@viewportai/daemon 0.2.0 → 0.3.0

package/docs/protocol-matrix.json

@@ -7,7 +7,10 @@
       "schema": "src/server/ws-protocol.ts#LaunchSchema",
       "handler": "src/server/ws-command-handlers.ts#launch",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-session-lifecycle.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": true
     },
@@ -17,7 +20,10 @@
       "schema": "src/server/ws-protocol.ts#KillSchema",
       "handler": "src/server/ws-command-handlers.ts#kill",
       "unitTests": ["tests/server/ws-protocol.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-session-lifecycle.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": false
     },
@@ -27,7 +33,10 @@
       "schema": "src/server/ws-protocol.ts#PromptSchema",
       "handler": "src/server/ws-command-handlers.ts#prompt",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-session-lifecycle.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": true
     },
@@ -37,7 +46,10 @@
       "schema": "src/server/ws-protocol.ts#RespondPermissionSchema",
       "handler": "src/server/ws-command-handlers.ts#respond-permission",
       "unitTests": ["tests/server/ws-protocol.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-session-lifecycle.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": true
     },
@@ -95,7 +107,17 @@
       "type": "list-sessions",
       "class": "stable",
       "schema": "src/server/ws-protocol.ts#ListSessionsSchema",
-      "handler": "src/server/ws-command-handlers.ts#list-sessions",
+      "handler": "src/server/ws-session-command-handlers.ts#list-sessions",
+      "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
+      "integrationTests": ["tests/server/ws-server.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": false
+    },
+    {
+      "type": "read-session-messages",
+      "class": "stable",
+      "schema": "src/server/ws-protocol.ts#ReadSessionMessagesSchema",
+      "handler": "src/server/ws-session-command-handlers.ts#read-session-messages",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
       "integrationTests": ["tests/server/ws-server.test.ts"],
       "surfacedInUi": true,
@@ -105,19 +127,103 @@
       "type": "resume",
       "class": "stable",
       "schema": "src/server/ws-protocol.ts#ResumeSchema",
-      "handler": "src/server/ws-command-handlers.ts#resume",
+      "handler": "src/server/ws-session-command-handlers.ts#resume",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-session-lifecycle.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": false
     },
+    {
+      "type": "sync-request",
+      "class": "stable",
+      "schema": "src/server/ws-protocol.ts#SyncRequestSchema",
+      "handler": "src/server/ws-command-handlers.ts#sync-request",
+      "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-session-lifecycle.test.ts"
+      ],
+      "surfacedInUi": true,
+      "surfacedInCli": false
+    },
+    {
+      "type": "workflow-run",
+      "class": "experimental",
+      "schema": "src/server/ws-protocol.ts#WorkflowRunSchema",
+      "handler": "src/server/ws-workflow-command-handlers.ts#workflow-run",
+      "unitTests": [
+        "tests/server/ws-protocol.test.ts",
+        "tests/server/ws-workflow-command-handlers.test.ts"
+      ],
+      "integrationTests": ["tests/e2e/protocol-workflow-run.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": true
+    },
+    {
+      "type": "workflow-list-runs",
+      "class": "experimental",
+      "schema": "src/server/ws-protocol.ts#WorkflowListRunsSchema",
+      "handler": "src/server/ws-workflow-command-handlers.ts#workflow-list-runs",
+      "unitTests": [
+        "tests/server/ws-protocol.test.ts",
+        "tests/server/ws-workflow-command-handlers.test.ts"
+      ],
+      "integrationTests": ["tests/e2e/protocol-workflow-run.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": true
+    },
+    {
+      "type": "workflow-show-run",
+      "class": "experimental",
+      "schema": "src/server/ws-protocol.ts#WorkflowShowRunSchema",
+      "handler": "src/server/ws-workflow-command-handlers.ts#workflow-show-run",
+      "unitTests": [
+        "tests/server/ws-protocol.test.ts",
+        "tests/server/ws-workflow-command-handlers.test.ts"
+      ],
+      "integrationTests": ["tests/e2e/protocol-workflow-run.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": true
+    },
+    {
+      "type": "workflow-approve",
+      "class": "experimental",
+      "schema": "src/server/ws-protocol.ts#WorkflowApproveRunSchema",
+      "handler": "src/server/ws-workflow-command-handlers.ts#workflow-approve",
+      "unitTests": [
+        "tests/server/ws-protocol.test.ts",
+        "tests/server/ws-workflow-command-handlers.test.ts"
+      ],
+      "integrationTests": ["tests/e2e/protocol-workflow-run.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": true
+    },
+    {
+      "type": "workflow-cancel",
+      "class": "experimental",
+      "schema": "src/server/ws-protocol.ts#WorkflowCancelRunSchema",
+      "handler": "src/server/ws-workflow-command-handlers.ts#workflow-cancel",
+      "unitTests": [
+        "tests/server/ws-protocol.test.ts",
+        "tests/server/ws-workflow-command-handlers.test.ts"
+      ],
+      "integrationTests": ["tests/e2e/protocol-workflow-run.test.ts"],
+      "surfacedInUi": true,
+      "surfacedInCli": true
+    },
     {
       "type": "watch-discovered-session",
       "class": "stable",
       "schema": "src/server/ws-protocol.ts#WatchDiscoveredSessionSchema",
-      "handler": "src/server/ws-command-handlers.ts#watch-discovered-session",
+      "handler": "src/server/ws-session-command-handlers.ts#watch-discovered-session",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-discovery-hooks.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-discovery-hooks.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": false
     },
@@ -125,9 +231,12 @@
       "type": "unwatch-discovered-session",
       "class": "stable",
       "schema": "src/server/ws-protocol.ts#UnwatchDiscoveredSessionSchema",
-      "handler": "src/server/ws-command-handlers.ts#unwatch-discovered-session",
+      "handler": "src/server/ws-session-command-handlers.ts#unwatch-discovered-session",
       "unitTests": ["tests/server/ws-protocol.test.ts", "tests/server/ws-command-handlers.test.ts"],
-      "integrationTests": ["tests/server/ws-server.test.ts", "tests/e2e/protocol-discovery-hooks.test.ts"],
+      "integrationTests": [
+        "tests/server/ws-server.test.ts",
+        "tests/e2e/protocol-discovery-hooks.test.ts"
+      ],
       "surfacedInUi": true,
       "surfacedInCli": false
     },

package/docs/releasing.md

@@ -1,65 +1,33 @@
 # Releasing and npm Publish
 
-## Current source of truth
+## Scope
 
-1. npm package name: `@viewportai/daemon` (`package.json` `name`).
-2. Version source: semantic-release from commit history on `main`.
-3. Publish trigger: `.github/workflows/release.yml` after `CI` succeeds on a push to `main`.
-4. npm auth: granular `NPM_TOKEN` secret in GitHub Actions.
+This document is intentionally narrow: it describes release validation for `@viewportai/daemon`, not the repo's package-versioning policy.
 
-## Version rules
+Feature PRs should not carry release metadata unless the goal of the PR is to cut a package release.
 
-1. `feat:` => `minor` (for example `0.4.0` -> `0.5.0`).
-2. `fix:` => `patch` (for example `0.4.1` -> `0.4.2`).
-3. `perf:` / `refactor:` / `revert:` => `patch`.
-4. `BREAKING CHANGE:` footer or `!` in type/scope => `major`.
-5. `docs:`, `test:`, `chore:` alone => no release.
+Package metadata lives in `packages/daemon/package.json`. Publishing is performed through the repo's current release workflow on `main` with `NPM_TOKEN`.
 
-## One-time setup for production publish
+## Release checklist
 
-1. Create npm organization scope `@viewportai` (or verify ownership if it already exists).
-2. Ensure repository package name remains `@viewportai/daemon`.
-3. Create a granular npm token with publish rights to `@viewportai/daemon`.
-4. Add GitHub Actions secret `NPM_TOKEN` in repo settings.
-5. Ensure branch protection on `main` requires the `CI` workflow to pass before merge.
-6. Ensure branch protection on `main` requires the `Semantic PR` workflow to pass before merge.
-7. Use squash-merge so the semantic PR title becomes the release-driving commit on `main`.
-8. Ensure npm package access is public (already configured via `publishConfig.access=public`).
-9. For this repository, enforce a pre-1.0 stream with a one-time baseline tag on the bootstrap `main` commit: `git tag v0.0.0 && git push origin v0.0.0`.
-10. Keep `package.json` publish metadata canonical for provenance:
-   - `repository.url` must be exactly `https://github.com/viewportai/daemon`
-   - `bin.vpd` must be exactly `bin/vpd.js`
+Before maintainers publish:
 
-## Release flow
+1. Merge the intended daemon changes to `main`.
+2. Confirm the repo's current release workflow is the one you intend to use.
+3. Confirm npm auth is configured through the repository secret.
 
-1. Open PR with semantic commits.
-2. Merge to `main` after CI green.
-3. `release.yml` runs semantic-release:
-   - calculates next version,
-   - updates `CHANGELOG.md`, `package.json`, and `package-lock.json`,
-   - creates git tag,
-   - creates GitHub release,
-   - publishes package to npm.
-4. Validate via:
-   - GitHub release/tag exists (`vX.Y.Z`),
-   - npm package version appears in registry,
-   - `vpd --version` from fresh global install matches.
+## Validation
 
-## Local dry run
-
-Use this before rollout changes to release config:
+Before publish:
 
 ```bash
-npx -y \
-  -p semantic-release \
-  -p @semantic-release/changelog \
-  -p @semantic-release/commit-analyzer \
-  -p conventional-changelog-conventionalcommits \
-  -p @semantic-release/git \
-  -p @semantic-release/github \
-  -p @semantic-release/npm \
-  -p @semantic-release/release-notes-generator \
-  semantic-release --dry-run
+npm run build -w @viewportai/daemon
+npm run test -w @viewportai/daemon
+node packages/daemon/dist/index.js --version
 ```
 
-This does not publish; it only reports what version would be released.
+After publish:
+
+1. Confirm the new version exists on npm.
+2. Confirm the git tag exists.
+3. Confirm a fresh global install reports the same `vpd --version`.

package/docs/security.md

@@ -12,7 +12,7 @@
 - `relay`
   - Requires explicit host allowlist.
   - Auth required.
-  - Relay transport and key exchange are next-phase work.
+  - Intended for managed or self-hosted relay-backed runtime access.
 
 ## Current controls
 
@@ -30,9 +30,6 @@
 
 - `vpd pair` creates short-lived offers (default 10 minutes, max 60 minutes).
 - Offer URL contains `offerId`, one-time proof, trust-anchor fingerprint, and connection metadata, not the auth token.
-- Offers are persisted and can be listed/revoked:
-  - `vpd pair list`
-  - `vpd pair revoke <offer-id>`
 - Daemon trust anchor can be inspected:
   - `vpd pair anchor`
 - Offer redemption is one-time:
@@ -40,10 +37,10 @@
   - Local loopback profile can bypass bearer auth for redeem; LAN/relay profiles cannot.
 - Pairing events are written to `~/.viewport/pairing-audit.jsonl`.
 
-## Relay-phase extensions
+## Remaining hardening work
 
-The next phase should add:
+The current foundation still needs dedicated security review in these areas:
 
-- Explicit device identity binding.
-- Revocation propagation across relay sessions.
-- Short-lived capability tokens scoped by command/permission class.
+- explicit device identity lifecycle
+- revocation propagation across relay sessions
+- short-lived capability-token scoping by command or permission class

package/docs/testing.md

@@ -49,13 +49,13 @@ npm run check
 Local environment verification:
 
 ```bash
-# isolated daemon lifecycle verification (temp VIEWPORT_HOME + dedicated listen target)
+# daemon lifecycle verification with temporary config + dedicated listen target
 npm run verify:env
 
 # includes launchd/systemd install + active status checks
 npm run verify:env:service
 
-# validates local tarball install + binary lifecycle in isolated npm prefix
+# validates local tarball install + binary lifecycle in a temporary npm prefix
 npm run verify:install
 ```
 
@@ -84,7 +84,7 @@ npm run verify:linux:ci
 
 This validates:
 1. Tarball install verification (`verify:install`)
-2. Dev install + isolated daemon lifecycle verification (`verify:env`)
+2. Dev install + temporary-config daemon lifecycle verification (`verify:env`)
 3. systemd user-service verification when available on runner (`verify:env:service`)
 
 ## What fullstack e2e proves

package/node_modules/@viewportai/context-engine/README.md

@@ -0,0 +1,33 @@
+# @viewportai/context-engine
+
+Canonical Context Vault engine for encrypted-edge context.
+
+This package is intentionally package-local CommonJS while the standalone POC is being landed into the Viewport monorepo. The daemon should depend on this package instead of reimplementing context encryption, event storage, materialization, candidate gating, profile resolution, or bundle manifest logic.
+
+## Boundary
+
+- Stable event schema: `viewport.context_event/v1`
+- Stable bundle manifest schema: `viewport.context_bundle_manifest/v1`
+- Server sync is still disabled until platform ciphertext-only guards and external protocol review exist.
+- Device-local private material is still file-backed in this engine; OS keychain / Secure Enclave storage is a separate hardening PR.
+
+## Threat / Test Map
+
+| Threat or claim | Proof |
+| --- | --- |
+| Context bodies are encrypted in sync events | `crypto-envelope.test.js`, `private-context.test.js`, `shared-context-sync.test.js` |
+| Wrong recipient cannot unwrap shared context | `crypto-envelope.test.js`, `hpke-grants.test.js` |
+| Tampered grants or envelopes are rejected | `crypto-envelope.test.js`, `hpke-grants.test.js`, `protocol-schemas.test.js` |
+| Untrusted agent/tool output cannot bypass candidate review | `poisoning-guard.test.js`, `candidate-workflow.test.js` |
+| Revocation blocks future access while old plaintext remains an explicit limitation | `key-rotation.test.js`, `team-scale-revocation.test.js`, `user-device-access.test.js` |
+| New approved user device can read existing resource history without resource-level rewrap | `user-device-access.test.js` |
+| User-owned events are signed by approved devices instead of a plaintext identity shadow | `user-device-access.test.js` |
+| User private key material is absent from exported encrypted sync events | `user-device-access.test.js` |
+| Any authorized peer can fulfill a missing user grant | `access-model.test.js` |
+| Missing grants are key-delivery-pending, not silently denied | `access-model.test.js` |
+| Resolver/profile drift is refused unless an override is recorded | `resolver-pins.test.js`, `profile-registry.test.js` |
+| Bundle manifests are reproducible and cite selected context | `bundle-resolution.test.js`, `protocol-vectors.test.js` |
+| Offline local resolution avoids remote plaintext calls | `offline-bundle.test.js`, `local-semantic-retrieval.test.js` |
+| Cooperative erase is a signed compliance receipt, not a cryptographic claw-back | `cooperative-erase.test.js` |
+
+This map is not a replacement for the full threat model in `plan/context/`; it is the package-level release checklist for engine behavior.

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/README.md

@@ -0,0 +1,37 @@
+# Protocol Vectors
+
+These fixtures are synthetic protocol vectors for validating external
+implementations. They are not customer data and are not production secrets.
+
+Run the standalone decoder proof from the repository root:
+
+```bash
+node packages/context-engine/fixtures/protocol-vectors/standalone-decoder.mjs
+```
+
+That script intentionally imports no `@viewportai/context-engine` source modules. It
+uses Node's built-in `crypto` APIs plus the documented HPKE library to prove the
+decoder surface from fixture fields alone.
+
+Cryptographic decoder vectors:
+
+- `key-grant.json` is the legacy X25519/HKDF/AES-GCM key-grant vector. It includes
+  synthetic recipient private key material so an independent decoder can unwrap the
+  repo key from documented fields.
+- `hpke-key-grant.json` is the canonical HPKE draft grant vector for
+  `viewport.context_key_grant/hpke-draft-01`. It includes synthetic recipient HPKE
+  private key material so an independent decoder can recover the 32-byte repo key
+  from the suite, `enc`, ciphertext, info, and AAD fields.
+- `signed-event.json` is a canonical-JSON Ed25519 event-signature vector. It omits
+  the private signing key and includes the public signing key needed to verify the
+  event.
+
+Schema fixtures:
+
+- `event.json`
+- `bundle-manifest.json`
+- `profile.json`
+- `erase-receipt.json`
+
+Those schema fixtures intentionally use synthetic placeholder signatures/digests
+where the test target is JSON-schema shape rather than cryptographic decoding.

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/bundle-manifest.json

@@ -0,0 +1,50 @@
+{
+  "apiVersion": "viewport.context_bundle_manifest/v1",
+  "bundle_id": "ctxb_00000000-0000-4000-8000-000000000001",
+  "resolved_at": "2026-05-06T12:00:00.000Z",
+  "resolver": {
+    "kind": "context-vault-poc",
+    "version": "0.0.1"
+  },
+  "index": {
+    "engine": "sqlite-fts5+local-hash-embeddings",
+    "embedding_model_id": "viewport-local-hash-embed-v0",
+    "embedding_model_digest": "sha256:local-hash-embed-v0"
+  },
+  "request": {
+    "packs": ["project-standards"],
+    "target": { "type": "pull_request", "ref": "123" },
+    "include_private": false,
+    "pins": { "resolverVersion": "0.0.1" },
+    "query": "auth proof",
+    "max_items": 2
+  },
+  "profile": {
+    "name": "code-review",
+    "path": ".viewport/context/profiles/code-review.json",
+    "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+    "schemaVersion": "viewport.context_profile/v1"
+  },
+  "retrieval": {
+    "mode": "local-semantic",
+    "local_only": true,
+    "remote_plaintext_calls": 0
+  },
+  "offline": {
+    "active": false,
+    "last_sync_at": null
+  },
+  "items": [
+    {
+      "entry_id": "ctxe_00000000-0000-4000-8000-000000000001",
+      "version_id": "ctxev_00000000-0000-4000-8000-000000000001",
+      "source": "git://api/AGENTS.md#auth",
+      "trust": "approved",
+      "scope": "resource",
+      "body_mode": "included",
+      "title": "Auth review standard",
+      "retrieval_score": 3
+    }
+  ],
+  "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/erase-receipt.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": "viewport.context_erase_receipt/v1",
+  "id": "erase_00000000-0000-4000-8000-000000000001",
+  "repoId": "project-api",
+  "actorName": "bob",
+  "revocationEventId": "evt_00000000-0000-4000-8000-000000000099",
+  "erasedAt": "2026-05-06T12:00:00.000Z",
+  "cacheTombstoned": true,
+  "signature": "test-signature"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/event.json

@@ -0,0 +1,29 @@
+{
+  "id": "evt_00000000-0000-4000-8000-000000000001",
+  "repoId": "project-api",
+  "type": "member.granted",
+  "actorName": "alice",
+  "keyEpoch": 1,
+  "visibility": "shared",
+  "createdAt": "2026-05-06T12:00:00.000Z",
+  "parentIds": [],
+  "encrypted": null,
+  "grant": {
+    "recipientName": "bob",
+    "keyEpoch": 1,
+    "wrappedRepoKeyEnvelope": {
+      "version": "viewport.context_key_grant/v1",
+      "recipientName": "bob",
+      "ephemeralPublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VuAyEAAklmjmOHFwx0OcI+CUZZJzXISJodl6sR1F+t2n0AxwM=\n-----END PUBLIC KEY-----\n",
+      "encryptedRepoKey": {
+        "alg": "x25519-hkdf-sha256+a256gcm",
+        "iv": "rc9ruAWOthZ/IqST",
+        "ciphertext": "OtqgEWfOa+iyYAZzcPaxt32iPN5r+jlQin96fg+VjOM=",
+        "tag": "nVQlT/MYdUeLYU2f9A1Vag=="
+      }
+    }
+  },
+  "payloadDigest": null,
+  "schemaVersion": "viewport.context_event/v1",
+  "signature": "test-signature"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/hpke-key-grant.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "viewport.context_hpke_grant_test_vector/v1",
+  "note": "Synthetic test-only key material for independent HPKE decoder validation.",
+  "recipient": {
+    "name": "bob",
+    "hpkePublicKey": "hMEIiwjdhCBLmIIZplaNKGp1mYTwLgmUZaueCxO/UEg=",
+    "hpkePrivateKey": "syFrnRn1OPjUlejS91CacJeZJXyrlauwZZJT9uX1M80="
+  },
+  "grant": {
+    "version": "viewport.context_key_grant/hpke-draft-01",
+    "recipientName": "bob",
+    "repoId": "ctx_protocol_golden",
+    "keyEpoch": 7,
+    "suite": {
+      "kem": "DHKEM_X25519_HKDF_SHA256",
+      "kdf": "HKDF_SHA256",
+      "aead": "AES_256_GCM"
+    },
+    "enc": "HLJVnA/9rEKTXOQ56xlbNXJZjW3AH4C7sAH9jyOisDY=",
+    "ciphertext": "i86AuN9MGuZoGI/5oNeE8m1yZSvNF5Opoc3BmwnSnKK6fXJ90+lWqucVY8Us4rQs",
+    "aadDigest": "sha256:1aee4f1b637f12e595218e8bb882e1bd8eb904a77ce9da6fcf19ac32c4ba7374"
+  },
+  "expectedRepoKeyDigest": "sha256:109ec41db86953f8fc155548d636770073705a6e0939a14b7e924d2e636d64f7"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/key-grant.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": "viewport.context_key_grant_test_vector/v1",
+  "note": "Synthetic test-only key material for independent decoder validation.",
+  "recipient": {
+    "name": "bob",
+    "encryptionPrivateKey": "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VuBCIEIMi+ecpm6YRMTXcHDWs11iPmBhG6bo1cSsgpapylIcVv\n-----END PRIVATE KEY-----\n",
+    "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VuAyEAT67E4n8i4NWKrJ/GFV82l50w7wpSFfbi9+OhLYFPESc=\n-----END PUBLIC KEY-----\n"
+  },
+  "grant": {
+    "version": "viewport.context_key_grant/v1",
+    "recipientName": "bob",
+    "ephemeralPublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VuAyEAAklmjmOHFwx0OcI+CUZZJzXISJodl6sR1F+t2n0AxwM=\n-----END PUBLIC KEY-----\n",
+    "encryptedRepoKey": {
+      "alg": "x25519-hkdf-sha256+a256gcm",
+      "iv": "rc9ruAWOthZ/IqST",
+      "ciphertext": "OtqgEWfOa+iyYAZzcPaxt32iPN5r+jlQin96fg+VjOM=",
+      "tag": "nVQlT/MYdUeLYU2f9A1Vag=="
+    }
+  },
+  "expectedRepoKeyDigest": "sha256:aae82925967d6e95d553eb2c5c1e71ac29de7b4c7208ca8bbdb5f1d32ff1e8c5"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/profile.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "viewport.context_profile/v1",
+  "name": "code-review",
+  "path": ".viewport/context/profiles/code-review.json",
+  "profile": {
+    "packs": ["project-standards", "review-rules"],
+    "query": "What auth regression proof is needed for review?",
+    "maxItems": 2
+  },
+  "digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
+  "updatedAt": "2026-05-06T12:00:00.000Z"
+}

package/node_modules/@viewportai/context-engine/fixtures/protocol-vectors/signed-event.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": "viewport.context_signed_event_test_vector/v1",
+  "note": "Synthetic signed event vector. The private key is intentionally omitted; decoders verify against the public key.",
+  "actor": {
+    "name": "alice-laptop",
+    "signingPublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAdc43VFGaywZlUGIEbJDnyU/Lnaib26Tjy3knMsHF/7U=\n-----END PUBLIC KEY-----\n"
+  },
+  "event": {
+    "id": "evt_protocol_golden_000000000000000001",
+    "repoId": "ctx_protocol_golden",
+    "type": "entry.approved",
+    "actorName": "alice-laptop",
+    "keyEpoch": 7,
+    "visibility": "shared",
+    "createdAt": "2026-05-10T00:00:00.000Z",
+    "parentIds": [],
+    "encrypted": {
+      "alg": "aes-256-gcm",
+      "iv": "AAAAAAAAAAAAAAAA",
+      "ciphertext": "cHJvdG9jb2wtZ29sZGVuLWNpcGhlcnRleHQ=",
+      "tag": "BBBBBBBBBBBBBBBBBBBBBB=="
+    },
+    "grant": null,
+    "payloadDigest": "sha256:748800bd8e465b4369449954e39905047be7849b0d5158917f45eccef0fb6392",
+    "schemaVersion": "viewport.context_event/v1",
+    "signature": "n+itl+5FYUAKQ+xEBZlgBfogNuVkG4tGTETT7lp6fk6k2JeS6uSaqIxiCUAEZ7UvCxQT3RHdsJBYliuaAy67Cg=="
+  }
+}