolve(repositoryRoot, path)),
+    ...entries.map((path) => resolve(repositoryRoot, path)),
+  ];
+  while (pending.length > 0) {
+    const path = exactFile(pending.pop()!);
+    if (seen.has(path)) continue;
+    if (!insideRepository(path, repositoryRoot)) throw new Error("The clean-clone source graph escaped the repository.");
+    seen.add(path);
+    const source = readFileSync(path, "utf8");
+    const specifiers = [
+      ...[...source.matchAll(IMPORT_PATTERN)].map((match) => match[1]!),
+      ...[...source.matchAll(URL_PATTERN)].map((match) => match[1]!),
+    ];
+    for (const specifier of specifiers) {
+      for (const resolved of resolveSpecifier(specifier, path, repositoryRoot, packages)) pending.push(resolved);
+    }
+  }
+  const paths = [...seen].sort();
+  const canonical = JSON.stringify(paths.map((path) => [
+    relative(repositoryRoot, path).split(sep).join("/"),
+    canonicalSource(path, repositoryRoot),
+  ]));
+  return { paths, count: paths.length, sha256: sha256(canonical) };
+}

package/apps/storefront/scripts/validate-v84-clone-lifecycle.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/** Fixed-input lifecycle proof composed from the frozen offline native-install producer. */
+import { readFixedV84NativeInstallEvidence } from "./fixed-v84-native-install-producer.js";
+import { buildV84CloneLifecycleEvidence } from "../src/lib/apps/v84CloneLifecycleEvidence.js";
+
+if (process.argv.length !== 2) {
+  process.stderr.write("refused: fixed-input lifecycle command accepts no arguments\n");
+  process.exit(64);
+}
+
+try {
+  const nativeEvidence = readFixedV84NativeInstallEvidence();
+  const evidence = await buildV84CloneLifecycleEvidence(nativeEvidence);
+  process.stdout.write(`${JSON.stringify(evidence, null, 2)}\n`);
+} catch {
+  process.stderr.write("refused: fixed lifecycle evidence unavailable\n");
+  process.exit(70);
+}

package/apps/storefront/src/components/Img.astro

@@ -47,7 +47,7 @@ const {
 } = Astro.props;
 
 // Render decision (placeholder / Cloudflare resizing / Shopify ?width=) lives in
-// lib/imageAttrs.ts so it's unit-testable without rendering this component (D4).
+// lib/imageAttrs.ts so it's unit-testable without rendering this component.
 const { src: resolvedSrc, srcset } = resolveImage({ src, rehosted, width, height, seed, label });
 
 const loadingAttr = loading ?? (priority ? "eager" : "lazy");

package/apps/storefront/src/components/Seo.astro

@@ -3,6 +3,9 @@
  * <Seo> — per-page title/meta, Open Graph, Twitter card, canonical, JSON-LD.
  * (brief §8). Tenant-aware: OG image + site name come from the resolved tenant.
  */
+import { articleSeoMetaTags, type ArticleMeta } from "@/lib/seo/meta.js";
+import { withXDefault, type Alternate } from "@/lib/seo/alternates.js";
+
 interface JsonLd {
   [key: string]: unknown;
 }
@@ -17,6 +20,25 @@ interface Props {
   noindex?: boolean;
   /** One or more JSON-LD graphs (Product, BreadcrumbList, Organization…). */
   jsonLd?: JsonLd | JsonLd[];
+  /** Alternate RSS/Atom feeds this page advertises (e.g. a collection's feed). */
+  feeds?: { title: string; href: string }[];
+  // --- B1.6 article SEO hardening (all additive/optional) ---
+  /** Open Graph `article:*` meta; emitted only when `ogType === "article"`. */
+  article?: ArticleMeta;
+  /** og:image:alt — accessible description of the OG image. */
+  imageAlt?: string;
+  imageWidth?: number;
+  imageHeight?: number;
+  twitterSite?: string;
+  twitterCreator?: string;
+  /** Syndication: when set, REPLACES the derived self-canonical (rel=canonical
+   *  + og:url) so search engines point at the original. */
+  canonicalOverride?: string;
+  /** I2 — per-variant `hreflang` alternates for a translated article (self +
+   *  siblings). When present and non-empty, emits one `<link rel="alternate">`
+   *  per entry PLUS an `x-default`. Absent/empty ⇒ no alternate links (a
+   *  singleton post is unchanged). */
+  alternates?: Alternate[];
 }
 
 const {
@@ -27,10 +49,29 @@ const {
   ogImage,
   noindex = false,
   jsonLd,
+  feeds = [],
+  article,
+  imageAlt,
+  imageWidth,
+  imageHeight,
+  twitterSite,
+  twitterCreator,
+  canonicalOverride,
+  alternates = [],
 } = Astro.props;
 
 const { tenant, canonicalBase } = Astro.locals;
-const canonical = new URL(path, canonicalBase + "/").toString();
+const canonical =
+  canonicalOverride ?? new URL(path, canonicalBase + "/").toString();
+const articleMeta = articleSeoMetaTags({
+  ogType,
+  article,
+  imageAlt,
+  imageWidth,
+  imageHeight,
+  twitterSite,
+  twitterCreator,
+});
 // Don't double-append the brand: merchant SEO titles (title_tag) often already
 // end with the store name.
 const fullTitle = title.includes(tenant.displayName)
@@ -41,6 +82,7 @@ const image = ogImage
   : new URL(tenant.theme_tokens?.brand?.ogImage ?? "/brand/northwind-og.svg", canonicalBase + "/").toString();
 
 const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
+const alternateLinks = withXDefault(alternates);
 ---
 
 <title>{fullTitle}</title>
@@ -48,6 +90,18 @@ const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
 <link rel="canonical" href={canonical} />
 {noindex && <meta name="robots" content="noindex,nofollow" />}
 
+{
+  feeds.map((f) => (
+    <link rel="alternate" type="application/rss+xml" title={f.title} href={f.href} />
+  ))
+}
+
+{
+  alternateLinks.map((a) => (
+    <link rel="alternate" hreflang={a.hreflang} href={a.href} />
+  ))
+}
+
 <meta property="og:type" content={ogType} />
 <meta property="og:site_name" content={tenant.displayName} />
 <meta property="og:title" content={fullTitle} />
@@ -60,6 +114,16 @@ const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
 {description && <meta name="twitter:description" content={description} />}
 <meta name="twitter:image" content={image} />
 
+{
+  articleMeta.map((t) =>
+    t.property ? (
+      <meta property={t.property} content={t.content} />
+    ) : (
+      <meta name={t.name} content={t.content} />
+    ),
+  )
+}
+
 {
   graphs.map((g) => (
     <script