abelien-harness 0.3.0 → 0.5.0

package/skills/abelien-hardware-selection/references/selection-service-contract.md

@@ -20,7 +20,7 @@ proposal 包含 status=verified|needs_confirmation、plan_mode=assemble_new|adap
 - quantity 显式给出且等于槽位数量，不默认补 1；每槽位最多一个型号。
 - selection_reason 非空；wiki_evidence 为完整 Wiki 中至少 8 字符的原文引用数组，不是 ID、ETag 或自由改写摘要。
 - constraint_checks 逐项包含 constraint_id、status=verified|unknown|incompatible、reason、evidence:[{component_id,quote}]。ID 覆盖 function、slot:<hard_constraints 的键>、limit:<每项 hard limit.id>。缺关键证据仍 unknown。
-- 多型号须逐 power/interfaces/mechanical/thermal/software 提供 compatibility_checks，包含 dimension/status/reason/evidence；每个维度引用每个所选型号的证据。
+- 多型号须为 power、interfaces 提供 compatibility_checks（dimension/status/reason/evidence，每个所选型号都有原文证据），除非可信电气数据已确定性通过；mechanical、thermal、software 可选填写，只作提示。见下文“电气兼容与兼容报告”。
 
 constraint_checks 非数组、ID 重复或不属于当前槽位时仍以 VALIDATION 拒绝。error.message 列明 slot_id、expected（当前槽位的 function / slot 键与全局 hard limit ID）、received（完整原顺序，非数组为 null）、unexpected（去重、首次出现顺序）与 duplicate（去重、首次重复顺序），供既有 Web 预检 issues 原样反馈并修正。其他槽位具有某个 hard_constraints 键，不使它成为当前槽位的有效 ID；例如 desk-sensor 的 slot:no-stand 不能用于缺少该键的 weather-display。只缺少某项检查仍走 CONSTRAINT_UNVERIFIED、needs_confirmation，不因诊断改为结构拒绝；Wiki 归属、incompatible 和门禁语义不变。
 
@@ -28,7 +28,7 @@ constraint_checks 非数组、ID 重复或不属于当前槽位时仍以 VALIDAT
 
 ## 输出与门禁
 
-保留 Web 既有十字段：id/status/source_snapshot/revision/plan_mode/selected_models/coverage_ledger/remaining_slots/unknowns/replacement_plan。ID/版本由输入和可信召回摘要确定。数量账本由代码计算，模型原始 coverage 和 compatibility 评估仍保留。型号标记 verification_scope=wiki_evidence_review_not_engineering_test、device_tested=false。
+无结构化 envelope 时保留 Web 既有十字段：id/status/source_snapshot/revision/plan_mode/selected_models/coverage_ledger/remaining_slots/unknowns/replacement_plan。ID/版本由输入和可信召回摘要确定。数量账本由代码计算，模型原始 coverage 和 compatibility 评估仍保留。型号标记 verification_scope=wiki_evidence_review_not_engineering_test、device_tested=false。
 
 verified 只代表同源、完整数量和有归属证据的 Agent 选型判断通过，不代表 CAD、几何、电气实测、采用或交付。缺关键评估、非空 unknowns、未覆盖槽位均返回 needs_confirmation；机器门拒绝，但保留结果。整机继承/覆盖 manifest 求解尚未实现，adapt_system 始终待确认；不能借 assemble_new 自动抵扣其他槽位。换型仍走 hardware.revise，不重新排序未点名组件。
 
@@ -55,3 +55,33 @@ V2 hardware evidence uses fixed prismer_then_volc ordered primary/fallback recei
 ## 审计 v1 终态与受信 blob 读取
 
 新运行开启 `AB_HARNESS_AUDIT_V1=true` 后，needs_confirmation 进入 selected_pending_confirmation，并以组装的 selectionId/selectionStatus/selectionRevision 结束 workflow。此状态仍待用户确认，不能当作 verified 或已采用；硬件/算法组合旅程跳过全部算法步骤。默认运行保留既有守卫。新引用证据的确定性重建需要 readResource 与受信 readBlob，可选 loopback HTTP wrapper 同样传入该端口；缺失时拒绝，不重新抓取来源。安装前无定义摘要和新运行标记的硬件运行保持只读，迁移边界见内核 workflow 规范。
+
+
+## 结构化尺寸与正式门禁
+
+limits 可附 envelope；严格形状与来源规则见 [索引尺寸契约](../../abelien-hardware/references/search-index-format.md)。hardware.search 在分类所有索引记录上先筛尺寸再 Top-K，未知和估算保留。hardware.select 读取冻结 recall 并核对 request_digest、正文 SHA-256 后，复用纯判定器重算，忽略模型伪造的尺寸、来源、名称和 dimension_check。incompatible 以 VALIDATION 拒绝所选件，必须选其他存活候选；dimension_check.decision_required=true（用户 hard 上限＋measured/datasheet 尺寸，且轴对齐装法全部失败，仍不足以证明放不下）时加入 DIMENSION_DECISION_REQUIRED 并返回 needs_confirmation，模型引用、确认或机械 verified 不能覆盖。unknown、估算尺寸、system/preference 上限或估算壁厚下的 risk 只随 selected_models.dimension_check 提示，不进入 unknowns，也不单独阻止 verified；尺寸限制仍须经原 constraint_checks 的 Wiki 证据门。
+
+没有 envelope 时旧流程仍可在原 Wiki 证据范围 verified，但 selected_models.dimension_check 始终显式为 unknown（PRODUCT_ENVELOPE_MISSING），不能宣传尺寸检查通过。clear 也只表示单件粗筛；device_tested 仍 false。hardware.finalize 仍只返回 proposed/needs_confirmation 的提案，不创建硬件正式资源。
+
+每个型号额外携带可信候选 title 派生的 name、dimensions_mm、dimension_basis、dimension_geometry、dimension_source 和 dimension_check；interfaces 只在候选存在时透传。bom_item_id 为 `selection-line-<24hex>`，以 slot_id/component_id 派生的稳定选型行身份，不冒称数据库 BOM 主键，不使用模型提供的 ID。
+
+有 envelope 时输出增加可选 occupancy：advisory=true、method、estimated_volume_mm3、unknown_lines、containers（limit_id/cavity_volume_mm3/ratio）。只统计 selected_models 的实际数量，按 bom_item_id 去重，不再次加入 coverage_ledger 的整机内部覆盖。它是包围体积估算，非装箱证明；unknown 基础的占位尺寸不计入体积，仅保留 unknown_lines；全未知时不输出容器密度。部分未知时体积/比例只含已知或显式估算行，不代表整体密度。浮点溢出/下溢等不可表示的几何量保持 unknown，无法表示的体积或比例省略，不序列化 NaN/Infinity；没有隐含硬阈值。工具函数只在调用方显式提供 occupancy_warning_ratio 策略时给 warning，默认没有告警阈值。接入方须接受这一可选加法，但不得将 occupancy 或 ratio 作为通过/拒绝权威。
+
+## 电气兼容与兼容报告
+
+多型号选型由 `electrical.mjs` 按星形拓扑做确定性电气检查：选中的唯一主控（`compute-control/controller-board|controller-module`）为中心，`power-energy` 件给主控供电，主控电压轨与已选电源给外设供电，外设所需总线由主控提供。没有主控或主控不止一个时拓扑记为 not_star，全部未知。
+
+只有 `electrical.basis` 为 measured / datasheet、且通过 `electrical_source` 源绑定的记录能给出确定结论：
+
+| 结果 | 含义 | 门禁 |
+| --- | --- | --- |
+| pass | 全部相关件可信且规则全部通过 | power / interfaces 视为已验证，不再要求逐件原文引用 |
+| fail | 总线类型缺失或数量不足（I2C / SPI / CAN 是共享总线，主控有即可；UART / USB / I2S / PWM / GPIO / ADC 按数量累加） | finalize 与 select 以 VALIDATION 拒绝，须替换一侧 |
+| gap | 可信数据下没有电压轨落在外设或主控的输入范围内 | 记 `ELECTRICAL_SUPPLY_GAP`，返回 needs_confirmation；须补电源或稳压件，不拒绝外设 |
+| risk | 电压只部分重叠、连接器不同、逻辑电平不同且未选电平转换件 | 不确定性判定，回到原文引用路径 |
+| unknown | 数据缺失、未源绑定或非星形 | 回到原文引用路径 |
+
+mechanical、thermal、software 只作提示，不进入 unknowns，也不阻止 verified；结构可行性由尺寸粗筛和 CAD 检查负责。任何维度只要模型明确给出 status=incompatible，都记 `COMPATIBILITY_INCOMPATIBLE` 并阻塞。
+
+多型号时输出增加可选根字段 `compatibility_report`：`method`、`dimensions`（每维 gate=deterministic|evidence|unverified|advisory、model_status、model_verified，power / interfaces 另有 electrical 结论）和 `electrical`（拓扑、主控与逐条检查）。它是选型依据的说明，不代表实测或制造可行；接入方须显式接收这一可选字段。所选型号原样携带候选的 `electrical` 与 `electrical_source`，不采用模型自填。
+

package/skills/abelien-hardware-selection/scripts/select.mjs

@@ -1,6 +1,9 @@
 // Shared local/HTTP contract. Quotes verify attribution, not engineering test results.
+import { evaluateDimensions, validateRequirementEnvelopes } from "../../abelien-hardware/scripts/dimensions.mjs";
+import { createHash } from "node:crypto";
 import { mergeHardwareWeb } from "../../abelien-hardware/scripts/web-merge.mjs";
 import { finalizeHardwareSelection } from "../../abelien-hardware/scripts/finalize-selection.mjs";
+import { evaluateElectrical } from "../../abelien-hardware/scripts/electrical.mjs";
 import { canonical, digest, selectionRequestDigest, validateSelectionSlots } from "../../abelien-hardware/scripts/selection-request.mjs";
 const record = value => value && typeof value === "object" && !Array.isArray(value);
 const text = value => typeof value === "string" && value.trim().length > 0;
@@ -26,6 +29,7 @@ export async function selectHardware({ input, readResource, readBlob }) {
     || !Array.isArray(requirements.limits)
     || requirements.limits.some(item => !requirement(item) || !["hard", "preference"].includes(item.strength)))
     invalid("clarified requirements need attributed context, reaction and limits; limit strength must be hard or preference");
+  validateRequirementEnvelopes(requirements);
   const entries = [...requirements.reaction, ...requirements.limits];
   if (new Set(entries.map(item => item.id)).size !== entries.length)
     invalid("reaction and limit IDs must be unique across requirements");
@@ -53,6 +57,12 @@ export async function selectHardware({ input, readResource, readBlob }) {
     const candidate = recall.results.find(item => item.slot_id === slot.slot_id)?.candidates?.find(item => item.component_id === model.component_id);
     if (!candidate || canonical(candidate.category_path) !== canonical(slot.category_path)
       || !text(candidate.content) || !/^[a-f0-9]{64}$/.test(candidate.wiki?.sha256 ?? "")) invalid("candidate needs complete matching Wiki provenance");
+    if (createHash("sha256").update(candidate.content).digest("hex") !== candidate.wiki.sha256) invalid("candidate content does not match frozen Wiki SHA-256");
+    const dimensionCheck = evaluateDimensions(candidate, requirements);
+    model.dimension_check = dimensionCheck;
+    if (dimensionCheck.status === "incompatible") invalid("selected candidate is dimensionally incompatible");
+    // Only a user hard limit with trusted sizes asks the user to decide; unknown and other risk stay advisory on dimension_check.
+    if (dimensionCheck.decision_required) add("DIMENSION_DECISION_REQUIRED", { slot_id: slot.slot_id, component_id: candidate.component_id, dimension_check: dimensionCheck });
     if (!text(model.selection_reason)) invalid("selection_reason is required");
     const unmatched = model.wiki_evidence.filter(quote => !text(quote) || quote.trim().length < 8 || !candidate.content.includes(quote));
     if (unmatched.length) add("WIKI_EVIDENCE_UNVERIFIED", { slot_id: slot.slot_id,
@@ -92,12 +102,29 @@ export async function selectHardware({ input, readResource, readBlob }) {
   if (recall.retrieval_mode !== "category_index" || recall.unknowns?.length) add("RECALL_INCOMPLETE", { details: recall.unknowns ?? [] });
   const compatibility = proposal.compatibility_checks ?? [];
   if (!Array.isArray(compatibility)) invalid("compatibility_checks must be an array");
-  if (models.size > 1) for (const dimension of ["power", "interfaces", "mechanical", "thermal", "software"]) {
-    const checks = compatibility.filter(item => item?.dimension === dimension);
-    if (checks.length !== 1 || checks[0].status !== "verified" || !text(checks[0].reason)
-      || !validQuotes(checks[0].evidence, candidates)
-      || !candidates.every(candidate => checks[0].evidence.some(item => item.component_id === candidate.component_id)))
-      add("COMPATIBILITY_UNVERIFIED", { dimension, assessments: checks });
+  // Power/interfaces: trusted deterministic pass, or quoted model evidence. Mechanical/thermal/software are advisory
+  // (size screening and CAD own mechanical fit); an explicit model "incompatible" still blocks every dimension.
+  let compatibilityReport;
+  if (models.size > 1) {
+    const electrical = evaluateElectrical(normalized.selected_models);
+    if (electrical.checks.some(check => check.status === "fail")) invalid("selected components are electrically incompatible");
+    const gaps = electrical.checks.filter(check => check.status === "gap");
+    if (gaps.length) add("ELECTRICAL_SUPPLY_GAP", { checks: gaps });
+    const dimensions = {};
+    for (const dimension of ["power", "interfaces", "mechanical", "thermal", "software"]) {
+      const checks = compatibility.filter(item => item?.dimension === dimension);
+      const modelVerified = checks.length === 1 && checks[0].status === "verified" && text(checks[0].reason)
+        && validQuotes(checks[0].evidence, candidates)
+        && candidates.every(candidate => checks[0].evidence.some(item => item.component_id === candidate.component_id));
+      const deterministic = electrical.dimensions[dimension];
+      const gate = ["mechanical", "thermal", "software"].includes(dimension) ? "advisory"
+        : deterministic === "pass" ? "deterministic" : modelVerified ? "evidence" : "unverified";
+      if (gate === "unverified") add("COMPATIBILITY_UNVERIFIED", { dimension, assessments: checks, electrical: deterministic });
+      if (checks.some(item => item?.status === "incompatible")) add("COMPATIBILITY_INCOMPATIBLE", { dimension, assessments: checks });
+      dimensions[dimension] = { gate, model_status: checks.length === 1 ? String(checks[0].status) : checks.length ? "ambiguous" : "missing",
+        model_verified: modelVerified, ...(deterministic !== undefined ? { electrical: deterministic } : {}) };
+    }
+    compatibilityReport = { method: "compatibility-gate-v1", dimensions, electrical };
   }
   const coverage = slots.map(slot => ({ slot_id: slot.slot_id, requested_quantity: slot.quantity,
     selected_quantity: models.get(slot.slot_id)?.quantity ?? 0,
@@ -114,6 +141,7 @@ export async function selectHardware({ input, readResource, readBlob }) {
   await checkMergedSource();
   const hash = digest({ input, source_digest: digest(source.body) });
   return { ...normalized, id: `selection-${hash.slice(0, 16)}`, revision: `r-${hash.slice(0, 12)}`,
-    status, coverage_ledger: coverage, remaining_slots: remaining, unknowns };
+    status, coverage_ledger: coverage, remaining_slots: remaining, unknowns,
+    ...(compatibilityReport ? { compatibility_report: compatibilityReport } : {}) };
 }
 export const run = selectHardware;

package/skills/abelien-harness/references/workflow-spec.md

@@ -6,7 +6,7 @@
 create 输入为 `schemaVersion:1, creationOperationId, inputRevision:0, manifestDigest, executionDefinitionVersion, executionDefinitionDigest, executionPath`；不接收任意来源正文或 provider/account/policy 覆盖。必须具有 `studio.create` 和 `tools:invoke` 委托。
 `creation active|get` 仅需 `state:read`，不借只读恢复索取工具或写入权限；创建、工具登记与调用提交仍须原有写权限，replacement request 仍须 `requests:write`。
 返回完整安全投影：保留 frozenInputs、plannedOccurrenceBindings、executionSources、进度与所有资产 Ref，不将派生外观来源丢弃。
-`tool register` 仅接受 creationOperationId/modificationOperationId 之一。CLI 默认受信上下文路径不变；模块的 contextFile 依赖注入只供受信宿主使用，不向模型开放路径、origin 或 token。
+`tool register` 仅接受 creationOperationId/modificationOperationId 之一。CLI 默认受信上下文路径见下文「Studio broker 调用」；模块的 contextFile 依赖注入只供受信宿主使用，不向模型开放路径、origin 或 token。
 本地宿主必须保持原 Agent 租约，先将真实已结算 receipt 交 Harness consume/get 校验，再持久化消费确认；回执保存不等于采用、workflow done 或自动恢复。unknown 不重新生成。
 
 ## 定义文件（域包 `workflows/<name>.json`，name 必须等于文件名）
@@ -107,12 +107,19 @@ ab studio invocation get <invocationId>
 以同 workflow identity 和根预算创建后继 attempt。已有点选必须与原 designContext 一致；纯文字目标
 仍须由 Web 在当前 F2 editableTargets 唯一验证。CLI 不接受自由文字直接扩大 target 或 impact。
 
-CLI 只读固定 `/tmp/abelien-runtime-delegation/current.json`；不提供 context／origin／token override。
+CLI 默认只读固定 `/home/agent/workspace/abelien-runtime-delegation/current.json`，与 Web EaaS driver
+的 file-API 挂载根一致；不搜索旧 `/tmp` 路径，也不提供 CLI／环境变量／模型 context、origin 或 token override。
+受信本地宿主仍可通过模块级 `studioCmd(...,{contextFile})` 注入隔离上下文；它不构成容器默认路径验收。
 宿主 context 必须是当前进程所有、普通文件、0600、至多 16 KiB，且 draft、logical environment、
 workflow、attempt、local run、generation、credential epoch、attempt fence、definition、action scope、
 签发／过期时间须与 token claims 全量一致。Web origin 只能是纯 HTTPS origin（测试 loopback 可 HTTP）。
 请求固定带 protocol v1、Bearer 且不带 Cookie；JSON 上限 256 KiB，响应上限 1 MiB。
 
+G02 回归使用独立文件夹具执行默认 `readStudioContext()` 和未注入 `contextFile` 的 `studioCmd()`，
+同时检查旧路径不回退、宿主注入与安全边界。它只证明本地源码行为；SR-SPEC-09-01 仍须发布包与
+真实 driver 写入的容器上下文配合裸 CLI 验收，并核对安装器、默认 CLI、driver、probe、receipt launcher
+使用同一权威路径。源码修正不代表既有安装包已更新。
+
 create/register/submit 遇到传输未知只以相同字节尝试一次；再次未知返回 `STUDIO_WRITE_UNKNOWN`，
 不得换 modificationOperationId、commandId、operationId 或 invocationId。读取可有界退避。Agent 输出
 不包含 token，也不返回 provider／policy／account／price。普通首轮 production EaaS 尚无 attempt
@@ -208,3 +215,9 @@ advance、外部 resume 和 CLI status --httl 按记录摘要解析。依次尝
 同事件的状态机分支必须有可证明互斥的守卫（至少一个同名键的精确值不同）。可选 enabledBy 指定宿主环境变量，值必须为字符串 true；运行时分支歧义返回 DOMAIN_INVALID，守卫不满足仍为 GUARD_FAILED。verified 分支保持原守卫。
 
 两份新硬件定义声明 `legacyResume:read_only`：旧运行缺少新协议或摘要时，advance/resume/HTTL 返回带迁移说明的 WORKFLOW_DRIFTED，status/list 保留原记录。旧 pinned 定义也不能冒充新协议。新协议运行可按已记录 SHA 恢复，后续改开关不影响它；缺失或损坏摘要不能降级。其他无摘要 workflow 保留原步序列守卫。包内历史定义为审计和已支持的原协议恢复保留，不给旧选型补造摘要。package.json 和正式 CHANGELOG 版本由后续 release 维护，本 MR 不发布。
+
+### 局部外观与工程回执
+
+传输词表增加 `mesh.generate@1` 与 `cad.build@2`（purpose=appearance_adaptation），其余工具仍仅支持@1；实际步骤准入、完整 DTO 与既有 definition digest 由 Web broker 维护。creation v3 及旧 v1/v2 只按原 persisted identity 回读，不自动迁移。creation 状态允许 latestTool、cadBuildAttempts、previewCandidateId，与既有冻结来源并存。
+
+receipt v1 增加 appearance.revision、mesh.generate、structure.adapt；这三步均必须携不可变 parentCandidateId，保持严格 creation/modification XOR，不能混入 repairBasis/repairOrdinal。EaaS waitIdentityVerified 另需核对 definitionDigest、stepKey 和 parentCandidateId；local checkpoint 仍交受信宿主判断，不代造已恢复或已采用。mesh 结果仅预览，structure.adapt 结果须同版工程和视觉检查后走既有采用事务。

package/skills/abelien-harness/scripts/generate3d-host.mjs

@@ -0,0 +1,398 @@
+// Trusted host library only. F4 remains authoritative for authorization, lease,
+// accounting and adoption. This module binds that invocation to one provider send.
+import fs from 'node:fs';
+import path from 'node:path';
+import { canonicalJson, createStore, fail, sha256Hex } from './ab.mjs';
+import {
+  assertVerified, effectiveSubmit, loadProfiles, resolveCredential, submitFlow,
+  statusFlow, artifactLocation, downloadArtifact, validateGlb,
+} from './generate3d.mjs';
+
+export const HOSTED_GENERATION_PROTOCOL = 1;
+export const HOSTED_GENERATION_AUTHORITY_PROTOCOL = 1;
+export const HOSTED_GENERATION_QUALIFICATION_PROTOCOL = 1;
+const HASH = /^[a-f0-9]{64}$/;
+const DEFAULT_MAX_ARTIFACT_BYTES = 128 * 1024 * 1024;
+const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.webp']);
+const SAFE_ERROR_CODES = new Set([
+  'UPLOAD_FAILED', 'HTTP_FAILED', 'HTTP_STATUS', 'TASK_FAILED', 'TASK_PENDING',
+  'CREDENTIAL_MISSING', 'DOWNLOAD_FAILED', 'ZIP_INVALID', 'GLB_INVALID',
+  'GENERATION_ABORTED', 'GENERATION_PROFILE_DRIFT', 'ARTIFACT_HASH_MISMATCH',
+  'GENERATION_AUTHORITY_STALE',
+  'GENERATION_QUALIFICATION_INVALID',
+]);
+
+function cleanError(error) {
+  const code = SAFE_ERROR_CODES.has(error?.code) ? error.code : 'GENERATION_IO_FAILED';
+  return fail(code, `Hosted generation failed: ${code}`);
+}
+
+function diagnostic(deps, phase, identity, error) {
+  if (typeof deps.onDiagnostic !== 'function') return;
+  const redact = value => {
+    let text = String(value ?? '').slice(0, 32_768);
+    for (const secret of Object.values(deps.env ?? {})) {
+      if (typeof secret === 'string' && secret.length >= 6) text = text.split(secret).join('[redacted]');
+    }
+    return text.replace(/https?:\/\/[^\s"'<>]+/gi, '[redacted-url]')
+      .replace(/Bearer\s+[^\s"',}]+/gi, 'Bearer [redacted]');
+  };
+  try {
+    const event = {phase, requestId: identity.requestId, inputDigest: identity.inputDigest,
+      error: {code: cleanError(error).code, message: redact(error?.message),
+        stack: redact(error?.stack), details: redact(JSON.stringify(error?.details ?? null))}};
+    // Private trusted observer only. Public results and gen3d resources remain code-only.
+    const result = deps.onDiagnostic(event);
+    result?.catch?.(() => {});
+  } catch { /* Observability failure cannot change paid execution/recovery. */ }
+}
+
+function hostDeps(deps) {
+  if (!deps || typeof deps.workdir !== 'string' || !path.isAbsolute(deps.workdir)) {
+    throw fail('GENERATION_INPUT_INVALID', 'Host workdir must be an absolute private invocation directory');
+  }
+  const maxArtifactBytes = deps.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;
+  if (!Number.isSafeInteger(maxArtifactBytes) || maxArtifactBytes < 1 || maxArtifactBytes > DEFAULT_MAX_ARTIFACT_BYTES) {
+    throw fail('GENERATION_INPUT_INVALID', 'Invalid artifact byte limit');
+  }
+  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+  return {
+    workdir: deps.workdir, env: deps.env ?? {}, credentialPolicy: 'env-only',
+    requireGlb: true, maxArtifactBytes, signal: deps.signal,
+    fetchImpl: async (url, init = {}) => {
+      if (deps.signal?.aborted) throw fail('GENERATION_ABORTED', 'Generation interrupted');
+      // The host must apply its outbound origin/DNS policy in fetchImpl.
+      // No credential-bearing redirects, including signed artifact downloads.
+      return fetchImpl(url, {...init, redirect: 'error'});
+    },
+  };
+}
+
+/** Offline profile information, not a price quote or an authorization. */
+function modelInfo(profiles, {provider, model: modelId}) {
+  const profile = profiles[provider];
+  if (!profile) throw fail('PROVIDER_NOT_FOUND', 'Provider not found');
+  const model = profile.models[modelId];
+  if (!model || model.available === false) throw fail('MODEL_NOT_FOUND', 'Model not available');
+  const configuration = {
+    provider, model: modelId, transport: profile.transport,
+    input: model.input, imageEncoding: profile.imageEncoding,
+    images: profile.images ?? null, upload: profile.upload ?? null,
+    submit: effectiveSubmit(profile, model), poll: model.poll ?? profile.poll,
+    download: profile.download,
+  };
+  return {
+    provider, model: modelId, input: model.input,
+    verified: model.verified ?? profile.verified,
+    estCostUsd: model.benchmark?.usd ?? null, historicalEstimate: true,
+    profileDigest: sha256Hex(canonicalJson(configuration)), providerIdempotency: false,
+  };
+}
+
+export function inspectHostedModel(deps, identity) {
+  return modelInfo(loadProfiles(hostDeps(deps)), identity);
+}
+function freezeSnapshot(value) {
+  if (value && typeof value === 'object') {
+    for (const child of Object.values(value)) freezeSnapshot(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+// An operator qualification is a trusted module dependency, never a model input,
+// generic CLI flag or environment bypass. The controller verifies the immutable
+// loaded release and supplies its digest independently of the manifest. Existing
+// request claims remain the sole send ledger; this admits exactly that request.
+function qualificationAdmission(deps, request, model, images) {
+  if (deps.qualification === undefined) return null;
+  const manifest = deps.qualification?.manifest;
+  const keys = ['schemaVersion', 'purpose', 'requestId', 'inputDigest', 'provider', 'model',
+    'profileDigest', 'imageSha256', 'releaseDigest', 'expiresAt', 'maxCreates', 'maxCredits'];
+  const invalid = () => { throw fail('GENERATION_QUALIFICATION_INVALID', 'Exact trusted qualification admission is required'); };
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)
+    || Object.keys(manifest).sort().join('|') !== keys.sort().join('|')) invalid();
+  if (manifest.schemaVersion !== 1 || manifest.purpose !== 'provider_qualification'
+    || manifest.requestId !== request.requestId || manifest.inputDigest !== request.inputDigest
+    || manifest.provider !== model.provider || manifest.model !== model.model
+    || manifest.profileDigest !== model.profileDigest || !HASH.test(manifest.releaseDigest ?? '')
+    || manifest.releaseDigest !== deps.qualification.releaseDigest
+    || !Array.isArray(manifest.imageSha256)
+    || canonicalJson(manifest.imageSha256) !== canonicalJson(images.map(image => image.sha256))
+    || manifest.maxCreates !== 1 || !Number.isSafeInteger(manifest.maxCredits) || manifest.maxCredits <= 0) invalid();
+  const expires = Date.parse(manifest.expiresAt);
+  if (!Number.isFinite(expires) || new Date(expires).toISOString() !== manifest.expiresAt
+    || expires <= (deps.now?.() ?? Date.now())) invalid();
+  const snapshot = freezeSnapshot(JSON.parse(JSON.stringify(manifest)));
+  return {manifest: snapshot, manifestDigest: sha256Hex(canonicalJson(snapshot))};
+}
+
+function identityPaths(deps, {requestId, inputDigest}) {
+  if (typeof requestId !== 'string' || !requestId.trim() || requestId.length > 512 ||
+      typeof inputDigest !== 'string' || !HASH.test(inputDigest)) {
+    throw fail('GENERATION_INPUT_INVALID', 'An exact invocation requestId and SHA-256 inputDigest are required');
+  }
+  const key = sha256Hex(requestId);
+  const localId = `g3d-host-${key}`;
+  return {
+    requestId, inputDigest, localId, id: `gen3d:${localId}`,
+    claim: path.join(deps.workdir, '.abelien', 'gen3d-send-claims', `${key}.json`),
+  };
+}
+
+function readClaim(paths) {
+  try {
+    const claim = JSON.parse(fs.readFileSync(paths.claim, 'utf8'));
+    if (claim.hosted?.requestId !== paths.requestId || claim.hosted.inputDigest !== paths.inputDigest) {
+      throw fail('GENERATION_IDENTITY_CONFLICT', 'Invocation identity does not match the original request');
+    }
+    if (claim.hosted.protocol !== HOSTED_GENERATION_PROTOCOL || !HASH.test(claim.hosted.requestDigest)) {
+      throw fail('GENERATION_STATE_UNREADABLE', 'Submission claim cannot be verified; do not resubmit');
+    }
+    return claim;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    if (error?.code?.startsWith('GENERATION_')) throw error;
+    throw fail('GENERATION_STATE_UNREADABLE', 'Submission claim cannot be read; do not resubmit');
+  }
+}
+
+function readBody(deps, paths, claim) {
+  if (!claim) return null;
+  const index = path.join(deps.workdir, '.abelien', 'store', 'index.json');
+  const body = fs.existsSync(index) ? createStore(deps.workdir).get(paths.id)?.body : null;
+  if (body && (body.hosted?.requestDigest !== claim.hosted.requestDigest ||
+      body.hosted?.inputDigest !== paths.inputDigest || body.hosted?.requestId !== paths.requestId)) {
+    throw fail('GENERATION_IDENTITY_CONFLICT', 'Stored resource does not match submission claim');
+  }
+  // A crash after exclusive claim and before store persistence is ambiguous. The
+  // immutable claim is sufficient to prohibit another send, never to prove success.
+  return body ?? claim;
+}
+
+function publicResult(paths, body) {
+  const status = body.status;
+  return {
+    id: paths.id, requestId: paths.requestId, inputDigest: paths.inputDigest,
+    requestDigest: body.hosted.requestDigest, profileDigest: body.hosted.profileDigest,
+    provider: body.provider, model: body.model, status,
+    ...(body.providerTaskId ? {providerTaskId: body.providerTaskId} : {}),
+    recovery: body.providerTaskId ? 'poll' : status === 'failed' ? 'none' : 'unknown',
+    providerIdempotency: false,
+    ...(body.errorCode ? {errorCode: body.errorCode} : {}),
+    ...(body.artifact ? {artifact: body.artifact} : {}),
+  };
+}
+
+/** No provider call and no credential read. Null means never claimed here. */
+export function lookupHostedGeneration(deps, identity) {
+  const trusted = hostDeps(deps), paths = identityPaths(trusted, identity);
+  const body = readBody(trusted, paths, readClaim(paths));
+  return body ? publicResult(paths, body) : null;
+}
+
+function claimExclusive(file, value) {
+  fs.mkdirSync(path.dirname(file), {recursive: true, mode: 0o700});
+  const tmpDir = fs.mkdtempSync(path.join(path.dirname(file), '.claim-'));
+  const tmp = path.join(tmpDir, 'claim.json');
+  try {
+    const fd = fs.openSync(tmp, 'wx', 0o600);
+    try { fs.writeFileSync(fd, canonicalJson(value)); fs.fsyncSync(fd); }
+    finally { fs.closeSync(fd); }
+    // Atomic no-replace publication: readers never observe a half-written claim.
+    try { fs.linkSync(tmp, file); }
+    catch (error) { if (error.code === 'EEXIST') return false; throw error; }
+    const dir = fs.openSync(path.dirname(file), 'r');
+    try { fs.fsyncSync(dir); } finally { fs.closeSync(dir); }
+    return true;
+  } finally { fs.rmSync(tmpDir, {recursive: true, force: true}); }
+}
+
+/** Exactly one paid send per requestId. Calling again only reads the original result. */
+export async function submitHostedGeneration(deps, request) {
+  const trusted = hostDeps(deps), paths = identityPaths(trusted, request);
+  const oldClaim = readClaim(paths);
+  if (oldClaim && (oldClaim.provider !== request.provider || oldClaim.model !== request.model)) {
+    throw fail('GENERATION_IDENTITY_CONFLICT', 'Provider/model changed for the same invocation');
+  }
+  trusted.profileSnapshot = freezeSnapshot(loadProfiles(trusted));
+  const model = modelInfo(trusted.profileSnapshot, request);
+  if (!Array.isArray(request.images) || request.images.length !== model.input.count) {
+    throw fail('IMAGE_COUNT', 'Image count does not match the selected model');
+  }
+  const prompt = request.prompt;
+  if (prompt !== undefined && typeof prompt !== 'string') throw fail('GENERATION_INPUT_INVALID', 'Prompt must be a string');
+  const requestDigestOf = sources => sha256Hex(canonicalJson({
+    requestId: paths.requestId, inputDigest: paths.inputDigest,
+    provider: request.provider, model: request.model, profileDigest: model.profileDigest,
+    images: sources.map(source => ({view: source.view, sha256: source.sha256, bytes: source.bytes})),
+    promptDigest: prompt === undefined ? null : sha256Hex(prompt),
+  }));
+  if (oldClaim) {
+    // Repeat submit: the immutable claim already records each source digest and byte
+    // length, so the original request digest is recomputable without re-reading the
+    // source files. Recovery must not depend on the host still holding them, and
+    // nothing on this path can dispatch a second paid send.
+    const recorded = Array.isArray(oldClaim.images) ? oldClaim.images : null;
+    const replayed = recorded !== null && recorded.length === request.images.length
+      && recorded.every((source, index) => source?.view === model.input.views[index]
+        && source?.sha256 === request.images[index]?.sha256
+        && Number.isSafeInteger(source?.bytes) && source.bytes >= 0);
+    if (!replayed || requestDigestOf(recorded) !== oldClaim.hosted.requestDigest) {
+      throw fail('GENERATION_IDENTITY_CONFLICT', 'Request content changed');
+    }
+    return publicResult(paths, readBody(trusted, paths, oldClaim));
+  }
+  const images = request.images.map((image, index) => {
+    if (!image || typeof image.path !== 'string' || !path.isAbsolute(image.path) ||
+        !HASH.test(image.sha256 ?? '') || !IMAGE_EXTENSIONS.has(path.extname(image.path).toLowerCase())) {
+      throw fail('GENERATION_INPUT_INVALID', 'Images require private absolute paths and SHA-256 hashes');
+    }
+    let bytes;
+    try {
+      if (fs.statSync(image.path).size > MAX_IMAGE_BYTES) throw Error('too large');
+      bytes = fs.readFileSync(image.path);
+    } catch { throw fail('IMAGE_READ', 'Image could not be read within the size limit'); }
+    if (bytes.length > MAX_IMAGE_BYTES) throw fail('IMAGE_READ', 'Image exceeds byte limit');
+    if (sha256Hex(bytes) !== image.sha256) throw fail('IMAGE_HASH_MISMATCH', 'Source image changed');
+    return {bytes, sha256: image.sha256, view: model.input.views[index], extension: path.extname(image.path).toLowerCase()};
+  });
+  const requestDigest = requestDigestOf(images.map(image => ({view: image.view, sha256: image.sha256, bytes: image.bytes.length})));
+  if (request.confirmSpend !== true) throw fail('SPEND_CONFIRM_REQUIRED', 'Host must confirm existing spend authorization');
+  if (typeof deps.beforePaidSubmit !== 'function') throw fail('GENERATION_AUTHORITY_REQUIRED', 'Trusted final paid authority callback is required');
+  const qualification = qualificationAdmission(deps, request, model, images);
+  if (!qualification) assertVerified({...model, name: model.provider}, false, `model ${model.provider}/${model.model}`);
+  // Never mutate the installed catalog or borrow its provider-level verification.
+  // Only this frozen engine call receives the operator's exact admission.
+  const submitProfileSnapshot = qualification ? freezeSnapshot({
+    ...trusted.profileSnapshot,
+    [request.provider]: {...trusted.profileSnapshot[request.provider], models: {
+      ...trusted.profileSnapshot[request.provider].models,
+      [request.model]: {...trusted.profileSnapshot[request.provider].models[request.model], verified: true},
+    }},
+  }) : trusted.profileSnapshot;
+  if (deps.signal?.aborted) throw fail('GENERATION_ABORTED', 'Generation interrupted before dispatch');
+  const profile = trusted.profileSnapshot[request.provider];
+  if (!resolveCredential(trusted, profile).value) throw fail('CREDENTIAL_MISSING', 'Explicit host credential is missing');
+
+  // Freeze bytes before any await/upload. Source paths can later change without
+  // changing the paid request or its persisted image identities.
+  const inputRoot = path.join(trusted.workdir, '.abelien', 'gen3d-inputs');
+  fs.mkdirSync(inputRoot, {recursive: true, mode: 0o700});
+  const inputDir = fs.mkdtempSync(path.join(inputRoot, 'input-'));
+  const files = images.map((image, index) => {
+    const file = path.join(inputDir, `${index}${image.extension}`);
+    fs.writeFileSync(file, image.bytes, {mode: 0o400}); return file;
+  });
+  const flags = {image: files, ...(prompt === undefined ? {} : {prompt}), 'confirm-spend': true};
+  let claimed = false, sent = false;
+  try {
+    // Exact existing engine validation, including unsupported prompt and templates,
+    // before irrevocably claiming this invocation.
+    await submitFlow(trusted, {provider: request.provider, model: request.model, flags: {...flags, 'dry-run': true}});
+    if (deps.signal?.aborted) throw fail('GENERATION_ABORTED', 'Generation interrupted before dispatch');
+    const now = new Date().toISOString();
+    const initial = {
+      provider: request.provider, model: request.model, transport: 'rest', status: 'unknown',
+      images: images.map((image,index) => ({path: files[index], view: image.view, sha256: image.sha256, bytes: image.bytes.length})),
+      submitAt: now, updatedAt: now,
+      hosted: {protocol: HOSTED_GENERATION_PROTOCOL, requestId: paths.requestId, inputDigest: paths.inputDigest,
+        requestDigest, profileDigest: model.profileDigest, ...(qualification ? {qualification} : {})},
+    };
+    claimed = claimExclusive(paths.claim, initial);
+    if (!claimed) {
+      const claim = readClaim(paths);
+      if (claim.hosted.requestDigest !== requestDigest) throw fail('GENERATION_IDENTITY_CONFLICT', 'Concurrent request content changed');
+      return publicResult(paths, readBody(trusted, paths, claim));
+    }
+    const store = createStore(trusted.workdir);
+    store.put('gen3d', paths.localId, initial);
+    try {
+      await submitFlow({...trusted,
+        profileSnapshot: submitProfileSnapshot,
+        beforeSubmit: async () => {
+          if (deps.signal?.aborted) throw fail('GENERATION_ABORTED', 'Generation interrupted before dispatch');
+          // Uploads can be slow. The trusted F4 host must recheck the original
+          // lease/fence, baseline and cancellation immediately before paid send.
+          try { await deps.beforePaidSubmit?.(); }
+          catch (error) {
+            diagnostic(deps, 'authority', paths, error);
+            throw fail('GENERATION_AUTHORITY_STALE', 'Original paid authorization is no longer current');
+          }
+          if (deps.signal?.aborted) throw fail('GENERATION_ABORTED', 'Generation interrupted before dispatch');
+          if (qualification) qualificationAdmission({...deps, qualification: {
+            manifest: qualification.manifest, releaseDigest: qualification.manifest.releaseDigest,
+          }}, request, model, images);
+          sent = true;
+          store.put('gen3d', paths.localId, {...initial, sendStartedAt: new Date().toISOString()});
+        },
+        store: {
+          put(kind, _localId, body) {
+            if (kind !== 'gen3d') throw fail('GENERATION_IDENTITY_CONFLICT', 'Unexpected resource kind');
+            if (typeof body.providerTaskId !== 'string' || !/^[A-Za-z0-9_.:-]{1,256}$/.test(body.providerTaskId)) {
+              throw fail('TASK_FAILED', 'Provider returned an invalid task identity');
+            }
+            return store.put(kind, paths.localId, {...body, hosted: initial.hosted});
+          },
+        },
+      }, {provider: request.provider, model: request.model, flags});
+    } catch (error) {
+      diagnostic(deps, sent ? 'submit' : 'prepare', paths, error);
+      // Errors after dispatch (including malformed success) cannot prove no charge.
+      // A known persisted provider ID must never be discarded by an error path.
+      const current = store.get(paths.id)?.body;
+      if (!current?.providerTaskId) store.put('gen3d', paths.localId, {
+        ...initial, status: sent ? 'unknown' : 'failed', errorCode: cleanError(error).code,
+        updatedAt: new Date().toISOString(),
+      });
+    }
+    return publicResult(paths, readBody(trusted, paths, initial));
+  } finally {
+    if (!claimed) fs.rmSync(inputDir, {recursive: true, force: true});
+  }
+}
+
+function storedContext(deps, identity) {
+  const trusted = hostDeps(deps), paths = identityPaths(trusted, identity);
+  const body = readBody(trusted, paths, readClaim(paths));
+  if (!body) throw fail('RESOURCE_NOT_FOUND', 'Hosted generation was not submitted');
+  trusted.profileSnapshot = freezeSnapshot(loadProfiles(trusted));
+  const model = modelInfo(trusted.profileSnapshot, body);
+  if (model.profileDigest !== body.hosted.profileDigest) throw fail('GENERATION_PROFILE_DRIFT', 'Provider configuration changed; reconcile original request');
+  return {trusted, paths, body};
+}
+
+/** At most one status operation. Unknown requests with no task ID stay offline. */
+export async function statusHostedGeneration(deps, identity) {
+  const {trusted, paths, body} = storedContext(deps, identity);
+  if (!body.providerTaskId || body.status === 'succeeded' || body.status === 'failed') return publicResult(paths, body);
+  try { await statusFlow(trusted, {id: paths.id}); } catch (error) {
+    diagnostic(deps, 'status', paths, error); throw cleanError(error);
+  }
+  return lookupHostedGeneration(trusted, identity);
+}
+
+/** Only fetch a known successful task; never a waiting loop or a new submit. */
+export async function fetchHostedGeneration(deps, identity) {
+  const {trusted, paths, body} = storedContext(deps, identity);
+  if (!body.providerTaskId || body.status !== 'succeeded') throw fail('TASK_PENDING', 'Artifact is not ready; use status with the original request');
+  if (body.artifact) {
+    let bytes;
+    try { bytes = fs.readFileSync(body.artifact.path); } catch { throw fail('ARTIFACT_HASH_MISMATCH', 'Persisted artifact is missing'); }
+    if (bytes.length !== body.artifact.bytes || sha256Hex(bytes) !== body.artifact.sha256) {
+      throw fail('ARTIFACT_HASH_MISMATCH', 'Persisted artifact changed');
+    }
+    validateGlb(bytes);
+    return publicResult(paths, body);
+  }
+  try {
+    const {url, download} = await artifactLocation(trusted, {id: paths.id});
+    const artifact = await downloadArtifact(trusted, {download}, url,
+      path.join(trusted.workdir, '.abelien', 'artifacts', 'gen3d', paths.localId), paths.localId);
+    const store = createStore(trusted.workdir);
+    const current = store.get(paths.id).body;
+    store.put('gen3d', paths.localId, {...current, artifact, status: 'succeeded', updatedAt: new Date().toISOString()});
+    return lookupHostedGeneration(trusted, identity);
+  } catch (error) { diagnostic(deps, 'fetch', paths, error); throw cleanError(error); }
+}