abelien-harness 0.4.0 → 0.6.0

package/skills/abelien-hardware/scripts/electrical.mjs

@@ -0,0 +1,168 @@
+// Deterministic electrical compatibility for a selected set of parts (star topology, v1).
+// Only measured/datasheet records can prove pass or a supply gap; missing data is unrecorded, never "not needed", and stays unknown.
+// Star-topology shortfalls are risks to confirm, so v1 never proves fail. This is not a circuit simulation.
+import { digest } from './selection-request.mjs';
+const object = v => v !== null && typeof v === 'object' && !Array.isArray(v);
+const positive = v => typeof v === 'number' && Number.isFinite(v) && v > 0;
+const text = v => typeof v === 'string' && v.trim().length > 0;
+const hash = v => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const slug = v => typeof v === 'string' && /^[a-z0-9][a-z0-9-]{0,47}$/.test(v);
+const invalid = message => { throw Object.assign(new Error(message), { code: 'VALIDATION' }); };
+function keys(value, required, optional, label) {
+  if (!object(value) || required.some(key => !Object.hasOwn(value, key)) || Object.keys(value).some(key => ![...required, ...optional].includes(key))) invalid(`${label} has missing or unsupported fields`);
+}
+export const ELECTRICAL_SCHEMA = 'abelien.component-electrical.v1';
+export const BUS_TYPES = ['i2c', 'spi', 'uart', 'usb', 'i2s', 'can', 'pwm', 'gpio', 'adc'];
+// Multi-drop buses only need to exist on the controller; the others are point-to-point and their counts add up.
+const SHARED_BUSES = ['i2c', 'spi', 'can'];
+const TRUSTED = ['measured', 'datasheet'];
+const BASES = ['measured', 'datasheet', 'estimate', 'unknown'];
+const range = v => Array.isArray(v) && v.length === 2 && v.every(positive) && v[0] <= v[1];
+
+function validatePower(rows, label) {
+  if (!Array.isArray(rows)) invalid(`${label} must be an array`);
+  const ids = new Set();
+  for (const row of rows) {
+    keys(row, ['id', 'voltage_v'], ['connector', 'max_current_a'], label);
+    if (!slug(row.id) || ids.has(row.id) || !range(row.voltage_v) || (row.connector !== undefined && !slug(row.connector))
+      || (row.max_current_a !== undefined && !positive(row.max_current_a))) invalid(`${label} entries need unique ids, ordered positive voltage ranges and slug connectors`);
+    ids.add(row.id);
+  }
+}
+// Strict consumer-side contract; the producer is the component database export (P2-04.03).
+export function validateElectricalRecord(value) {
+  keys(value, ['schema', 'basis', 'power_inputs', 'power_outputs', 'buses'], [], 'electrical record');
+  if (value.schema !== ELECTRICAL_SCHEMA || !BASES.includes(value.basis)) invalid('unsupported electrical record schema or basis');
+  validatePower(value.power_inputs, 'electrical power_inputs');
+  validatePower(value.power_outputs, 'electrical power_outputs');
+  if (!Array.isArray(value.buses)) invalid('electrical buses must be an array');
+  for (const bus of value.buses) {
+    keys(bus, ['type', 'role', 'count'], ['logic_level_v'], 'electrical bus');
+    if (!BUS_TYPES.includes(bus.type) || !['controller', 'peripheral'].includes(bus.role) || !Number.isSafeInteger(bus.count) || bus.count < 1
+      || (bus.logic_level_v !== undefined && !positive(bus.logic_level_v))) invalid('electrical bus needs a known type, role, positive count and positive logic level');
+  }
+  return value;
+}
+// Source-bound records only; an unbound or legacy record is reported as unknown, never trusted.
+export function electricalFields(value) {
+  const record = value?.electrical, source = value?.electrical_source, id = value?.component_id ?? value?.record_id;
+  if (record === undefined && source === undefined) return {};
+  if (!object(source) || source.component_id !== id || !hash(source.revision) || !hash(source.snapshot_id)
+    || Object.keys(source).some(key => !['component_id', 'revision', 'snapshot_id', 'evidence_ref'].includes(key))
+    || (source.evidence_ref !== undefined && !text(source.evidence_ref))) return { electrical: null, electrical_source: null };
+  validateElectricalRecord(record);
+  if (source.revision !== digest({ component_id: id, ...record })) invalid('electrical source revision does not match candidate fields');
+  return { electrical: record, electrical_source: { ...source } };
+}
+const overlaps = (a, b) => a[0] <= b[1] && b[0] <= a[1];
+const within = (inner, outer) => inner[0] >= outer[0] && inner[1] <= outer[1];
+const isController = part => part.category_path?.[0] === 'compute-control' && ['controller-board', 'controller-module'].includes(part.category_path?.[1]);
+const isPower = part => part.category_path?.[0] === 'power-energy';
+const isLevelShifter = part => part.category_path?.[0] === 'electrical-interconnect' && part.category_path?.[1] === 'level-shifting';
+const trusted = part => TRUSTED.includes(part.electrical?.basis);
+const ref = part => ({ slot_id: part.slot_id, component_id: part.component_id });
+
+// Supply match against trusted rails only. A missing rail is a supply gap (add a power part), never a reason to reject the consumer.
+// Among rails whose voltage fits, the one with the largest recorded max_current_a is chosen (rails without current last, then input order);
+// current is settled afterwards in settleCurrent, because one rail may feed several consumers.
+function supply(consumer, sources, rule, dimension, loads) {
+  const parts = [consumer, ...sources].map(ref), inputs = consumer.electrical?.power_inputs ?? [];
+  if (!trusted(consumer)) return { rule, dimension, status: 'unknown', parts, reason: 'UNTRUSTED_OR_MISSING_DATA' };
+  // The v1 schema has no "needs no power" value: an empty list is unrecorded, not unpowered.
+  if (!inputs.length) return { rule, dimension, status: 'unknown', parts, reason: 'NO_DECLARED_INPUT' };
+  const rails = sources.filter(trusted).flatMap(source => (source.electrical.power_outputs ?? []).map(output => ({ source, output })));
+  const capacity = row => row.output.max_current_a ?? -1;
+  const fit = rails.filter(({ output }) => inputs.some(input => within(output.voltage_v, input.voltage_v)))
+    .reduce((best, row) => (!best || capacity(row) > capacity(best) ? row : best), null);
+  if (fit) {
+    const input = inputs.find(row => within(fit.output.voltage_v, row.voltage_v));
+    const connectorRisk = Boolean(input.connector && fit.output.connector && input.connector !== fit.output.connector);
+    const check = { rule, dimension, status: connectorRisk ? 'risk' : 'pass', parts, reason: connectorRisk ? 'CONNECTOR_MISMATCH' : 'RAIL_WITHIN_INPUT',
+      rail: { component_id: fit.source.component_id, id: fit.output.id, voltage_v: fit.output.voltage_v, connector: fit.output.connector ?? null },
+      input: { id: input.id, voltage_v: input.voltage_v, connector: input.connector ?? null } };
+    loads.set(check, { key: JSON.stringify([fit.source.slot_id, fit.source.component_id, fit.output.id]), capacity: fit.output.max_current_a,
+      draw: input.max_current_a === undefined ? undefined : input.max_current_a * (consumer.quantity ?? 1) });
+    return check;
+  }
+  if (sources.some(source => !trusted(source))) return { rule, dimension, status: 'unknown', parts, reason: 'UNTRUSTED_SOURCE_MAY_SUPPLY' };
+  const partial = rails.some(({ output }) => inputs.some(input => overlaps(output.voltage_v, input.voltage_v)));
+  return { rule, dimension, status: partial ? 'risk' : 'gap', parts, reason: partial ? 'RAIL_PARTIALLY_OUTSIDE_INPUT' : 'NO_SUPPLY_RAIL_FOR_INPUT' };
+}
+// Input max_current_a is the input's maximum draw (including loads it passes on); output max_current_a is the rail's maximum supply.
+// A rail's load is the sum of draw x quantity over every consumer assigned to it; one rail of a multi-quantity source counts once.
+// Recorded loads above capacity are a risk; any missing current on that rail is unknown. A pass needs every current recorded and within capacity.
+function settleCurrent(checks, loads) {
+  const rails = new Map();
+  for (const check of checks) if (loads.has(check)) {
+    const row = loads.get(check);
+    rails.set(row.key, [...(rails.get(row.key) ?? []), check]);
+  }
+  for (const members of rails.values()) {
+    const rows = members.map(check => loads.get(check)), capacity = rows[0].capacity;
+    const known = rows.filter(row => row.draw !== undefined), total = known.reduce((sum, row) => sum + row.draw, 0);
+    const complete = capacity !== undefined && known.length === rows.length;
+    const status = capacity !== undefined && total > capacity + 1e-9 ? 'exceeded' : complete ? 'within' : 'unrecorded';
+    for (const check of members) {
+      const draw = loads.get(check).draw;
+      check.current = { status, draw_a: draw ?? null, rail_load_a: known.length ? total : null, capacity_a: capacity ?? null };
+      if (status === 'exceeded') Object.assign(check, { status: 'risk', reason: 'RAIL_CURRENT_EXCEEDED' });
+      else if (status === 'unrecorded' && check.status === 'pass') Object.assign(check, { status: 'unknown', reason: 'CURRENT_UNRECORDED' });
+    }
+  }
+}
+// fail (incompatible part) > gap (missing part) > pass (all checks pass on trusted data) > risk > unknown. v1 rules never emit fail.
+const aggregate = (checks, dimension, members) => {
+  const rows = checks.filter(check => check.dimension === dimension);
+  for (const status of ['fail', 'gap']) if (rows.some(check => check.status === status)) return status;
+  if (rows.length && rows.every(check => check.status === 'pass') && members.every(trusted)) return 'pass';
+  return rows.some(check => check.status === 'risk') ? 'risk' : 'unknown';
+};
+// parts: [{slot_id, component_id, category_path, quantity, electrical}] for the whole selection.
+export function evaluateElectrical(parts) {
+  const method = 'electrical-star-v1', controllers = parts.filter(isController);
+  if (controllers.length !== 1) return { method, topology: 'not_star', dimensions: { power: 'unknown', interfaces: 'unknown' }, checks: [],
+    reasons: [{ code: controllers.length ? 'MULTIPLE_CONTROLLERS' : 'NO_CONTROLLER', controllers: controllers.map(ref) }] };
+  const [controller] = controllers, sources = parts.filter(isPower), shifters = parts.filter(isLevelShifter);
+  const peripherals = parts.filter(part => part !== controller && !isPower(part) && !isLevelShifter(part));
+  const checks = [], loads = new Map();
+  // Rule 1: a selected supply must power the controller. Without one the controller's own supply is outside the selection: unknown, never pass.
+  if (sources.length) checks.push(supply(controller, sources, 'controller_supply', 'power', loads));
+  else checks.push({ rule: 'controller_supply', dimension: 'power', status: 'unknown', parts: [ref(controller)], reason: 'CONTROLLER_SUPPLY_OUTSIDE_SELECTION' });
+  // Rule 2: each peripheral needs a controller rail or a selected supply rail inside one of its input ranges.
+  for (const part of peripherals) checks.push(supply(part, [controller, ...sources], 'peripheral_supply', 'power', loads));
+  settleCurrent(checks, loads);
+  // Rule 3: bus types the peripherals need should exist on the controller; point-to-point counts should also fit.
+  // The star assumption ignores expansion and driver boards, so a shortfall is a risk to confirm, never a proof of incompatibility.
+  const need = new Map();
+  for (const part of peripherals) for (const bus of part.electrical?.buses ?? []) if (bus.role === 'peripheral')
+    need.set(bus.type, [...(need.get(bus.type) ?? []), { part, bus, count: bus.count * (part.quantity ?? 1) }]);
+  for (const part of peripherals) if (!trusted(part)) checks.push({ rule: 'bus_availability', dimension: 'interfaces', status: 'unknown', parts: [ref(part), ref(controller)], reason: 'UNTRUSTED_OR_MISSING_DATA' });
+  const shifterTrusted = shifters.length > 0 && shifters.every(trusted);
+  for (const [type, rows] of need) {
+    const parts2 = [ref(controller), ...rows.map(row => ref(row.part))];
+    if (!trusted(controller) || rows.some(row => !trusted(row.part))) { checks.push({ rule: 'bus_availability', dimension: 'interfaces', status: 'unknown', bus: type, parts: parts2, reason: 'UNTRUSTED_OR_MISSING_DATA' }); continue; }
+    if (!controller.electrical.buses.some(bus => bus.role === 'controller')) { checks.push({ rule: 'bus_availability', dimension: 'interfaces', status: 'unknown', bus: type, parts: parts2, reason: 'CONTROLLER_BUSES_UNRECORDED' }); continue; }
+    const offered = controller.electrical.buses.filter(bus => bus.type === type && bus.role === 'controller');
+    const available = offered.reduce((sum, bus) => sum + bus.count, 0);
+    const devices = rows.reduce((sum, row) => sum + row.count, 0);
+    const required = SHARED_BUSES.includes(type) ? 1 : devices;
+    checks.push({ rule: 'bus_availability', dimension: 'interfaces', bus: type, parts: parts2, required, available,
+      status: available >= required ? 'pass' : 'risk', reason: !available ? 'BUS_TYPE_MISSING' : available < required ? 'BUS_COUNT_SHORT' : 'BUS_AVAILABLE' });
+    // Several devices on one shared SPI bus each need a chip-select line, which v1 does not model. I2C address conflicts are not checked in v1.
+    if (type === 'spi' && available && devices > available)
+      checks.push({ rule: 'spi_chip_select', dimension: 'interfaces', bus: type, parts: parts2, devices, available, status: 'risk', reason: 'SPI_CHIP_SELECT_UNVERIFIED' });
+    // Rule 4: a logic-level mismatch is only a risk in v1; only a trusted level shifter can clear it. Unrecorded levels stay unknown.
+    for (const row of rows) {
+      const level = offered.find(bus => bus.logic_level_v !== undefined)?.logic_level_v;
+      const base = { rule: 'logic_level', dimension: 'interfaces', bus: type, parts: [ref(controller), ref(row.part)], controller_v: level ?? null, peripheral_v: row.bus.logic_level_v ?? null };
+      if (!offered.length) continue;
+      if (level === undefined || row.bus.logic_level_v === undefined) { checks.push({ ...base, status: 'unknown', reason: 'LOGIC_LEVEL_UNRECORDED' }); continue; }
+      const mismatch = Math.abs(level - row.bus.logic_level_v) > 1e-9;
+      checks.push({ ...base, status: !mismatch || shifterTrusted ? 'pass' : shifters.length ? 'unknown' : 'risk',
+        reason: !mismatch ? 'LOGIC_LEVEL_MATCH' : shifterTrusted ? 'LEVEL_SHIFTER_SELECTED' : shifters.length ? 'LEVEL_SHIFTER_UNTRUSTED' : 'LOGIC_LEVEL_MISMATCH' });
+    }
+  }
+  const powerMembers = [controller, ...sources, ...peripherals.filter(part => checks.some(check => check.dimension === 'power' && check.parts.some(row => row.component_id === part.component_id)))];
+  return { method, topology: 'star', controller: ref(controller), checks,
+    dimensions: { power: aggregate(checks, 'power', powerMembers), interfaces: aggregate(checks, 'interfaces', [controller, ...peripherals]) } };
+}

package/skills/abelien-hardware/scripts/finalize-selection.mjs

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { assemblyOccupancy, dimensionFields, evaluateDimensions } from "./dimensions.mjs";
+import { electricalFields } from "./electrical.mjs";
 import { selectionRequestDigest } from "./selection-request.mjs";
 
 function error(message, details) {
@@ -74,13 +75,13 @@ export async function finalizeHardwareSelection({ input }) {
         slot_id: selected.slot_id, component_id: selected.component_id,
       });
     }
-    const dimensionCheck = evaluateDimensions(candidate, input.requirements);
+    const dimensionCheck = evaluateDimensions(candidate, input.requirements, (input.slots ?? []).find(slot => slot?.slot_id === selected.slot_id));
     if (dimensionCheck.status === "incompatible") throw error("selected component is dimensionally incompatible; choose a surviving candidate", { slot_id: selected.slot_id, component_id: selected.component_id, dimension_check: dimensionCheck });
     return {
       name: String(candidate.title ?? candidate.name ?? candidate.model ?? candidate.component_id),
       // This is a deterministic selection-line identity, NOT an upstream catalog BOM identity.
       bom_item_id: `selection-line-${digest({ slot_id: selected.slot_id, component_id: candidate.component_id }).slice(0, 24)}`,
-      ...dimensionFields(candidate), dimension_check: dimensionCheck,
+      ...dimensionFields(candidate), dimension_check: dimensionCheck, ...electricalFields(candidate),
       ...(candidate.interfaces !== undefined ? { interfaces: candidate.interfaces } : {}),
       slot_id: selected.slot_id, component_id: selected.component_id, quantity: selected.quantity,
       selection_reason: selected.selection_reason, wiki_evidence: selected.wiki_evidence,
@@ -94,6 +95,7 @@ export async function finalizeHardwareSelection({ input }) {
       ...(candidate.source_type === "external_web" ? { source_type: candidate.source_type, source: candidate.source, geometry: candidate.geometry, CAD_available: false, cad_available: false, engineering_verified: false } : {}),
     };
   });
+  // Electrical checks never reject here: star-topology bus shortfalls and supply gaps are reported by hardware.select for confirmation.
   const stable = {
     requirements: input.requirements ?? {}, slots: input.slots ?? [], source_snapshot: recall.source_snapshot,
     proposal: { ...proposal, selected_models: selectedModels },

package/skills/abelien-hardware/scripts/provider-chain-contract.mjs

@@ -2,7 +2,7 @@ import { digest, selectionRequestDigest } from "./selection-request.mjs";
 import { failure, text } from "./web-common.mjs";
 import { sha256, normalizePublicSourceUrl, pageText, publicAddress, publicReadFailureCodes } from "./public-page.mjs";
 import { intactReceipt, successfulReceipt } from "./web-receipt.mjs";
-import { volcQueryRequest } from "./volc-web-search.mjs";
+import { volcQueryRequest, legacyVolcQueryRequest } from "./volc-web-search.mjs";
 import { isIP } from "node:net";
 export const chainProtocol = "prismer-volc-source-v2", chainPolicy = "prismer_then_volc";
 export const receiptFields = ["raw", "raw_sha256", "response", "response_sha256", "request_id", "received_at", "http_status"];
@@ -13,8 +13,27 @@ export const same = (left, right) => digest({ value: left }) === digest({ value:
 export const selectedReceipt = group => group?.attempts?.find(attempt => attempt.id === group.selected_attempt_id) ?? null;
 export const queryResults = attempt => attempt?.provider === "volcengine" ? attempt.response?.Result?.WebResults?.map(result => ({ ...result, url: result?.Url ?? null })) : attempt?.response?.results;
 export const missingKey = attempt => attempt?.status === "unavailable" && attempt.dispatch_state === "not_sent" && attempt.reason === "missing_key" && attempt.error_code === "HARDWARE_WEB_CONFIG" && attempt.raw == null && attempt.response == null && attempt.http_status == null;
+// A Prismer attempt skipped by the trusted host switch is recorded unsent with no receipt;
+// it authorizes the same group's Volc query or direct source read.
+export const prismerDisabled = attempt => attempt?.provider === "prismer" && attempt.status === "unavailable" && attempt.dispatch_state === "not_sent" && attempt.reason === "prismer_disabled" && attempt.error_code == null && attempt.raw == null && attempt.response == null && attempt.http_status == null;
+// The Prismer switch belongs to one web evidence: it is pinned when the evidence first needs
+// provider IO, and every resume uses the pinned value, never the host environment of that time.
+// Legacy evidence without the pin is inferred from its own attempts; a mix fails closed.
+export const prismerSwitches = ["enabled", "disabled"];
+const prismerAttempts = body => [...(body.searches ?? []), ...(body.pages ?? [])].flatMap(group => Array.isArray(group?.attempts) ? group.attempts : []).filter(attempt => attempt?.provider === "prismer");
+function switchConsistent(body) {
+  const attempts = prismerAttempts(body);
+  return body.prismer_switch === "disabled" ? attempts.every(prismerDisabled) : !attempts.some(prismerDisabled);
+}
+export function pinPrismerSwitch(body, current) {
+  if (Object.hasOwn(body, "prismer_switch")) return body.prismer_switch;
+  const attempts = prismerAttempts(body), disabled = attempts.some(prismerDisabled), live = attempts.some(attempt => !prismerDisabled(attempt));
+  if (disabled && live) throw failure("HARDWARE_WEB_RECONCILIATION_REQUIRED", "legacy evidence mixes skipped and dispatched Prismer attempts; reconcile it before resuming");
+  body.prismer_switch = disabled ? "disabled" : live ? "enabled" : current;
+  return body.prismer_switch;
+}
 export const knownDenial = attempt => attempt?.provider === "prismer" && attempt.status === "denied" && attempt.dispatch_state === "sent" && [401, 403, 402, 429].includes(attempt.http_status) && intactReceipt(attempt);
-export const permitsFallback = (attempt, query) => knownDenial(attempt) || missingKey(attempt) || (query && attempt?.status === "completed" && successfulReceipt(attempt) && Array.isArray(queryResults(attempt)) && queryResults(attempt).length === 0);
+export const permitsFallback = (attempt, query) => knownDenial(attempt) || missingKey(attempt) || prismerDisabled(attempt) || (query && attempt?.status === "completed" && successfulReceipt(attempt) && Array.isArray(queryResults(attempt)) && queryResults(attempt).length === 0);
 export function expectedSelection(group, query) {
   const primary = group.attempts?.[0], fallback = group.attempts?.[1];
   if (!primary) return null;
@@ -67,13 +86,14 @@ function validateGroup(group, item, page, partial) {
   const operation = page ? sourceOperation(page.source_url) : null;
   for (const [index, attempt] of attempts.entries()) {
     const provider = index === 0 ? "prismer" : query ? "volcengine" : "direct_https", kind = query ? "query" : index === 0 ? operation.kind : "direct_page";
-    const request = query ? index === 0 ? primaryQuery(item) : volcQueryRequest(item) : index === 0 ? operation.request : { url: page.source_url, method: "GET" };
-    if (attempt.provider !== provider || attempt.kind !== kind || attempt.role !== (index === 0 ? "primary" : "fallback") || attempt.group_id !== group.id || attempt.id !== operationId(group.id, provider, kind, request) || !same(attempt.request, request)) return false;
+    // Volc receipts saved before the Count-5 default keep their frozen Count-10 request shape.
+    const requests = query ? index === 0 ? [primaryQuery(item)] : [volcQueryRequest(item), legacyVolcQueryRequest(item)] : [index === 0 ? operation.request : { url: page.source_url, method: "GET" }];
+    if (attempt.provider !== provider || attempt.kind !== kind || attempt.role !== (index === 0 ? "primary" : "fallback") || attempt.group_id !== group.id || !requests.some(request => attempt.id === operationId(group.id, provider, kind, request) && same(attempt.request, request))) return false;
     if (index === 1 && !permitsFallback(attempts[0], query)) return false;
     if (["in_progress", "unknown", "failed"].includes(attempt.status)) return false;
     if (provider === "direct_https") { if (!validDirect(attempt) || (attempt.dispatch_state === "not_sent" && operation.kind !== "parse") || (attempt.public_read_failure && operation.kind === "parse")) return false; continue; }
     if (Object.hasOwn(attempt, "public_read_failure")) return false;
-    if (missingKey(attempt) || knownDenial(attempt)) continue;
+    if (missingKey(attempt) || knownDenial(attempt) || prismerDisabled(attempt)) continue;
     if (attempt.dispatch_state !== "sent" || !["completed", "pending"].includes(attempt.status) || !successfulReceipt(attempt)) return false;
     if (query && !Array.isArray(queryResults(attempt))) return false;
     if (attempt.status === "pending" && !(kind === "parse" && text(attempt.task_id) && attempt.task_id === attempt.response.taskId)) return false;
@@ -81,7 +101,7 @@ function validateGroup(group, item, page, partial) {
     if (page && (!Array.isArray(attempt.observations) || !attempt.observations.every(value => ["status", "result"].includes(value.kind) && (value.error_code ? ((value.raw === undefined && value.response === undefined) || intactReceipt(value)) : successfulReceipt(value) && value.response.taskId === attempt.task_id)))) return false;
   }
   const expected = expectedSelection(group, query), selected = selectedReceipt(group);
-  if (group.selected_attempt_id == null) return partial && group.status === "in_progress" && (knownDenial(attempts[0]) || missingKey(attempts[0]) || successfulReceipt(attempts[0])) && (!page || page.attempt == null);
+  if (group.selected_attempt_id == null) return partial && group.status === "in_progress" && (knownDenial(attempts[0]) || missingKey(attempts[0]) || prismerDisabled(attempts[0]) || successfulReceipt(attempts[0])) && (!page || page.attempt == null);
   if (!selected || !expected || selected.id !== expected.id) return false;
   return group.selected_provider === selected.provider && (query ? group.status === "completed" && receiptFields.every(key => same(group[key], selected[key])) : same(page.attempt, selected));
 }
@@ -89,6 +109,7 @@ export function validateChainIntegrity({ original, source, saved, allowPartial =
   const reject = message => { throw failure(code, message); }, body = saved?.body, expectedId = `hardware-web-evidence:web-evidence-${digest({ recall_id: source.id, request_digest: selectionRequestDigest(original) }).slice(0, 24)}`;
   try {
     if (saved?.id !== expectedId || saved.kind !== "hardware-web-evidence" || body.id !== expectedId.split(":")[1] || body.protocol !== chainProtocol || body.provider !== "prismer" || body.schema_version !== 2 || body.provider_policy !== chainPolicy || body.recall_id !== source.id || body.recall_digest !== digest(source) || body.request_digest !== selectionRequestDigest(original) || selectionRequestDigest(body) !== selectionRequestDigest(original) || body.plan_digest !== digest(original.unresolved_slots) || body.plan_digest !== digest(body.unresolved_slots) || !["completed", ...(allowPartial ? ["pending", "in_progress"] : [])].includes(body.status)) reject("chain identity or original frozen plan drifted");
+    if (Object.hasOwn(body, "prismer_switch") && (!prismerSwitches.includes(body.prismer_switch) || !switchConsistent(body))) reject("pinned Prismer switch is invalid or contradicts its attempts");
     if (![body.searches, body.pages, body.query_plans, body.unknowns].every(Array.isArray) || !body.query_plans.length || !body.query_plans.every(plan => Array.isArray(plan.unresolved_slots) && plan.plan_digest === digest(plan.unresolved_slots)) || body.query_plans.at(-1).plan_digest !== body.plan_digest || new Set(body.searches.map(entry => entry.id)).size !== body.searches.length || new Set(body.pages.map(page => page.id)).size !== body.pages.length) reject("chain history is malformed");
     for (const entry of body.searches) {
       const item = body.query_plans.flatMap(plan => plan.unresolved_slots).find(item => item.slot_id === entry.slot_id && item.query === entry.query && item.reason === entry.reason && same(entry.request, primaryQuery(item)));

package/skills/abelien-hardware/scripts/public-page.mjs

@@ -1,121 +1,11 @@
-import https from "node:https";
-import dns from "node:dns/promises";
-import { isIP } from "node:net";
-import { createHash } from "node:crypto";
-import { failure, timed } from "./web-common.mjs";
-export const sha256 = bytes => createHash("sha256").update(bytes).digest("hex");
-export const publicReadFailureCodes = Object.freeze({ transport: "HARDWARE_WEB_TRANSPORT", dns: "HARDWARE_WEB_DNS", access: "HARDWARE_WEB_URL", redirect: "HARDWARE_WEB_PAGE", timeout: "HARDWARE_WEB_TIMEOUT" });
-const readFailures = new WeakMap();
-export const publicReadFailure = error => readFailures.get(error) ?? null;
-function readFailure(stage) {
-  const code = publicReadFailureCodes[stage], error = failure(code, `public source ${stage} failed`);
-  readFailures.set(error, Object.freeze({ stage, code, failed_at: new Date().toISOString() })); return error;
-}
-const networkError = error => ["ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "EPIPE", "ENETUNREACH", "EHOSTUNREACH", "EAI_AGAIN", "ENOTFOUND", "ENODATA", "ESERVFAIL", "EREFUSED"].includes(error?.code);
-async function readTimed(operation, timeoutMs) {
-  try { return await timed(operation, timeoutMs, "HARDWARE_PUBLIC_READ_TIMEOUT"); }
-  catch (error) { if (error?.code === "HARDWARE_PUBLIC_READ_TIMEOUT") throw readFailure("timeout"); throw error; }
-}
-export function publicAddress(address) {
-  if (typeof address !== "string") return false;
-  if (isIP(address) === 4) {
-    const value = address.split(".").reduce((out, part) => (out * 256 + Number(part)) >>> 0, 0);
-    const ranges = [["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8], ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4]];
-    return !ranges.some(([network, bits]) => {
-      const base = network.split(".").reduce((out, part) => (out * 256 + Number(part)) >>> 0, 0), mask = (0xffffffff << (32 - bits)) >>> 0;
-      return (value & mask) === (base & mask);
-    });
-  }
-  if (isIP(address) === 6) {
-    const normalized = new URL(`https://[${address}]/`).hostname.slice(1, -1);
-    return /^[23][0-9a-f]{3}:/.test(normalized) && !/^(2001:(:|[01][0-9a-f]?:|2[0-9a-f]?:|db8:)|2002:|3fff:)/.test(normalized);
-  }
-  return false;
-}
-export function normalizePublicSourceUrl(value) {
-  let url; try { url = new URL(value); } catch { throw failure("HARDWARE_WEB_URL", "public source URL is invalid"); }
-  if (url.protocol !== "https:" || url.username || url.password || (url.port && url.port !== "443")
-    || !url.hostname.includes(".") || isIP(url.hostname.replace(/^\[|\]$/g, ""))
-    || /(^|\.)(localhost|local|internal|test|invalid)$/.test(url.hostname)) throw failure("HARDWARE_WEB_URL", "only public HTTPS source URLs without credentials are allowed");
-  url.hash = ""; return url;
-}
-function pageRequest(url, { address, family, signal, headers = {} }) {
-  return new Promise((resolve, reject) => {
-    const req = https.get(url, { signal, agent: false, servername: new URL(url).hostname, rejectUnauthorized: true, headers: { "user-agent": "Abelien-Hardware-Evidence/1", accept: "text/html,text/plain,application/xhtml+xml,application/pdf", ...headers },
-      lookup: (_hostname, opts, callback) => callback(null, ...(opts.all ? [[{ address, family }]] : [address, family])) }, response => {
-      const chunks = []; response.on("data", chunk => chunks.push(chunk)); response.on("error", () => reject(readFailure("transport")));
-      response.on("end", () => resolve({ status: response.statusCode, headers: response.headers, bytes: Buffer.concat(chunks) }));
-    });
-    req.on("error", () => reject(readFailure("transport")));
-  });
-}
-async function dohLookup(hostname, signal, request) {
-  const answers = await Promise.all(["A", "AAAA"].map(async type => {
-    // Fixed trusted resolver and public bootstrap address; no unchecked system resolution.
-    const url = `https://cloudflare-dns.com/dns-query?type=${type}&name=${encodeURIComponent(hostname)}`;
-    let response;
-    try {
-      response = await request(url, { address: "1.1.1.1", family: 4, signal, headers: { accept: "application/dns-json" } });
-    } catch (error) { if (publicReadFailure(error) || networkError(error)) throw readFailure("dns"); throw error; }
-    let value;
-    try { value = JSON.parse(Buffer.from(response.bytes ?? []).toString("utf8")); }
-    catch (error) { if (error instanceof SyntaxError) throw failure("HARDWARE_WEB_DNS", "trusted public DNS returned malformed JSON"); throw error; }
-    if (response.status !== 200 || value?.Status !== 0 || (value.Answer !== undefined && !Array.isArray(value.Answer))) throw readFailure("dns");
-    return (value.Answer ?? []).filter(item => [1, 28].includes(item?.type)).map(item => ({ address: item.data, family: item.type === 1 ? 4 : 6 }));
-  }));
-  return answers.flat();
-}
-export function decodeHtmlEntities(raw) {
-  return raw.replace(/&#(x[0-9a-f]+|[0-9]+);/gi, (_, n) => { const code = n[0].toLowerCase() === "x" ? parseInt(n.slice(1), 16) : Number(n); return code <= 0x10ffff ? String.fromCodePoint(code) : "�"; })
-    .replace(/&(amp|lt|gt|quot|apos|nbsp);/gi, (_, entity) => ({ amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " })[entity.toLowerCase()]);
-}
-export function pageText(raw, contentType) {
-  if (!contentType.includes("html")) return raw;
-  return decodeHtmlEntities(raw.replace(/<(script|style|noscript)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, " ").replace(/<[^>]+>/g, " ")).replace(/\s+/g, " ").trim();
-}
-// Validate the submitted URL only. Prismer's remote fetch/redirect behavior is outside
-// this local DNS check; this does not assert that its source connection is pinned.
-export async function validatePublicSource(target, { lookup, dnsRequest = pageRequest, dnsTransport = "system", timeoutMs = 30000, checkUrl = () => {} } = {}) {
-  checkUrl(target);
-  const url = normalizePublicSourceUrl(target);
-  await readTimed(async signal => {
-    let addresses;
-    try { addresses = await (lookup ? lookup(url.hostname) : dnsTransport === "doh" ? dohLookup(url.hostname, signal, dnsRequest) : dns.lookup(url.hostname, { all: true, verbatim: true })); }
-    catch (error) { if (publicReadFailure(error) || networkError(error)) throw readFailure("dns"); throw error; }
-    if (!Array.isArray(addresses) || !addresses.length || addresses.some(item => !publicAddress(item?.address) || isIP(item.address) !== item.family)) throw failure("HARDWARE_WEB_URL", "submitted source DNS includes non-public addresses");
-  }, timeoutMs);
-  return url.href;
-}
-export async function fetchPublicPage(target, { lookup, pageRequest: request = pageRequest, dnsRequest = pageRequest, dnsTransport = "system", timeoutMs = 30000, maxRedirects = 5, checkUrl = () => {} } = {}) {
-  checkUrl(target);
-  let url = normalizePublicSourceUrl(target); const redirects = [], connections = [], fetchedAt = new Date().toISOString();
-  if (!["system", "doh"].includes(dnsTransport)) throw failure("HARDWARE_WEB_CONFIG", "web DNS transport must be system or doh");
-  return readTimed(async signal => {
-    for (let n = 0; n <= maxRedirects; n++) {
-      let addresses;
-      try { addresses = await (lookup ? lookup(url.hostname) : dnsTransport === "doh" ? dohLookup(url.hostname, signal, dnsRequest) : dns.lookup(url.hostname, { all: true, verbatim: true })); }
-      catch (err) { if (publicReadFailure(err) || networkError(err)) throw readFailure("dns"); throw err; }
-      if (!Array.isArray(addresses) || !addresses.length || addresses.some(item => !publicAddress(item?.address) || isIP(item.address) !== item.family)) throw readFailure("access");
-      connections.push({ url: url.href, tls_hostname: url.hostname, addresses, address: addresses[0].address, family: addresses[0].family });
-      let response;
-      try { response = await request(url.href, { address: addresses[0].address, family: addresses[0].family, signal }); }
-      catch (error) { if (publicReadFailure(error)) throw error; if (networkError(error)) throw readFailure("transport"); throw error; }
-      const bytes = Buffer.from(response.bytes ?? []), headers = response.headers ?? {};
-      if ([301, 302, 303, 307, 308].includes(response.status)) {
-        if (n === maxRedirects || !headers.location) throw readFailure("redirect");
-        let next;
-        try { next = new URL(headers.location, url); } catch (error) { if (error?.code === "ERR_INVALID_URL") throw readFailure("redirect"); throw error; }
-        try { next = normalizePublicSourceUrl(next.href); checkUrl(next.href); } catch (error) { if (error?.code === "HARDWARE_WEB_URL") throw readFailure("access"); throw error; }
-        redirects.push({ from: url.href, to: next.href }); url = next; continue;
-      }
-      const common = { url: normalizePublicSourceUrl(target).href, final_url: url.href, fetched_at: fetchedAt, redirects, connections, dns_transport: dnsTransport, http_status: response.status,
-        raw_sha256: sha256(bytes), raw_base64: bytes.toString("base64"), content_type: String(headers["content-type"] ?? "").toLowerCase() };
-      const mime = common.content_type;
-      if (response.status < 200 || response.status >= 300) return { ...common, status: "unavailable", reason: "http_status", text: null, text_sha256: null };
-      if (mime.includes("pdf") || bytes.subarray(0, 5).toString() === "%PDF-") return { ...common, status: "unavailable", reason: "pdf_parser_unavailable", text: null, text_sha256: null };
-      if (!(mime.startsWith("text/") || mime.includes("xhtml"))) return { ...common, status: "unavailable", reason: "unsupported_content_type", text: null, text_sha256: null };
-      const text = pageText(bytes.toString("utf8"), mime);
-      return { ...common, status: text.trim() ? "read" : "unavailable", reason: text.trim() ? null : "empty_page", text, text_sha256: sha256(text) };
-    }
-  }, timeoutMs);
-}
+// Hardware binding of the kernel public HTTPS reader (P2-13.03). Codes, User-Agent and Accept are unchanged.
+import { createPublicReader } from "../../abelien-harness/scripts/web/public-read.mjs";
+export { sha256 } from "../../abelien-harness/scripts/web/common.mjs";
+export { publicAddress, decodeHtmlEntities, pageText } from "../../abelien-harness/scripts/web/public-read.mjs";
+const reader = createPublicReader({
+  codes: { transport: "HARDWARE_WEB_TRANSPORT", dns: "HARDWARE_WEB_DNS", access: "HARDWARE_WEB_URL", redirect: "HARDWARE_WEB_PAGE", timeout: "HARDWARE_WEB_TIMEOUT",
+    url: "HARDWARE_WEB_URL", config: "HARDWARE_WEB_CONFIG", readTimeout: "HARDWARE_PUBLIC_READ_TIMEOUT" },
+  userAgent: "Abelien-Hardware-Evidence/1",
+  accept: "text/html,text/plain,application/xhtml+xml,application/pdf",
+});
+export const { publicReadFailureCodes, publicReadFailure, normalizePublicSourceUrl, validatePublicSource, fetchPublicPage } = reader;

package/skills/abelien-hardware/scripts/response-redaction.mjs

@@ -1,135 +1,6 @@
-import { createHash } from "node:crypto";
+import { redact } from "../../abelien-harness/scripts/web/redact.mjs";
 import { text } from "./web-common.mjs";
 
-// Four numbers describe a whole unchanged run or one decoded unit:
-// output start/end, original start/end. No object is allocated per character.
-function appendSpan(spans, start, end, originalStart, originalEnd) {
-  if (start === end) return;
-  const last = spans.length - 4;
-  if (last >= 0 && spans[last + 1] === start && spans[last + 3] === originalStart &&
-      spans[last + 1] - spans[last] === spans[last + 3] - spans[last + 2] &&
-      end - start === originalEnd - originalStart) {
-    spans[last + 1] = end; spans[last + 3] = originalEnd; return;
-  }
-  spans.push(start, end, originalStart, originalEnd);
-}
-function spanAt(spans, index) {
-  let low = 0, high = spans.length / 4 - 1;
-  while (low <= high) {
-    const middle = (low + high) >>> 1, offset = middle * 4;
-    if (index < spans[offset]) high = middle - 1;
-    else if (index >= spans[offset + 1]) low = middle + 1;
-    else return offset;
-  }
-  throw new Error("Redaction span missing");
-}
-function originalRange(projection, start, end) {
-  const spans = projection.spans, first = spanAt(spans, start), last = spanAt(spans, end - 1);
-  const from = spans[first + 1] - spans[first] === spans[first + 3] - spans[first + 2]
-    ? spans[first + 2] + start - spans[first] : spans[first + 2];
-  const to = spans[last + 1] - spans[last] === spans[last + 3] - spans[last + 2]
-    ? spans[last + 2] + end - spans[last] : spans[last + 3];
-  return [from, to];
-}
-function copyRange(projection, start, end, spans, output) {
-  if (start === end) return output;
-  const source = projection.spans;
-  for (let offset = spanAt(source, start); start < end; offset += 4) {
-    const stop = Math.min(end, source[offset + 1]);
-    const linear = source[offset + 1] - source[offset] === source[offset + 3] - source[offset + 2];
-    const from = linear ? source[offset + 2] + start - source[offset] : source[offset + 2];
-    const to = linear ? source[offset + 2] + stop - source[offset] : source[offset + 3];
-    appendSpan(spans, output, output + stop - start, from, to);
-    output += stop - start; start = stop;
-  }
-  return output;
-}
-function percentLayer(projection) {
-  const value = projection.value, chunks = [], spans = [];
-  let cursor = 0, output = 0, changed = false;
-  for (let index = value.indexOf("%"); index !== -1; index = value.indexOf("%", index + 1)) {
-    let encoded = "", decoded = null, size = 0;
-    // UTF-8 has at most four bytes per scalar; malformed units stay intact.
-    for (let bytes = 1; bytes <= 4; bytes++) {
-      const part = value.slice(index + (bytes - 1) * 3, index + bytes * 3);
-      if (!/^%[0-9a-f]{2}$/i.test(part)) break;
-      encoded += part;
-      try { decoded = decodeURIComponent(encoded); size = bytes * 3; break; } catch { /* Try this scalar's remaining bytes. */ }
-    }
-    if (decoded === null) continue;
-    chunks.push(value.slice(cursor, index), decoded);
-    output = copyRange(projection, cursor, index, spans, output);
-    const [from, to] = originalRange(projection, index, index + size);
-    appendSpan(spans, output, output + decoded.length, from, to); output += decoded.length;
-    cursor = index + size; index = cursor - 1; changed = true;
-  }
-  if (!changed) return null;
-  chunks.push(value.slice(cursor)); copyRange(projection, cursor, value.length, spans, output);
-  return { value: chunks.join(""), spans };
-}
-function* jsonChildren(projection) {
-  const value = projection.value, tokenPattern = /"(?:\\.|[^"\\])*"/y;
-  let coveredUntil = -1;
-  // Every possible start remains eligible, including a preceding token's closing
-  // quote. Interior escaped starts in a valid decoded child are already covered
-  // by that child's traversal; avoid materializing all of its overlapping suffixes.
-  for (let start = value.indexOf('"'); start !== -1; start = value.indexOf('"', start + 1)) {
-    if (start < coveredUntil) continue;
-    tokenPattern.lastIndex = start;
-    const match = tokenPattern.exec(value); if (!match) continue;
-    const token = match[0], end = start + token.length - 1;
-    // Removing quotes without decoding changes neither matches nor percent units.
-    // The parent already covers that identity projection.
-    if (!token.includes("\\")) continue;
-    let decoded; try { decoded = JSON.parse(token); } catch { continue; }
-    coveredUntil = end;
-    const spans = []; let cursor = start + 1, output = 0;
-    for (let escape = value.indexOf("\\", cursor); escape !== -1 && escape < end; escape = value.indexOf("\\", cursor)) {
-      output = copyRange(projection, cursor, escape, spans, output);
-      const size = value[escape + 1] === "u" ? 6 : 2;
-      const unit = JSON.parse('"' + value.slice(escape, escape + size) + '"');
-      const [from, to] = originalRange(projection, escape, escape + size);
-      appendSpan(spans, output, output + unit.length, from, to); output += unit.length;
-      cursor = escape + size;
-    }
-    copyRange(projection, cursor, end, spans, output);
-    if (decoded.length) yield { value: decoded, spans };
-  }
-}
-function identity(projection) {
-  // Fixed-size memo entries, with UTF-16 preserving even lone-surrogate spelling.
-  const spans = Float64Array.from(projection.spans);
-  return createHash("sha256").update(String(projection.value.length) + ":").update(Buffer.from(projection.value, "utf16le"))
-    .update(Buffer.from(spans.buffer)).digest("hex");
-}
-function redact(raw, keys) {
-  if (!keys.length) return raw;
-  if (!raw.includes("%") && !raw.includes("\\")) return keys.reduce((value, key) => value.split(key).join("[redacted]"), raw);
-  const ranges = [], seen = new Set(), stack = [{ projection: { value: raw, spans: raw.length ? [0, raw.length, 0, raw.length] : [] } }];
-  while (stack.length) {
-    const frame = stack[stack.length - 1], projection = frame.projection;
-    if (!frame.children) {
-      const memo = identity(projection); if (seen.has(memo)) { stack.pop(); continue; } seen.add(memo);
-      for (const key of keys) for (let index = projection.value.indexOf(key); index !== -1; index = projection.value.indexOf(key, index + 1)) {
-        const [start, end] = originalRange(projection, index, index + key.length); ranges.push({ start, end });
-      }
-      frame.children = jsonChildren(projection);
-    }
-    const next = frame.children.next();
-    if (!next.done) { stack.push({ projection: next.value }); continue; }
-    // A percent layer is a tail transition, releasing its finished parent instead
-    // of retaining an eager queue of full bodies. JSON children are visited lazily.
-    const percent = percentLayer(projection); stack.pop(); if (percent) stack.push({ projection: percent });
-  }
-  let result = "", start = 0, end = 0;
-  for (const range of ranges.sort((a, b) => a.start - b.start || b.end - a.end)) {
-    if (range.start < end) { end = Math.max(end, range.end); continue; }
-    if (end > start) { result += "[redacted]"; start = end; }
-    result += raw.slice(start, range.start); start = range.start; end = range.end;
-  }
-  if (end > start) { result += "[redacted]"; start = end; }
-  return result + raw.slice(start);
-}
 export function redactHardwareResponse(raw, env = {}) {
   const keys = [...new Set([env.PRISMER_API_KEY, env.WEB_SEARCH_API_KEY].filter(text))].sort((a, b) => b.length - a.length);
   return redact(raw, keys);