@yunhozz/arc 0.1.9 → 0.2.0

package/lib/runtime/schema.mjs

@@ -36,6 +36,7 @@ const unique = (items,key) => items.every(x=>object(x)&&text(x[key])) && new Set
 function approval(a){return object(a)&&text(a.id)&&['user-message','human-confirmation'].includes(a.source)&&text(a.messageRef)&&hash(a.contentHash)&&object(a.scope)&&text(a.scope.taskId)&&absolute(a.scope.target)&&strings(a.scope.operations)&&a.scope.operations.every(op=>OPERATIONS.includes(op))&&strings(a.scope.paths)&&a.scope.paths.every(absolute);}
 /** Validate stored workflow data. Observed provenance must still be checked by evaluate. */
 export function validateWorkflowState(s){
+ if(object(s)&&s.workflowKind!==undefined)fail('provider state cannot use cooperative contract');
  if(!object(s)||s.schemaVersion!==1||!text(s.workflowId)||!Number.isSafeInteger(s.revision)||s.revision<0)fail('version or identity');
  if(!object(s.versions)||['policy','runtime','adapter','policyHash','runtimeHash','adapterHash'].some(k=>!text(s.versions[k])))fail('versions');
  if(['policyHash','runtimeHash','adapterHash'].some(k=>!hash(s.versions[k])))fail('hash algorithm');

package/lib/runtime/scope.mjs

@@ -0,0 +1,36 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+export const absolute=value=>typeof value==='string'&&path.isAbsolute(value)&&path.normalize(value)===value;
+export const within=(base,file)=>absolute(file)&&!path.relative(base,file).split(path.sep).includes('..')&&!path.isAbsolute(path.relative(base,file));
+/** Inspect every component, including ancestors outside the ARC namespace. */
+export async function inspectPath(filename,{missing=false,directory=false}={}){
+ if(!absolute(filename))throw Error('Unsafe absolute path');
+ let cursor=path.parse(filename).root;
+ const parts=filename.slice(cursor.length).split(path.sep).filter(Boolean);
+ for(let i=0;i<parts.length;i++){
+  cursor=path.join(cursor,parts[i]);let stat;
+  try{stat=await fs.lstat(cursor);}catch(error){if(missing&&error.code==='ENOENT')return;throw error;}
+  if(stat.isSymbolicLink())throw Error('Unsafe symlink path');
+  if(i<parts.length-1||directory){if(!stat.isDirectory())throw Error('Unsafe directory type');}
+  else if(!stat.isFile())throw Error('State must be a regular file');
+ }
+}
+export function validateWorkflowId(id){if(typeof id!=='string'||!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(id))throw Error('Invalid workflow ID');return id;}
+/** Shell-free, read-only observation; inherited Git target/config overrides are removed. */
+export async function observeCooperativeTarget(cwd){
+ if(!absolute(cwd))throw Error('Absolute workspace required');await inspectPath(cwd,{directory:true});
+ const env=Object.fromEntries(Object.entries(process.env).filter(([key])=>!key.toUpperCase().startsWith('GIT_')));
+ Object.assign(env,{GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_OPTIONAL_LOCKS:'0',GIT_NO_REPLACE_OBJECTS:'1',GIT_NO_LAZY_FETCH:'1',GIT_TERMINAL_PROMPT:'0'});
+ const query=(args,detached=false)=>{const r=spawnSync('git',['--no-pager','-c','core.fsmonitor=false',...args],{cwd,env,encoding:'utf8',timeout:10000,maxBuffer:1024*1024});if(detached&&r.status===1&&!r.error)return null;if(r.status!==0||r.error||!r.stdout.endsWith('\n')||r.stdout.slice(0,-1).includes('\n'))throw Error('Git target observation failed');return r.stdout.slice(0,-1);};
+ const target={realpath:query(['rev-parse','--show-toplevel']),gitCommonDir:query(['rev-parse','--path-format=absolute','--git-common-dir']),gitDir:query(['rev-parse','--absolute-git-dir']),head:query(['rev-parse','HEAD']),branch:query(['symbolic-ref','--quiet','--short','HEAD'],true)};
+ await validateObservedTarget(cwd,target);return target;
+}
+export async function validateObservedTarget(cwd,target){
+ if(!absolute(cwd)||!target||target.realpath!==cwd||!absolute(target.gitCommonDir)||!absolute(target.gitDir)||!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(target.head)||!(target.branch===null||typeof target.branch==='string'&&target.branch))throw Error('Invalid observed target');
+ await inspectPath(cwd,{directory:true});await inspectPath(target.gitCommonDir,{directory:true});
+ return target;
+}
+export async function workflowStatePath(target,workflowId){
+ validateWorkflowId(workflowId);const statePath=path.join(target.gitCommonDir,'arc','workflows',workflowId,'state.json');await inspectPath(statePath,{missing:true});return statePath;
+}

package/lib/runtime/store.mjs

@@ -1,3 +1,4 @@
+import {verifiedCooperativeReconciliation} from './acceptance.mjs';
 import {verifiedReconciliation} from './gate.mjs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -51,13 +52,33 @@ export async function transactWorkflow({statePath,expectedRevision,requestId,req
   next.revision=state.revision+1;next.requests=prior?state.requests.map(r=>r.requestId===requestId?{requestId,requestFingerprint,decision}:r):[...state.requests,{requestId,requestFingerprint,decision}];
   next.audit=[...state.audit,{requestId,revision:next.revision,decision:decision.decision,ruleIds:decision.ruleIds??[],result:'pending'}];
   validateWorkflowState(next);
-  temporary=path.join(parent,`.${path.basename(statePath)}.${crypto.randomUUID()}.tmp`);
-  const handle=await fs.open(temporary,'wx',0o600);try{await handle.writeFile(JSON.stringify(next,null,2)+'\n');await handle.sync();}finally{await handle.close();}
-  await fs.rename(temporary,statePath);temporary=undefined;
-  const directory=await fs.open(parent,'r');try{await directory.sync();}finally{await directory.close();}
+  await saveDurableState({statePath,state:next});
   return {state:next,decision,replayed:false};
  }finally{
   if(temporary)await fs.unlink(temporary).catch(()=>{});
   if(lock){await lock.close();await fs.unlink(lockPath);}
  }
 }
+
+/** Shared durability primitive. A post-rename sync error is reported as failure;
+ * the caller must re-read rather than assume rollback or repeat an effect. */
+export async function saveDurableState({statePath,state,create=false,storage={}}){
+ const parent=path.dirname(statePath),temporary=path.join(parent,`.${path.basename(statePath)}.${crypto.randomUUID()}.tmp`);
+ let exists=false;
+ try{
+  const handle=await fs.open(temporary,'wx',0o600);exists=true;
+  try{await handle.writeFile(JSON.stringify(state,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+  if(create){await (storage.link??fs.link)(temporary,statePath);await fs.unlink(temporary);}else await (storage.rename??fs.rename)(temporary,statePath);
+  exists=false;
+  const directory=await fs.open(parent,'r');try{await directory.sync();}finally{await directory.close();}
+ }finally{if(exists)await fs.unlink(temporary).catch(()=>{});}
+}
+
+/** Only a locally verified cooperative commit may advance the stored target. */
+export function applyCooperativeCommitTransition({state,decision}){
+ if(decision?.decision!=='allow'||!verifiedCooperativeReconciliation(decision,state)||!decision.proposedTransition?.commit)throw Error('Verified cooperative reconciliation required');
+ const next=structuredClone(state),transition=decision.proposedTransition;
+ next.targetHistory.push({target:structuredClone(state.target),revision:state.revision+1,source:'local-observation',kind:'verified-commit-parent'});
+ next.target=structuredClone(transition.target);next.commits.push(structuredClone(transition.commit));next.tasks.find(t=>t.id===transition.commit.taskId).status='committed';
+ return next;
+}

package/lib/runtime/verification.mjs

@@ -0,0 +1,123 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {spawnSync} from 'node:child_process';
+import {fingerprintRequest} from './store.mjs';
+import {absolute,within,inspectPath} from './scope.mjs';
+const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+const text=v=>typeof v==='string'&&v.length>0;
+const hash=v=>typeof v==='string'&&/^sha256:[a-f0-9]{64}$/.test(v);
+const list=v=>Array.isArray(v)&&v.every(text)&&new Set(v).size===v.length;
+const fields=(v,keys)=>v&&typeof v==='object'&&!Array.isArray(v)&&Object.keys(v).every(k=>keys.includes(k));
+const base=state=>({expectedRevision:state?.revision??0,coverage:{enforcement:'cooperative',provenance:'operator-attested',nativeVerified:false},requiredEvidence:[],nextActions:[],proposedTransition:null});
+const hold=(state,id,reason)=>({...base(state),decision:'hold',ruleIds:['cooperative.'+id],reason});
+const allow=(state,transition)=>({...base(state),decision:'allow',ruleIds:['cooperative.verification'],proposedTransition:transition});
+const current=(state,scope,taskId,changes)=>scope==='final'?changes?.final:changes?.tasks?.[taskId];
+const approval=(state,taskId)=>state.records.filter(r=>r.kind==='approval'&&(!r.data.affectedTaskIds||r.data.affectedTaskIds.includes(taskId))).at(-1);
+function authorized(state,task){
+ const a=approval(state,task?.id);
+ return task&&!task.invalidated&&a&&a.source==='operator-attested'&&a.targetVersion===state.targetVersion&&task.scopeVersion===a.scopeVersion&&task.targetVersion===state.targetVersion&&task.approvalRef===a.messageRef&&task.approvalVersion===a.data.approvalVersion&&task.documentVersion===a.data.documentVersion;
+}
+function descriptorValid(state,d,operation){
+ if(operation==='review')return fields(d,['kind','paths'])&&d.kind==='source-review'&&list(d.paths)&&d.paths.length>0&&d.paths.every(p=>absolute(p)&&within(state.target.realpath,p));
+ return fields(d,['executable','args','cwd','env','outputs'])&&absolute(d.executable)&&Array.isArray(d.args)&&d.args.every(v=>typeof v==='string')&&absolute(d.cwd)&&within(state.target.realpath,d.cwd)&&fields(d.env,Object.keys(d.env??{}))&&Object.values(d.env).every(v=>typeof v==='string')&&Array.isArray(d.outputs)&&d.outputs.every(p=>absolute(p)&&within(state.target.realpath,p));
+}
+const assignedImplementer=(state,id,taskId)=>state.assignments.some(a=>a.agentId===id&&a.taskId===taskId&&a.status==='active');
+function independent(state,actor,taskId){
+ if(!fields(actor,['id','role'])||!text(actor.id))return false;
+ if(state.assignments.some(a=>a.agentId===actor.id))return false;
+ return !(state.intents??[]).some(i=>i.verificationActor?.id===actor.id&&(i.verificationActor.role!==actor.role||actor.role==='qa'&&i.taskId!==taskId))&&!(state.checks??[]).some(c=>c.verificationActor?.id===actor.id&&(c.verificationActor.role!==actor.role||actor.role==='qa'&&c.taskId!==taskId));
+}
+/** Invalidate only the affected dependency closure; preserve all historical evidence. */
+export function invalidateAffectedEvidence({state,changedVersions={},affectedTaskIds}={}){
+ const next=structuredClone(state),ids=new Set(affectedTaskIds??next.tasks.map(t=>t.id));
+ let changed=true;while(changed){changed=false;for(const t of next.tasks)if(!ids.has(t.id)&&t.dependencies?.some(id=>ids.has(id))){ids.add(t.id);changed=true;}}
+ for(const t of next.tasks)if(ids.has(t.id)){t.invalidated=true;t.status='held';t.invalidatedBy=structuredClone(changedVersions);t.invalidatedAt=state.revision+1;}
+ for(const key of ['checks','acceptances'])for(const entry of next[key]??[])if(entry.scope==='final'||ids.has(entry.taskId)){entry.stale=true;entry.invalidatedBy=structuredClone(changedVersions);}
+ for(const intent of next.intents??[])if(['check','review'].includes(intent.operation)&&(intent.scope==='final'||ids.has(intent.taskId)))intent.stale=true;
+ // Old approval statements remain immutable; no change creates renewed authority.
+ if(Number.isSafeInteger(changedVersions.scopeVersion))next.scopeVersion=changedVersions.scopeVersion;
+ return next;
+}
+function record({state,request,evidence}){
+ const entry=request.evidence,d=entry?.data;
+ if(!entry||!text(entry.messageRef)||!d)return hold(state,'verification-record','Structured evidence required');
+ if(entry.kind==='acceptance-evidence'&&d.kind==='task'){
+  const t=d.task,previous=state.tasks.find(task=>task.id===t?.id),a=approval(state,t?.id);
+  if(previous?.invalidated&&(!a||!Number.isSafeInteger(a.revision)||a.revision<previous.invalidatedAt||a.scopeVersion!==state.scopeVersion))return hold(state,'task-approval-stale','Invalidated task requires a renewed approval statement');
+  if(!fields(t,['id','paths','criteria','requiredChecks','dependencies','approvalRef','approvalVersion','documentVersion','scopeVersion','targetVersion','status'])||!text(t.id)||!list(t.paths)||!t.paths.length||!t.paths.every(p=>absolute(p)&&within(state.target.realpath,p))||!list(t.criteria)||!t.criteria.length||!list(t.dependencies)||t.dependencies.includes(t.id)||t.dependencies.some(id=>!state.tasks.some(task=>task.id===id))||!Array.isArray(t.requiredChecks)||!t.requiredChecks.length||!t.requiredChecks.every(c=>descriptorValid(state,c,'check'))||!['pending',undefined].includes(t.status)||state.tasks.some(task=>task.id===t.id&&['accepted','committed'].includes(task.status))||!authorized(state,t))return hold(state,'task-contract','Current approval and explicit pending task contract required');
+  return allow(state,{task:{...structuredClone(t),status:'pending',source:'operator-attested',messageRef:entry.messageRef}});
+ }
+ if(entry.kind!=='finding')return hold(state,'unsupported','Check and review outcomes require durable intent/result');
+ if(d.action==='open'){
+  const check=state.checks.find(c=>c.id===d.checkId&&!c.stale);
+  if(!fields(d,['action','id','checkId','message'])||!text(d.id)||!text(d.message)||state.findings.some(f=>f.id===d.id)||!check)return hold(state,'finding','Finding must link an existing check or review');
+  return allow(state,{finding:{id:d.id,checkId:check.id,scope:check.scope,taskId:check.taskId,origin:check.scope==='final'&&check.operation==='review'?'final-review':'check',status:'open',message:d.message,messageRef:entry.messageRef,source:'operator-attested'}});
+ }
+ const finding=state.findings.find(f=>f.id===d.id);
+ const affected=finding?.scope==='final'?state.tasks.map(t=>t.id):[finding?.taskId];
+ if(!fields(d,['action','id','actor','changeFingerprint'])||d.action!=='resolve'||!finding||finding.status==='closed'||!fields(d.actor,['id','role'])||d.actor.role!=='implementer'||!affected.some(id=>assignedImplementer(state,d.actor.id,id))||!hash(d.changeFingerprint)||d.changeFingerprint!==current(state,finding.scope,finding.taskId,evidence?.changes))return hold(state,'finding-resolution','Assigned Implementer correction at the current fingerprint required');
+ return allow(state,{finding:{...finding,status:'resolved',resolutionRef:entry.messageRef,resolutionActor:structuredClone(d.actor),changeFingerprint:d.changeFingerprint}});
+}
+/** Pure cooperative gate: verifies recorded consistency, never identity or semantic sufficiency. */
+export function evaluateCooperativeVerification({state,request,evidence}={}){
+ if(state?.mode!=='plan')return hold(state,'unsupported','Only the complete spec and plan path is supported');
+ if(!request||request.expectedRevision!==state.revision)return hold(state,'revision','Stale verification request');
+ if(request.actor?.role!=='orchestrator')return hold(state,'verification-actor','Orchestrator statement required');
+ if(request.operation==='verification-record')return record({state,request,evidence});
+ if(request.operation==='verification-result')return outcome({state,request,evidence});
+ if(!['check','review'].includes(request.operation))return hold(state,'unsupported','Unsupported verification operation');
+ const a=request.arguments,t=state.tasks.find(t=>t.id===request.taskId);
+ if(!fields(a,['scope','actor','descriptor','changeFingerprint','findingIds'])||!['task','final'].includes(a.scope)||!hash(a.changeFingerprint)||a.changeFingerprint!==current(state,a.scope,request.taskId,evidence?.changes)||!descriptorValid(state,a.descriptor,request.operation))return hold(state,'verification-fingerprint','Exact scope descriptor and current fingerprint required');
+ if(a.scope==='task'&&(!authorized(state,t)||t.status==='held'||request.operation==='review'||!t.requiredChecks.some(d=>same(d,a.descriptor))))return hold(state,'verification-task','Current task approval and exact assigned check required; Reviewer is final only');
+ if(a.scope==='final'&&(request.taskId!==undefined||request.operation!=='review'||!state.tasks.length||state.tasks.some(t=>!authorized(state,t)||!['accepted','committed'].includes(t.status))))return hold(state,'verification-final','Final review follows accepted tasks and required task checks');
+ const finalCorrection=a.scope==='final'&&state.findings.some(f=>f.origin==='final-review'&&f.status==='resolved'&&a.findingIds?.includes(f.id));
+ if(a.scope==='final'&&!finalCorrection&&state.tasks.some(task=>task.requiredChecks.some(descriptor=>!state.checks.some(c=>c.scope==='task'&&c.taskId===task.id&&c.operation==='check'&&!c.stale&&c.status==='passed'&&c.verdict==='proven'&&text(c.resultRef)&&c.verificationActor?.role==='qa'&&same(c.descriptor,descriptor)&&(c.changeFingerprint===evidence.changes?.tasks?.[task.id]||task.status==='committed'&&state.commits?.some(commit=>commit.taskId===task.id&&commit.observationSource==='local-git'&&commit.fingerprint===c.changeFingerprint&&commit.postCommitFingerprint===evidence.changes?.tasks?.[task.id]))))))return hold(state,'verification-final-checks','Initial final review requires current task QA evidence');
+ if(a.actor?.role!==(request.operation==='review'?'reviewer':'qa')||a.actor.id===request.actor.id||!independent(state,a.actor,request.taskId))return hold(state,'verification-independence','Independent actor statement and fresh task QA required');
+ const findings=state.findings.filter(f=>f.status!=='closed'&&(a.scope==='final'||f.scope==='task'&&f.taskId===request.taskId));
+ if(a.findingIds!==undefined&&(!list(a.findingIds)||a.findingIds.some(id=>!findings.some(f=>f.id===id))))return hold(state,'finding-recheck','Unknown finding recheck');
+ if(findings.some(f=>f.status!=='resolved'||!text(f.resolutionRef)||f.resolutionActor?.role!=='implementer'||f.changeFingerprint!==a.changeFingerprint||!a.findingIds?.includes(f.id)||f.origin==='final-review'&&request.operation!=='review'||f.origin!=='final-review'&&request.operation!=='check'))return hold(state,'finding-recheck','Implementer resolution and the required QA or final Reviewer recheck required');
+ if(state.intents.some(i=>['check','review'].includes(i.operation)&&['prepared','unknown','mismatch'].includes(i.status)&&i.scope===a.scope&&i.taskId===request.taskId&&same(i.descriptor,a.descriptor)&&!i.stale))return hold(state,'verification-active','Reconcile the existing verification intent');
+ const intent={requestId:request.requestId,operation:request.operation,status:'prepared',scope:a.scope,taskId:request.taskId,verificationActor:structuredClone(a.actor),descriptor:structuredClone(a.descriptor),changeFingerprint:a.changeFingerprint,findingIds:[...(a.findingIds??[])],scopeVersion:state.scopeVersion,targetVersion:state.targetVersion,versions:structuredClone(state.versions),target:structuredClone(state.target),approval:structuredClone(approval(state,request.taskId)),taskFingerprint:fingerprintRequest(a.scope==='final'?state.tasks:t),fingerprint:fingerprintRequest(request),source:'operator-attested'};
+ return allow(state,{intent});
+}
+function outcome({state,request,evidence}){
+ const intent=state.intents.find(i=>i.requestId===request.intentId),r=request.result,d=r?.data;
+ if(!intent||!['check','review'].includes(intent.operation)||!['prepared','unknown','mismatch'].includes(intent.status))return hold(state,'verification-intent','Matching unresolved verification intent required');
+ const valid=r&&['succeeded','failed','unknown','mismatch'].includes(r.status)&&text(r.messageRef)&&fields(d,['actor','descriptor','scope','taskId','changeFingerprint','verdict'])&&['proven','unmet','unverified'].includes(d.verdict)&&same(d.actor,intent.verificationActor)&&same(d.descriptor,intent.descriptor)&&d.scope===intent.scope&&d.taskId===intent.taskId&&d.changeFingerprint===intent.changeFingerprint;
+ const fresh=!intent.stale&&intent.changeFingerprint===current(state,intent.scope,intent.taskId,evidence?.changes)&&(intent.scope==='task'||intent.scopeVersion===state.scopeVersion)&&intent.targetVersion===state.targetVersion&&same(intent.target,state.target)&&same(intent.versions,state.versions)&&independent(state,intent.verificationActor,intent.taskId)&&same(intent.approval,approval(state,intent.taskId))&&intent.taskFingerprint===fingerprintRequest(intent.scope==='final'?state.tasks:state.tasks.find(t=>t.id===intent.taskId));
+ const status=!valid?'mismatch':r.status;
+ const check={id:intent.requestId,operation:intent.operation,scope:intent.scope,taskId:intent.taskId,descriptor:structuredClone(intent.descriptor),verificationActor:structuredClone(intent.verificationActor),changeFingerprint:intent.changeFingerprint,resultRef:r?.messageRef,verdict:valid?d.verdict:'unverified',status:fresh&&status==='succeeded'&&d.verdict==='proven'?'passed':status==='failed'||d?.verdict==='unmet'?'failed':'unverified',stale:!fresh,source:'operator-attested'};
+ const findings=[];
+ if(check.status==='failed')findings.push({id:intent.requestId+':failure',checkId:check.id,scope:intent.scope,taskId:intent.taskId,origin:intent.operation==='review'?'final-review':'check',status:'open',source:'operator-attested',messageRef:r.messageRef});
+ if(check.status==='passed')for(const id of intent.findingIds){const f=state.findings.find(f=>f.id===id);if(!f||f.status!=='resolved'||f.changeFingerprint!==intent.changeFingerprint)return hold(state,'finding-recheck','Finding changed after prepare');findings.push({...f,status:'closed',recheckRef:r.messageRef,recheckActor:structuredClone(d.actor)});}
+ const transition={result:{...structuredClone(r),status,source:'operator-attested'},check,findings};
+ return check.status==='passed'?allow(state,transition):{...hold(state,'verification-'+status,'Recorded outcome does not establish passing current evidence'),proposedTransition:transition};
+}
+function defaultRunner({cwd,args}){
+ const env=Object.fromEntries(Object.entries(process.env).filter(([k])=>!k.toUpperCase().startsWith('GIT_')));
+ Object.assign(env,{GIT_OPTIONAL_LOCKS:'0',GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:process.platform==='win32'?'NUL':'/dev/null',GIT_NO_REPLACE_OBJECTS:'1',GIT_NO_LAZY_FETCH:'1',GIT_TERMINAL_PROMPT:'0'});
+ return spawnSync('git',['--no-pager','--literal-pathspecs','-c','core.fsmonitor=false',...args],{cwd,env,encoding:'buffer',timeout:10000,maxBuffer:16*1024*1024});
+}
+/** Read tracked/untracked regular bytes, deletions and modes without staging or execution.
+ * The snapshot is cooperative evidence at observation time, not an atomic execution sandbox. */
+export async function readCooperativeChanges({state,gitRunner=defaultRunner}){
+ const inventory=await gitRunner({cwd:state.target.realpath,args:['ls-files','--cached','--others','--exclude-standard','-z']});
+ if(inventory?.status!==0||inventory.error||!Buffer.isBuffer(inventory.stdout))throw Error('Verification inventory query failed');
+ const raw=new TextDecoder('utf-8',{fatal:true}).decode(inventory.stdout);
+ if(raw&&!raw.endsWith('\0'))throw Error('Incomplete verification inventory');
+ const index=await gitRunner({cwd:state.target.realpath,args:['ls-files','--stage','-z']});
+ if(index?.status!==0||index.error||!Buffer.isBuffer(index.stdout))throw Error('Verification index query failed');
+ const indexText=new TextDecoder('utf-8',{fatal:true}).decode(index.stdout),indexRows=[];
+ if(indexText&&!indexText.endsWith('\0'))throw Error('Incomplete verification index');
+ for(const entry of indexText?indexText.slice(0,-1).split('\0'):[]){const match=/^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\t([\s\S]+)$/.exec(entry);if(!match)throw Error('Verification requires regular stage-0 index entries');indexRows.push({path:path.join(state.target.realpath,match[3]),entry});}
+ const names=[...new Set(raw?raw.slice(0,-1).split('\0'):[])].sort(),rows=[];
+ for(const name of names){
+  if(!name||name.includes('\\')||name.includes('\n')||name.includes('\r')||path.isAbsolute(name)||name.split('/').some(p=>!p||p==='.'||p==='..'))throw Error('Invalid verification path');
+  const file=path.join(state.target.realpath,...name.split('/'));
+  try{await inspectPath(file);const stat=await fs.lstat(file);if(!stat.isFile())throw Error('Verification requires regular files');rows.push({path:file,mode:stat.mode&0o777,hash:'sha256:'+createHash('sha256').update(await fs.readFile(file)).digest('hex')});}
+  catch(error){if(error.code!=='ENOENT')throw error;rows.push({path:file,deleted:true});}
+ }
+ const tasks={},taskSnapshots={};for(const task of state.tasks){if(!list(task.paths)||!task.paths.every(p=>absolute(p)&&within(state.target.realpath,p)))throw Error('Invalid task paths');taskSnapshots[task.id]={scope:'task',taskId:task.id,target:Object.fromEntries(Object.entries(state.target).filter(([key])=>key!=='head')),paths:task.paths,index:indexRows.filter(row=>task.paths.some(p=>within(p,row.path))),rows:rows.filter(row=>task.paths.some(p=>within(p,row.path)))};tasks[task.id]=fingerprintRequest(taskSnapshots[task.id]);}
+ return {tasks,taskSnapshots,final:fingerprintRequest({scope:'final',target:state.target,index:indexRows,rows})};
+}

package/lib/tui/app.mjs

@@ -0,0 +1,41 @@
+import {createTerminalSession} from './terminal.mjs';
+import {escapeTerminalText} from './render.mjs';
+import {createManagementContext,prepareOperation,executeOperation} from '../management/operations.mjs';
+import {collectStatus} from '../management/status.mjs';
+import {runSetup,summary} from './setup.mjs';
+import {runWorkflow,workflowRows} from './workflow.mjs';
+const home=['Install / Reconfigure','Change Preset','Workflow','Update Harness','Uninstall Harness','Exit'];
+function interrupted(){return Object.assign(Error('Session interrupted'),{code:'ARC_CANCELLED'});}
+function operationRows(prepared){
+ if(prepared.kind==='workflow')return['Command: '+prepared.command,'Workspace: '+prepared.cwd,'Workflow: '+prepared.workflowId,'Confirmation does not supply runtime approval evidence.'];
+ const rows=['Operation: '+prepared.kind];if(prepared.options)rows.push('Target: '+prepared.options.target,...(prepared.kind==='install'?['Settings: '+summary(prepared.options),'External references must be downloaded after applying.']:[]));
+ for(const plan of prepared.plans??[]){rows.push('Target: '+(plan.target?.platform??plan.platform??'harness'),'Destination: '+(plan.target?.home??plan.home??''));for(const key of ['managedPaths','writes','deletes','removals','preserved','preserve']){const values=plan[key];if(Array.isArray(values))for(const item of values)rows.push(key+': '+(typeof item==='string'?item:item.path??item.destination??item.relativePath??'managed file'));}for(const change of plan.globalChanges??[])rows.push('Global: '+change.path+' — '+(change.action??'managed ARC update'));for(const note of plan.summary??[])rows.push(note);}
+ if(prepared.kind==='uninstall')rows.push('Remove ARC harness and managed profiles.',prepared.options?.skipGlobal?'Preserve ARC global instruction blocks.':'Remove selected ARC global instruction blocks.','Preserve native concurrency, user files, other skills and workflow audit state.','CLI npm package is retained.');
+ if(prepared.kind==='update')rows.push('Installed settings are preserved.','Global CLI replacement ends this session.');
+ return rows;
+}
+export function createTuiInterface(session,{input,controller}={}){
+ async function event(){const e=await session.nextEvent();if(e.name==='interrupt')throw interrupted();if(e.name==='eof')throw Object.assign(Error('Session closed'),{code:'ARC_TUI_EOF'});if(e.name==='error')throw e.error;return e;}
+ async function menu(title,rows,{selected=0,info=[],requiresConfirmation=false}={}){
+  while(true){const offset=Math.max(0,selected-7),visible=rows.slice(offset,offset+8);const screen={title,rows:[...info,...visible],selected:info.length+selected-offset,requiresConfirmation,hint:'Up/Down: select | Enter: continue | Esc: back'+(rows.length>8?' | '+(offset+1)+'-'+Math.min(offset+8,rows.length)+'/'+rows.length:'')};const rendered=session.render(screen);const e=await event();if(e.name==='up')selected=(selected+rows.length-1)%rows.length;else if(e.name==='down')selected=(selected+1)%rows.length;else if(e.name==='back')return null;else if(e.name==='enter'&&(!requiresConfirmation||rendered.applyEnabled))return selected;}
+ }
+ async function text(title,initial=''){let value=initial;while(true){session.render({title,rows:[value],hint:'Type or paste | Left: delete | Enter: accept | Esc/Backspace: back'});const e=await event();if(e.name==='text'||e.name==='paste')value+=e.text;else if(e.name==='left')value=[...value].slice(0,-1).join('');else if(e.name==='back')return null;else if(e.name==='enter')return value;}}
+ async function page(title,rows,{requireRead=false}={}){let offset=0;while(true){const size=8,slice=rows.slice(offset,offset+size);const rendered=session.render({title,rows:slice,requiresConfirmation:requireRead,hint:`Rows ${offset+1}-${Math.min(offset+size,rows.length)} of ${rows.length} | Up/Down: scroll | Enter/Esc: back`});const e=await event();if(e.name==='down')offset=Math.min(Math.max(0,rows.length-size),offset+1);else if(e.name==='up')offset=Math.max(0,offset-1);else if(e.name==='back')return false;else if(e.name==='enter'&&(!requireRead||rendered.applyEnabled)){if(requireRead&&offset+size<rows.length){offset=Math.min(rows.length-size,offset+size);}else return true;}}}
+ async function review(title,prepared){const rows=operationRows(prepared);while(true){const choice=await menu('Review '+title,['Cancel','Edit','Apply','View change details','Validate (read only)'],{info:rows.slice(0,8),requiresConfirmation:true});if(choice===null||choice===0)return'cancel';if(choice===1)return'edit';if(choice===2){if(rows.length>8){if(!await page('Review all changes',rows,{requireRead:true}))continue;const confirm=await menu('Confirm '+title,['Cancel','Apply'],{info:['All details reviewed. Apply the prepared snapshot?'],requiresConfirmation:true});if(confirm!==1)continue;}return'apply';}if(choice===3)await page('Change details',rows);if(choice===4)await page('Validation',['Prepared plans validated without changes or downloads.','Execution rechecks the reviewed snapshot.','External downloads are checked only after applying.']);}}
+ async function busy(action){session.render({title:'Working',rows:['Operation in progress. Please wait.'],hint:'Ctrl+C: interrupt'});session.setBusy(true);const wasFlowing=input?.readableFlowing;const onData=chunk=>{if(String(chunk).includes('\x03')||String(chunk).includes('\x04'))controller?.abort();};input?.on('data',onData);try{const result=await action();if(controller?.signal.aborted){if(typeof result?.code!=='number')throw interrupted();return{...result,code:130,interrupted:true};}return result;}finally{input?.removeListener('data',onData);if(wasFlowing!==true)input?.pause?.();session.setBusy(false);session.discardInput();}}
+ return{menu,text,page,review,busy};
+}
+export function resultRows(result){return[...(result.messages??[]).map(s=>s.trim()),...[result.stdout,result.stderr].flatMap(text=>text?text.trimEnd().split(/\r?\n/):[]),...(result.results??[]).flatMap(item=>[`${item.platform??item.target?.platform??'Target'}: ${item.status}; rollback: ${item.rollback??'not needed'}`,...(item.residualPaths??[]).map(p=>'Residual path: '+p),...(item.error?['Error: '+item.error.message]:[])]),...(result.error?['Error: '+result.error.message]:[]),'Exit code: '+result.code,...(result.code===0?['Open a new agent session to use changed harness settings.']:['Review the failed target and retry from the menu.']),...(result.exitSession?['CLI replacement ended this session. Run arc again for further management.']:[])];}
+export async function runTui(options={}){
+ let session=options.session,code=0,finalReport;const controller=new AbortController(),signals=options.signals??process;const abort=()=>controller.abort();signals.on('SIGINT',abort);signals.on('SIGTERM',abort);
+ try{session??=createTerminalSession(options);const ui=createTuiInterface(session,{input:options.input??process.stdin,controller}),api={collectStatus,prepareOperation,executeOperation,...options.services},context=options.context?{...options.context,signal:controller.signal}:await createManagementContext({...options.contextOptions,signal:controller.signal});const draft={};let selected=0;
+  while(true){const statuses=await api.collectStatus(context);const info=statuses.map(s=>s.platform+': '+s.state+(s.diagnostics?.length?' — '+s.diagnostics.map(e=>e.message).join('; '):''));const choice=await ui.menu('ARC Management',home,{selected,info});if(choice===null)continue;selected=choice;if(choice===5)return code;
+   try{if(choice===2){await runWorkflow({ui,cwd:context.cwd??process.cwd(),services:options.services,onResult:result=>{code=result.code;if(code===130){finalReport=workflowRows(result);throw interrupted();}}});continue;}
+    let prepared;if(choice===0||choice===1)prepared=await runSetup({ui,statuses,draft,kind:choice===0?'install':'preset',prepare:settings=>api.prepareOperation(context,settings)});
+    else if(choice===3){prepared=await ui.busy(()=>api.prepareOperation(context,{kind:'update'}));const decision=await ui.review('Update Harness',prepared);if(decision!=='apply')prepared=null;}
+    else{const target=await ui.menu('Uninstall target',['Codex','Claude','Both targets']);if(target===null)continue;const global=await ui.menu('Global ARC instructions',['Remove ARC blocks','Preserve ARC blocks']);if(global===null)continue;prepared=await ui.busy(()=>api.prepareOperation(context,{kind:'uninstall',target:['codex','claude','all'][target],skipGlobal:global===1}));const decision=await ui.review('Uninstall Harness',prepared);if(decision!=='apply')prepared=null;}
+    if(!prepared)continue;const result=await ui.busy(()=>api.executeOperation(context,prepared));code=result.code;if(code===130){finalReport=resultRows(result);return 130;}if(result.exitSession){finalReport=resultRows(result);session.render({title:'Result',rows:finalReport,hint:'Session ended'});return code;}await ui.page('Result',resultRows(result));
+   }catch(error){if(['ARC_CANCELLED','ARC_TUI_EOF'].includes(error.code))throw error;code=error.code==='ARC_CLI_INPUT'?2:1;await ui.page('Operation unavailable',[error.message,'No unreviewed changes were applied.']);}
+  }
+ }catch(error){if(error.code==='ARC_CANCELLED')return 130;if(error.code==='ARC_TUI_EOF')return code;if(error.code==='ARC_TUI_TERMINAL')return 2;throw error;}finally{signals.removeListener('SIGINT',abort);signals.removeListener('SIGTERM',abort);session?.dispose();if(finalReport)(options.output??process.stdout).write(finalReport.map(row=>escapeTerminalText(row)).join('\n')+'\n');}
+}

package/lib/tui/render.mjs

@@ -0,0 +1,21 @@
+// Treat all screen content as data. Only terminal.mjs emits terminal commands.
+export function escapeTerminalText(value=''){
+ return String(value).replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu,character=>{
+  const code=character.codePointAt(0);return code<=255?'\\x'+code.toString(16).padStart(2,'0'):'\\u{'+code.toString(16)+'}';
+ });
+}
+function width(character){return /[\p{Mark}]/u.test(character)?0:character.codePointAt(0)>=0x1100?2:1;}
+function fit(text,columns){let used=0,result='';for(const character of text){const size=width(character);if(used+size>columns)return{text:result,complete:false};result+=character;used+=size;}return{text:result,complete:true};}
+export function renderScreen(screen={}, {columns=80,rows=24}={}){
+ // Leave the last column unused to avoid terminal autowrap at the right edge.
+ columns=Math.max(1,Math.floor(Number(columns)||80)-1);rows=Math.max(1,Math.floor(Number(rows)||24));
+ const entries=screen.rows??[],hint=screen.hint??'Up/Down: select | Enter: continue | Esc: back';
+ const lines=[escapeTerminalText(screen.title),...entries.map((row,index)=>(index===screen.selected?'> ':'  ')+escapeTerminalText(row)),escapeTerminalText(hint)];
+ const fitted=lines.map(line=>fit(line,columns));
+ const required=screen.requiredRows??entries.map((_,index)=>index);
+ const requiredVisible=required.every(index=>Number.isInteger(index)&&index>=0&&index<entries.length&&index+1<rows-1&&fitted[index+1].complete);
+ const applyEnabled=!screen.requiresConfirmation||(requiredVisible&&fitted[0].complete&&lines.length<=rows&&fitted.at(-1).complete);
+ const visible=fitted.slice(0,rows).map(line=>line.text);
+ if(!applyEnabled)visible[visible.length-1]=fit('Resize terminal to review before applying.',columns).text;
+ return{text:visible.join('\n'),applyEnabled};
+}

package/lib/tui/setup.mjs

@@ -0,0 +1,20 @@
+import {parsePositiveLimit} from '../limits.mjs';
+export function initialSettings(statuses){return Object.fromEntries(['codex','claude'].map(platform=>{const settings=statuses.find(s=>s.platform===platform)?.settings;return[platform,{preset:settings?.modelConfig?.preset??'balanced',language:settings?.language??'en',maxTotalSubagents:settings?.limits?.max_total_subagents??100,maxConcurrentSubagents:settings?.limits?.max_concurrent_subagents??5,skipGlobal:false}];}));}
+export function setupOptions(draft,target){if(target==='all'&&JSON.stringify(draft.codex)!==JSON.stringify(draft.claude))throw Error('Target settings differ. Explicitly select common values before applying to both.');return{...draft[target==='all'?'codex':target],target};}
+export async function runSetup({ui,statuses,draft,kind,prepare}){
+ for(const[key,value]of Object.entries(initialSettings(statuses)))draft[key]??=value;
+ while(true){const targetIndex=await ui.menu(kind==='preset'?'Change Preset':'Install / Reconfigure',['Codex','Claude','Both targets']);if(targetIndex===null)return null;const target=['codex','claude','all'][targetIndex];
+  if(target==='all'&&JSON.stringify(draft.codex)!==JSON.stringify(draft.claude)){
+   const choice=await ui.menu('Target settings differ',['Back','Use Codex values for both','Use Claude values for both'],{info:['Codex: '+summary(draft.codex),'Claude: '+summary(draft.claude),'Choosing common values replaces the other target values.']});if(choice===null||choice===0)continue;const source=choice===1?'codex':'claude';draft.codex={...draft[source]};draft.claude={...draft[source]};
+  }
+  const settings=draft[target==='all'?'codex':target];let editing=true;
+  while(editing){const labels=kind==='preset'?['Preset: '+settings.preset,'Review changes']:['Preset: '+settings.preset,'Harness language: '+settings.language,'Total subagents: '+settings.maxTotalSubagents,'Concurrent subagents: '+settings.maxConcurrentSubagents,'Apply global settings: '+!settings.skipGlobal,'Review changes'];const field=await ui.menu('Settings — '+target,labels);if(field===null)break;
+   if(field===0){const value=await ui.menu('Performance preset',['Economy','Balanced','Smart'],{selected:['economy','balanced','smart'].indexOf(settings.preset)});if(value!==null)settings.preset=['economy','balanced','smart'][value];}
+   else if(kind==='install'&&field===1){const value=await ui.menu('Harness output language',['English','Korean'],{selected:settings.language==='ko'?1:0});if(value!==null)settings.language=['en','ko'][value];}
+   else if(kind==='install'&&(field===2||field===3)){const key=field===2?'maxTotalSubagents':'maxConcurrentSubagents';const raw=await ui.text(field===2?'Maximum total subagents':'Maximum concurrent subagents',String(settings[key]));if(raw!==null)try{settings[key]=parsePositiveLimit(raw);}catch{await ui.page('Invalid limit',['Enter a positive safe ASCII decimal integer.']);}}
+   else if(kind==='install'&&field===4)settings.skipGlobal=!settings.skipGlobal;
+   else{if(target==='all')draft.claude={...settings};const prepared=await prepare({kind,...setupOptions(draft,target)});const action=await ui.review(kind==='preset'?'Change Preset':'Install / Reconfigure',prepared);if(action==='apply'||action===true)return prepared;if(action==='cancel')return null;}
+  }
+ }
+}
+export function summary(s){return`preset=${s.preset}, language=${s.language}, total=${s.maxTotalSubagents}, concurrent=${s.maxConcurrentSubagents}, global=${!s.skipGlobal}`;}

package/lib/tui/terminal.mjs

@@ -0,0 +1,71 @@
+import {StringDecoder} from 'node:string_decoder';
+import {renderScreen} from './render.mjs';
+
+/** Events are {name, sequence, ...detail}. Names: up/down/left/right, enter,
+ * back, text/paste (text), resize (columns,rows), blocked, eof, interrupt
+ * (signal), error (error). Every data chunk gets a sequence; paste is one event.
+ * render/discardInput/setBusy invalidate buffered input. While busy all data is
+ * discarded. Only one nextEvent waiter is allowed. dispose is idempotent,
+ * restores owned terminal state, and settles a waiting reader with eof. Shutdown
+ * discards unread events; a chunk is fully decoded before resolving a reader,
+ * so an Enter followed by EOF in that chunk cannot escape shutdown.
+ */
+export function createTerminalSession({input=process.stdin,output=process.stdout,signals=process}={}){
+ if(!input.isTTY||!output.isTTY)throw Object.assign(Error('An interactive terminal is required.'),{code:'ARC_TUI_TERMINAL'});
+ const wasRaw=Boolean(input.isRaw),wasFlowing=input.readableFlowing;
+ let disposed=false,busy=false,parsing=false,pending='',paste=null,sequence=0,escapeTimer,waiter,queue=[],screen,lastLines=0,applyEnabled=true;
+ let decoder=new StringDecoder('utf8'),lastWasCR=false;
+ const clearTimer=()=>{clearTimeout(escapeTimer);escapeTimer=undefined;};
+ function deliver(name,detail={}){
+  const event={name,sequence,...detail};if(waiter&&!parsing){const resolve=waiter;waiter=undefined;resolve(event);}else queue.push(event);
+ }
+ function discardInput(){clearTimer();pending='';paste=null;decoder=new StringDecoder('utf8');queue=[];}
+ function dispose(){
+  if(disposed)return;disposed=true;clearTimer();pending='';paste=null;queue=[];
+  input.removeListener('data',onData);input.removeListener('end',onEnd);input.removeListener('close',onEnd);input.removeListener('error',onError);
+  output.removeListener('resize',onResize);output.removeListener('error',onError);signals.removeListener('SIGINT',onSigint);signals.removeListener('SIGTERM',onSigterm);
+  try{if(input.setRawMode&&!input.destroyed)input.setRawMode(wasRaw);}finally{
+   try{if(wasFlowing!==true)input.pause();}finally{
+    try{output.write('\x1b[?2004l\x1b[?25h\n');}finally{if(waiter){const resolve=waiter;waiter=undefined;resolve({name:'eof',sequence});}}
+   }
+  }
+ }
+ function finish(name,detail){const resolve=waiter;waiter=undefined;dispose();if(resolve)resolve({name,sequence,...detail});else deliver(name,detail);}
+ function onEnd(){if(!disposed)finish('eof');}
+ function onError(error){if(!disposed)finish('error',{error});}
+ function onSigint(){if(!disposed)finish('interrupt',{signal:'SIGINT'});}
+ function onSigterm(){if(!disposed)finish('interrupt',{signal:'SIGTERM'});}
+ function draw(){
+  const result=renderScreen(screen,{columns:output.columns,rows:output.rows});applyEnabled=result.applyEnabled;
+  if(lastLines)output.write(`\x1b[${lastLines}A\r`);
+  const lines=result.text.split('\n');
+  for(let index=0;index<Math.max(lastLines,lines.length);index++)output.write('\x1b[2K'+(lines[index]??'')+'\n');
+  if(lastLines>lines.length)output.write(`\x1b[${lastLines-lines.length}A\r`);
+  lastLines=lines.length;return result;
+ }
+ function render(value){if(disposed)return{applyEnabled:false,text:''};discardInput();screen=value;try{return draw();}catch(error){dispose();throw error;}}
+ function onResize(){if(disposed)return;discardInput();try{if(screen)draw();deliver('resize',{columns:output.columns,rows:output.rows});}catch(error){onError(error);}}
+ function parse(){
+  while(pending&&!disposed){
+   if(paste!==null){const end=pending.indexOf('\x1b[201~');if(end<0){const tail=pending.lastIndexOf('\x1b');if(tail<0){paste+=pending;pending='';}else{paste+=pending.slice(0,tail);pending=pending.slice(tail);}return;}paste+=pending.slice(0,end);pending=pending.slice(end+6);deliver('paste',{text:paste});paste=null;continue;}
+   if(pending.startsWith('\x1b[200~')){pending=pending.slice(6);paste='';continue;}
+   const arrow=/^\x1b(?:\[|O)([ABCD])/.exec(pending);
+   if(arrow){pending=pending.slice(arrow[0].length);deliver({A:'up',B:'down',C:'right',D:'left'}[arrow[1]]);continue;}
+   if(pending[0]==='\x1b'){
+    if(pending==='\x1b'||['\x1b[','\x1bO','\x1b[2','\x1b[20','\x1b[200'].includes(pending)){escapeTimer=setTimeout(()=>{escapeTimer=undefined;pending='';deliver('back');},35);return;}
+    // Unknown escape sequences are consumed as text, never executed as keys.
+    const unknown=/^\x1b\[[0-9;?]*[ -/]*[@-~]/.exec(pending);if(unknown){pending=pending.slice(unknown[0].length);continue;}
+    pending=pending.slice(1);deliver('back');continue;
+   }
+   const character=[...pending][0];pending=pending.slice(character.length);const skipLF=lastWasCR&&character==='\n';lastWasCR=character==='\r';if(skipLF)continue;
+   if(character==='\x03'){onSigint();return;}if(character==='\x04'){onEnd();return;}
+   if(character==='\r'||character==='\n')deliver(applyEnabled?'enter':'blocked');
+   else if(character==='\x7f'||character==='\b')deliver('back');
+   else if(!/[\p{Cc}]/u.test(character))deliver('text',{text:character});
+  }
+ }
+ function onData(chunk){if(disposed||busy)return;sequence++;clearTimer();pending+=typeof chunk==='string'?chunk:decoder.write(chunk);parsing=true;try{parse();}finally{parsing=false;if(waiter&&queue.length){const resolve=waiter;waiter=undefined;resolve(queue.shift());}}}
+ input.on('data',onData);input.on('end',onEnd);input.on('close',onEnd);input.on('error',onError);output.on('resize',onResize);output.on('error',onError);signals.on('SIGINT',onSigint);signals.on('SIGTERM',onSigterm);
+ try{input.setRawMode?.(true);input.resume();output.write('\x1b[?25l\x1b[?2004h');}catch(error){dispose();throw error;}
+ return{render,discardInput,dispose,setBusy(value){busy=Boolean(value);discardInput();},nextEvent(){if(queue.length)return Promise.resolve(queue.shift());if(disposed)return Promise.resolve({name:'eof',sequence});if(waiter)return Promise.reject(Error('Only one terminal event reader is allowed.'));return new Promise(resolve=>{waiter=resolve;});}};
+}

package/lib/tui/workflow.mjs

@@ -0,0 +1,12 @@
+import * as workflowServices from '../management/workflow.mjs';
+export async function runWorkflow({ui,cwd,services={},onResult=()=>{}}){
+ const api={...workflowServices,...services};let workspace=cwd;
+ while(true){let observed;try{observed=await api.observeWorkspace(workspace);}catch(error){if(['ARC_CANCELLED','ARC_TUI_EOF'].includes(error.code))throw error;const selection=await ui.menu('Workflow workspace',['Back','Change workspace'],{info:['Workspace: '+workspace,'Cannot observe this repository. Select a valid repository root.']});if(selection!==1)return;const value=await ui.text('Absolute repository root',workspace);if(value!==null)workspace=value;continue;}workspace=observed.realpath;const selection=await ui.menu('Workflow workspace',['Continue','Change workspace'],{info:['Workspace: '+observed.realpath,'Branch: '+(observed.branch??'(detached)'),'HEAD: '+observed.head]});if(selection===null)return;if(selection===1){const value=await ui.text('Absolute repository root',workspace);if(value!==null)workspace=value;continue;}
+  let leave=false;while(!leave){const workflows=await api.listWorkflows(workspace);const pick=await ui.menu('Workflows',['Initialize workflow',...workflows.map(w=>w.id+(w.foreign?' — different target':w.invalid?' — invalid state':` — revision ${w.revision}`))]);if(pick===null)break;
+   let workflowId;if(pick===0){workflowId=await ui.text('Workflow ID','');if(workflowId===null)continue;const actor=await ui.text('Actor ID (operator attestation)','');if(actor===null)continue;const messageRef=await ui.text('Target selection message reference','');if(messageRef===null)continue;const contentHash=await ui.text('Target selection content hash (sha256:...)','');if(contentHash===null)continue;await submit('init',{mode:'plan',actor:{id:actor},selection:{messageRef,contentHash}});}
+   else{workflowId=workflows[pick-1].id;while(true){const action=await ui.menu('Workflow — '+workflowId,['Refresh status','Record evidence','Prepare task / operation','Record result','Reconcile']);if(action===null)break;const command=['status','record','prepare','result','reconcile'][action];if(command==='status')await submit(command);else{const jsonPath=await ui.text('Absolute regular JSON file (payload stays private)','');if(jsonPath!==null)await submit(command,undefined,jsonPath);}}}
+   async function submit(command,input,jsonPath){try{const prepared=await api.prepareWorkflow({cwd:workspace,workflowId,command,input,jsonPath});const review=await ui.review('Workflow '+command,{kind:'workflow',command,cwd:workspace,workflowId});if(review!=='apply'&&review!==true)return;const result=await ui.busy?.(()=>api.executeWorkflow(prepared))??await api.executeWorkflow(prepared);onResult(result);await ui.page('Workflow '+String(result.decision).toUpperCase(),workflowRows(result));}catch(error){if(['ARC_CANCELLED','ARC_TUI_EOF'].includes(error.code))throw error;await ui.page('Workflow input rejected',['Check absolute paths, JSON schema, revision and matching checkout.','Payload and error details are hidden to protect secrets.']);}}
+  }
+ }
+}
+export function workflowRows(result){return['Decision: '+result.decision+' (exit '+result.code+')','Workflow: '+result.workflowId,'Revision: '+result.revision,...(result.target?['Workspace: '+result.target.realpath,'HEAD: '+result.target.head]:[]),...(result.ruleIds??[]).map(r=>'Rule: '+r),...(result.tasks??[]).map(t=>'Task: '+t.id+' — '+t.status),...(result.unresolved??[]),...(result.requiredEvidence??[]).map(r=>'Required: '+r),...(result.nextActions??[]).map(r=>'Next: '+r),...(result.error?[result.error]:[])];}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunhozz/arc",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"

package/scripts/postinstall.mjs

@@ -1,4 +1,2 @@
-import {fileURLToPath} from 'node:url';
 import {runPostinstall} from '../lib/cli/postinstall.mjs';
-const packageRoot=fileURLToPath(new URL('../',import.meta.url));
-process.exitCode=await runPostinstall({packageRoot,cwd:packageRoot});
+process.exitCode=await runPostinstall({});

package/scripts/update-runtime-assets.mjs

@@ -1,6 +1,8 @@
+import {RUNTIME_MODULE_PATHS} from '../lib/installer/runtime-assets.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
+import {COOPERATIVE_RUNTIME_MODULES} from '../lib/runtime/bootstrap.mjs';
 const args=process.argv.slice(2);const i=args.indexOf('--root');
 const root=i<0?fileURLToPath(new URL('../',import.meta.url)):path.resolve(args[i+1]);
 const check=args.includes('--check');
@@ -11,7 +13,10 @@ function safe(filename,directory=false){
 }
 function sources(relative){const dir=path.join(root,relative);safe(dir,true);const result=[];for(const entry of fs.readdirSync(dir).sort()){const rel=path.join(relative,entry);const file=path.join(root,rel);safe(file,fs.lstatSync(file).isDirectory());if(fs.lstatSync(file).isDirectory())result.push(...sources(rel));else if(entry.endsWith('.mjs'))result.push(rel);else throw Error(`Unexpected canonical runtime file: ${rel}`);}return result;}
 try{
- safe(root,true);const entries=sources('lib/runtime').map(name=>[path.relative('lib/runtime',name),fs.readFileSync(path.join(root,name))]);
+ safe(root,true);const modules=sources('lib/runtime').map(name=>name.split(path.sep).join('/')).sort();
+ for(const name of COOPERATIVE_RUNTIME_MODULES)if(!modules.includes(`lib/runtime/${name}`))throw Error(`Missing runtime module: ${name}`);
+ if(modules.length!==RUNTIME_MODULE_PATHS.length||modules.some((name,index)=>name!==RUNTIME_MODULE_PATHS[index]))throw Error('Runtime asset inventory does not match canonical modules');
+ const entries=modules.map(name=>[name.slice('lib/runtime/'.length),fs.readFileSync(path.join(root,name))]);
  const policy=path.join(root,'lib/policy/role-policy.json');safe(policy);entries.push(['role-policy.json',fs.readFileSync(policy)]);
  const outputs=[];for(const platform of ['codex','claude'])for(const [name,bytes]of entries){const filename=path.join(root,platform,'skill/runtime',name);safe(filename);outputs.push({filename,bytes});}
  let drift=false;for(const {filename,bytes}of outputs){if(!fs.existsSync(filename)||!fs.readFileSync(filename).equals(bytes)){drift=true;if(!check){fs.mkdirSync(path.dirname(filename),{recursive:true});fs.writeFileSync(filename,bytes);}}}

package/lib/cli/choices.mjs

@@ -1,47 +0,0 @@
-import readline from 'node:readline';
-import {EventEmitter} from 'node:events';
-function inputError(message){return Object.assign(new Error(message),{code:'ARC_CLI_INPUT'});}
-function cancelled(){return Object.assign(new Error('Installation cancelled.'),{code:'ARC_CANCELLED'});}
-export async function selectChoices(options,{input=process.stdin,output=process.stdout,targetOnly=false,languageDefault}={}){
- if(languageDefault===undefined&&options.target&&(targetOnly||options.preset)||languageDefault!==undefined&&options.language)return options;
- if(!input.isTTY||!output.isTTY)throw inputError(targetOnly?'Non-interactive execution requires --target':'Non-interactive execution requires --target and --preset');
- const menus=languageDefault!==undefined?[['language',['English','한국어'],['en','ko'],languageDefault==='ko'?1:0]]:[['target',['Claude','Codex','All'],['claude','codex','all'],0],['preset',['Economy','Balanced','Smart'],['economy','balanced','smart'],1]].filter(([key])=>!options[key]&&(!targetOnly||key==='target'));
- const wasRaw=input.isRaw,wasFlowing=input.readableFlowing,listeners=new Map(['data','newListener'].map(event=>[event,input.listeners(event)]));
- let menu=0,index=menus[0][3];
- const draw=(redraw=false)=>{const [key,labels]=menus[menu];if(redraw)output.write(`\x1b[${labels.length}A\r`);else output.write(`Select ${key==='target'?'an installation target':key==='language'?'an output language':'a performance preset'} [Up/Down]:\n`);output.write(labels.map((label,i)=>`\x1b[2K${i===index?'>':' '} ${label}`).join('\n')+'\n');};
- const keys=new EventEmitter();let onKey,onData,onEnd,onError,abort;
- try{return await new Promise((resolve,reject)=>{
-  abort=()=>reject(cancelled());onEnd=abort;onError=reject;
-  onKey=(str,key={})=>{try{if(key.name==='c'&&key.ctrl||key.name==='d'&&key.ctrl)return abort();if(key.name==='up'||key.name==='down'){index=(index+(key.name==='up'?-1:1)+menus[menu][1].length)%menus[menu][1].length;draw(true);}else if(key.name==='return'||key.name==='enter'){const [name,,values]=menus[menu];options[name]=values[index];output.write('\n');if(++menu===menus.length){keys.removeListener('keypress',onKey);resolve(options);}else{index=menus[menu][3];draw();}}}catch(error){reject(error);}};
-  keys.on('keypress',onKey);readline.emitKeypressEvents(keys);onData=chunk=>keys.emit('data',chunk);input.on('data',onData);input.once('end',onEnd);input.once('close',onEnd);input.once('error',onError);process.once('SIGINT',abort);process.once('SIGTERM',abort);
-  if(input.setRawMode)input.setRawMode(true);input.resume();draw();
- });}finally{
-  keys.removeAllListeners();input.removeListener('data',onData);input.removeListener('end',onEnd);input.removeListener('close',onEnd);input.removeListener('error',onError);process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
-  for(const [event,before]of listeners)for(const listener of input.listeners(event))if(!before.includes(listener))input.removeListener(event,listener);
-  if(input.setRawMode)input.setRawMode(Boolean(wasRaw));if(wasFlowing!==true)input.pause();
- }
-}
-
-export async function selectLimits(options,selections,{input=process.stdin,output=process.stdout}={}){
- const{parsePositiveLimit}=await import('../limits.mjs');
- const fields=[['maxTotalSubagents','max_total_subagents',100,'total'],['maxConcurrentSubagents','max_concurrent_subagents',5,'concurrent']].filter(([key])=>options[key]===undefined);
- if(!fields.length)return options;
- const wasRaw=input.isRaw,wasFlowing=input.readableFlowing,listeners=new Map(['data','newListener'].map(event=>[event,input.listeners(event)]));
- let index=0,value='',onKey,onData,onEnd,onError,abort;
- const draw=()=>{const[,,fallback,label]=fields[index];output.write(`Maximum ${label} subagents [Default=${fallback}]: `);};
- try{return await new Promise((resolve,reject)=>{
-  abort=()=>reject(cancelled());onEnd=abort;onError=reject;
-  onKey=(str,key={})=>{if(key.ctrl&&(key.name==='c'||key.name==='d'))return abort();if(key.name==='return'||key.name==='enter'){
-   const[name,,,label]=fields[index];if(value.trim()){try{options[name]=parsePositiveLimit(value,label);}catch(cause){output.write(`\n${cause.message}\n`);value='';draw();return;}}
-   if(name==='maxConcurrentSubagents')options.concurrentSelected=true;output.write('\n');value='';if(++index===fields.length){input.removeListener('keypress',onKey);resolve(options);}else draw();
-  }else if(key.name==='backspace'){value=value.slice(0,-1);output.write('\b \b');}else if(str&&!key.ctrl&&!key.meta){value+=str;output.write(str);}};
-  onData=chunk=>{for(const character of chunk.toString()){if(index===fields.length)break;const name=character==='\r'||character==='\n'?'return':character==='\x03'?'c':character==='\x04'?'d':character==='\x7f'||character==='\b'?'backspace':undefined;onKey(character,{name,ctrl:character==='\x03'||character==='\x04'});}};
-  input.on('data',onData);input.once('end',onEnd);input.once('close',onEnd);input.once('error',onError);process.once('SIGINT',abort);process.once('SIGTERM',abort);if(input.setRawMode)input.setRawMode(true);input.resume();draw();
- });}finally{
-  input.removeListener('data',onData);input.removeListener('end',onEnd);input.removeListener('close',onEnd);input.removeListener('error',onError);process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
-  for(const[event,before]of listeners)for(const listener of input.listeners(event))if(!before.includes(listener))input.removeListener(event,listener);
-  if(input.setRawMode)input.setRawMode(Boolean(wasRaw));if(wasFlowing!==true)input.pause();
- }
-}
-
-export async function selectLanguage(options,languageDefault,io={}){return selectChoices(options,{...io,languageDefault});}

package/lib/cli/completion.mjs

@@ -1,55 +0,0 @@
-export function renderCompletion(shell){
- if(shell==='bash')return `_arc() {
- local cur="\${COMP_WORDS[COMP_CWORD]}" prev="\${COMP_WORDS[COMP_CWORD-1]}" command="\${COMP_WORDS[1]}" choices=""
- case "$prev" in
-  --target) [[ $command == -* || $command == preset || $command == uninstall ]] && choices="claude codex all" ;;
-  --preset) [[ $command == -* ]] && choices="economy balanced smart" ;;
-  --language) [[ $command == -* ]] && choices="en ko" ;;
-  *)
-   if (( COMP_CWORD == 1 )) && [[ $cur != -* ]]; then choices="preset uninstall completion upgrade"
-   else
-    case "$command" in
-     preset)
-      if (( COMP_CWORD == 2 )) && [[ $cur != -* ]]; then choices="economy balanced smart"
-      else choices="--target --check --dry-run --help"; fi ;;
-     uninstall) choices="--target --dry-run --skip-global --help --version" ;;
-     upgrade) choices="--help" ;;
-     completion) (( COMP_CWORD == 2 )) && choices="zsh bash" ;;
-     -*) choices="--target --preset --language --max-total-subagents --max-concurrent-subagents --check --dry-run --skip-global --help --version" ;;
-    esac
-   fi ;;
- esac
- COMPREPLY=( $(compgen -W "$choices" -- "$cur") )
-}
-complete -F _arc arc
-`;
- if(shell==='zsh')return `_arc() {
- local -a candidates
- if (( CURRENT == 2 )) && [[ \${words[CURRENT]} != -* ]]; then
-  candidates=(preset uninstall completion upgrade)
- else
-  case "\${words[CURRENT-1]}" in
-   --target) [[ \${words[2]} == -* || \${words[2]} == preset || \${words[2]} == uninstall ]] && candidates=(claude codex all) ;;
-   --preset) [[ \${words[2]} == -* ]] && candidates=(economy balanced smart) ;;
-   --language) [[ \${words[2]} == -* ]] && candidates=(en ko) ;;
-   *) case "\${words[2]}" in
-    preset)
-     if (( CURRENT == 3 )) && [[ \${words[CURRENT]} != -* ]]; then candidates=(economy balanced smart)
-     else candidates=(--target --check --dry-run --help); fi ;;
-    uninstall) candidates=(--target --dry-run --skip-global --help --version) ;;
-    upgrade) candidates=(--help) ;;
-    completion) (( CURRENT == 3 )) && candidates=(zsh bash) ;;
-    -*) candidates=(--target --preset --language --max-total-subagents --max-concurrent-subagents --check --dry-run --skip-global --help --version) ;;
-   esac ;;
-  esac
- fi
- compadd -a candidates
-}
-if (( ! $+functions[compdef] )); then
- autoload -Uz compinit
- compinit -D
-fi
-compdef _arc arc
-`;
- throw new Error('Unsupported completion shell');
-}