@volter/twin-standard 1.0.103 → 1.0.105

package/README.md

@@ -28,8 +28,12 @@ The public `assessPack(packDir, { browser: true, consumer })` API runs inside a
 kernel dispatch and replays journeys through Chromium when their wire is HTTP. Install Playwright and Chromium for
 that target. Its report distinguishes API support, operations exercised, journey failures and replay, and does not
 claim DOM interaction coverage. `consumer` contains absolute `appDir` and `cli` paths and the candidate's
-`artifactIntegrity`. Prepare the pack's `journeys/first-use.json` with `prepareConsumerApp(packDir, newAppDir)`,
-then install its exact SDK dependencies with scripts disabled before the assessment World starts. The public
+`artifactIntegrity`. Prepare the pack's `journeys/first-use.json` with `prepareConsumerApp(packDir, newAppDir, { cli, artifact })`:
+`artifact` is the absolute unpublished tarball path, or omitted for a registry release. Preparation adds the exact candidate
+and the CLI's kernel peer to the app. Install those and its exact SDK dependencies with scripts disabled before the
+assessment World starts. The journey refuses candidate or kernel imports from evaluator ancestors and checks the
+app's own lockfile against the assessed integrity. Older evidence without this installation identity does not satisfy
+the current completion check. The public
 `runConsumerWorkflow(packDir, consumer)` lets a builder walk only that entry journey while authoring; it runs no
 grade or conformance checks. Installed readiness requires ordinary CLI initialization against the exact candidate,
 SDK assertions, read-only state inspection after stop/resume for stored workflows, and verified teardown. A

package/dist/src/assessment.d.ts

@@ -67,6 +67,19 @@ export declare function assessPack(packDir: string, options?: AssessmentOptions)
             '@volter/world-core': string;
             '@volter/world-runtime': string;
         };
+        application: {
+            candidate: {
+                package: any;
+                version: string;
+                integrity: string;
+            };
+            kernel: {
+                package: string;
+                version: string;
+            };
+            dependencyLockSha256: string;
+            appLocal: boolean;
+        };
         sourceInputsSha256: string;
         recipeSha256: string;
         fixture: string;
@@ -83,8 +96,12 @@ export declare function assessPack(packDir: string, options?: AssessmentOptions)
         teardownVerified: boolean;
         retainedReadback: boolean;
         clock: {
+            beforeStop?: string | null | undefined;
+            afterResume?: string | null | undefined;
+            retentionVerified?: boolean | undefined;
             at: string;
             advanceAfterRun?: string;
+            mode?: undefined;
         } | {
             mode: string;
         };

package/dist/src/cli.js

@@ -31,7 +31,7 @@ import { standardPackageFile } from "./package-file.js";
 import { gatePublished } from "./published.js";
 const [command, ...args] = process.argv.slice(2);
 const usage = () => {
-    console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | --version');
+    console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> [--candidate <tgz>] | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | --version');
     process.exit(2);
 };
 if (command === '--version') {
@@ -123,10 +123,12 @@ else if (command === 'prepare-consumer') {
     if (existsSync(out))
         throw new Error('Prepared consumer output already exists');
     const { prepareConsumerApp } = await import("./consumer.js");
-    const fixture = prepareConsumerApp(resolve(args[0]), appDir);
+    const candidateAt = args.indexOf('--candidate');
+    const artifact = candidateAt >= 0 ? resolve(value('--candidate')) : undefined;
+    const fixture = prepareConsumerApp(resolve(args[0]), appDir, { cli, artifact });
     const { writeFileSync } = await import('node:fs');
     writeFileSync(out, JSON.stringify({ appDir, cli, artifactIntegrity }, null, 2) + '\n');
-    console.log(JSON.stringify({ appDir, fixture, preparedConsumer: out, next: 'Install the app SDK dependencies with scripts disabled before assessing inside a World' }));
+    console.log(JSON.stringify({ appDir, fixture, preparedConsumer: out, next: 'Install the app SDK, candidate and kernel dependencies with scripts disabled before assessing inside a World' }));
 }
 else if (command === 'assess') {
     if (!args[0])

package/dist/src/consumer.d.ts

@@ -19,12 +19,16 @@ export type ConsumerOptions = {
     cli: string;
     artifactIntegrity: string;
 };
+type ConsumerInstallation = {
+    cli: string;
+    artifact?: string;
+};
 /** Bind behavior inputs on both source and packed layouts; compiled outputs and score caches are not inputs. */
 export declare function consumerSourceDigest(pack: string): string;
 /** A pack supplies its own entry journey; older immutable releases use a versioned standard fixture. */
 export declare function consumerRecipe(vendor: string, packDir?: string): ConsumerRecipe;
 /** Materialize only a new caller-owned app. Normal dependency installation happens before offline assessment. */
-export declare function prepareConsumerApp(packDir: string, appDir: string): {
+export declare function prepareConsumerApp(packDir: string, appDir: string, installation?: ConsumerInstallation): {
     recipeSha256: string;
     dependencies: Record<string, string>;
 };
@@ -47,6 +51,19 @@ export declare function runConsumerWorkflow(packDir: string, options: ConsumerOp
         '@volter/world-core': string;
         '@volter/world-runtime': string;
     };
+    application: {
+        candidate: {
+            package: any;
+            version: string;
+            integrity: string;
+        };
+        kernel: {
+            package: string;
+            version: string;
+        };
+        dependencyLockSha256: string;
+        appLocal: boolean;
+    };
     sourceInputsSha256: string;
     recipeSha256: string;
     fixture: string;
@@ -63,9 +80,14 @@ export declare function runConsumerWorkflow(packDir: string, options: ConsumerOp
     teardownVerified: boolean;
     retainedReadback: boolean;
     clock: {
+        beforeStop?: string | null | undefined;
+        afterResume?: string | null | undefined;
+        retentionVerified?: boolean | undefined;
         at: string;
         advanceAfterRun?: string;
+        mode?: undefined;
     } | {
         mode: string;
     };
 }>;
+export {};

package/dist/src/consumer.js

@@ -2,10 +2,33 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { standardPackageFile } from "./package-file.js";
+function packageIdentity(entry, name) {
+    let directory = dirname(realpathSync(entry));
+    while (true) {
+        const file = join(directory, 'package.json');
+        if (existsSync(file)) {
+            const pkg = JSON.parse(readFileSync(file, 'utf8'));
+            if (pkg.name === name)
+                return { directory, version: pkg.version };
+        }
+        const parent = dirname(directory);
+        if (parent === directory)
+            throw new Error(`${name} has no installed package identity`);
+        directory = parent;
+    }
+}
+function consumerTools(cli) {
+    const entry = realpathSync(cli), require = createRequire(entry);
+    return {
+        '@volter/world': packageIdentity(entry, '@volter/world').version,
+        '@volter/world-core': packageIdentity(require.resolve('@volter/world-core/runtime'), '@volter/world-core').version,
+        '@volter/world-runtime': packageIdentity(require.resolve('@volter/world-runtime'), '@volter/world-runtime').version,
+    };
+}
 /** Bind behavior inputs on both source and packed layouts; compiled outputs and score caches are not inputs. */
 export function consumerSourceDigest(pack) {
     const entries = [];
@@ -49,7 +72,7 @@ export function consumerRecipe(vendor, packDir) {
     return recipe;
 }
 /** Materialize only a new caller-owned app. Normal dependency installation happens before offline assessment. */
-export function prepareConsumerApp(packDir, appDir) {
+export function prepareConsumerApp(packDir, appDir, installation) {
     const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));
     const vendor = Object.keys(facts.packs ?? {})[0];
     if (!vendor || Object.keys(facts.packs).length !== 1)
@@ -71,6 +94,16 @@ export function prepareConsumerApp(packDir, appDir) {
             throw new Error('Consumer files must contain text');
         return [path, content];
     });
+    if (installation) {
+        const metadata = JSON.parse(readFileSync(join(packDir, 'package.json'), 'utf8'));
+        const tools = consumerTools(installation.cli);
+        if (installation.artifact && (!isAbsolute(installation.artifact) || !statSync(installation.artifact).isFile()))
+            throw new Error('Consumer candidate must be an absolute prepared archive path');
+        if (Object.hasOwn(app.dependencies ?? {}, metadata.name))
+            throw new Error('Consumer SDK dependencies must not substitute the candidate package');
+        app.devDependencies = { ...app.devDependencies, '@volter/world-core': tools['@volter/world-core'], [metadata.name]: installation.artifact ? `file:${installation.artifact}` : metadata.version };
+        files.find(([path]) => path === 'package.json')[1] = JSON.stringify(app, null, 2) + '\n';
+    }
     mkdirSync(appDir, { recursive: true });
     for (const [path, content] of files) {
         mkdirSync(dirname(join(appDir, path)), { recursive: true });
@@ -83,29 +116,24 @@ export async function runConsumerWorkflow(packDir, options) {
         throw new Error('Consumer requires absolute prepared paths and candidate SHA-512 integrity');
     if (existsSync(join(options.appDir, '.volter/world.json')))
         throw new Error('Consumer app already has a World; prepare a new app rather than reusing prior state');
-    const packageVersion = (entry, name) => {
-        let directory = dirname(entry);
-        while (true) {
-            const file = join(directory, 'package.json');
-            if (existsSync(file)) {
-                const pkg = JSON.parse(readFileSync(file, 'utf8'));
-                if (pkg.name === name)
-                    return pkg.version;
-            }
-            const parent = dirname(directory);
-            if (parent === directory)
-                throw new Error(`${name} has no installed package identity`);
-            directory = parent;
-        }
-    };
     const cliEntry = realpathSync(options.cli);
-    const cliRequire = createRequire(cliEntry);
-    const tools = {
-        '@volter/world': packageVersion(cliEntry, '@volter/world'),
-        '@volter/world-core': packageVersion(cliRequire.resolve('@volter/world-core/runtime'), '@volter/world-core'),
-        '@volter/world-runtime': packageVersion(cliRequire.resolve('@volter/world-runtime'), '@volter/world-runtime'),
-    };
+    const tools = consumerTools(cliEntry);
     const metadata = JSON.parse(readFileSync(join(packDir, 'package.json'), 'utf8'));
+    const appRoot = realpathSync(options.appDir), appRequire = createRequire(join(appRoot, 'package.json'));
+    const candidate = packageIdentity(appRequire.resolve(metadata.name), metadata.name);
+    const kernel = packageIdentity(appRequire.resolve('@volter/world-core/runtime'), '@volter/world-core');
+    for (const [name, identity] of [[metadata.name, candidate], ['@volter/world-core', kernel]]) {
+        const location = relative(join(appRoot, 'node_modules'), identity.directory);
+        if (location.startsWith('..') || isAbsolute(location))
+            throw new Error(`${name}: consumer resolves an evaluator or ancestor dependency; install it in the app`);
+    }
+    const appLockBytes = readFileSync(join(appRoot, 'package-lock.json'));
+    const appLock = JSON.parse(appLockBytes.toString());
+    if (candidate.version !== metadata.version || appLock.packages?.[`node_modules/${metadata.name}`]?.integrity !== options.artifactIntegrity)
+        throw new Error('Consumer app candidate does not match the exact assessed artifact');
+    if (kernel.version !== tools['@volter/world-core'] || appLock.packages?.['node_modules/@volter/world-core']?.version !== kernel.version)
+        throw new Error('Consumer app kernel does not match the CLI kernel pin');
+    const application = { candidate: { package: metadata.name, version: candidate.version, integrity: options.artifactIntegrity }, kernel: { package: '@volter/world-core', version: kernel.version }, dependencyLockSha256: createHash('sha256').update(appLockBytes).digest('hex'), appLocal: true };
     const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));
     const vendor = Object.keys(facts.packs ?? {})[0];
     if (!vendor || Object.keys(facts.packs).length !== 1)
@@ -135,6 +163,8 @@ export async function runConsumerWorkflow(packDir, options) {
     let upAttempted = false;
     let retainedReadback = false;
     let teardownVerified = false;
+    let clockBeforeStop = null;
+    let clockAfterResume = null;
     try {
         if (compiledCli)
             nodeVersion = (await execute('node-version', 'node', ['--version'])).trim();
@@ -152,9 +182,20 @@ export async function runConsumerWorkflow(packDir, options) {
                 await run('clock-advance', ['clock', 'advance', recipe.clock.advanceAfterRun]);
                 await run('inspect-timed-result', ['run', '--', ...recipe.retention.readback]);
             }
+            if (recipe.clock) {
+                clockBeforeStop = (await run('clock-before-stop', ['clock', 'show'])).trim();
+                const instant = Date.parse(clockBeforeStop);
+                if (!Number.isFinite(instant) || new Date(instant).toISOString() !== clockBeforeStop)
+                    throw new Error('Declared customer clock is not frozen before stop');
+            }
             const before = JSON.parse(await run('log-before-stop', ['log', '--json']));
             await run('stop', ['down']);
             await run('resume', ['up']);
+            if (recipe.clock) {
+                clockAfterResume = (await run('clock-after-resume', ['clock', 'show'])).trim();
+                if (clockAfterResume !== clockBeforeStop)
+                    throw new Error('Resume lost or changed the declared customer clock');
+            }
             const resumed = JSON.parse(await run('log-after-resume', ['log', '--json']));
             if (JSON.stringify(before) !== JSON.stringify(resumed))
                 throw new Error('Resume changed recorded application state before readback');
@@ -186,11 +227,11 @@ export async function runConsumerWorkflow(packDir, options) {
         measured: true, passed: failures.length === 0 && teardownVerified,
         scope: 'Exact installed artifact; normal CLI initialization, unchanged SDK, result assertions and retained-state read-only resume where applicable',
         package: metadata.name, version: metadata.version, integrity: options.artifactIntegrity,
-        tools,
+        tools, application,
         sourceInputsSha256: consumerSourceDigest(packDir), recipeSha256: createHash('sha256').update(JSON.stringify(recipe)).digest('hex'),
         fixture: existsSync(join(packDir, 'journeys/first-use.json')) ? 'journeys/first-use.json' : `standard/clients/${vendor}.first-use.json`, appDir: resolve(options.appDir), appName: basename(options.appDir),
         commands, failures, teardownVerified, retainedReadback,
-        clock: recipe.clock ?? { mode: 'wall' },
+        clock: recipe.clock ? { ...recipe.clock, ...('readback' in recipe.retention ? { beforeStop: clockBeforeStop, afterResume: clockAfterResume, retentionVerified: retainedReadback && clockBeforeStop !== null && clockBeforeStop === clockAfterResume } : {}) } : { mode: 'wall' },
         ...('none' in recipe.retention ? { retentionNotApplicable: recipe.retention.none } : {}),
         node: nodeVersion,
         evaluatorRuntime: { nodeCompatibility: process.versions.node, bun: process.versions.bun ?? null },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.103",
+  "version": "1.0.105",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -75,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.111",
+    "@volter/world-core": "3.0.113",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/cli.ts

@@ -24,7 +24,7 @@ import { gatePublished } from './published.ts';
 
 const [command, ...args] = process.argv.slice(2);
 const usage = (): never => {
-  console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | --version');
+  console.error('usage: twin-standard gate <repo> [units…] | gate-published <name>@<version>… [--registry <url>] | grade <unit>… [--static] [--form] | derive <unit> [--out <dir>] | read-page <url> [--raw] | check-sources <unit> [--recheck] | conform <pack dir> | <name>@<version> [--registry <url>] | create <dir> --init <vendor> --package <@scope/name> | create <unit> --index | facts <pack dir> [--out <file>] | prepare-consumer <pack dir> --app <new dir> --cli <volter executable> --integrity <sha512> --out <json> [--candidate <tgz>] | assess <pack dir> --prepared-consumer <json> [--browser] [--out <file>] | --version');
   process.exit(2);
 };
 
@@ -83,10 +83,12 @@ if (command === '--version') {
   const out = resolve(value('--out'));
   if (existsSync(out)) throw new Error('Prepared consumer output already exists');
   const { prepareConsumerApp } = await import('./consumer.ts');
-  const fixture = prepareConsumerApp(resolve(args[0]!), appDir);
+  const candidateAt = args.indexOf('--candidate');
+  const artifact = candidateAt >= 0 ? resolve(value('--candidate')) : undefined;
+  const fixture = prepareConsumerApp(resolve(args[0]!), appDir, { cli, artifact });
   const { writeFileSync } = await import('node:fs');
   writeFileSync(out, JSON.stringify({ appDir, cli, artifactIntegrity }, null, 2) + '\n');
-  console.log(JSON.stringify({ appDir, fixture, preparedConsumer: out, next: 'Install the app SDK dependencies with scripts disabled before assessing inside a World' }));
+  console.log(JSON.stringify({ appDir, fixture, preparedConsumer: out, next: 'Install the app SDK, candidate and kernel dependencies with scripts disabled before assessing inside a World' }));
 } else if (command === 'assess') {
   if (!args[0]) usage();
   const { assessPack } = await import('./assessment.ts');

package/src/consumer.ts

@@ -2,7 +2,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { standardPackageFile } from './package-file.ts';
@@ -17,6 +17,26 @@ export type ConsumerRecipe = {
   retention: { readback: string[] } | { none: string };
 };
 export type ConsumerOptions = { appDir: string; cli: string; artifactIntegrity: string };
+type ConsumerInstallation = { cli: string; artifact?: string };
+
+function packageIdentity(entry: string, name: string): { directory: string; version: string } {
+  let directory = dirname(realpathSync(entry));
+  while (true) {
+    const file = join(directory, 'package.json');
+    if (existsSync(file)) { const pkg = JSON.parse(readFileSync(file, 'utf8')); if (pkg.name === name) return { directory, version: pkg.version }; }
+    const parent = dirname(directory);
+    if (parent === directory) throw new Error(`${name} has no installed package identity`);
+    directory = parent;
+  }
+}
+function consumerTools(cli: string) {
+  const entry = realpathSync(cli), require = createRequire(entry);
+  return {
+    '@volter/world': packageIdentity(entry, '@volter/world').version,
+    '@volter/world-core': packageIdentity(require.resolve('@volter/world-core/runtime'), '@volter/world-core').version,
+    '@volter/world-runtime': packageIdentity(require.resolve('@volter/world-runtime'), '@volter/world-runtime').version,
+  };
+}
 
 /** Bind behavior inputs on both source and packed layouts; compiled outputs and score caches are not inputs. */
 export function consumerSourceDigest(pack: string): string {
@@ -52,7 +72,7 @@ export function consumerRecipe(vendor: string, packDir?: string): ConsumerRecipe
 }
 
 /** Materialize only a new caller-owned app. Normal dependency installation happens before offline assessment. */
-export function prepareConsumerApp(packDir: string, appDir: string): { recipeSha256: string; dependencies: Record<string, string> } {
+export function prepareConsumerApp(packDir: string, appDir: string, installation?: ConsumerInstallation): { recipeSha256: string; dependencies: Record<string, string> } {
   const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));
   const vendor = Object.keys(facts.packs ?? {})[0];
   if (!vendor || Object.keys(facts.packs).length !== 1) throw new Error('Consumer preparation requires one artifact vendor identity');
@@ -66,8 +86,16 @@ export function prepareConsumerApp(packDir: string, appDir: string): { recipeSha
   const files = Object.entries(recipe.files).map(([path, content]) => {
     if (isAbsolute(path) || path.includes('\\') || path.split('/').some((part) => !part || part === '.' || part === '..') || path.split('/').includes('node_modules') || ['.env', '.npmrc', '.volter/world.json'].includes(path)) throw new Error(`Invalid consumer file: ${path}`);
     if (typeof content !== 'string') throw new Error('Consumer files must contain text');
-    return [path, content] as const;
+    return [path, content] as [string, string];
   });
+  if (installation) {
+    const metadata = JSON.parse(readFileSync(join(packDir, 'package.json'), 'utf8'));
+    const tools = consumerTools(installation.cli);
+    if (installation.artifact && (!isAbsolute(installation.artifact) || !statSync(installation.artifact).isFile())) throw new Error('Consumer candidate must be an absolute prepared archive path');
+    if (Object.hasOwn(app.dependencies ?? {}, metadata.name)) throw new Error('Consumer SDK dependencies must not substitute the candidate package');
+    app.devDependencies = { ...app.devDependencies, '@volter/world-core': tools['@volter/world-core'], [metadata.name]: installation.artifact ? `file:${installation.artifact}` : metadata.version };
+    files.find(([path]) => path === 'package.json')![1] = JSON.stringify(app, null, 2) + '\n';
+  }
   mkdirSync(appDir, { recursive: true });
   for (const [path, content] of files) {
     mkdirSync(dirname(join(appDir, path)), { recursive: true });
@@ -79,24 +107,21 @@ export function prepareConsumerApp(packDir: string, appDir: string): { recipeSha
 export async function runConsumerWorkflow(packDir: string, options: ConsumerOptions) {
   if (!isAbsolute(options.appDir) || !isAbsolute(options.cli) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(options.artifactIntegrity)) throw new Error('Consumer requires absolute prepared paths and candidate SHA-512 integrity');
   if (existsSync(join(options.appDir, '.volter/world.json'))) throw new Error('Consumer app already has a World; prepare a new app rather than reusing prior state');
-  const packageVersion = (entry: string, name: string): string => {
-    let directory = dirname(entry);
-    while (true) {
-      const file = join(directory, 'package.json');
-      if (existsSync(file)) { const pkg = JSON.parse(readFileSync(file, 'utf8')); if (pkg.name === name) return pkg.version; }
-      const parent = dirname(directory);
-      if (parent === directory) throw new Error(`${name} has no installed package identity`);
-      directory = parent;
-    }
-  };
   const cliEntry = realpathSync(options.cli);
-  const cliRequire = createRequire(cliEntry);
-  const tools = {
-    '@volter/world': packageVersion(cliEntry, '@volter/world'),
-    '@volter/world-core': packageVersion(cliRequire.resolve('@volter/world-core/runtime'), '@volter/world-core'),
-    '@volter/world-runtime': packageVersion(cliRequire.resolve('@volter/world-runtime'), '@volter/world-runtime'),
-  };
+  const tools = consumerTools(cliEntry);
   const metadata = JSON.parse(readFileSync(join(packDir, 'package.json'), 'utf8'));
+  const appRoot = realpathSync(options.appDir), appRequire = createRequire(join(appRoot, 'package.json'));
+  const candidate = packageIdentity(appRequire.resolve(metadata.name), metadata.name);
+  const kernel = packageIdentity(appRequire.resolve('@volter/world-core/runtime'), '@volter/world-core');
+  for (const [name, identity] of [[metadata.name, candidate], ['@volter/world-core', kernel]] as const) {
+    const location = relative(join(appRoot, 'node_modules'), identity.directory);
+    if (location.startsWith('..') || isAbsolute(location)) throw new Error(`${name}: consumer resolves an evaluator or ancestor dependency; install it in the app`);
+  }
+  const appLockBytes = readFileSync(join(appRoot, 'package-lock.json'));
+  const appLock = JSON.parse(appLockBytes.toString());
+  if (candidate.version !== metadata.version || appLock.packages?.[`node_modules/${metadata.name}`]?.integrity !== options.artifactIntegrity) throw new Error('Consumer app candidate does not match the exact assessed artifact');
+  if (kernel.version !== tools['@volter/world-core'] || appLock.packages?.['node_modules/@volter/world-core']?.version !== kernel.version) throw new Error('Consumer app kernel does not match the CLI kernel pin');
+  const application = { candidate: { package: metadata.name, version: candidate.version, integrity: options.artifactIntegrity }, kernel: { package: '@volter/world-core', version: kernel.version }, dependencyLockSha256: createHash('sha256').update(appLockBytes).digest('hex'), appLocal: true };
   const facts = JSON.parse(readFileSync(join(packDir, 'generated/pack-facts.json'), 'utf8'));
   const vendor = Object.keys(facts.packs ?? {})[0];
   if (!vendor || Object.keys(facts.packs).length !== 1) throw new Error('Consumer workflow requires one selected artifact identity');
@@ -124,6 +149,8 @@ export async function runConsumerWorkflow(packDir: string, options: ConsumerOpti
   let upAttempted = false;
   let retainedReadback = false;
   let teardownVerified = false;
+  let clockBeforeStop: string | null = null;
+  let clockAfterResume: string | null = null;
   try {
     if (compiledCli) nodeVersion = (await execute('node-version', 'node', ['--version'])).trim();
     await run('init', ['init', '--twins', vendor]);
@@ -138,9 +165,18 @@ export async function runConsumerWorkflow(packDir: string, options: ConsumerOpti
         await run('clock-advance', ['clock', 'advance', recipe.clock.advanceAfterRun]);
         await run('inspect-timed-result', ['run', '--', ...recipe.retention.readback]);
       }
+      if (recipe.clock) {
+        clockBeforeStop = (await run('clock-before-stop', ['clock', 'show'])).trim();
+        const instant = Date.parse(clockBeforeStop);
+        if (!Number.isFinite(instant) || new Date(instant).toISOString() !== clockBeforeStop) throw new Error('Declared customer clock is not frozen before stop');
+      }
       const before = JSON.parse(await run('log-before-stop', ['log', '--json']));
       await run('stop', ['down']);
       await run('resume', ['up']);
+      if (recipe.clock) {
+        clockAfterResume = (await run('clock-after-resume', ['clock', 'show'])).trim();
+        if (clockAfterResume !== clockBeforeStop) throw new Error('Resume lost or changed the declared customer clock');
+      }
       const resumed = JSON.parse(await run('log-after-resume', ['log', '--json']));
       if (JSON.stringify(before) !== JSON.stringify(resumed)) throw new Error('Resume changed recorded application state before readback');
       await run('retained-readback', ['run', '--', ...recipe.retention.readback]);
@@ -163,11 +199,11 @@ export async function runConsumerWorkflow(packDir: string, options: ConsumerOpti
     measured: true, passed: failures.length === 0 && teardownVerified,
     scope: 'Exact installed artifact; normal CLI initialization, unchanged SDK, result assertions and retained-state read-only resume where applicable',
     package: metadata.name, version: metadata.version, integrity: options.artifactIntegrity,
-    tools,
+    tools, application,
     sourceInputsSha256: consumerSourceDigest(packDir), recipeSha256: createHash('sha256').update(JSON.stringify(recipe)).digest('hex'),
     fixture: existsSync(join(packDir, 'journeys/first-use.json')) ? 'journeys/first-use.json' : `standard/clients/${vendor}.first-use.json`, appDir: resolve(options.appDir), appName: basename(options.appDir),
     commands, failures, teardownVerified, retainedReadback,
-    clock: recipe.clock ?? { mode: 'wall' },
+    clock: recipe.clock ? { ...recipe.clock, ...('readback' in recipe.retention ? { beforeStop: clockBeforeStop, afterResume: clockAfterResume, retentionVerified: retainedReadback && clockBeforeStop !== null && clockBeforeStop === clockAfterResume } : {}) } : { mode: 'wall' },
     ...('none' in recipe.retention ? { retentionNotApplicable: recipe.retention.none } : {}),
     node: nodeVersion,
     evaluatorRuntime: { nodeCompatibility: process.versions.node, bun: process.versions.bun ?? null },