agentera 3.0.0-dev.41 → 3.0.0-dev.46

package/dist/registries/packagePublication.js

@@ -0,0 +1,229 @@
+import fs from "node:fs";
+import path from "node:path";
+export const ACTIVATION_CLASSES = [
+    "cli", "capability", "runtime", "reference", "state", "package", "bootstrap",
+];
+export const ACTIVATION_DIMENSIONS = [
+    "discovery", "behavior", "diagnostics", "package_projection", "instructions", "adversarial",
+];
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+/** Code-owned identity that the publication document must project exactly. */
+export const ACTIVATION_CLASS_AUTHORITIES = deepFreeze({
+    cli: {
+        path: "packages/cli/src/cli/dispatch/commands.ts", symbol: "DISPATCHER_TOP_LEVEL_COMMANDS",
+        correction: "pnpm -C packages/cli test:source -- test/cli/activationConjunction.test.ts",
+    },
+    capability: {
+        path: "packages/cli/src/capabilities/index.ts", symbol: "CAPABILITY_INSTRUCTIONS",
+        correction: "pnpm -C packages/cli test:source -- test/cli/activationConjunction.test.ts",
+    },
+    runtime: {
+        path: "packages/cli/src/runtime/lifecycleAuthority.ts", symbol: "loadLifecycleAuthority",
+        correction: "pnpm -C packages/cli test:source -- test/runtime/runtimeLifecycle.test.ts",
+    },
+    reference: {
+        path: "packages/cli/src/validate/retainedReferenceAuthority.ts", symbol: "validateRetainedReferenceAuthority",
+        correction: "node packages/cli/dist/bin/agentera.js check validate retained-references --format json",
+    },
+    state: {
+        path: "packages/cli/src/state/write/runtimeOperations.ts", symbol: "runtimeOperationSpecs",
+        correction: "node packages/cli/dist/bin/agentera.js check validate state --format json",
+    },
+    package: {
+        path: "packages/cli/src/registries/packageRegistry.ts", symbol: "loadRegistry",
+        correction: "pnpm -C packages/cli run verify:package",
+    },
+    bootstrap: {
+        path: "packages/cli/src/validate/bootstrapAuthority.ts", symbol: "bootstrapMatrixAuthority",
+        correction: "pnpm -C packages/cli test:source -- test/cli/runtimeBootstrapMatrix.test.ts",
+    },
+});
+/** SHA-256 uses the sorted exact UTF-8 identities joined by one LF byte. */
+export const ACTIVATION_CENSUS_AUTHORITY = deepFreeze({
+    algorithm: "sha256(sorted_utf8_ids_joined_by_lf)",
+    classes: {
+        cli: { count: 27, sha256: "986a637f5c11c57ab7a897a01bd291d0811846e5339c3831c715932cf9659ad4" },
+        capability: { count: 12, sha256: "007e1157a892fec54182b1803aeaa442cf8e2e332e6a055c3bd020e2b0731867" },
+        runtime: { count: 81, sha256: "03fe600a3a27f05daf0d1b59c16b00bedc354a13c70ea60be0b457175fdf743c" },
+        reference: { count: 22, sha256: "2b48c82bb7ee10388d9ebb4fa7ea3743ea82a7e9aaedfcd5a858eeedb9d891ae" },
+        state: { count: 36, sha256: "a9f371e2f6d49e7cb890767d7dfe26edee11d4a7d28ee35ab6c491c0abafbbf0" },
+        package: { count: 66, sha256: "3548af7e84151c90690a6eb3d1cb6c7847f39b290161ecab599d8cb1bf0d2cb0" },
+        bootstrap: { count: 34, sha256: "71c2038744e2518a6adb722acbb5f9352bddfb5d1c92eeb0e347297ef2ca2f1e" },
+    },
+    total: { count: 278, sha256: "5767645b4d78d8716e7ea1a283125bcfd43e13634311b33b62bc0a307d1abdb3" },
+});
+/** Each dimension names the production contract it observes independently. */
+export const ACTIVATION_EVIDENCE_SOURCES = deepFreeze({
+    cli: { discovery: "cli.dispatcher-inventory", behavior: "cli.dispatch-handler-registry", diagnostics: "cli.command-diagnostic-registry", package_projection: "cli.schema-dispatcher-projection", instructions: "cli.public-help-declaration", adversarial: "cli.invalid-shape-command-authority" },
+    capability: { discovery: "capability.instruction-registry", behavior: "capability.route-handler-registry", diagnostics: "capability.schema-contract-directories", package_projection: "capability.packaged-registry-projection", instructions: "capability.served-instruction-targets", adversarial: "capability.registry-schema-closure" },
+    runtime: { discovery: "runtime.lifecycle-retirement-loader", behavior: "runtime.cleanup-behavior-records", diagnostics: "runtime.retired-diagnostic-expansion", package_projection: "runtime.packaged-authority-loaders", instructions: "runtime.lifecycle-declaration-records", adversarial: "runtime.retirement-shape-authority" },
+    reference: { discovery: "reference.retained-inventory", behavior: "reference.production-consumers", diagnostics: "reference.authority-entry-validation", package_projection: "reference.packaged-retained-inventory", instructions: "reference.consumer-runbook-contracts", adversarial: "reference.owner-command-shape-authority" },
+    state: { discovery: "state.read-write-runtime-registries", behavior: "state.read-write-dispatch-contracts", diagnostics: "state.recovery-and-bound-contracts", package_projection: "state.schema-discovery-projections", instructions: "state.help-and-example-projections", adversarial: "state.input-and-output-bound-authorities" },
+    package: { discovery: "package.registry-surface-records", behavior: "package.construction-classification-records", diagnostics: "package.generated-surface-classifications", package_projection: "package.packaged-registry-projection", instructions: "package.identity-and-selector-contracts", adversarial: "package.selector-shape-authority" },
+    bootstrap: { discovery: "bootstrap.matrix-axis-registry", behavior: "bootstrap.acceptance-execution-specs", diagnostics: "bootstrap.rejection-classification-specs", package_projection: "bootstrap.packaged-matrix-authority", instructions: "bootstrap.state-applicability-contracts", adversarial: "bootstrap.invalid-command-classification-authority" },
+});
+export const ACTIVATION_CHECK_IDS = Object.freeze(ACTIVATION_CLASSES.flatMap((classId) => ACTIVATION_DIMENSIONS.map((dimension) => `${classId}.${dimension}`)));
+export const SOURCE_GATE_IDS = [
+    "source", "stress", "performance", "package", "generated-overlap", "typecheck", "build",
+    "compact", "capability-contract", "activation-conjunction",
+];
+export const SOURCE_DAG_PHASES = {
+    batchA: ["generated-overlap", "stress", "typecheck"],
+    performanceBarrier: ["performance"],
+    barrierB: ["compact", "capability-contract", "activation-conjunction"],
+    generatedOverlapOrigins: ["source", "package", "build", "generated-overlap"],
+};
+const EXACT_COMMANDS = {
+    source: ["pnpm", "-C", "packages/cli", "run", "test:source"],
+    stress: ["pnpm", "-C", "packages/cli", "run", "test:stress"],
+    performance: ["pnpm", "-C", "packages/cli", "run", "test:performance"],
+    package: ["pnpm", "-C", "packages/cli", "run", "verify:package"],
+    "generated-overlap": ["pnpm", "-C", "packages/cli", "run", "verify:generated-overlap"],
+    typecheck: ["pnpm", "-C", "packages/cli", "run", "typecheck"],
+    build: ["pnpm", "-C", "packages/cli", "build"],
+    compact: ["node", "packages/cli/dist/bin/agentera.js", "check", "compact"],
+    "capability-contract": ["node", "packages/cli/dist/bin/agentera.js", "check", "validate", "capability-contract", "--format", "json"],
+    "activation-conjunction": ["node", "packages/cli/dist/bin/agentera.js", "check", "validate", "activation-conjunction", "--format", "json"],
+};
+function fail(message) { throw new Error(`package publication contract: ${message}`); }
+function exactList(value, expected, label) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))
+        fail(`${label} must be a string list`);
+    if (value.length !== new Set(value).size)
+        fail(`${label} contains duplicates`);
+    if (value.length !== expected.length || value.some((entry, index) => entry !== expected[index]))
+        fail(`${label} must exactly match governed order`);
+    return [...value];
+}
+function positiveInteger(value, label, maximum = 1_000_000) {
+    if (!Number.isSafeInteger(value) || value <= 0 || value > maximum)
+        fail(`${label} must be a bounded positive integer`);
+    return value;
+}
+function boundedText(value, label, maximum, grammar) {
+    if (typeof value !== "string" || value.length === 0 || value.length > maximum || !grammar.test(value))
+        fail(`${label} is invalid`);
+    return value;
+}
+function exactCommand(value, expected, label) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > 12)
+        fail(`${label} must be a bounded nonempty command`);
+    const command = value.map((token, index) => boundedText(token, `${label}[${index}]`, 160, /^[^\s\0-\x1f\x7f]+$/));
+    if (command.length !== expected.length || command.some((token, index) => token !== expected[index]))
+        fail(`${label} does not match its governed command`);
+    return command;
+}
+function exactCensusIdentity(value, expected, label) {
+    if (!value || Object.keys(value).sort().join("\0") !== "count\0sha256")
+        fail(`${label} must contain exact count and sha256 fields`);
+    if (value.count !== expected.count || value.sha256 !== expected.sha256) {
+        fail(`${label} must equal count ${expected.count} and sha256 ${expected.sha256}`);
+    }
+    return { count: expected.count, sha256: expected.sha256 };
+}
+/** Validate the sole publication authority against behavior-owned exact sets and grammar. */
+export function validatePackagePublicationDocument(raw) {
+    if (raw?.schemaVersion !== "agentera.packagePublication.v2")
+        fail("schemaVersion is invalid");
+    const source = raw?.qualification?.source;
+    const activation = source?.activationConjunction;
+    if (!source || !activation || activation.gateIdentity !== "agentera.activationConjunction.v1")
+        fail("source activation conjunction is missing or invalid");
+    if (!Array.isArray(source.gates) || source.gates.length !== SOURCE_GATE_IDS.length)
+        fail("source gates must contain exactly ten entries");
+    const sourceGates = source.gates.map((gate, index) => {
+        const name = SOURCE_GATE_IDS[index];
+        if (!gate || gate.name !== name)
+            fail(`source gate ${index} must be '${name}'`);
+        const command = exactCommand(gate.command, EXACT_COMMANDS[name], `gate ${name} command`);
+        const owner = boundedText(gate.owner, `gate ${name} owner`, 240, /^packages\/cli\/(?:src\/.+\.ts|scripts\/.+\.mjs|package\.json)#[A-Za-z0-9_.-]+$/);
+        const correction = boundedText(gate.correction, `gate ${name} correction`, 320, /^(?:pnpm|node) [^\0\r\n]+$/);
+        if (correction !== command.join(" "))
+            fail(`gate ${name} correction must equal its command`);
+        return { name, command, owner, correction };
+    });
+    const dag = source.dag;
+    const batchA = exactList(dag?.batchA, SOURCE_DAG_PHASES.batchA, "source batch A");
+    const performanceBarrier = exactList(dag?.performanceBarrier, SOURCE_DAG_PHASES.performanceBarrier, "source performance barrier");
+    const barrierB = exactList(dag?.barrierB, SOURCE_DAG_PHASES.barrierB, "source barrier B");
+    const generatedOverlapOrigins = exactList(dag?.generatedOverlapOrigins, SOURCE_DAG_PHASES.generatedOverlapOrigins, "generated overlap origins");
+    const phases = [...batchA, ...performanceBarrier, ...barrierB];
+    if (phases.length !== new Set(phases).size)
+        fail("source execution phases must be disjoint");
+    const scheduled = new Set([...phases, ...generatedOverlapOrigins]);
+    if (scheduled.size !== SOURCE_GATE_IDS.length || SOURCE_GATE_IDS.some((name) => !scheduled.has(name)))
+        fail("source schedule must cover every gate exactly through its declared origin");
+    const minimumExecutionWindowMs = {};
+    if (!dag?.minimumExecutionWindowMs || Object.keys(dag.minimumExecutionWindowMs).length !== barrierB.length)
+        fail("barrier B minimum execution windows must exactly match barrier B");
+    for (const name of barrierB)
+        minimumExecutionWindowMs[name] = positiveInteger(dag.minimumExecutionWindowMs[name], `${name} minimum execution window`, 120_000);
+    const classes = exactList(activation.classes, ACTIVATION_CLASSES, "activation classes");
+    const dimensions = exactList(activation.dimensions, ACTIVATION_DIMENSIONS, "activation dimensions");
+    const checkIds = exactList(activation.checkIds, ACTIVATION_CHECK_IDS, "activation check IDs");
+    if (!activation.owners || Object.keys(activation.owners).join("\0") !== classes.join("\0"))
+        fail("activation owners must exactly match ordered classes");
+    const owners = {};
+    for (const classId of classes) {
+        const owner = activation.owners[classId];
+        if (!owner)
+            fail(`activation owner '${classId}' is missing`);
+        const canonical = ACTIVATION_CLASS_AUTHORITIES[classId];
+        const expectedFields = ["path", "symbol", ...(canonical.selector ? ["selector"] : []), "correction"].sort();
+        if (Object.keys(owner).sort().join("\0") !== expectedFields.join("\0")
+            || owner.path !== canonical.path
+            || owner.symbol !== canonical.symbol
+            || owner.selector !== canonical.selector
+            || owner.correction !== canonical.correction) {
+            fail(`activation owner '${classId}' must equal ${canonical.path}#${canonical.selector ?? canonical.symbol}; correction: ${canonical.correction}`);
+        }
+        owners[classId] = {
+            path: boundedText(owner.path, `${classId} owner path`, 240, /^packages\/cli\/(?:src\/.+\.ts|scripts\/.+\.mjs)$/),
+            symbol: boundedText(owner.symbol, `${classId} owner symbol`, 120, /^[A-Za-z_$][A-Za-z0-9_.$-]*$/),
+            ...(owner.selector ? { selector: boundedText(owner.selector, `${classId} owner selector`, 240, /^[^\0\r\n]+$/) } : {}),
+            correction: boundedText(owner.correction, `${classId} correction`, 320, /^(?:pnpm|node) [^\0\r\n]+$/),
+        };
+    }
+    const census = activation.census;
+    if (!census || Object.keys(census).sort().join("\0") !== "algorithm\0classes\0total"
+        || census.algorithm !== ACTIVATION_CENSUS_AUTHORITY.algorithm)
+        fail("activation census authority is missing or invalid");
+    if (!census.classes || Object.keys(census.classes).join("\0") !== classes.join("\0"))
+        fail("activation census classes must exactly match ordered classes");
+    const censusClasses = {};
+    for (const classId of classes) {
+        censusClasses[classId] = exactCensusIdentity(census.classes[classId], ACTIVATION_CENSUS_AUTHORITY.classes[classId], `activation census '${classId}'`);
+    }
+    const censusTotal = exactCensusIdentity(census.total, ACTIVATION_CENSUS_AUTHORITY.total, "activation census total");
+    const boundNames = ["maxRows", "maxViolations", "maxDiagnosticCharacters", "maxOutputBytes", "maxGenerationIdCharacters", "maxPathCharacters", "maxSymbolCharacters", "maxSelectorCharacters", "maxCorrectionCharacters", "maxCheckIdCharacters", "maxSurfaceIdCharacters"];
+    if (!activation.bounds || Object.keys(activation.bounds).sort().join("\0") !== [...boundNames].sort().join("\0"))
+        fail("activation bounds must contain the exact governed fields");
+    const bounds = Object.fromEntries(boundNames.map((name) => [name, positiveInteger(activation.bounds[name], `activation bounds.${name}`, name === "maxOutputBytes" ? 262_144 : 100_000)]));
+    if (bounds.maxOutputBytes > 196_608)
+        fail("activation output bound must retain 25 percent headroom");
+    return {
+        sourceGates,
+        sourceDag: {
+            batchA, performanceBarrier, barrierB, generatedOverlapOrigins,
+            overlapCleanupMarginMs: positiveInteger(dag.overlapCleanupMarginMs, "overlap cleanup margin", 60_000),
+            overlapParentReconciliationMarginMs: positiveInteger(dag.overlapParentReconciliationMarginMs, "parent reconciliation margin", 60_000),
+            minimumExecutionWindowMs,
+        },
+        sourceQualificationMs: positiveInteger(raw?.benchmark?.timeouts?.sourceQualificationMs, "source qualification timeout", 900_000),
+        activationConjunction: {
+            gateIdentity: activation.gateIdentity, classes, dimensions, checkIds, bounds, owners,
+            census: { algorithm: ACTIVATION_CENSUS_AUTHORITY.algorithm, classes: censusClasses, total: censusTotal },
+        },
+    };
+}
+export function loadPackagePublicationModel(root) {
+    const file = path.join(root, "references/adapters/package-publication.json");
+    return validatePackagePublicationDocument(JSON.parse(fs.readFileSync(file, "utf8")));
+}

package/dist/registries/packageRegistry.js

@@ -10,6 +10,7 @@ export const REQUIRED_GROUPS = [
     "version_authority",
     "version_surfaces",
     "bundle_surfaces",
+    "bootstrap_command_authority",
     "docs_targets",
     "release_policy",
 ];
@@ -23,6 +24,7 @@ const REQUIRED_FIELDS = {
     ],
     version_surfaces: ["surfaces"],
     bundle_surfaces: ["directories", "files", "generated_files", "skip_parts", "skip_suffixes"],
+    bootstrap_command_authority: ["scanned_formats", "scalar_classifications", "emitted_producers", "constructor_non_producers"],
     docs_targets: ["version_files_source", "version_files", "index_targets"],
     release_policy: [
         "semver_policy_source",
@@ -32,7 +34,7 @@ const REQUIRED_FIELDS = {
 };
 const CONSUMER_GROUPS = {
     validator: ["identity", "version_authority", "version_surfaces"],
-    upgrade: ["identity", "version_authority", "bundle_surfaces"],
+    upgrade: ["identity", "version_authority", "bundle_surfaces", "bootstrap_command_authority"],
     docs: ["identity", "version_authority", "docs_targets", "release_policy"],
     tests: REQUIRED_GROUPS,
 };
@@ -258,6 +260,9 @@ function validateGroup(prefix, group, value, root) {
         case "bundle_surfaces":
             errors.push(...validateBundleSurfaces(prefix, value));
             break;
+        case "bootstrap_command_authority":
+            errors.push(...validateBootstrapCommandAuthority(prefix, value, root));
+            break;
         case "docs_targets":
             errors.push(...validateDocsTargets(prefix, value, root));
             break;
@@ -360,6 +365,118 @@ function validateBundleSurfaces(prefix, value) {
             errors.push(`${prefix}.${field} must be a list of strings`);
         }
     }
+    const generated = value.generated_files;
+    if (!Array.isArray(generated)) {
+        errors.push(`${prefix}.generated_files must be a list`);
+    }
+    else {
+        generated.forEach((entry, index) => {
+            const entryPrefix = `${prefix}.generated_files[${index}]`;
+            if (!isMapping(entry)) {
+                errors.push(`${entryPrefix} must be an object`);
+                return;
+            }
+            errors.push(...validateRequiredObjectFields(entryPrefix, entry, ["id", "path", "format", "classification", "command_authority_reason"]));
+            errors.push(...validateBundlePath(entryPrefix, entry.id, entry.path));
+            if (typeof entry.id === "string" && entry.id) {
+                const previous = ids.get(entry.id);
+                if (previous)
+                    errors.push(`${entryPrefix}.id ${JSON.stringify(entry.id)} duplicates ${previous}.id; correction: use a unique id across all bundle surfaces`);
+                else
+                    ids.set(entry.id, entryPrefix);
+            }
+            if (typeof entry.path === "string" && entry.path) {
+                const previous = paths.get(entry.path);
+                if (previous)
+                    errors.push(`${entryPrefix}.path ${JSON.stringify(entry.path)} for id ${JSON.stringify(entry.id)} duplicates ${previous}.path; correction: use a unique path across all bundle surfaces`);
+                else
+                    paths.set(entry.path, entryPrefix);
+            }
+            if (entry.format !== "json")
+                errors.push(`${entryPrefix}.format must be json`);
+            if (entry.classification !== "active")
+                errors.push(`${entryPrefix}.classification must be active`);
+            if (typeof entry.command_authority_reason !== "string" || !entry.command_authority_reason) {
+                errors.push(`${entryPrefix}.command_authority_reason must be a non-empty string`);
+            }
+        });
+    }
+    return errors;
+}
+function validateBootstrapCommandAuthority(prefix, value, root) {
+    const errors = [];
+    const formats = value.scanned_formats;
+    if (!Array.isArray(formats) || !formats.every((item) => typeof item === "string") || new Set(formats).size !== 3 || !["markdown", "yaml", "json"].every((format) => formats.includes(format))) {
+        errors.push(`${prefix}.scanned_formats must contain exactly markdown, yaml, and json`);
+    }
+    for (const field of ["emitted_producers", "constructor_non_producers"]) {
+        const entries = value[field];
+        if (!Array.isArray(entries)) {
+            errors.push(`${prefix}.${field} must be a list`);
+            continue;
+        }
+        const paths = new Set();
+        entries.forEach((entry, index) => {
+            const entryPrefix = `${prefix}.${field}[${index}]`;
+            if (!isMapping(entry)) {
+                errors.push(`${entryPrefix} must be an object`);
+                return;
+            }
+            errors.push(...validateRequiredObjectFields(entryPrefix, entry, ["path", "reason"]));
+            errors.push(...validateRepoPath(`${entryPrefix}.path`, entry.path, root));
+            if (typeof entry.reason !== "string" || !entry.reason)
+                errors.push(`${entryPrefix}.reason must be a non-empty string`);
+            if (typeof entry.path === "string") {
+                if (paths.has(entry.path))
+                    errors.push(`${entryPrefix}.path duplicates ${JSON.stringify(entry.path)}`);
+                paths.add(entry.path);
+            }
+        });
+    }
+    const classifications = value.scalar_classifications;
+    if (!Array.isArray(classifications)) {
+        errors.push(`${prefix}.scalar_classifications must be a list`);
+    }
+    else {
+        const identities = new Set();
+        const reasons = new Set();
+        classifications.forEach((entry, index) => {
+            const entryPrefix = `${prefix}.scalar_classifications[${index}]`;
+            if (!isMapping(entry)) {
+                errors.push(`${entryPrefix} must be an object`);
+                return;
+            }
+            errors.push(...validateRequiredObjectFields(entryPrefix, entry, [
+                "path",
+                "region",
+                "category",
+                "classification",
+                "normalized_sha256",
+                "reason",
+            ]));
+            errors.push(...validateRepoPath(`${entryPrefix}.path`, entry.path, root));
+            if (typeof entry.region !== "string" || !entry.region)
+                errors.push(`${entryPrefix}.region must be a non-empty string`);
+            if (!["identity_only", "argument_bearing", "other_vocabulary"].includes(String(entry.category)))
+                errors.push(`${entryPrefix}.category is invalid`);
+            if (!["bounded_descriptive", "exact_exemption"].includes(String(entry.classification)))
+                errors.push(`${entryPrefix}.classification is invalid`);
+            if (typeof entry.normalized_sha256 !== "string" || !/^[a-f0-9]{64}$/u.test(entry.normalized_sha256))
+                errors.push(`${entryPrefix}.normalized_sha256 must be lowercase SHA-256`);
+            if (typeof entry.reason !== "string" || !entry.reason)
+                errors.push(`${entryPrefix}.reason must be a non-empty string`);
+            else if (reasons.has(entry.reason))
+                errors.push(`${entryPrefix}.reason duplicates another scalar-specific reason`);
+            else
+                reasons.add(entry.reason);
+            if (typeof entry.path === "string" && typeof entry.region === "string") {
+                const identity = `${entry.path}\u0000${entry.region}`;
+                if (identities.has(identity))
+                    errors.push(`${entryPrefix} duplicates path and region ${JSON.stringify(entry.path)} ${JSON.stringify(entry.region)}`);
+                identities.add(identity);
+            }
+        });
+    }
     return errors;
 }
 function validateBundlePath(prefix, id, value) {
@@ -498,4 +615,3 @@ function validateForbiddenFields(prefix, value) {
     }
     return errors;
 }
-//# sourceMappingURL=packageRegistry.js.map

package/dist/registries/todoReadinessContract.js

@@ -446,4 +446,3 @@ export function loadTodoReadinessContract(todoSchemaPath = path.join(resolveSour
         ordering: readiness.ordering,
     };
 }
-//# sourceMappingURL=todoReadinessContract.js.map

package/dist/registries/triggerLoader.js

@@ -172,4 +172,3 @@ export function loadTriggerModel(contract, options = {}) {
     }
     return { capabilities: model };
 }
-//# sourceMappingURL=triggerLoader.js.map

package/dist/registries/verbosityBudgetContract.js

@@ -203,4 +203,3 @@ export function validateVerbosityBudgetContract(contractPath = verbosityBudgetAu
     }
     return errors;
 }
-//# sourceMappingURL=verbosityBudgetContract.js.map

package/dist/release/releaseMetadata.js

@@ -32,6 +32,12 @@ export const RELEASE_PROVENANCE_EXCLUSIONS = [
     "packages/cli/src/release/releaseMetadata.ts",
     "references/adapters/package-surface-characterization.md",
 ];
+export const STABLE_SHIM_PROVENANCE_PATHS = [
+    "packages/cli/shim/bin",
+    "packages/cli/shim/lib",
+    "packages/cli/shim/README.md",
+    "packages/cli/shim/LICENSE",
+];
 const SEMVER_CORE_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const SEMVER_STRICT_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 const PRE_RELEASE_RE = /-(.+)$/;
@@ -107,6 +113,53 @@ function validateGitRefProvenance(root, gitRef) {
     }
     return [];
 }
+export function validateStableShimGitRefProvenance(root, gitRef) {
+    const manifestPath = "packages/cli/shim/package.json";
+    const inside = runGit(root, ["rev-parse", "--is-inside-work-tree"]);
+    if (inside.status !== 0 || String(inside.stdout).trim() !== "true")
+        return [];
+    const commit = runGit(root, ["cat-file", "-e", `${gitRef}^{commit}`]);
+    if (commit.status !== 0) {
+        return [`${manifestPath}: agentera.gitRef ${JSON.stringify(gitRef)} is not a commit in the local repository`];
+    }
+    const diff = runGit(root, ["diff", "--quiet", gitRef, "--", ...STABLE_SHIM_PROVENANCE_PATHS]);
+    if (diff.status !== 0) {
+        return [
+            `${manifestPath}: agentera.gitRef ${JSON.stringify(gitRef)} does not match the stable shim packaged inputs; ` +
+                "select the last substantive shim-source commit",
+        ];
+    }
+    const status = runGit(root, [
+        "status",
+        "--porcelain=v1",
+        "--untracked-files=all",
+        "--",
+        manifestPath,
+        ...STABLE_SHIM_PROVENANCE_PATHS,
+    ]);
+    if (status.status !== 0 || String(status.stdout).trim() !== "") {
+        return [
+            `${manifestPath}: stable shim packaged inputs have uncommitted or untracked changes outside approved release metadata`,
+        ];
+    }
+    const selected = runGit(root, ["show", `${gitRef}:${manifestPath}`]);
+    const current = readJson(path.join(root, manifestPath));
+    try {
+        const selectedManifest = JSON.parse(String(selected.stdout));
+        if (selected.status !== 0 ||
+            current === null ||
+            !isDeepStrictEqual(normalizedPackageMetadata(selectedManifest), normalizedPackageMetadata(current))) {
+            return [
+                `${manifestPath}: package contract differs from agentera.gitRef ${JSON.stringify(gitRef)} ` +
+                    "outside the permitted version and gitRef fields",
+            ];
+        }
+    }
+    catch {
+        return [`${manifestPath}: unable to read package contract from agentera.gitRef ${JSON.stringify(gitRef)}`];
+    }
+    return [];
+}
 function readRegistryVersion(root) {
     const source = "registry.json";
     const data = readJson(path.join(root, source));
@@ -210,7 +263,21 @@ export function readReleaseMetadata(root = rootDefault()) {
  * Validate release-metadata coherence. Returns an empty array when the
  * source-tree version surfaces agree on a single release train.
  */
-export function validateReleaseMetadata(root = rootDefault()) {
+export function validateReleaseMetadata(root = rootDefault(), adapter = "development") {
+    if (adapter === "stable") {
+        const manifestPath = "packages/cli/shim/package.json";
+        const shim = readJson(path.join(resolvePath(root), manifestPath));
+        if (shim === null)
+            return [`${manifestPath}: missing or unreadable; cannot validate release-metadata`];
+        const agentera = shim.agentera;
+        const gitRef = agentera && typeof agentera === "object" && !Array.isArray(agentera)
+            ? agentera.gitRef
+            : null;
+        if (typeof gitRef !== "string" || !GIT_REF_HEX_RE.test(gitRef)) {
+            return [`${manifestPath}: agentera.gitRef must be a 40-character hex SHA for stable shim provenance`];
+        }
+        return validateStableShimGitRefProvenance(resolvePath(root), gitRef);
+    }
     const errors = [];
     const snap = readReleaseMetadata(root);
     const rootLabel = path.basename(resolvePath(root)) || "repo root";
@@ -306,7 +373,7 @@ export function releaseMetadataMain(opts = {}) {
     const root = resolvePath(opts.root ?? rootDefault());
     const out = opts.out ?? ((line) => process.stdout.write(line + "\n"));
     const err = opts.err ?? ((line) => process.stderr.write(line + "\n"));
-    const errors = validateReleaseMetadata(root);
+    const errors = validateReleaseMetadata(root, opts.adapter);
     if (errors.length > 0) {
         out("release-metadata validation failed:");
         for (const message of errors)
@@ -316,4 +383,3 @@ export function releaseMetadataMain(opts = {}) {
     out("release-metadata ok");
     return 0;
 }
-//# sourceMappingURL=releaseMetadata.js.map

package/dist/runtime/lifecycleAdapterContract.js

@@ -455,4 +455,3 @@ export function validateRuntimeLifecycleAdapterContractRoot(root = resolveSource
         ];
     }
 }
-//# sourceMappingURL=lifecycleAdapterContract.js.map

package/dist/runtime/lifecycleAdapters.js

@@ -775,4 +775,3 @@ export function inspectRuntimeLifecycleAdapters(context, contract = loadRuntimeL
 export function applyRuntimeAdapterRepair(report, options = {}) {
     return applyLifecycleOperations(report.repairPlan, options);
 }
-//# sourceMappingURL=lifecycleAdapters.js.map

package/dist/runtime/lifecycleAuthority.js

@@ -451,4 +451,3 @@ export function buildRuntimeLifecycleState(authority, observations) {
 export function isLifecycleEvidenceValue(value) {
     return EVIDENCE_VALUES.has(value);
 }
-//# sourceMappingURL=lifecycleAuthority.js.map

package/dist/runtime/lifecycleOperationContract.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { resolveSourceRoot } from "../core/sourceRoot.js";
 import { loadYamlMapping } from "../core/yaml.js";
 import { LIFECYCLE_APPLY_STATUSES, LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH, LIFECYCLE_PLAN_ACTIONS, LIFECYCLE_RESOURCE_STATES, } from "./lifecycleOperations.js";
 function sameList(value, expected) {
@@ -97,18 +98,26 @@ export function validateLifecycleOperationContractData(value) {
     }
     return errors;
 }
+export function loadLifecycleOperationContract(contractPath = path.join(resolveSourceRoot(), LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH)) {
+    const data = loadYamlMapping(fs.readFileSync(contractPath, "utf8"));
+    const errors = validateLifecycleOperationContractData(data);
+    if (errors.length > 0) {
+        throw new Error(`Lifecycle operation contract validation failed: ${errors.join("; ")}`);
+    }
+    return data;
+}
 export function validateLifecycleOperationContractRoot(root) {
     const contractPath = path.join(root, LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH);
     if (!fs.existsSync(contractPath)) {
         return [`${LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH}:1: missing lifecycle operation contract`];
     }
     try {
-        return validateLifecycleOperationContractData(loadYamlMapping(fs.readFileSync(contractPath, "utf8"))).map((error) => `${LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH}: ${error}`);
+        loadLifecycleOperationContract(contractPath);
+        return [];
     }
     catch (error) {
         return [
-            `${LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH}: could not parse contract: ${error.message}`,
+            `${LIFECYCLE_OPERATION_CONTRACT_RELATIVE_PATH}: could not load contract: ${error.message}`,
         ];
     }
 }
-//# sourceMappingURL=lifecycleOperationContract.js.map

package/dist/runtime/lifecycleOperations.js

@@ -632,4 +632,3 @@ export function applyLifecycleOperations(plan, options = {}) {
         ownershipLedger: ledger,
     };
 }
-//# sourceMappingURL=lifecycleOperations.js.map

package/dist/runtime/lifecycleOwnershipJournal.js

@@ -620,4 +620,3 @@ export function appendLifecycleOwnershipJournal(journalPath, ledger) {
     }
     throw new Error("ownership journal remained busy after bounded append retries");
 }
-//# sourceMappingURL=lifecycleOwnershipJournal.js.map

package/dist/runtime/lifecyclePublication.js

@@ -413,4 +413,3 @@ export function removeLifecycleResource(spec, observation, hook) {
         }
     });
 }
-//# sourceMappingURL=lifecyclePublication.js.map

package/dist/runtime/lifecycleSnapshot.js

@@ -436,4 +436,3 @@ export function summarizeRuntimeLifecycle(snapshot) {
         })),
     };
 }
-//# sourceMappingURL=lifecycleSnapshot.js.map