agentera 3.0.0-dev.51 → 3.0.0-dev.69

package/dist/state/write/explain.js

@@ -7,6 +7,7 @@ import { operationSpec, mutationParityMatrix, writerOwnedFields, verbsForArtifac
 import { reject } from "./errors.js";
 import { structuredInputDescriptor, structuredInputSchemaProjection } from "./input.js";
 import { artifactSchemaFieldsForOperation } from "../../registries/artifactSchemaProjection.js";
+import { progressWriteGuidance } from "../progressWritePolicy.js";
 function defaultVerb(artifact) {
     const verb = verbsForArtifact(artifact).find((candidate) => candidate !== "explain");
     if (!verb)
@@ -148,7 +149,7 @@ export function buildExplain(artifact, projectRoot, requestedVerb) {
                     : artifact === "experiments"
                         ? ["EXPERIMENT"]
                         : artifact === "todo"
-                            ? ["TODO_PUBLIC", "TODO_OPERATIONAL"]
+                            ? verb === "correct-owners" ? ["OWNER_MAPPING"] : ["TODO_PUBLIC", "TODO_OPERATIONAL"]
                             : artifact === "progress"
                                 ? ["CYCLE", "CONTEXT", "GLOSSARY_CAVEAT"]
                                 : artifact === "decisions"
@@ -183,7 +184,13 @@ export function buildExplain(artifact, projectRoot, requestedVerb) {
             result.input_schema = { ...result.input_schema, record_fields: ["name", "depends_on", "acceptance", "evidence", "blocked_reason"] };
         if (artifact === "plan" && verb === "update")
             result.input_schema = { ...result.input_schema, record_fields: ["name", "depends_on", "acceptance", "evidence", "blocked_reason", "surprise"], clearable_patch_fields: ["depends_on", "acceptance", "evidence", "blocked_reason"] };
-        if (artifact === "todo") {
+        if (artifact === "todo" && verb === "correct-owners") {
+            result.input_schema = {
+                ...result.input_schema,
+                record_fields: ["schema_version", "owners", "owners.id", "owners.source_line"],
+            };
+        }
+        else if (artifact === "todo") {
             result.input_schema = {
                 ...result.input_schema,
                 typed_fields: ["kind", "target_version", "title", "requirements", "acceptance", "release_blocker", "severity", "readiness"],
@@ -304,6 +311,13 @@ function decisionsGuidance(artifact, verb, _entityHealth = false, entityArtifact
             "supply a reason and YYYY-MM-DD date; supersede additionally requires a distinct existing replacement ID",
             ...base,
         ];
+    if (entityArtifact && artifact === "todo" && verb === "correct-owners")
+        return [
+            "supply every canonical TODO ID with one current one-based Markdown source_line through --input",
+            "preview is read-only; apply requires the same owner mapping, its exact effect SHA-256, and --yes",
+            "the correction is available only for marker-absent unsafe-inactive state; exact replay validates the stored owner-mapping authorization",
+            ...base,
+        ];
     if (entityArtifact && artifact === "todo")
         return [
             "a bare ten-letter TODO item ID is assigned by the CLI; status starts open",
@@ -316,7 +330,7 @@ function decisionsGuidance(artifact, verb, _entityHealth = false, entityArtifact
     if (entityArtifact && artifact === "docs")
         return ["a bare ten-letter documentation inventory ID is assigned by the CLI; path remains record data", ...base];
     if (artifact === "progress" && verb === "append")
-        return ["supply one progress cycle mapping with --input PATH or --input -; the writer assigns id, artifact, and publication_order", "record content flags are retired; inspect the structured record_fields in explain before writing", ...base];
+        return [...progressWriteGuidance(), "when the policy authorizes or requires progress, supply one cycle mapping with --input PATH or --input -; the writer assigns id, artifact, and publication_order", "record content flags are retired; inspect the structured record_fields in explain before writing", ...base];
     if (artifact === "decisions" && verb === "append")
         return ["a bare ten-letter ID is assigned by the CLI; do not pass an identity", "supply one decision record mapping with --input PATH or --input -; the writer assigns id and artifact", "record content flags are retired; satisfaction remains a separate flag-only transition", ...base];
     if (artifact === "decisions" && verb === "update")

package/dist/state/write/input.js

@@ -1,6 +1,8 @@
 import fs from "node:fs";
 import { loadYamlMapping } from "../../core/yaml.js";
 import { glossaryCaveatContract } from "../../registries/glossaryCaveatContract.js";
+import { progressWritePolicy } from "../progressWritePolicy.js";
+import { todoOwnerCorrectionInputViolations } from "../todoReconciliationRepair.js";
 const caveat = glossaryCaveatContract();
 const field = (path, type, description, options = { required: false, update: "replace" }) => ({ path, type, description, ...options });
 const PROGRESS_INPUT_SCHEMA = {
@@ -31,6 +33,7 @@ const PROGRESS_INPUT_SCHEMA = {
         omitted_fields: "not present in the canonical record except writer-defaulted timestamp",
         writer_metadata: "id, artifact, and publication_order are assigned by the writer and excluded from logical replay comparison",
         glossary_caveat: "current events deduplicate by the existing caveat lifecycle contract; resolved and superseded events remain distinct",
+        progress_write_policy: progressWritePolicy(),
     },
     ownedFields: ["id", "artifact", "publication_order"],
     immutableFields: [],
@@ -120,12 +123,31 @@ const PLAN_TASK_UPDATE_INPUT_SCHEMA = {
     bounds: { max_input_utf8_bytes: 32768, max_collection_items: 1 },
     examples: ["agentera state plan update --id qjtrmnpvka --plan abcdefghij --input task-patch.yaml --format json"],
 };
+const TODO_OWNER_CORRECTION_INPUT_SCHEMA = {
+    root: "one unsafe TODO owner mapping",
+    fields: [
+        field("schema_version", "string", "Exact owner-correction input schema version.", { required: true, enum: ["agentera.todoOwnerCorrection.v1"], update: "replace" }),
+        field("owners", "list", "Complete one-to-one canonical TODO ID to current Markdown source-line mapping.", { required: true, itemType: "mapping", shape: "id:string, source_line:integer", update: "replace" }),
+        field("owners.id", "string", "Canonical bare ten-letter TODO ID claimed by this row.", { required: true, update: "replace" }),
+        field("owners.source_line", "integer", "Current one-based Markdown line claimed by this TODO ID.", { required: true, update: "replace" }),
+    ],
+    semantics: {
+        mode: "exact_owner_mapping",
+        owners: "every canonical TODO entity and every managed TODO checkbox row must appear exactly once; input order is normalized by ID before effect authorization",
+        public_authority: "the current mapped Markdown row supplies public description, severity, status, and order; entity operational fields remain unchanged",
+    },
+    ownedFields: ["reconciliation", "public_document", "activation"],
+    immutableFields: ["id", "artifact", "readiness", "dependencies", "gates", "evidence", "lifecycle"],
+    bounds: { max_input_utf8_bytes: 32768, max_collection_items: 256 },
+    examples: ["agentera state todo correct-owners --input owner-mapping.yaml --dry-run --format json"],
+};
 const STRUCTURED_INPUT_SCHEMAS = {
     "progress.append": PROGRESS_INPUT_SCHEMA,
     "decisions.append": DECISION_APPEND_INPUT_SCHEMA,
     "decisions.amend": DECISION_AMEND_INPUT_SCHEMA,
     "plan.append": PLAN_TASK_APPEND_INPUT_SCHEMA,
     "plan.update": PLAN_TASK_UPDATE_INPUT_SCHEMA,
+    "todo.correct-owners": TODO_OWNER_CORRECTION_INPUT_SCHEMA,
 };
 export function structuredInputDescriptor(artifact, verb) {
     return STRUCTURED_INPUT_SCHEMAS[`${artifact}.${verb}`] ?? null;
@@ -311,7 +333,7 @@ function planTaskInputViolations(input, verb) {
     return violations;
 }
 export function structuredRecordInputViolations(artifact, verb, input) {
-    if (!input || (artifact !== "progress" && artifact !== "decisions" && artifact !== "plan"))
+    if (!input || (artifact !== "progress" && artifact !== "decisions" && artifact !== "plan" && artifact !== "todo"))
         return [];
     if (artifact === "progress" && verb === "append")
         return progressInputViolations(input);
@@ -319,6 +341,8 @@ export function structuredRecordInputViolations(artifact, verb, input) {
         return decisionInputViolations(input, verb);
     if (artifact === "plan" && (verb === "append" || verb === "update"))
         return planTaskInputViolations(input, verb);
+    if (artifact === "todo" && verb === "correct-owners")
+        return todoOwnerCorrectionInputViolations(input);
     return [];
 }
 export function normalizeDecisionRecordInput(input) {

package/dist/state/write/runtimeOperations.js

@@ -5,7 +5,7 @@ export const RUNTIME_WRITABLE_ARTIFACTS = [
 ];
 export const RUNTIME_WRITE_VERBS = [
     "append", "update", "amend", "set-status", "supersede", "set-plan-status",
-    "record-evaluation", "archive", "create", "replace", "publish", "activate", "repair", "set-severity", "resolve", "reopen", "explain",
+    "record-evaluation", "archive", "create", "replace", "publish", "activate", "repair", "correct-owners", "set-severity", "resolve", "reopen", "explain",
 ];
 const readiness = loadTodoReadinessContract();
 const f = (flag, field, kind, options = {}) => ({ flag, field, kind, required: false, ...options });
@@ -50,6 +50,7 @@ const RUNTIME_OPERATION_CORES = [
     op("experiments", "publish", [f("--objective", "objective", "string", { required: true }), f("--id", "id", "string")], { selectors: ["--objective", "--id"], ownedFields: ["id", "artifact", "objective", "archive_identity"], inputMode: "structured", inputRoot: "one experiment entry", inputSources: ["file", "stdin"], structuredInputSources: ["file", "stdin"], cliOwnedFields: ["id", "artifact", "objective"], inputMaxBytes: 32768, compacts: true }),
     op("todo", "activate", [f("--effect-sha256", "effect_sha256", "string"), f("--yes", "confirmed", "boolean")], { ownedFields: ["reconciliation", "public_document", "activation"], compacts: true }),
     op("todo", "repair", [f("--effect-sha256", "effect_sha256", "string"), f("--yes", "confirmed", "boolean")], { ownedFields: ["reconciliation", "public_document", "activation"], compacts: true }),
+    op("todo", "correct-owners", [f("--effect-sha256", "effect_sha256", "string"), f("--yes", "confirmed", "boolean")], { ownedFields: ["reconciliation", "public_document", "activation"], inputMode: "structured", inputRoot: "one unsafe TODO owner mapping", inputSources: ["file", "stdin"], structuredInputSources: ["file", "stdin"], inputMaxBytes: 32768, compacts: true }),
     op("todo", "create", [], { ownedFields: ["id", "artifact", "status", "public_order", "lifecycle"], inputMode: "structured", inputRoot: "full typed TODO record", inputSources: ["file", "stdin"], structuredInputSources: ["file", "stdin"], cliOwnedFields: ["id", "artifact", "status", "public_order", "lifecycle"], inputMaxBytes: 32768 }),
     op("todo", "update", [f("--id", "id", "string", { required: true })], { selectors: ["--id"], ownedFields: ["id", "artifact", "status", "public_order", "lifecycle"], inputMode: "structured", inputRoot: "TODO record patch", inputSources: ["file", "stdin"], structuredInputSources: ["file", "stdin"], cliOwnedFields: ["id", "artifact", "status", "public_order", "lifecycle"], inputMaxBytes: 32768 }),
     op("todo", "set-severity", [f("--id", "id", "string", { required: true }), f("--severity", "severity", "string", { required: true, validValues: ["critical", "degraded", "normal", "annoying"] }), f("--reason", "lifecycle.reason", "string", { required: true }), f("--date", "lifecycle.date", "date", { required: true })], { selectors: ["--id"], ownedFields: ["id", "artifact", "severity", "lifecycle"] }),
@@ -95,8 +96,9 @@ const RUNTIME_OPERATION_PROJECTIONS = {
     "objective.create": projection("Remove identity fields assigned by the CLI and retry with one schema-valid objective document.", developmentCommand("state objective create --input objective.yaml --format json")),
     "objective.update": projection("Reread the objective, copy its bare ID to --id, remove CLI-owned fields, and retry.", developmentCommand("state objective update --id qjtrmnpvka --input objective.yaml --format json")),
     "experiments.publish": projection("Use a bare objective ID, omit numeric legacy selectors, and retry the exact input; divergent immutable identities remain untouched.", developmentCommand("state experiments publish --objective qjtrmnpvka --input experiment.yaml --format json")),
-    "todo.activate": projection("Preview and review every reported safe activation effect before explicit confirmed apply; unsafe inactive evidence requires non-mutating owner correction and replanning.", developmentCommand("state todo activate --dry-run --format json"), developmentCommand("state todo activate --effect-sha256 EFFECT_SHA256 --yes --format json")),
+    "todo.activate": projection("Preview and review every reported safe activation effect before explicit confirmed apply; unsafe inactive evidence requires the separate effect-bound owner-correction operation.", developmentCommand("state todo activate --dry-run --format json"), developmentCommand("state todo activate --effect-sha256 EFFECT_SHA256 --yes --format json")),
     "todo.repair": projection("Preview and review every diagnosed repair decision before explicit confirmed apply; ambiguous evidence is rejected without effects.", developmentCommand("state todo repair --dry-run --format json"), developmentCommand("state todo repair --effect-sha256 EFFECT_SHA256 --yes --format json")),
+    "todo.correct-owners": projection("Supply one complete id/source_line owner mapping, preview its bounded effect, then apply only the exact returned effect; malformed, ambiguous, unmatched, or stale evidence is rejected without effects.", developmentCommand("state todo correct-owners --input owner-mapping.yaml --dry-run --format json"), developmentCommand("state todo correct-owners --input owner-mapping.yaml --effect-sha256 EFFECT_SHA256 --yes --format json")),
     "todo.create": projection(`Run ${developmentCommand("state todo explain --verb create --format json")}, remove CLI-owned fields, provide the full typed TODO record, and retry.`, developmentCommand("state todo create --input todo.yaml --format json")),
     "todo.update": projection("Reread the TODO item, use its bare ID, supply only typed patch fields, and use null or an empty list only for declared clearable fields.", developmentCommand("state todo update --id qjtrmnpvka --input todo-patch.yaml --format json")),
     "todo.set-severity": projection("Use the bare TODO ID, one immediate-impact severity, a reason, and a YYYY-MM-DD date; no record input is accepted.", developmentCommand('state todo set-severity --id qjtrmnpvka --severity degraded --reason "Impact changed" --date 2026-07-31 --format json')),

package/dist/state/write/transaction.js

@@ -1,7 +1,7 @@
 import { amendDecisionEntity, appendDecisionEntity, updateDecisionSatisfactionEntity } from "../decisionEntities.js";
 import { appendHealthEntity } from "../healthEntities.js";
 import { mutateObjectiveEntity, publishExperimentEntity } from "../objectiveExperimentEntities.js";
-import { mutatePlanEntities } from "../planEntities.js";
+import { createFreshPlanEntities, mutatePlanEntities } from "../planEntities.js";
 import { withEntityWriterLock } from "../entityStorage.js";
 import { appendProgressEntity } from "../progressEntities.js";
 import { requireEntityStateBinding } from "../stateMode.js";
@@ -21,6 +21,11 @@ export function executeStateWrite(req, _options = {}) {
             syntax: `agentera state ${req.artifact} ${req.spec.verb} --input PATH --format json`,
             example: `agentera state ${req.artifact} ${req.spec.verb} --input - --format json`,
         });
+    if (req.artifact === "plan" && req.spec.verb === "create") {
+        const initialized = createFreshPlanEntities(req);
+        if (initialized)
+            return initialized;
+    }
     const binding = requireEntityStateBinding(req.projectRoot);
     const publicationContext = binding.publicationContext;
     try {

package/dist/validate/activationArtifactEvidence.js

@@ -6,19 +6,9 @@ import path from "node:path";
 import { ACTIVATION_CANONICAL_TUPLES } from "../registries/activationTuples.js";
 import { loadRegistry } from "../registries/packageRegistry.js";
 import { packageCommandDeclarations, packageDescriptorSemantics, packageDescriptors, } from "./activationPackageSemantics.js";
+import { GENERATED_OWNER_EVIDENCE_SCHEMA, OWNER_EVIDENCE_MAX_BYTES, PACKAGE_IDENTITY_MAX_BYTES, PACKAGE_IDENTITY_SCHEMA, PACKAGE_OWNER_EVIDENCE_SCHEMA, PACKAGE_SNAPSHOT_DIRECTORY, PACKAGE_SNAPSHOT_EXTRACTED_MAX_BYTES, PACKAGE_SNAPSHOT_MARKER_MAX_BYTES, PACKAGE_SNAPSHOT_MAX_ENTRIES, PACKAGE_SNAPSHOT_SCHEMA, PACKAGE_SNAPSHOT_TARBALL_MAX_BYTES, SOURCE_OWNER_EVIDENCE_SCHEMA, } from "./activationArtifactEvidenceTypes.js";
 import { bootstrapMatrixAuthority } from "./bootstrapAuthority.js";
-export const SOURCE_OWNER_EVIDENCE_SCHEMA = "agentera.activationSourceOwnerEvidence.v1";
-export const PACKAGE_OWNER_EVIDENCE_SCHEMA = "agentera.activationPackageOwnerEvidence.v1";
-export const GENERATED_OWNER_EVIDENCE_SCHEMA = "agentera.activationGeneratedOwnerEvidence.v1";
-export const PACKAGE_IDENTITY_SCHEMA = "agentera.activationPackageIdentity.v1";
-export const PACKAGE_SNAPSHOT_SCHEMA = "agentera.activationPackageSnapshot.v1";
-export const PACKAGE_SNAPSHOT_DIRECTORY = ".activation-package-snapshot";
-export const OWNER_EVIDENCE_MAX_BYTES = 262_144;
-export const PACKAGE_IDENTITY_MAX_BYTES = 16_384;
-export const PACKAGE_SNAPSHOT_MARKER_MAX_BYTES = 16_384;
-export const PACKAGE_SNAPSHOT_TARBALL_MAX_BYTES = 64 * 1024 * 1024;
-export const PACKAGE_SNAPSHOT_EXTRACTED_MAX_BYTES = 128 * 1024 * 1024;
-export const PACKAGE_SNAPSHOT_MAX_ENTRIES = 4_096;
+export * from "./activationArtifactEvidenceTypes.js";
 const sourceCapabilityCache = new Map();
 const CAPABILITY_IDS = Object.freeze(ACTIVATION_CANONICAL_TUPLES
     .filter((tuple) => tuple.class === "capability")
@@ -409,9 +399,9 @@ function sourceProjection(root) {
         },
     };
 }
-function runtimeArtifactObservation(runtimeRoot, projectRoot, sourceRoot) {
+function runtimeArtifactObservation(runtimeRoot, projectRoot, sourceRoot, mode = "full") {
     const script = path.join(sourceRoot, "packages/cli/scripts/observe-runtime-artifact.mjs");
-    const result = spawnSync(process.execPath, [script, runtimeRoot, projectRoot], {
+    const result = spawnSync(process.execPath, [script, runtimeRoot, projectRoot, mode], {
         cwd: projectRoot,
         env: process.env,
         encoding: "utf8",
@@ -444,8 +434,8 @@ function runtimeArtifactObservation(runtimeRoot, projectRoot, sourceRoot) {
             },
         } };
 }
-function runtimeProjection(runtimeRoot, projectRoot, sourceRoot) {
-    return runtimeArtifactObservation(runtimeRoot, projectRoot, sourceRoot).projection;
+function runtimeProjection(runtimeRoot, projectRoot, sourceRoot, mode = "full") {
+    return runtimeArtifactObservation(runtimeRoot, projectRoot, sourceRoot, mode).projection;
 }
 function createRecord(producerKind, artifactClass, artifactIdentity, artifactContentDigest, content, generation, packageIntegrity) {
     return {
@@ -548,7 +538,7 @@ function genericDimensionObservation(classId, dimension, input) {
         return { help: input.helpFamilies, examples: writes.map((entry) => ({ id: `${entry.artifact}.${entry.verb}`, examples: entry.projection.examples })) };
     return { bounds: input.bounds, inputBounds: writes.map((entry) => ({ id: `${entry.artifact}.${entry.verb}`, bytes: entry.inputMaxBytes, formats: entry.projection.formatValues })) };
 }
-export function createSourceOwnerEvidence(root, productionInputs) {
+export function createSourceOwnerEvidence(root, productionInputs, packageExecution) {
     const capabilities = sourceProjection(root);
     const record = packageRecord(root);
     const records = {
@@ -570,6 +560,37 @@ export function createSourceOwnerEvidence(root, productionInputs) {
             }
         }
     }
+    if (packageExecution) {
+        const { fixture, runtimeSummary, missingSurfaceResults } = packageExecution;
+        const capabilityProject = path.join(fixture.root, "activation-source-package-capability-project");
+        resetObservationProject(capabilityProject);
+        const packageCapabilities = runtimeProjection(fixture.packageRoot, capabilityProject, root);
+        const packageRows = runtimeSummary.rows.filter((row) => row.runtime === "package");
+        const rejectedRows = packageRows.filter((row) => !row.accepted);
+        const commandPolicy = {
+            rowCount: packageRows.length,
+            accepted: packageRows.filter((row) => row.accepted).length,
+            rejected: rejectedRows.length,
+            classifications: Object.fromEntries([...new Set(packageRows.map((row) => row.classification))].sort().map((classification) => [classification, packageRows.filter((row) => row.classification === classification).length])),
+            compositeIdentityDigest: observationDigest(packageRows.map((row) => `${row.runtime}/${row.projectState}/${row.id}`).sort()),
+        };
+        const adversarial = {
+            rowCount: rejectedRows.length,
+            allBlockedBeforeChildStart: rejectedRows.every((row) => row.childStarted === false),
+            classifications: Object.fromEntries([...new Set(rejectedRows.map((row) => row.classification))].sort().map((classification) => [classification, rejectedRows.filter((row) => row.classification === classification).length])),
+        };
+        records["capability.extracted-served"] = createRecord("source-owner", "capability-extracted-served", "package/dist/bin/agentera.js#prime-context", packageCapabilities.artifacts.served, packageCapabilities.served, null, null);
+        records["package.command-policy"] = createRecord("source-owner", "package-command-policy", "source-integration/runtime-matrix/classifications", observationDigest(packageRows), commandPolicy, null, null);
+        records["package.adversarial"] = createRecord("source-owner", "package-adversarial", "source-integration/runtime-matrix/rejections", observationDigest(rejectedRows), adversarial, null, null);
+        records["bootstrap.extracted-classifications"] = createRecord("source-owner", "bootstrap-extracted-classifications", "source-integration/runtime-matrix/rows", observationDigest(packageRows), packageRows, null, null);
+        records["bootstrap.extracted-diagnostics"] = createRecord("source-owner", "bootstrap-extracted-diagnostics", "source-integration/runtime-matrix/rejection-diagnostics", observationDigest(rejectedRows), rejectedRows, null, null);
+        const parity = {
+            ...(runtimeSummary.runtimeObservationDigests ?? {}),
+            packageArtifact: runtimeSummary.packageArtifact ?? null,
+        };
+        records["bootstrap.source-package-parity"] = createRecord("source-owner", "bootstrap-source-package-parity", "source-integration/runtime-matrix/parity", observationDigest(parity), parity, null, null);
+        records["bootstrap.missing-surface"] = createRecord("source-owner", "bootstrap-missing-surface", "source-integration/runtime-matrix/missing-required-surfaces", observationDigest(missingSurfaceResults), missingSurfaceResults, null, null);
+    }
     return finishEvidence({
         schemaVersion: SOURCE_OWNER_EVIDENCE_SCHEMA,
         producerKind: "source-owner",
@@ -605,16 +626,23 @@ function seedObservationProject(project) {
     fs.mkdirSync(path.join(project, ".agentera"), { recursive: true, mode: 0o700 });
     fs.writeFileSync(path.join(project, ".agentera/state-mode.yaml"), "schemaVersion: agentera.stateMode.v1\nmode: entities\n", { flag: "wx", mode: 0o600 });
 }
+function resetObservationProject(project) {
+    fs.rmSync(project, { recursive: true, force: true });
+    seedObservationProject(project);
+}
 export async function finalizePackageOwnerEvidence(options) {
-    const { root, fixture, runtimeSummary } = options;
+    const { root, fixture } = options;
     const runtimeRoot = fixture.packageRoot;
     const capabilityProject = path.join(fixture.root, "activation-capability-project");
-    seedObservationProject(capabilityProject);
-    const capabilities = await runtimeProjection(runtimeRoot, capabilityProject, root);
+    resetObservationProject(capabilityProject);
+    const capabilities = runtimeProjection(runtimeRoot, capabilityProject, root, "package-smoke");
     const record = packageRecord(path.join(runtimeRoot, "bundle"));
     const packageArtifact = packageArtifactObservation(runtimeRoot, fixture, options.requiredFiles, options.snapshotDirectory);
     const integrity = packageArtifact.integrity;
     const portability = {
+        deterministicPackRuns: fixture.deterministicBytes.packRuns,
+        deterministicTarballSha256: fixture.deterministicBytes.sha256,
+        secondTarballSha256: fixture.deterministicBytes.secondSha256,
         constructionRootCount: fixture.pathIndependence.constructionRoots.length,
         constructionRootsDistinct: new Set(fixture.pathIndependence.constructionRoots).size === fixture.pathIndependence.constructionRoots.length,
         extractedRootCount: fixture.pathIndependence.extractedRoots.length,
@@ -630,38 +658,18 @@ export async function finalizePackageOwnerEvidence(options) {
             files: fixture.pathIndependence.secondManifest.files,
         },
     };
-    const packageRows = runtimeSummary.rows.filter((row) => row.runtime === "package");
-    const rejectedRows = packageRows.filter((row) => !row.accepted);
-    const commandPolicy = {
-        rowCount: packageRows.length,
-        accepted: packageRows.filter((row) => row.accepted).length,
-        rejected: rejectedRows.length,
-        classifications: Object.fromEntries([...new Set(packageRows.map((row) => row.classification))].sort().map((classification) => [classification, packageRows.filter((row) => row.classification === classification).length])),
-        compositeIdentityDigest: observationDigest(packageRows.map((row) => `${row.runtime}/${row.projectState}/${row.id}`).sort()),
-    };
-    const adversarial = {
-        rowCount: rejectedRows.length,
-        allBlockedBeforeChildStart: rejectedRows.every((row) => row.childStarted === false),
-        classifications: Object.fromEntries([...new Set(rejectedRows.map((row) => row.classification))].sort().map((classification) => [classification, rejectedRows.filter((row) => row.classification === classification).length])),
-    };
     const records = {
         "capability.extracted-modules": createRecord("package-owner", "capability-extracted-modules", "package/dist/capabilities/*/instructions.js", capabilities.artifacts.modules, capabilities.modules, null, integrity),
         "capability.extracted-runtime-registry": createRecord("package-owner", "capability-extracted-runtime-registry", "package/dist/capabilities/index.js#CAPABILITY_INSTRUCTIONS", capabilities.artifacts.runtimeRegistry, capabilities.runtimeRegistry, null, integrity),
-        "capability.extracted-served": createRecord("package-owner", "capability-extracted-served", "package/dist/bin/agentera.js#prime-context", capabilities.artifacts.served, capabilities.served, null, integrity),
         "capability.extracted-registry": createRecord("package-owner", "capability-extracted-registry", "package/bundle/registry.json#skills[0].capabilities", capabilities.artifacts.registry, capabilities.registry, null, integrity),
         "capability.extracted-routes": createRecord("package-owner", "capability-extracted-routes", "package/dist/cli/commands/capability.js#CAPABILITY_ROUTING_NAMES", capabilities.artifacts.routes, capabilities.routes, null, integrity),
         "capability.extracted-schemas": createRecord("package-owner", "capability-extracted-schemas", "package/bundle/skills/agentera/capabilities/*/schemas", capabilities.artifacts.schemas, capabilities.schemas, null, integrity),
         "package.extracted-artifact": createRecord("package-owner", "package-extracted-artifact", "npm-tarball/extracted-package", observationDigest(packageArtifact), packageArtifact, null, integrity),
         "package.extracted-registry": createRecord("package-owner", "package-extracted-registry", "package/bundle/references/adapters/package-registry.yaml#records[agentera]", artifactDigest(runtimeRoot, ["bundle/references/adapters/package-registry.yaml"]), packageDescriptorSemantics(packageDescriptors(record)), null, integrity),
-        "package.command-policy": createRecord("package-owner", "package-command-policy", "package/runtime-matrix/classifications", observationDigest(packageRows), commandPolicy, null, integrity),
+        "package.extracted-smoke": createRecord("package-owner", "package-extracted-smoke", "package/dist/bin/agentera.js#prime-context-status", capabilities.artifacts.served, capabilities.served, null, integrity),
         "package.portability": createRecord("package-owner", "package-portability", "npm-tarball/path-portability", fixture.pathIndependence.contentSha256, portability, null, integrity),
-        "package.adversarial": createRecord("package-owner", "package-adversarial", "package/runtime-matrix/rejections", observationDigest(rejectedRows), adversarial, null, integrity),
-        "bootstrap.extracted-classifications": createRecord("package-owner", "bootstrap-extracted-classifications", "package/runtime-matrix/rows", observationDigest(packageRows), packageRows, null, integrity),
-        "bootstrap.extracted-diagnostics": createRecord("package-owner", "bootstrap-extracted-diagnostics", "package/runtime-matrix/rejection-diagnostics", observationDigest(rejectedRows), rejectedRows, null, integrity),
         "bootstrap.extracted-startup": createRecord("package-owner", "bootstrap-extracted-startup", "package/dist/bin/agentera.js#startup-producers", capabilities.artifacts.startupProducers, capabilities.startupProducers, null, integrity),
         "bootstrap.extracted-declarations": createRecord("package-owner", "bootstrap-extracted-declarations", "package/bundle/references/adapters/package-registry.yaml#bootstrap_command_authority", artifactDigest(runtimeRoot, ["bundle/references/adapters/package-registry.yaml"]), packageCommandDeclarations(record), null, integrity),
-        "bootstrap.source-package-parity": createRecord("package-owner", "bootstrap-source-package-parity", "package/runtime-matrix/parity", observationDigest(runtimeSummary.runtimeObservationDigests ?? {}), runtimeSummary.runtimeObservationDigests ?? {}, null, integrity),
-        "bootstrap.missing-surface": createRecord("package-owner", "bootstrap-missing-surface", "package/runtime-matrix/missing-required-surfaces", observationDigest(options.missingSurfaceResults), options.missingSurfaceResults, null, integrity),
     };
     for (const classId of ["runtime", "reference", "state"]) {
         const relative = classId === "runtime"

package/dist/validate/activationArtifactEvidenceTypes.js

@@ -0,0 +1,12 @@
+export const SOURCE_OWNER_EVIDENCE_SCHEMA = "agentera.activationSourceOwnerEvidence.v1";
+export const PACKAGE_OWNER_EVIDENCE_SCHEMA = "agentera.activationPackageOwnerEvidence.v1";
+export const GENERATED_OWNER_EVIDENCE_SCHEMA = "agentera.activationGeneratedOwnerEvidence.v1";
+export const PACKAGE_IDENTITY_SCHEMA = "agentera.activationPackageIdentity.v1";
+export const PACKAGE_SNAPSHOT_SCHEMA = "agentera.activationPackageSnapshot.v1";
+export const PACKAGE_SNAPSHOT_DIRECTORY = ".activation-package-snapshot";
+export const OWNER_EVIDENCE_MAX_BYTES = 262_144;
+export const PACKAGE_IDENTITY_MAX_BYTES = 16_384;
+export const PACKAGE_SNAPSHOT_MARKER_MAX_BYTES = 16_384;
+export const PACKAGE_SNAPSHOT_TARBALL_MAX_BYTES = 64 * 1024 * 1024;
+export const PACKAGE_SNAPSHOT_EXTRACTED_MAX_BYTES = 128 * 1024 * 1024;
+export const PACKAGE_SNAPSHOT_MAX_ENTRIES = 4_096;

package/dist/validate/activationEvidenceManifest.js

@@ -43,7 +43,7 @@ const CHECK_OBSERVATIONS = Object.freeze({
     "package.discovery": ["package.source-registry"],
     "package.behavior": ["package.source-construction", "package.generated-construction"],
     "package.diagnostics": ["package.command-policy"],
-    "package.package_projection": ["package.generated-registry", "package.extracted-artifact", "package.extracted-registry"],
+    "package.package_projection": ["package.generated-registry", "package.extracted-artifact", "package.extracted-registry", "package.extracted-smoke"],
     "package.instructions": ["package.source-selectors", "package.generated-selectors"],
     "package.adversarial": ["package.portability", "package.adversarial"],
     "bootstrap.discovery": ["bootstrap.source-authority"],
@@ -63,6 +63,13 @@ const SOURCE_PROVENANCE = {
     "package.source-construction": ["package-source-construction", "references/adapters/package-registry.yaml#records[agentera].bundle_surfaces"],
     "package.source-selectors": ["package-source-selectors", "references/adapters/package-registry.yaml#records[agentera].semantic_fields"],
     "bootstrap.source-authority": ["bootstrap-source-authority", "packages/cli/src/validate/bootstrapAuthority.ts#bootstrapMatrixAuthority"],
+    "capability.extracted-served": ["capability-extracted-served", "package/dist/bin/agentera.js#prime-context"],
+    "package.command-policy": ["package-command-policy", "source-integration/runtime-matrix/classifications"],
+    "package.adversarial": ["package-adversarial", "source-integration/runtime-matrix/rejections"],
+    "bootstrap.extracted-classifications": ["bootstrap-extracted-classifications", "source-integration/runtime-matrix/rows"],
+    "bootstrap.extracted-diagnostics": ["bootstrap-extracted-diagnostics", "source-integration/runtime-matrix/rejection-diagnostics"],
+    "bootstrap.source-package-parity": ["bootstrap-source-package-parity", "source-integration/runtime-matrix/parity"],
+    "bootstrap.missing-surface": ["bootstrap-missing-surface", "source-integration/runtime-matrix/missing-required-surfaces"],
 };
 const GENERATED_PROVENANCE = {
     "capability.generated-modules": ["capability-generated-modules", "generation/dist/capabilities/*/instructions.js"],
@@ -83,21 +90,15 @@ const GENERATED_PROVENANCE = {
 const PACKAGE_PROVENANCE = {
     "capability.extracted-modules": ["capability-extracted-modules", "package/dist/capabilities/*/instructions.js"],
     "capability.extracted-runtime-registry": ["capability-extracted-runtime-registry", "package/dist/capabilities/index.js#CAPABILITY_INSTRUCTIONS"],
-    "capability.extracted-served": ["capability-extracted-served", "package/dist/bin/agentera.js#prime-context"],
     "capability.extracted-registry": ["capability-extracted-registry", "package/bundle/registry.json#skills[0].capabilities"],
     "capability.extracted-routes": ["capability-extracted-routes", "package/dist/cli/commands/capability.js#CAPABILITY_ROUTING_NAMES"],
     "capability.extracted-schemas": ["capability-extracted-schemas", "package/bundle/skills/agentera/capabilities/*/schemas"],
     "package.extracted-artifact": ["package-extracted-artifact", "npm-tarball/extracted-package"],
     "package.extracted-registry": ["package-extracted-registry", "package/bundle/references/adapters/package-registry.yaml#records[agentera]"],
-    "package.command-policy": ["package-command-policy", "package/runtime-matrix/classifications"],
+    "package.extracted-smoke": ["package-extracted-smoke", "package/dist/bin/agentera.js#prime-context-status"],
     "package.portability": ["package-portability", "npm-tarball/path-portability"],
-    "package.adversarial": ["package-adversarial", "package/runtime-matrix/rejections"],
-    "bootstrap.extracted-classifications": ["bootstrap-extracted-classifications", "package/runtime-matrix/rows"],
-    "bootstrap.extracted-diagnostics": ["bootstrap-extracted-diagnostics", "package/runtime-matrix/rejection-diagnostics"],
     "bootstrap.extracted-startup": ["bootstrap-extracted-startup", "package/dist/bin/agentera.js#startup-producers"],
     "bootstrap.extracted-declarations": ["bootstrap-extracted-declarations", "package/bundle/references/adapters/package-registry.yaml#bootstrap_command_authority"],
-    "bootstrap.source-package-parity": ["bootstrap-source-package-parity", "package/runtime-matrix/parity"],
-    "bootstrap.missing-surface": ["bootstrap-missing-surface", "package/runtime-matrix/missing-required-surfaces"],
 };
 for (const classId of ["cli", "runtime", "reference", "state"]) {
     for (const dimension of ["discovery", "behavior", "diagnostics", "instructions", "adversarial"]) {
@@ -276,6 +277,12 @@ function validatePackageSemantics(manifest, violations) {
 }
 function validateExecutedArtifactSemantics(manifest, violations) {
     const records = allRecords(manifest.producers);
+    const smoke = records.get("package.extracted-smoke")?.content;
+    if (canonicalObservationJson(smoke?.identities) !== canonicalObservationJson(["status"])
+        || smoke?.bodies?.status?.bytes <= 0
+        || !/^[a-f0-9]{64}$/.test(smoke?.bodies?.status?.sha256 ?? "")) {
+        violations.push("extracted package smoke is missing or did not serve status");
+    }
     const artifact = records.get("package.extracted-artifact")?.content;
     if (!artifact || canonicalObservationJson({
         filename: artifact.filename,
@@ -319,8 +326,11 @@ function validateExecutedArtifactSemantics(manifest, violations) {
         violations.push("complete extracted package tree is not bound to the current tarball payload");
     }
     const portability = records.get("package.portability")?.content;
-    if (portability?.constructionRootCount !== 2 || portability?.constructionRootsDistinct !== true
-        || portability?.extractedRootCount !== 2 || portability?.extractedRootsDistinct !== true
+    if (portability?.deterministicPackRuns !== 2
+        || !/^[a-f0-9]{64}$/.test(portability?.deterministicTarballSha256 ?? "")
+        || portability?.secondTarballSha256 !== portability?.deterministicTarballSha256
+        || portability?.constructionRootCount !== 2 || portability?.constructionRootsDistinct !== true
+        || portability?.extractedRootCount !== 1 || portability?.extractedRootsDistinct !== true
         || portability?.forbiddenPathMatches?.length !== 0 || !/^[a-f0-9]{64}$/.test(portability?.contentSha256 ?? "")) {
         violations.push("extracted package portability evidence is incomplete or failed");
     }
@@ -390,6 +400,12 @@ function validateExecutedArtifactSemantics(manifest, violations) {
         || canonicalObservationJson(Object.keys(parity.source).sort()) !== canonicalObservationJson(["clean", "partial", "v2", "v3"])) {
         violations.push("source and extracted package runtime classification parity failed");
     }
+    if (parity?.packageArtifact?.filename !== manifest.packageArtifact?.filename
+        || parity?.packageArtifact?.integrity !== manifest.packageArtifact?.integrity
+        || parity?.packageArtifact?.shasum !== manifest.packageArtifact?.shasum
+        || parity?.packageArtifact?.tarballSha256 !== manifest.packageArtifact?.tarballSha256) {
+        violations.push("source integration package artifact differs from the package owner artifact");
+    }
     const missing = records.get("bootstrap.missing-surface")?.content;
     if (!Array.isArray(missing) || missing.length !== DEVELOPMENT_RUNTIME_REQUIRED_FILES.length * 2
         || new Set(missing.map((entry) => `${entry.runtime}/${entry.relative}`)).size !== missing.length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentera",
-  "version": "3.0.0-dev.51",
+  "version": "3.0.0-dev.69",
   "description": "One CLI, many capabilities: project state, artifact validation, and capability routing for AI coding agents",
   "keywords": [
     "agentera",
@@ -36,13 +36,17 @@
     "test:stress": "node scripts/verify-lane.mjs stress",
     "test:performance": "node scripts/verify-lane.mjs performance",
     "test:performance:integration": "node test/integration/performanceOwner.integration.mjs",
+    "test:capacity": "node scripts/verify-lane.mjs capacity",
     "test:watch": "vp test watch --config vite.config.ts",
     "verify:package": "node scripts/verify-lane.mjs package",
     "verify:generated-overlap": "node scripts/verify-generated-overlap.mjs",
     "generated:cleanup": "node scripts/build-package.mjs --cleanup",
     "pack:dry-run": "node scripts/pack-package.mjs --dry-run",
     "release:prepare": "node scripts/publication-transaction.mjs prepare development",
+    "release:prepare:push": "node scripts/publication-transaction.mjs prepare-push development",
+    "release:validate:push": "node scripts/publication-transaction.mjs validate-push development",
     "release:qualify:source": "node scripts/release-qualification.mjs source",
+    "release:ready": "node scripts/release-readiness.mjs development",
     "release:qualify:candidate": "node scripts/release-qualification.mjs candidate --adapter development",
     "release:approve": "node scripts/release-qualification.mjs approval --adapter development",
     "release:attest": "node scripts/release-qualification.mjs attest --adapter development",
@@ -63,20 +67,21 @@
     "bundle:data": "node scripts/build-package.mjs"
   },
   "dependencies": {
-    "smol-toml": "^1.3.1",
+    "smol-toml": "^1.7.1",
     "yaml": "^2.8.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
-    "typescript": "^5.7.2",
-    "vite": "^6.3.5",
-    "vite-plus": "^0.1.22"
+    "@typescript/typescript6": "6.0.2",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.1",
+    "vite-plus": "^0.2.8"
   },
   "engines": {
     "node": ">=22"
   },
   "agentera": {
     "suiteVersion": "3.0.0",
-    "gitRef": "a70ed56a72d633f3f11e94cede11fe4aadba2d2e"
+    "gitRef": "cb8746e8eaec765d3b7a0a82cc561656caca33e9"
   }
 }