@yunhozz/arc 0.1.9 → 0.2.0

package/codex/skill/runtime/schema.mjs

@@ -36,6 +36,7 @@ const unique = (items,key) => items.every(x=>object(x)&&text(x[key])) && new Set
 function approval(a){return object(a)&&text(a.id)&&['user-message','human-confirmation'].includes(a.source)&&text(a.messageRef)&&hash(a.contentHash)&&object(a.scope)&&text(a.scope.taskId)&&absolute(a.scope.target)&&strings(a.scope.operations)&&a.scope.operations.every(op=>OPERATIONS.includes(op))&&strings(a.scope.paths)&&a.scope.paths.every(absolute);}
 /** Validate stored workflow data. Observed provenance must still be checked by evaluate. */
 export function validateWorkflowState(s){
+ if(object(s)&&s.workflowKind!==undefined)fail('provider state cannot use cooperative contract');
  if(!object(s)||s.schemaVersion!==1||!text(s.workflowId)||!Number.isSafeInteger(s.revision)||s.revision<0)fail('version or identity');
  if(!object(s.versions)||['policy','runtime','adapter','policyHash','runtimeHash','adapterHash'].some(k=>!text(s.versions[k])))fail('versions');
  if(['policyHash','runtimeHash','adapterHash'].some(k=>!hash(s.versions[k])))fail('hash algorithm');

package/codex/skill/runtime/scope.mjs

@@ -0,0 +1,36 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+export const absolute=value=>typeof value==='string'&&path.isAbsolute(value)&&path.normalize(value)===value;
+export const within=(base,file)=>absolute(file)&&!path.relative(base,file).split(path.sep).includes('..')&&!path.isAbsolute(path.relative(base,file));
+/** Inspect every component, including ancestors outside the ARC namespace. */
+export async function inspectPath(filename,{missing=false,directory=false}={}){
+ if(!absolute(filename))throw Error('Unsafe absolute path');
+ let cursor=path.parse(filename).root;
+ const parts=filename.slice(cursor.length).split(path.sep).filter(Boolean);
+ for(let i=0;i<parts.length;i++){
+  cursor=path.join(cursor,parts[i]);let stat;
+  try{stat=await fs.lstat(cursor);}catch(error){if(missing&&error.code==='ENOENT')return;throw error;}
+  if(stat.isSymbolicLink())throw Error('Unsafe symlink path');
+  if(i<parts.length-1||directory){if(!stat.isDirectory())throw Error('Unsafe directory type');}
+  else if(!stat.isFile())throw Error('State must be a regular file');
+ }
+}
+export function validateWorkflowId(id){if(typeof id!=='string'||!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(id))throw Error('Invalid workflow ID');return id;}
+/** Shell-free, read-only observation; inherited Git target/config overrides are removed. */
+export async function observeCooperativeTarget(cwd){
+ if(!absolute(cwd))throw Error('Absolute workspace required');await inspectPath(cwd,{directory:true});
+ const env=Object.fromEntries(Object.entries(process.env).filter(([key])=>!key.toUpperCase().startsWith('GIT_')));
+ Object.assign(env,{GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_OPTIONAL_LOCKS:'0',GIT_NO_REPLACE_OBJECTS:'1',GIT_NO_LAZY_FETCH:'1',GIT_TERMINAL_PROMPT:'0'});
+ const query=(args,detached=false)=>{const r=spawnSync('git',['--no-pager','-c','core.fsmonitor=false',...args],{cwd,env,encoding:'utf8',timeout:10000,maxBuffer:1024*1024});if(detached&&r.status===1&&!r.error)return null;if(r.status!==0||r.error||!r.stdout.endsWith('\n')||r.stdout.slice(0,-1).includes('\n'))throw Error('Git target observation failed');return r.stdout.slice(0,-1);};
+ const target={realpath:query(['rev-parse','--show-toplevel']),gitCommonDir:query(['rev-parse','--path-format=absolute','--git-common-dir']),gitDir:query(['rev-parse','--absolute-git-dir']),head:query(['rev-parse','HEAD']),branch:query(['symbolic-ref','--quiet','--short','HEAD'],true)};
+ await validateObservedTarget(cwd,target);return target;
+}
+export async function validateObservedTarget(cwd,target){
+ if(!absolute(cwd)||!target||target.realpath!==cwd||!absolute(target.gitCommonDir)||!absolute(target.gitDir)||!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(target.head)||!(target.branch===null||typeof target.branch==='string'&&target.branch))throw Error('Invalid observed target');
+ await inspectPath(cwd,{directory:true});await inspectPath(target.gitCommonDir,{directory:true});
+ return target;
+}
+export async function workflowStatePath(target,workflowId){
+ validateWorkflowId(workflowId);const statePath=path.join(target.gitCommonDir,'arc','workflows',workflowId,'state.json');await inspectPath(statePath,{missing:true});return statePath;
+}

package/codex/skill/runtime/store.mjs

@@ -1,3 +1,4 @@
+import {verifiedCooperativeReconciliation} from './acceptance.mjs';
 import {verifiedReconciliation} from './gate.mjs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -51,13 +52,33 @@ export async function transactWorkflow({statePath,expectedRevision,requestId,req
   next.revision=state.revision+1;next.requests=prior?state.requests.map(r=>r.requestId===requestId?{requestId,requestFingerprint,decision}:r):[...state.requests,{requestId,requestFingerprint,decision}];
   next.audit=[...state.audit,{requestId,revision:next.revision,decision:decision.decision,ruleIds:decision.ruleIds??[],result:'pending'}];
   validateWorkflowState(next);
-  temporary=path.join(parent,`.${path.basename(statePath)}.${crypto.randomUUID()}.tmp`);
-  const handle=await fs.open(temporary,'wx',0o600);try{await handle.writeFile(JSON.stringify(next,null,2)+'\n');await handle.sync();}finally{await handle.close();}
-  await fs.rename(temporary,statePath);temporary=undefined;
-  const directory=await fs.open(parent,'r');try{await directory.sync();}finally{await directory.close();}
+  await saveDurableState({statePath,state:next});
   return {state:next,decision,replayed:false};
  }finally{
   if(temporary)await fs.unlink(temporary).catch(()=>{});
   if(lock){await lock.close();await fs.unlink(lockPath);}
  }
 }
+
+/** Shared durability primitive. A post-rename sync error is reported as failure;
+ * the caller must re-read rather than assume rollback or repeat an effect. */
+export async function saveDurableState({statePath,state,create=false,storage={}}){
+ const parent=path.dirname(statePath),temporary=path.join(parent,`.${path.basename(statePath)}.${crypto.randomUUID()}.tmp`);
+ let exists=false;
+ try{
+  const handle=await fs.open(temporary,'wx',0o600);exists=true;
+  try{await handle.writeFile(JSON.stringify(state,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+  if(create){await (storage.link??fs.link)(temporary,statePath);await fs.unlink(temporary);}else await (storage.rename??fs.rename)(temporary,statePath);
+  exists=false;
+  const directory=await fs.open(parent,'r');try{await directory.sync();}finally{await directory.close();}
+ }finally{if(exists)await fs.unlink(temporary).catch(()=>{});}
+}
+
+/** Only a locally verified cooperative commit may advance the stored target. */
+export function applyCooperativeCommitTransition({state,decision}){
+ if(decision?.decision!=='allow'||!verifiedCooperativeReconciliation(decision,state)||!decision.proposedTransition?.commit)throw Error('Verified cooperative reconciliation required');
+ const next=structuredClone(state),transition=decision.proposedTransition;
+ next.targetHistory.push({target:structuredClone(state.target),revision:state.revision+1,source:'local-observation',kind:'verified-commit-parent'});
+ next.target=structuredClone(transition.target);next.commits.push(structuredClone(transition.commit));next.tasks.find(t=>t.id===transition.commit.taskId).status='committed';
+ return next;
+}

package/codex/skill/runtime/verification.mjs

@@ -0,0 +1,123 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {spawnSync} from 'node:child_process';
+import {fingerprintRequest} from './store.mjs';
+import {absolute,within,inspectPath} from './scope.mjs';
+const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+const text=v=>typeof v==='string'&&v.length>0;
+const hash=v=>typeof v==='string'&&/^sha256:[a-f0-9]{64}$/.test(v);
+const list=v=>Array.isArray(v)&&v.every(text)&&new Set(v).size===v.length;
+const fields=(v,keys)=>v&&typeof v==='object'&&!Array.isArray(v)&&Object.keys(v).every(k=>keys.includes(k));
+const base=state=>({expectedRevision:state?.revision??0,coverage:{enforcement:'cooperative',provenance:'operator-attested',nativeVerified:false},requiredEvidence:[],nextActions:[],proposedTransition:null});
+const hold=(state,id,reason)=>({...base(state),decision:'hold',ruleIds:['cooperative.'+id],reason});
+const allow=(state,transition)=>({...base(state),decision:'allow',ruleIds:['cooperative.verification'],proposedTransition:transition});
+const current=(state,scope,taskId,changes)=>scope==='final'?changes?.final:changes?.tasks?.[taskId];
+const approval=(state,taskId)=>state.records.filter(r=>r.kind==='approval'&&(!r.data.affectedTaskIds||r.data.affectedTaskIds.includes(taskId))).at(-1);
+function authorized(state,task){
+ const a=approval(state,task?.id);
+ return task&&!task.invalidated&&a&&a.source==='operator-attested'&&a.targetVersion===state.targetVersion&&task.scopeVersion===a.scopeVersion&&task.targetVersion===state.targetVersion&&task.approvalRef===a.messageRef&&task.approvalVersion===a.data.approvalVersion&&task.documentVersion===a.data.documentVersion;
+}
+function descriptorValid(state,d,operation){
+ if(operation==='review')return fields(d,['kind','paths'])&&d.kind==='source-review'&&list(d.paths)&&d.paths.length>0&&d.paths.every(p=>absolute(p)&&within(state.target.realpath,p));
+ return fields(d,['executable','args','cwd','env','outputs'])&&absolute(d.executable)&&Array.isArray(d.args)&&d.args.every(v=>typeof v==='string')&&absolute(d.cwd)&&within(state.target.realpath,d.cwd)&&fields(d.env,Object.keys(d.env??{}))&&Object.values(d.env).every(v=>typeof v==='string')&&Array.isArray(d.outputs)&&d.outputs.every(p=>absolute(p)&&within(state.target.realpath,p));
+}
+const assignedImplementer=(state,id,taskId)=>state.assignments.some(a=>a.agentId===id&&a.taskId===taskId&&a.status==='active');
+function independent(state,actor,taskId){
+ if(!fields(actor,['id','role'])||!text(actor.id))return false;
+ if(state.assignments.some(a=>a.agentId===actor.id))return false;
+ return !(state.intents??[]).some(i=>i.verificationActor?.id===actor.id&&(i.verificationActor.role!==actor.role||actor.role==='qa'&&i.taskId!==taskId))&&!(state.checks??[]).some(c=>c.verificationActor?.id===actor.id&&(c.verificationActor.role!==actor.role||actor.role==='qa'&&c.taskId!==taskId));
+}
+/** Invalidate only the affected dependency closure; preserve all historical evidence. */
+export function invalidateAffectedEvidence({state,changedVersions={},affectedTaskIds}={}){
+ const next=structuredClone(state),ids=new Set(affectedTaskIds??next.tasks.map(t=>t.id));
+ let changed=true;while(changed){changed=false;for(const t of next.tasks)if(!ids.has(t.id)&&t.dependencies?.some(id=>ids.has(id))){ids.add(t.id);changed=true;}}
+ for(const t of next.tasks)if(ids.has(t.id)){t.invalidated=true;t.status='held';t.invalidatedBy=structuredClone(changedVersions);t.invalidatedAt=state.revision+1;}
+ for(const key of ['checks','acceptances'])for(const entry of next[key]??[])if(entry.scope==='final'||ids.has(entry.taskId)){entry.stale=true;entry.invalidatedBy=structuredClone(changedVersions);}
+ for(const intent of next.intents??[])if(['check','review'].includes(intent.operation)&&(intent.scope==='final'||ids.has(intent.taskId)))intent.stale=true;
+ // Old approval statements remain immutable; no change creates renewed authority.
+ if(Number.isSafeInteger(changedVersions.scopeVersion))next.scopeVersion=changedVersions.scopeVersion;
+ return next;
+}
+function record({state,request,evidence}){
+ const entry=request.evidence,d=entry?.data;
+ if(!entry||!text(entry.messageRef)||!d)return hold(state,'verification-record','Structured evidence required');
+ if(entry.kind==='acceptance-evidence'&&d.kind==='task'){
+  const t=d.task,previous=state.tasks.find(task=>task.id===t?.id),a=approval(state,t?.id);
+  if(previous?.invalidated&&(!a||!Number.isSafeInteger(a.revision)||a.revision<previous.invalidatedAt||a.scopeVersion!==state.scopeVersion))return hold(state,'task-approval-stale','Invalidated task requires a renewed approval statement');
+  if(!fields(t,['id','paths','criteria','requiredChecks','dependencies','approvalRef','approvalVersion','documentVersion','scopeVersion','targetVersion','status'])||!text(t.id)||!list(t.paths)||!t.paths.length||!t.paths.every(p=>absolute(p)&&within(state.target.realpath,p))||!list(t.criteria)||!t.criteria.length||!list(t.dependencies)||t.dependencies.includes(t.id)||t.dependencies.some(id=>!state.tasks.some(task=>task.id===id))||!Array.isArray(t.requiredChecks)||!t.requiredChecks.length||!t.requiredChecks.every(c=>descriptorValid(state,c,'check'))||!['pending',undefined].includes(t.status)||state.tasks.some(task=>task.id===t.id&&['accepted','committed'].includes(task.status))||!authorized(state,t))return hold(state,'task-contract','Current approval and explicit pending task contract required');
+  return allow(state,{task:{...structuredClone(t),status:'pending',source:'operator-attested',messageRef:entry.messageRef}});
+ }
+ if(entry.kind!=='finding')return hold(state,'unsupported','Check and review outcomes require durable intent/result');
+ if(d.action==='open'){
+  const check=state.checks.find(c=>c.id===d.checkId&&!c.stale);
+  if(!fields(d,['action','id','checkId','message'])||!text(d.id)||!text(d.message)||state.findings.some(f=>f.id===d.id)||!check)return hold(state,'finding','Finding must link an existing check or review');
+  return allow(state,{finding:{id:d.id,checkId:check.id,scope:check.scope,taskId:check.taskId,origin:check.scope==='final'&&check.operation==='review'?'final-review':'check',status:'open',message:d.message,messageRef:entry.messageRef,source:'operator-attested'}});
+ }
+ const finding=state.findings.find(f=>f.id===d.id);
+ const affected=finding?.scope==='final'?state.tasks.map(t=>t.id):[finding?.taskId];
+ if(!fields(d,['action','id','actor','changeFingerprint'])||d.action!=='resolve'||!finding||finding.status==='closed'||!fields(d.actor,['id','role'])||d.actor.role!=='implementer'||!affected.some(id=>assignedImplementer(state,d.actor.id,id))||!hash(d.changeFingerprint)||d.changeFingerprint!==current(state,finding.scope,finding.taskId,evidence?.changes))return hold(state,'finding-resolution','Assigned Implementer correction at the current fingerprint required');
+ return allow(state,{finding:{...finding,status:'resolved',resolutionRef:entry.messageRef,resolutionActor:structuredClone(d.actor),changeFingerprint:d.changeFingerprint}});
+}
+/** Pure cooperative gate: verifies recorded consistency, never identity or semantic sufficiency. */
+export function evaluateCooperativeVerification({state,request,evidence}={}){
+ if(state?.mode!=='plan')return hold(state,'unsupported','Only the complete spec and plan path is supported');
+ if(!request||request.expectedRevision!==state.revision)return hold(state,'revision','Stale verification request');
+ if(request.actor?.role!=='orchestrator')return hold(state,'verification-actor','Orchestrator statement required');
+ if(request.operation==='verification-record')return record({state,request,evidence});
+ if(request.operation==='verification-result')return outcome({state,request,evidence});
+ if(!['check','review'].includes(request.operation))return hold(state,'unsupported','Unsupported verification operation');
+ const a=request.arguments,t=state.tasks.find(t=>t.id===request.taskId);
+ if(!fields(a,['scope','actor','descriptor','changeFingerprint','findingIds'])||!['task','final'].includes(a.scope)||!hash(a.changeFingerprint)||a.changeFingerprint!==current(state,a.scope,request.taskId,evidence?.changes)||!descriptorValid(state,a.descriptor,request.operation))return hold(state,'verification-fingerprint','Exact scope descriptor and current fingerprint required');
+ if(a.scope==='task'&&(!authorized(state,t)||t.status==='held'||request.operation==='review'||!t.requiredChecks.some(d=>same(d,a.descriptor))))return hold(state,'verification-task','Current task approval and exact assigned check required; Reviewer is final only');
+ if(a.scope==='final'&&(request.taskId!==undefined||request.operation!=='review'||!state.tasks.length||state.tasks.some(t=>!authorized(state,t)||!['accepted','committed'].includes(t.status))))return hold(state,'verification-final','Final review follows accepted tasks and required task checks');
+ const finalCorrection=a.scope==='final'&&state.findings.some(f=>f.origin==='final-review'&&f.status==='resolved'&&a.findingIds?.includes(f.id));
+ if(a.scope==='final'&&!finalCorrection&&state.tasks.some(task=>task.requiredChecks.some(descriptor=>!state.checks.some(c=>c.scope==='task'&&c.taskId===task.id&&c.operation==='check'&&!c.stale&&c.status==='passed'&&c.verdict==='proven'&&text(c.resultRef)&&c.verificationActor?.role==='qa'&&same(c.descriptor,descriptor)&&(c.changeFingerprint===evidence.changes?.tasks?.[task.id]||task.status==='committed'&&state.commits?.some(commit=>commit.taskId===task.id&&commit.observationSource==='local-git'&&commit.fingerprint===c.changeFingerprint&&commit.postCommitFingerprint===evidence.changes?.tasks?.[task.id]))))))return hold(state,'verification-final-checks','Initial final review requires current task QA evidence');
+ if(a.actor?.role!==(request.operation==='review'?'reviewer':'qa')||a.actor.id===request.actor.id||!independent(state,a.actor,request.taskId))return hold(state,'verification-independence','Independent actor statement and fresh task QA required');
+ const findings=state.findings.filter(f=>f.status!=='closed'&&(a.scope==='final'||f.scope==='task'&&f.taskId===request.taskId));
+ if(a.findingIds!==undefined&&(!list(a.findingIds)||a.findingIds.some(id=>!findings.some(f=>f.id===id))))return hold(state,'finding-recheck','Unknown finding recheck');
+ if(findings.some(f=>f.status!=='resolved'||!text(f.resolutionRef)||f.resolutionActor?.role!=='implementer'||f.changeFingerprint!==a.changeFingerprint||!a.findingIds?.includes(f.id)||f.origin==='final-review'&&request.operation!=='review'||f.origin!=='final-review'&&request.operation!=='check'))return hold(state,'finding-recheck','Implementer resolution and the required QA or final Reviewer recheck required');
+ if(state.intents.some(i=>['check','review'].includes(i.operation)&&['prepared','unknown','mismatch'].includes(i.status)&&i.scope===a.scope&&i.taskId===request.taskId&&same(i.descriptor,a.descriptor)&&!i.stale))return hold(state,'verification-active','Reconcile the existing verification intent');
+ const intent={requestId:request.requestId,operation:request.operation,status:'prepared',scope:a.scope,taskId:request.taskId,verificationActor:structuredClone(a.actor),descriptor:structuredClone(a.descriptor),changeFingerprint:a.changeFingerprint,findingIds:[...(a.findingIds??[])],scopeVersion:state.scopeVersion,targetVersion:state.targetVersion,versions:structuredClone(state.versions),target:structuredClone(state.target),approval:structuredClone(approval(state,request.taskId)),taskFingerprint:fingerprintRequest(a.scope==='final'?state.tasks:t),fingerprint:fingerprintRequest(request),source:'operator-attested'};
+ return allow(state,{intent});
+}
+function outcome({state,request,evidence}){
+ const intent=state.intents.find(i=>i.requestId===request.intentId),r=request.result,d=r?.data;
+ if(!intent||!['check','review'].includes(intent.operation)||!['prepared','unknown','mismatch'].includes(intent.status))return hold(state,'verification-intent','Matching unresolved verification intent required');
+ const valid=r&&['succeeded','failed','unknown','mismatch'].includes(r.status)&&text(r.messageRef)&&fields(d,['actor','descriptor','scope','taskId','changeFingerprint','verdict'])&&['proven','unmet','unverified'].includes(d.verdict)&&same(d.actor,intent.verificationActor)&&same(d.descriptor,intent.descriptor)&&d.scope===intent.scope&&d.taskId===intent.taskId&&d.changeFingerprint===intent.changeFingerprint;
+ const fresh=!intent.stale&&intent.changeFingerprint===current(state,intent.scope,intent.taskId,evidence?.changes)&&(intent.scope==='task'||intent.scopeVersion===state.scopeVersion)&&intent.targetVersion===state.targetVersion&&same(intent.target,state.target)&&same(intent.versions,state.versions)&&independent(state,intent.verificationActor,intent.taskId)&&same(intent.approval,approval(state,intent.taskId))&&intent.taskFingerprint===fingerprintRequest(intent.scope==='final'?state.tasks:state.tasks.find(t=>t.id===intent.taskId));
+ const status=!valid?'mismatch':r.status;
+ const check={id:intent.requestId,operation:intent.operation,scope:intent.scope,taskId:intent.taskId,descriptor:structuredClone(intent.descriptor),verificationActor:structuredClone(intent.verificationActor),changeFingerprint:intent.changeFingerprint,resultRef:r?.messageRef,verdict:valid?d.verdict:'unverified',status:fresh&&status==='succeeded'&&d.verdict==='proven'?'passed':status==='failed'||d?.verdict==='unmet'?'failed':'unverified',stale:!fresh,source:'operator-attested'};
+ const findings=[];
+ if(check.status==='failed')findings.push({id:intent.requestId+':failure',checkId:check.id,scope:intent.scope,taskId:intent.taskId,origin:intent.operation==='review'?'final-review':'check',status:'open',source:'operator-attested',messageRef:r.messageRef});
+ if(check.status==='passed')for(const id of intent.findingIds){const f=state.findings.find(f=>f.id===id);if(!f||f.status!=='resolved'||f.changeFingerprint!==intent.changeFingerprint)return hold(state,'finding-recheck','Finding changed after prepare');findings.push({...f,status:'closed',recheckRef:r.messageRef,recheckActor:structuredClone(d.actor)});}
+ const transition={result:{...structuredClone(r),status,source:'operator-attested'},check,findings};
+ return check.status==='passed'?allow(state,transition):{...hold(state,'verification-'+status,'Recorded outcome does not establish passing current evidence'),proposedTransition:transition};
+}
+function defaultRunner({cwd,args}){
+ const env=Object.fromEntries(Object.entries(process.env).filter(([k])=>!k.toUpperCase().startsWith('GIT_')));
+ Object.assign(env,{GIT_OPTIONAL_LOCKS:'0',GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_NO_REPLACE_OBJECTS:'1',GIT_NO_LAZY_FETCH:'1',GIT_TERMINAL_PROMPT:'0'});
+ return spawnSync('git',['--no-pager','--literal-pathspecs','-c','core.fsmonitor=false',...args],{cwd,env,encoding:'buffer',timeout:10000,maxBuffer:16*1024*1024});
+}
+/** Read tracked/untracked regular bytes, deletions and modes without staging or execution.
+ * The snapshot is cooperative evidence at observation time, not an atomic execution sandbox. */
+export async function readCooperativeChanges({state,gitRunner=defaultRunner}){
+ const inventory=await gitRunner({cwd:state.target.realpath,args:['ls-files','--cached','--others','--exclude-standard','-z']});
+ if(inventory?.status!==0||inventory.error||!Buffer.isBuffer(inventory.stdout))throw Error('Verification inventory query failed');
+ const raw=new TextDecoder('utf-8',{fatal:true}).decode(inventory.stdout);
+ if(raw&&!raw.endsWith('\0'))throw Error('Incomplete verification inventory');
+ const index=await gitRunner({cwd:state.target.realpath,args:['ls-files','--stage','-z']});
+ if(index?.status!==0||index.error||!Buffer.isBuffer(index.stdout))throw Error('Verification index query failed');
+ const indexText=new TextDecoder('utf-8',{fatal:true}).decode(index.stdout),indexRows=[];
+ if(indexText&&!indexText.endsWith('\0'))throw Error('Incomplete verification index');
+ for(const entry of indexText?indexText.slice(0,-1).split('\0'):[]){const match=/^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\t([\s\S]+)$/.exec(entry);if(!match)throw Error('Verification requires regular stage-0 index entries');indexRows.push({path:path.join(state.target.realpath,match[3]),entry});}
+ const names=[...new Set(raw?raw.slice(0,-1).split('\0'):[])].sort(),rows=[];
+ for(const name of names){
+  if(!name||name.includes('\\')||name.includes('\n')||name.includes('\r')||path.isAbsolute(name)||name.split('/').some(p=>!p||p==='.'||p==='..'))throw Error('Invalid verification path');
+  const file=path.join(state.target.realpath,...name.split('/'));
+  try{await inspectPath(file);const stat=await fs.lstat(file);if(!stat.isFile())throw Error('Verification requires regular files');rows.push({path:file,mode:stat.mode&0o777,hash:'sha256:'+createHash('sha256').update(await fs.readFile(file)).digest('hex')});}
+  catch(error){if(error.code!=='ENOENT')throw error;rows.push({path:file,deleted:true});}
+ }
+ const tasks={},taskSnapshots={};for(const task of state.tasks){if(!list(task.paths)||!task.paths.every(p=>absolute(p)&&within(state.target.realpath,p)))throw Error('Invalid task paths');taskSnapshots[task.id]={scope:'task',taskId:task.id,target:Object.fromEntries(Object.entries(state.target).filter(([key])=>key!=='head')),paths:task.paths,index:indexRows.filter(row=>task.paths.some(p=>within(p,row.path))),rows:rows.filter(row=>task.paths.some(p=>within(p,row.path)))};tasks[task.id]=fingerprintRequest(taskSnapshots[task.id]);}
+ return {tasks,taskSnapshots,final:fingerprintRequest({scope:'final',target:state.target,index:indexRows,rows})};
+}

package/codex/skill/scripts/model_config.py

@@ -13,7 +13,7 @@ from typing import TypedDict
 ROLE_FILES: dict[str, str] = {
     "arc_scouter": "arc-scouter.toml",
     "arc_planner": "arc-planner.toml",
-    "arc_coder": "arc-coder.toml",
+    "arc_implementer": "arc-implementer.toml",
     "arc_qa": "arc-qa.toml",
     "arc_reviewer": "arc-reviewer.toml",
 }
@@ -95,13 +95,13 @@ def validate_config(config: dict, path: Path) -> dict:
 def load_settings(config_path: Path) -> dict[str, RoleSettings]:
     """Validate every preset and return the active role settings."""
     _, _, config = _parse_file(config_path, "settings")
-    validate_config(config, config_path)
+    config = validate_config(config, config_path)
     return {role: dict(variants[config["preset"]]) for role, variants in config["roles"].items()}
 
 
 def serialize_settings(config: dict) -> bytes:
     """Serialize a complete unified configuration without losing inactive presets."""
-    validate_config(config, Path("models.toml"))
+    config = validate_config(config, Path("models.toml"))
     lines = ["version = 1", f'preset = {json.dumps(config["preset"])}']
     for role in ROLE_FILES:
         for preset in PRESETS:

package/lib/cli/postinstall.mjs

@@ -1,17 +1,4 @@
-import path from 'node:path';
-import {inspectNpmContext,resolveInvocationCwd} from '../npm/context.mjs';
-import {openInstallerTerminal} from './terminal.mjs';
-import {runCli} from './index.mjs';
-export async function runPostinstall({packageRoot,env=process.env,cwd=process.cwd(),input=process.stdin,output=process.stdout,error=process.stderr,deps={}}){
- let terminal;
- try{
-  if(env.npm_lifecycle_event!=='postinstall'){output.write('Run arc to install the ARC harness.\n');return 0;}
-  const context=await(deps.inspectNpmContext??inspectNpmContext)({packageRoot,entryPath:path.join(packageRoot,'scripts/postinstall.mjs'),env,cwd});
-  if(context.kind!=='global'){output.write('Run arc to install the ARC harness.\n');return 0;}
-  terminal=(deps.openInstallerTerminal??openInstallerTerminal)({env,input,output,error});
-  if(terminal.kind==='skip'){output.write('Run arc to install the ARC harness.\n');return 0;}
-  const invocationCwd=resolveInvocationCwd({env,cwd,lifecycle:true});
-  return await(deps.runCli??runCli)([],{...terminal.io,cwd:invocationCwd,env});
- }catch(cause){(terminal?.io.error??error).write(`Error: ${cause.message}\n`);return 1;}
- finally{terminal?.dispose?.();}
+export async function runPostinstall({output=process.stdout}={}){
+ output.write('Run arc to install or manage the ARC harness.\n');
+ return 0;
 }

package/lib/cli/root.mjs

@@ -1,21 +1,11 @@
 import fs from 'node:fs';
-import {renderCompletion} from './completion.mjs';
-const usage='Usage: arc [installation options]\n  arc preset [economy|balanced|smart] --target <codex|claude|all>\n  arc uninstall --target <codex|claude|all>\n  arc upgrade [--help]\n  arc completion <zsh|bash>  (shell setup)\n  arc --help | --version';
-const completionUsage='Usage: arc completion <zsh|bash>';
+const usage='Usage: arc\n       arc --help\n       arc --version';
 export async function runRoot(args=process.argv.slice(2),io={}){
- const output=io.output??process.stdout,error=io.error??process.stderr;
- const [command,...rest]=args;
- if(command==='--help'&&!rest.length){output.write(usage+'\n\n');return(await import('./index.mjs')).runCli(args,io);}
- if(command==='--version'&&!rest.length){output.write(JSON.parse(fs.readFileSync(new URL('../../package.json',import.meta.url))).version+'\n');return 0;}
- if(command==='preset')return(await import('./preset.mjs')).runCli(rest,io);
- if(command==='upgrade')return(await import('./upgrade.mjs')).runCli(rest,io);
- if(command==='install'){error.write('Error: The install subcommand was removed. Run npx --yes @yunhozz/arc [installation options].\n');return 2;}
- if(command===undefined||command.startsWith('--'))return(await import('./index.mjs')).runCli(args,io);
- if(command==='uninstall')return(await import('./uninstall.mjs')).runCli(rest,io);
- if(command==='completion'){
-  if(rest.length===1&&rest[0]==='--help'){output.write(completionUsage+'\n');return 0;}
-  if(rest.length===1&&['zsh','bash'].includes(rest[0])){output.write(renderCompletion(rest[0]));return 0;}
-  error.write('Error: Expected a completion shell (zsh or bash).\n'+completionUsage+'\n');return 2;
- }
- error.write(`Error: Unknown command: ${command}\n${usage}\n`);return 2;
+ const input=io.input??process.stdin,output=io.output??process.stdout,error=io.error??process.stderr;
+ if(args.length===1&&args[0]==='--help'){output.write(usage+'\n\nOpen ARC Management in an interactive terminal to install or manage the harness.\n');return 0;}
+ if(args.length===1&&args[0]==='--version'){output.write(JSON.parse(fs.readFileSync(new URL('../../package.json',import.meta.url))).version+'\n');return 0;}
+ if(args.length){error.write('Error: Unsupported arguments. Open arc to manage the harness.\n'+usage+'\n');return 2;}
+ if(!input.isTTY||!output.isTTY){error.write('Error: arc requires an interactive terminal. Run arc directly in a terminal.\n');return 2;}
+ const {runTui}=await import('../tui/app.mjs');
+ return runTui({...io,input,output,contextOptions:{...io.contextOptions,...(io.cwd?{cwd:io.cwd}:{}),...(io.env?{env:io.env}:{})}});
 }

package/lib/cli/upgrade.mjs

@@ -1,57 +1 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import {fileURLToPath} from 'node:url';
-const packageRoot=path.resolve(fileURLToPath(new URL('../../',import.meta.url)));
-const usage='Usage: arc upgrade [--help]';
-const inputError=message=>Object.assign(Error(message),{code:'ARC_CLI_INPUT'});
-const configurationError=message=>Object.assign(Error(message),{code:'ARC_TARGET_CONFIGURATION'});
-function identity(root){const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));if(pkg.name!=='@yunhozz/arc'||!/^\d+\.\d+\.\d+$/.test(pkg.version))throw configurationError('Invalid ARC package identity');return pkg;}
-async function runtime(deps){
- const [context,state,upgrade,npm]=await Promise.all([import('../npm/context.mjs'),import('../installer/upgrade-state.mjs'),import('../installer/upgrade.mjs'),import('../npm/upgrade.mjs')]);
- let safeFs=deps.safeFs;if(!safeFs){const[{loadNative},{openRoot}]=await Promise.all([import('../safe-fs/native.mjs'),import('../safe-fs/index.mjs')]);const native=loadNative();safeFs={openRoot:root=>openRoot(root,{native})};}
- return{...context,...state,...upgrade,...npm,...deps,safeFs};
-}
-function report(result,output,error){
- for(const item of result.results){output.write(item.platform+': '+item.status+'; rollback: '+item.rollback+'\n');for(const filename of item.residualPaths??[])output.write('Residual path: '+filename+'\n');if(item.error)error.write('Error: '+item.error.message+'\n');}
- if(result.interrupted)return 130;
- if(result.results.every(item=>item.status==='installed'&&!item.error)){output.write('ARC version '+result.version+' harness upgraded! Previous harness version: not recorded.\nOpen a new shell session to use updated completion.\nzsh completion: eval "$(arc completion zsh)" for this session\n');return 0;}
- error.write('Harness update did not complete. Retry arc upgrade or npx --yes @yunhozz/arc@latest upgrade.\n');return 1;
-}
-function failure(cause,error){error.write('Error: '+cause.message+'\n');return ['ARC_CANCELLED','ARC_NPM_CANCELLED'].includes(cause.code)?130:['ARC_CLI_INPUT','ARC_TARGET_CONFIGURATION','ARC_UNSUPPORTED_RUNTIME','ARC_NATIVE_UNAVAILABLE'].includes(cause.code)?2:1;}
-export async function runCli(args=process.argv.slice(2),io={},deps={}){
- const output=io.output??process.stdout,error=io.error??process.stderr;let controller,onInterrupt,packageStarted=false;
- try{
-  if(args.length===1&&args[0]==='--help'){output.write(usage+'\nUpdates the global CLI and installed harness; npm exec updates the harness only.\n');return 0;}
-  if(args.length)throw inputError('Expected no arguments or --help');
-  const root=deps.packageRoot??packageRoot,pkg=identity(root),env=io.env??process.env,cwd=fs.realpathSync(io.cwd??process.cwd()),api=await runtime(deps);
-  const context=await api.inspectNpmContext({packageRoot:root,entryPath:path.join(root,'bin/arc.mjs'),env,cwd});
-  if(!['global','npx'].includes(context.kind))throw configurationError('Run upgrade from a verified global ARC installation or npx --yes @yunhozz/arc@latest upgrade');
-  const state=api.collectInstalledState({safeFs:api.safeFs,userHome:deps.userHome??os.homedir(),env,cwd});
-  if(!state.targets.length)throw configurationError('No installed ARC harness found. Run npx --yes @yunhozz/arc to install it first');
-  controller=new AbortController();onInterrupt=()=>controller.abort();process.once('SIGINT',onInterrupt);process.once('SIGTERM',onInterrupt);
-  if(context.kind==='npx')return report(await api.upgradeInstalledTargets({packageRoot:root,state,safeFs:api.safeFs,signal:controller.signal}),output,error);
-  const latest=await api.resolveLatest({context,env,cwd,signal:controller.signal});packageStarted=true;
-  const replaced=await api.upgradeGlobal({context,expectedVersion:latest.version,env,cwd,signal:controller.signal});
-  if(replaced.packageStatus!=='updated')throw replaced.error??Error('CLI replacement failed');
-  output.write('CLI: updated to '+latest.version+' (previous '+pkg.version+').\n');
-  const result=await api.runUpgradeChild({entryPath:path.join(context.packageRoot,'bin/arc-upgrade.mjs'),request:{protocol:1,expectedVersion:latest.version,invocationCwd:cwd,expectedStateToken:state.stateToken},env,cwd,signal:controller.signal});
-  if(result.stdout)output.write(result.stdout);if(result.stderr)error.write(result.stderr);
-  if(result.code===0&&!result.signal)return 0;
-  error.write('CLI was updated but the harness update did not complete. Retry arc upgrade or npx --yes @yunhozz/arc@latest upgrade.\n');return result.code===130?130:1;
- }catch(cause){const code=failure(cause,error);if(cause.code==='ARC_CLI_INPUT')error.write(usage+'\n');if(packageStarted)error.write('CLI state may have changed. Retry arc upgrade; if it is unavailable, run npx --yes @yunhozz/arc@latest upgrade.\n');return code;}
- finally{if(onInterrupt){process.removeListener('SIGINT',onInterrupt);process.removeListener('SIGTERM',onInterrupt);}}
-}
-export async function runChild(request,io={},deps={}){
- const output=io.output??process.stdout,error=io.error??process.stderr;let onInterrupt;
- try{
-  if(!request||Object.keys(request).sort().join(',')!=='expectedStateToken,expectedVersion,invocationCwd,protocol'||request.protocol!==1||typeof request.expectedVersion!=='string'||!/^\d+\.\d+\.\d+$/.test(request.expectedVersion)||typeof request.expectedStateToken!=='string'||!/^[a-f0-9]{64}$/.test(request.expectedStateToken)||typeof request.invocationCwd!=='string'||!path.isAbsolute(request.invocationCwd)||fs.realpathSync(request.invocationCwd)!==request.invocationCwd)throw inputError('Invalid private upgrade request');
-  const root=deps.packageRoot??packageRoot,pkg=identity(root);if(pkg.version!==request.expectedVersion)throw configurationError('The new ARC package version does not match the requested upgrade');
-  const api=await runtime(deps),env=io.env??process.env,cwd=request.invocationCwd,context=await api.inspectNpmContext({packageRoot:root,entryPath:path.join(root,'bin/arc-upgrade.mjs'),env,cwd});
-  if(context.kind!=='global'||context.packageRoot!==root)throw configurationError('Cannot verify the replaced global ARC package');
-  const state=api.collectInstalledState({safeFs:api.safeFs,userHome:deps.userHome??os.homedir(),env,cwd});if(state.stateToken!==request.expectedStateToken)throw configurationError('Installed ARC settings changed during CLI replacement; retry upgrade');
-  if(!state.targets.length)throw configurationError('No installed ARC harness found');
-  const controller=new AbortController();onInterrupt=()=>controller.abort();process.once('SIGINT',onInterrupt);process.once('SIGTERM',onInterrupt);
-  return report(await api.upgradeInstalledTargets({packageRoot:root,state,safeFs:api.safeFs,signal:controller.signal}),output,error);
- }catch(cause){return failure(cause,error);}finally{if(onInterrupt){process.removeListener('SIGINT',onInterrupt);process.removeListener('SIGTERM',onInterrupt);}}
-}
+export async function runChild(...args){return(await import('../management/update.mjs')).runChild(...args);}

package/lib/installer/manifest.mjs

@@ -1,3 +1,5 @@
+import {COOPERATIVE_RUNTIME_MODULES} from '../runtime/bootstrap.mjs';
+import {RUNTIME_MODULE_PATHS} from './runtime-assets.mjs';
 import {POLICY_TARGETS,buildPolicyOutputs} from '../policy/render.mjs';
 import {isDynamicReferencePath,readReferenceBundle} from './superpowers.mjs';
 import path from 'node:path';import crypto from 'node:crypto';import{loadModelConfig,resolveModelSettings,renderProfiles}from '../models/index.mjs';import{readCheckedFile,typeOf,sameIdentity,metadataOf}from './targets.mjs';
@@ -23,9 +25,12 @@ export function verifyPayload({packageRoot,safeFs}){
   for(const item of FIXED)select(item,false);for(const item of ROOTS)select(item,true);
   for(const platform of ['codex','claude'])if(!referenceTrees[platform])throw Error('Required superpowers reference tree is missing');
   for(const name of listed.keys())if(!files.has(name))throw Error(`Manifest entry is missing: ${name}`);
-  const required=['claude/skill/hooks/role-git-guard.mjs','claude/skill/hooks/git-policy.json','lib/policy/claude-hook.mjs','lib/policy/role-policy.json','lib/policy/render.mjs','scripts/update-role-policy.mjs','lib/limits.mjs','lib/installer/limits.mjs','lib/installer/runtime-config.mjs','README.md','install.command','package.json','bin/arc.mjs','lib/cli/root.mjs','lib/cli/completion.mjs','lib/installer/shell-completion.mjs','lib/installer/manifest.mjs','lib/installer/targets.mjs','lib/installer/global-config.mjs','lib/installer/plan.mjs','lib/safe-fs/index.mjs','lib/safe-fs/native.mjs','lib/models/index.mjs','lib/models/config.mjs','lib/models/profiles.mjs','vendor/toml/LICENSE','vendor/toml/package.json','vendor/toml/provenance.json','vendor/toml/dist/index.js','prebuilds/index.json'];
+  const required=['claude/skill/hooks/role-git-guard.mjs','claude/skill/hooks/git-policy.json','lib/policy/claude-hook.mjs','lib/policy/role-policy.json','lib/policy/render.mjs','scripts/update-role-policy.mjs','lib/limits.mjs','lib/installer/limits.mjs','lib/installer/runtime-config.mjs','README.md','install.command','package.json','bin/arc.mjs','lib/cli/root.mjs','lib/tui/app.mjs','lib/tui/terminal.mjs','lib/tui/render.mjs','lib/tui/setup.mjs','lib/tui/workflow.mjs','lib/management/operations.mjs','lib/management/status.mjs','lib/management/update.mjs','lib/management/workflow.mjs','lib/cli/postinstall.mjs','scripts/postinstall.mjs','lib/cli/upgrade.mjs','bin/arc-upgrade.mjs','lib/installer/shell-completion.mjs','lib/installer/manifest.mjs','lib/installer/targets.mjs','lib/installer/global-config.mjs','lib/installer/plan.mjs','lib/safe-fs/index.mjs','lib/safe-fs/native.mjs','lib/models/index.mjs','lib/models/config.mjs','lib/models/profiles.mjs','vendor/toml/LICENSE','vendor/toml/package.json','vendor/toml/provenance.json','vendor/toml/dist/index.js','prebuilds/index.json'];
+  required.push('lib/installer/runtime-assets.mjs',...RUNTIME_MODULE_PATHS);
+  for(const platform of ['codex','claude'])required.push(`${platform}/skill/runtime/role-policy.json`,...RUNTIME_MODULE_PATHS.map(name=>`${platform}/skill/runtime/${name.slice('lib/runtime/'.length)}`));
   for(const tuple of ['darwin-arm64','darwin-x64','linux-arm64-gnu','linux-x64-gnu'])required.push(`prebuilds/${tuple}/arc_safe_fs.node`);
-  const modelInputs={};for(const platform of ['codex','claude']){const base=`${platform}/skill`;required.push(`${base}/SKILL.md`,`${base}/models.toml`,`${base}/references/limits.md`);const profiles=new Map();for(const role of ['scouter','planner','coder','qa','reviewer']){const name=`arc-${role}.${platform==='codex'?'toml':'md'}`,key=`${platform}/agents/${name}`;required.push(key);profiles.set(name,files.get(key));}modelInputs[platform]={models:files.get(`${base}/models.toml`),profiles};}
+  for(const platform of ['codex','claude'])for(const name of [...COOPERATIVE_RUNTIME_MODULES,'role-policy.json'])required.push(`${platform}/skill/runtime/${name}`);
+  const modelInputs={};for(const platform of ['codex','claude']){const base=`${platform}/skill`;required.push(`${base}/SKILL.md`,`${base}/models.toml`,`${base}/references/limits.md`);const profiles=new Map();for(const role of ['scouter','planner','implementer','qa','reviewer']){const name=`arc-${role}.${platform==='codex'?'toml':'md'}`,key=`${platform}/agents/${name}`;required.push(key);profiles.set(name,files.get(key));}modelInputs[platform]={models:files.get(`${base}/models.toml`),profiles};}
   for(const name of required)if(!files.has(name))throw Error(`Required runtime asset is missing: ${name}`);
   const policyInputs=new Map(POLICY_TARGETS.map(({path:name})=>[name,files.get(name)]));
   const policyOutputs=buildPolicyOutputs(policyInputs,JSON.parse(files.get('lib/policy/role-policy.json').toString('utf8')));

package/lib/installer/plan.mjs

@@ -17,23 +17,19 @@ export function previewLanguage({target,safeFs}){
  let existing=null;try{if(current.exists)existing=parseLanguage(current.bytes).language;}catch(cause){fail(`Invalid ARC language settings: ${cause.message}`);}
  return{existing,snapshot};
 }
-export function buildInstallPlan({payload,target,preset,skipGlobal=false,safeFs,limits,concurrentExplicit=false,limitsPreview,language='en',languagePreview,modelConfig}){
- validateLanguage(language);
- if(languagePreview)assertPlanSnapshot({snapshot:languagePreview.snapshot},{safeFs});
- const languageState=languagePreview??previewLanguage({target,safeFs});
- if(limitsPreview)assertPlanSnapshot({snapshot:limitsPreview.snapshot},{safeFs});
- const preview=limitsPreview??previewLimits({target,safeFs});
- limits=resolveLimits({existing:preview.existing,overrides:limits??{}});
+function renderModelAssets({payload,target,preset,modelConfig,language}){
  const input=payload.modelInputs[target.platform];if(!input)fail('Selected payload platform is unavailable');
  const config=modelConfig===undefined?applyPreset(loadModelConfig(input.models,target.platform),preset):validateModelConfig(modelConfig);if(config.platform!==target.platform)fail('Model config platform does not match target');const profiles=renderProfiles(input.profiles,resolveModelSettings(config));for(const[name,bytes]of profiles)profiles.set(name,renderLanguagePolicy(bytes,language));const modelBytes=Buffer.from(serializeModelConfig(config));
  if(target.platform==='claude'){try{const script=payload.files.get('claude/skill/hooks/role-git-guard.mjs'),policy=payload.files.get('claude/skill/hooks/git-policy.json');if(!Buffer.isBuffer(script)||!script.length||!Buffer.isBuffer(policy))throw Error('Missing hook assets');validateGitPolicy(JSON.parse(policy.toString('utf8')));for(const[name,bytes]of profiles)profiles.set(name,installClaudeHook(bytes,path.join(target.home,'skills/arc')));}catch(cause){fail(`Invalid Claude Git guard: ${cause.message}`);}}
+ return{profiles,modelBytes};
+}
+function renderSkillPayload({payload,target,language,modelBytes,limits}){
  const skill=new Map();for(const[name,bytes]of payload.files)if(name.startsWith(target.payloadPrefix+'/skill/'))skill.set(name.slice((target.payloadPrefix+'/skill/').length),Buffer.from(bytes));skill.set('SKILL.md',renderLanguagePolicy(skill.get('SKILL.md'),language));skill.set('settings.toml',serializeLanguage(language));skill.set('models.toml',modelBytes);skill.set('limits.toml',serializeLimits(limits));
- const snapshot=new Map(),home=target.home;const skills=path.join(home,'skills'),agents=path.join(home,'agents'),arc=path.join(skills,'arc');
- for(const name of [home,skills,agents])inspectPath(safeFs,name,{kind:'directory',snapshot});
- inspectPath(safeFs,arc,{kind:'directory',tree:true,allowLinks:true,snapshot});
- const profilePaths=target.profileNames.map(name=>path.join(agents,name));for(const name of profilePaths)inspectPath(safeFs,name,{kind:'file',snapshot});
- const externalPaths=[],summary=['Fresh superpowers references will be acquired inside ARC'];
- const globalChanges=[];summary.push(`ARC limits: total ${limits.max_total_subagents}; concurrent ${limits.max_concurrent_subagents} (policy: ${arc}/limits.toml)`);
+ return skill;
+}
+function renderNativeChanges({target,safeFs,snapshot,skipGlobal,preview,concurrentExplicit,limits,summary,language}){
+ const home=target.home;
+ const globalChanges=[];
  if(limits.max_concurrent_subagents>limits.max_total_subagents)summary.push(`Effective concurrency is at most ${limits.max_total_subagents} for a fresh ARC session; it may be lower after cumulative use or due to native capacity.`);
  if(skipGlobal)summary.push('Native concurrency update skipped (--skip-global).');
  else for(const filename of target.globalPaths){
@@ -50,6 +46,24 @@ export function buildInstallPlan({payload,target,preset,skipGlobal=false,safeFs,
   if(rendered.content!==null&&(original===null||!rendered.content.equals(original)))globalChanges.push({path:filename,original,content:rendered.content,action:rendered.action});
   for(const note of rendered.notes??[])summary.push(`${filename}: ${note}`);
  }
+ return globalChanges;
+}
+export function buildInstallPlan({payload,target,preset,skipGlobal=false,safeFs,limits,concurrentExplicit=false,limitsPreview,language='en',languagePreview,modelConfig}){
+ validateLanguage(language);
+ if(languagePreview)assertPlanSnapshot({snapshot:languagePreview.snapshot},{safeFs});
+ const languageState=languagePreview??previewLanguage({target,safeFs});
+ if(limitsPreview)assertPlanSnapshot({snapshot:limitsPreview.snapshot},{safeFs});
+ const preview=limitsPreview??previewLimits({target,safeFs});
+ limits=resolveLimits({existing:preview.existing,overrides:limits??{}});
+ const {profiles,modelBytes}=renderModelAssets({payload,target,preset,modelConfig,language});
+ const skill=renderSkillPayload({payload,target,language,modelBytes,limits});
+ const snapshot=new Map(),home=target.home;const skills=path.join(home,'skills'),agents=path.join(home,'agents'),arc=path.join(skills,'arc');
+ for(const name of [home,skills,agents])inspectPath(safeFs,name,{kind:'directory',snapshot});
+ inspectPath(safeFs,arc,{kind:'directory',tree:true,allowLinks:true,snapshot});
+ const profilePaths=target.profileNames.map(name=>path.join(agents,name));for(const name of profilePaths)inspectPath(safeFs,name,{kind:'file',snapshot});
+ const externalPaths=[],summary=['Fresh superpowers references will be acquired inside ARC'];
+ summary.push(`ARC limits: total ${limits.max_total_subagents}; concurrent ${limits.max_concurrent_subagents} (policy: ${arc}/limits.toml)`);
+ const globalChanges=renderNativeChanges({target,safeFs,snapshot,skipGlobal,preview,concurrentExplicit,limits,summary,language});
  const managedPaths=[arc,...profilePaths,...(skipGlobal?[]:target.globalPaths)];
  for(const [filename,metadata]of preview.snapshot)snapshot.set(filename,metadata);
  for(const [filename,metadata]of languageState.snapshot)snapshot.set(filename,metadata);

package/lib/installer/runtime-assets.mjs

@@ -0,0 +1,25 @@
+// Installation inventory uses repository-root-relative POSIX paths.
+// Keep install-only additions separate from cooperative runtime hash inputs.
+export const RUNTIME_MODULE_PATHS = Object.freeze([
+ 'lib/runtime/acceptance.mjs',
+ 'lib/runtime/adapters/claude.mjs',
+ 'lib/runtime/adapters/codex.mjs',
+ 'lib/runtime/assignment.mjs',
+ 'lib/runtime/bootstrap.mjs',
+ 'lib/runtime/capabilities.mjs',
+ 'lib/runtime/cli.mjs',
+ 'lib/runtime/command.mjs',
+ 'lib/runtime/cooperative-schema.mjs',
+ 'lib/runtime/cooperative.mjs',
+ 'lib/runtime/evaluate.mjs',
+ 'lib/runtime/external.mjs',
+ 'lib/runtime/gate.mjs',
+ 'lib/runtime/git-evidence.mjs',
+ 'lib/runtime/git-query.mjs',
+ 'lib/runtime/identity.mjs',
+ 'lib/runtime/operations.mjs',
+ 'lib/runtime/schema.mjs',
+ 'lib/runtime/scope.mjs',
+ 'lib/runtime/store.mjs',
+ 'lib/runtime/verification.mjs'
+]);

package/lib/installer/shell-completion.mjs

@@ -1,29 +1,24 @@
 import path from 'node:path';
-import {applyTransaction} from './transaction.mjs';
 import {inspectPath,TargetConfigurationError} from './targets.mjs';
 const start='# >>> arc completion >>>',end='# <<< arc completion <<<';
-const body='if command -v arc >/dev/null 2>&1; then\n  eval "$(arc completion zsh)"\nfi';
-export function renderShellCompletion(original){
+export function removeShellCompletion(original){
  let text;try{text=original===null?'':new TextDecoder('utf-8',{fatal:true,ignoreBOM:true}).decode(original);}catch{throw new TargetConfigurationError('.zshrc must be valid UTF-8');}
  const starts=[...text.matchAll(/# >>> arc completion >>>/g)],ends=[...text.matchAll(/# <<< arc completion <<</g)];
- if(starts.length!==ends.length||starts.length>1)throw new TargetConfigurationError('Malformed ARC completion markers');
- const newline=text.includes('\r\n')?'\r\n':'\n',block=start+newline+body.replaceAll('\n',newline)+newline+end;
- if(starts.length){const first=starts[0].index,last=ends[0].index;if(first>=last||(first>0&&text[first-1]!=='\n')||(last>0&&text[last-1]!=='\n')||!['','\n','\r'].includes(text[last+end.length]??''))throw new TargetConfigurationError('Malformed ARC completion markers');return Buffer.from(text.slice(0,first)+block+text.slice(last+end.length));}
- return Buffer.concat([original??Buffer.alloc(0),Buffer.from((text&&!text.endsWith('\n')?newline:'')+block+newline)]);
+ const malformed=()=>{throw new TargetConfigurationError('Malformed ARC completion markers');};
+ if(starts.length!==ends.length||starts.length>1)malformed();
+ if(!starts.length)return{changed:false,content:original};
+ const first=starts[0].index,last=ends[0].index;let stop=last+end.length;
+ if(first>=last||(first>0&&text[first-1]!=='\n')||(last>0&&text[last-1]!=='\n')||!['','\n','\r\n'].includes(text.slice(stop,stop+2).startsWith('\r')?text.slice(stop,stop+2):text.slice(stop,stop+1)))malformed();
+ if(text.slice(stop,stop+2)==='\r\n')stop+=2;else if(text[stop]==='\n')stop++;
+ return{changed:true,content:Buffer.from(text.slice(0,first)+text.slice(stop))};
 }
-export function attachShellCompletion(plans,{safeFs}){
- const plan=plans[0];if(!plan||plan.skipGlobal)return;
+export function attachShellCompletionCleanup(plans,{safeFs}){
+ const plan=plans[0];if(!plan)return;
  const filename=path.join(plan.target.userHome,'.zshrc'),current=inspectPath(safeFs,filename,{kind:'file',read:true,snapshot:plan.snapshot}),original=current.bytes??null;
+ const removed=removeShellCompletion(original);
+ for(const item of plans){item.managedPaths=item.managedPaths.filter(name=>name!==filename);item.globalChanges=item.globalChanges.filter(change=>change.path!==filename);if(item!==plan)item.snapshot.delete(filename);}
+ if(!removed.changed)return;
  const metadata=plan.snapshot.get(filename);if(metadata&&(metadata.mode&0o222n)===0n)throw new TargetConfigurationError('.zshrc is not writable');
- const content=renderShellCompletion(original);plan.managedPaths.push(filename);
- if(original===null||!content.equals(original))plan.globalChanges.push({path:filename,original,content,action:'register completion'});
- plan.summary.push(`${filename}: zsh completion; opens automatically in a new zsh session. For this session: eval "$(arc completion zsh)"`);
-}
-
-export function registerShellCompletion(userHome,{safeFs,hooks={}}){
- const plan={target:{userHome},globalChanges:[],managedPaths:[],externalPaths:[],snapshot:new Map(),summary:[]};
- attachShellCompletion([plan],{safeFs});
- if(!plan.globalChanges.length)return{status:'unchanged',residualPaths:[]};
- const result=applyTransaction(plan,{safeFs,hooks,specs:plan.globalChanges.map(change=>({path:change.path,bytes:change.content}))});
- return{...result,status:result.cleanupError?'failed':'registered'};
+ plan.managedPaths.push(filename);plan.globalChanges.push({path:filename,original,content:removed.content,action:'remove managed completion'});
+ plan.summary.push(`${filename}: remove managed ARC completion block`);
 }

package/lib/installer/targets.mjs

@@ -9,7 +9,7 @@ export function resolveTarget(platform,{userHome,env={},cwd}={}){
  let home;if(platform==='codex'){const raw=env.CODEX_HOME;if(raw!==undefined&&(typeof raw!=='string'||!raw.trim()))fail('CODEX_HOME is empty or invalid');const expanded=expand(raw??path.join(userHome,'.codex'));if(path.isAbsolute(expanded))home=path.resolve(expanded);else{const base=cwd??process.cwd();if(typeof base!=='string'||!path.isAbsolute(base))fail('cwd must be absolute for relative CODEX_HOME');home=path.resolve(base,expanded);}}
  else{home=path.join(userHome,'.claude');const raw=env.CLAUDE_CONFIG_DIR;if(raw!==undefined&&(typeof raw!=='string'||!raw.trim()||!path.isAbsolute(expand(raw))||path.resolve(expand(raw))!==home))fail('CLAUDE_CONFIG_DIR must select the default ~/.claude directory');}
  if(home==='/'||home===path.resolve(userHome))fail('Target home must not be the filesystem or user-home root');
- const profileNames=['scouter','planner','coder','qa','reviewer'].map(role=>`arc-${role}.${platform==='codex'?'toml':'md'}`);
+ const profileNames=['scouter','planner','implementer','qa','reviewer'].map(role=>`arc-${role}.${platform==='codex'?'toml':'md'}`);
  return Object.freeze({platform,home,userHome:path.resolve(userHome),payloadPrefix:platform,profileNames:Object.freeze(profileNames),instructionPath:path.join(home,platform==='codex'?'AGENTS.md':'CLAUDE.md'),runtimeConfigPath:path.join(home,platform==='codex'?'config.toml':'settings.json'),globalPaths:Object.freeze(platform==='codex'?[path.join(home,'AGENTS.md'),path.join(home,'config.toml')]:[path.join(home,'CLAUDE.md'),path.join(home,'settings.json')])});
 }
 export function typeOf(metadata){return Number(metadata.mode&0o170000n);}

package/lib/installer/uninstall.mjs

@@ -3,6 +3,7 @@ import {inspectPath,sameIdentity,TargetConfigurationError} from './targets.mjs';
 import {SKILLS,snapshotSkill} from './superpowers.mjs';
 import {validatePlanSet} from './plan.mjs';
 import {removeManagedBlock} from './global-config.mjs';
+import {attachShellCompletionCleanup} from './shell-completion.mjs';
 export function buildUninstallPlan({target,safeFs,skipGlobal=false}){
  const snapshot=new Map(),removals=[],managedPaths=[path.join(target.home,'skills/arc'),...target.profileNames.map(name=>path.join(target.home,'agents',name))],globalChanges=[];
  for(const filename of managedPaths){const directory=filename===managedPaths[0];const found=inspectPath(safeFs,filename,{kind:directory?'directory':'file',tree:directory,allowLinks:directory,snapshot});if(found.exists)removals.push(filename);}
@@ -14,11 +15,14 @@ export function buildUninstallPlan({target,safeFs,skipGlobal=false}){
  }
  for(const skill of linkedSkills){const root=arc+'/references/superpowers/'+skill,directory=safeFs.openRoot(root);try{if(!sameIdentity(snapshot.get(root),directory.stat()))throw new TargetConfigurationError('Removal reference root changed');snapshotSkill(directory,root,[]);}finally{directory.close();}}
  if(!skipGlobal){const filename=target.instructionPath??target.globalPaths[0],found=inspectPath(safeFs,filename,{kind:'file',read:true,snapshot});managedPaths.push(filename);if(found.exists){const removed=removeManagedBlock(found.bytes);if(removed.changed)globalChanges.push({path:filename,content:removed.content});}}
- return{target,skipGlobal,snapshot,removals,managedPaths,externalPaths:[],globalChanges,summary:[target.platform==='codex'?'Codex config.toml wait settings and native concurrency key are preserved.':'Claude settings.json native concurrency key is preserved.']};
+ const plan={target,skipGlobal,snapshot,removals,managedPaths,externalPaths:[],globalChanges,summary:[target.platform==='codex'?'Codex config.toml wait settings and native concurrency key are preserved.':'Claude settings.json native concurrency key is preserved.']};
+ attachShellCompletionCleanup([plan],{safeFs});return plan;
 }
 import {assertPlanSnapshot,applyUninstallTransaction} from './transaction.mjs';
 export async function uninstallTargets(plans,{safeFs,signal,hooks={}}){
  const results=plans.map(plan=>({platform:plan.target.platform,status:'not-started',rollback:'not-needed',residualPaths:[],error:null}));let invalid=false;
+ // Each standalone preview retains its snapshot; only the first plan owns the shared shell write.
+ for(const plan of plans.slice(1)){const filename=path.join(plans[0].target.userHome,'.zshrc');plan.managedPaths=plan.managedPaths.filter(name=>name!==filename);plan.globalChanges=plan.globalChanges.filter(change=>change.path!==filename);plan.snapshot.delete(filename);}
  try{validatePlanSet(plans);}catch(error){return{results:results.map(item=>({...item,status:'failed',error})),interrupted:false};}
  for(let i=0;i<plans.length;i++)try{assertPlanSnapshot(plans[i],{safeFs});}catch(error){results[i]={...results[i],status:'failed',error};invalid=true;}
  if(invalid)return{results,interrupted:false};