agentera 3.0.0-dev.72 → 3.0.0-dev.75

package/dist/registries/glossaryTermIdentity.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -15,3 +16,124 @@ export function unicodeCaselessExact(left, right) {
     const literal = escapeRegExp(left);
     return new RegExp(`^(?:${literal})$(?![\\s\\S])`, "iu").test(right);
 }
+function compareCodePoints(left, right) {
+    const leftCodePoint = left.codePointAt(0) ?? 0;
+    const rightCodePoint = right.codePointAt(0) ?? 0;
+    return leftCodePoint - rightCodePoint;
+}
+export function compareGlossaryUnicodeStrings(left, right) {
+    const leftScalars = [...left];
+    const rightScalars = [...right];
+    for (let index = 0; index < Math.min(leftScalars.length, rightScalars.length); index += 1) {
+        const comparison = compareCodePoints(leftScalars[index], rightScalars[index]);
+        if (comparison !== 0)
+            return comparison;
+    }
+    return leftScalars.length - rightScalars.length;
+}
+function singleScalar(value) {
+    return [...value].length === 1 ? value : null;
+}
+/**
+ * Build the same simple-case equivalence key used by the stable identity.
+ * Lowercase mapping is the primary Unicode simple-fold projection. A
+ * lowercased uppercase mapping is admitted only when the existing equality
+ * matcher confirms it, which avoids transitive casing mistakes such as
+ * treating ASCII `I` and dotless `ı` as equal.
+ */
+function unicodeSimpleCaseFoldKey(value) {
+    return [...value]
+        .map((character) => {
+        const lower = singleScalar(character.toLowerCase()) ?? character;
+        const upper = singleScalar(character.toUpperCase());
+        const upperLower = upper === null ? null : singleScalar(upper.toLowerCase());
+        if (upperLower !== null && unicodeCaselessExact(character, upperLower)) {
+            return upperLower;
+        }
+        return lower;
+    })
+        .join("");
+}
+function sha256Utf8(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function requireNonEmpty(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new TypeError(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+/**
+ * Return a content-addressed identity for one Unicode caseless-exact term.
+ * The original spelling is not changed or stored in the identity key.
+ */
+export function stableGlossaryTermIdentity(term) {
+    const value = requireNonEmpty(term, "term");
+    const key = unicodeSimpleCaseFoldKey(value);
+    return sha256Utf8(JSON.stringify({
+        schema_version: "agentera.personalGlossaryTermIdentity.v1",
+        key,
+    }));
+}
+export const GLOSSARY_CANDIDATE_SCOPES = ["personal", "project", "ambiguous"];
+export function isGlossaryCandidateScope(value) {
+    return GLOSSARY_CANDIDATE_SCOPES.includes(value);
+}
+export function canonicalGlossaryJson(value) {
+    if (value === undefined)
+        throw new TypeError("canonical JSON cannot contain undefined");
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalGlossaryJson).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort(compareGlossaryUnicodeStrings)
+        .map((key) => `${JSON.stringify(key)}:${canonicalGlossaryJson(record[key])}`)
+        .join(",")}}`;
+}
+export function glossaryCanonicalSha256(value) {
+    return sha256Utf8(canonicalGlossaryJson(value));
+}
+/**
+ * Return a content-addressed candidate revision without mining or publishing.
+ * Evidence order is not semantic, but every evidence identity remains bound.
+ */
+export function glossaryCandidateRevision(input) {
+    const stableTermIdentity = requireNonEmpty(input.stable_term_identity, "stable_term_identity");
+    const meaning = requireNonEmpty(input.meaning, "meaning");
+    const policyVersion = requireNonEmpty(input.policy_version, "policy_version");
+    const generation = requireNonEmpty(input.generation, "generation");
+    if (!Array.isArray(input.evidence))
+        throw new TypeError("evidence must be a list");
+    if (!isGlossaryCandidateScope(input.scope)) {
+        throw new TypeError("scope must be personal, project, or ambiguous");
+    }
+    const evidence = input.evidence.map((item) => {
+        requireNonEmpty(item.source_id, "evidence.source_id");
+        requireNonEmpty(item.evidence_anchor, "evidence.evidence_anchor");
+        return item;
+    });
+    const canonicalEvidence = new Set();
+    for (const item of evidence) {
+        const canonical = canonicalGlossaryJson(item);
+        if (canonicalEvidence.has(canonical)) {
+            throw new TypeError("evidence must not contain duplicate canonical evidence records");
+        }
+        canonicalEvidence.add(canonical);
+    }
+    evidence.sort((left, right) => {
+        const leftCanonical = canonicalGlossaryJson(left);
+        const rightCanonical = canonicalGlossaryJson(right);
+        return compareGlossaryUnicodeStrings(leftCanonical, rightCanonical);
+    });
+    return sha256Utf8(canonicalGlossaryJson({
+        schema_version: "agentera.personalGlossaryCandidateRevision.v1",
+        stable_term_identity: stableTermIdentity,
+        meaning,
+        scope: input.scope,
+        evidence,
+        policy_version: policyVersion,
+        generation,
+    }));
+}

package/dist/registries/packagePublication.js

@@ -52,12 +52,12 @@ export const ACTIVATION_CENSUS_AUTHORITY = deepFreeze({
         cli: { count: 27, sha256: "986a637f5c11c57ab7a897a01bd291d0811846e5339c3831c715932cf9659ad4" },
         capability: { count: 12, sha256: "007e1157a892fec54182b1803aeaa442cf8e2e332e6a055c3bd020e2b0731867" },
         runtime: { count: 81, sha256: "03fe600a3a27f05daf0d1b59c16b00bedc354a13c70ea60be0b457175fdf743c" },
-        reference: { count: 22, sha256: "2b48c82bb7ee10388d9ebb4fa7ea3743ea82a7e9aaedfcd5a858eeedb9d891ae" },
+        reference: { count: 25, sha256: "2094946cd6e189c6ab3db16dd0725596cec759abcea88d8335b05215b65ccfc2" },
         state: { count: 38, sha256: "7ab0dd6ef1b1b1ce66bd9ea94d1de3d542528233e928a44102e289bf12416681" },
-        package: { count: 66, sha256: "3548af7e84151c90690a6eb3d1cb6c7847f39b290161ecab599d8cb1bf0d2cb0" },
+        package: { count: 67, sha256: "d73cd86fed39057cf9ae73e462a59e842372392b1e88846f2b220378a2ff75cc" },
         bootstrap: { count: 34, sha256: "71c2038744e2518a6adb722acbb5f9352bddfb5d1c92eeb0e347297ef2ca2f1e" },
     },
-    total: { count: 280, sha256: "051ed9a57857a39e11ed8fb583bff9d2a67a306c5ab897a0ee829212468bc23a" },
+    total: { count: 284, sha256: "3f30b26839aec47639f2197c9efda5caf2a73d5afca9fb38ff9a341e18a72b98" },
 });
 /** Each dimension names the production contract it observes independently. */
 export const ACTIVATION_EVIDENCE_SOURCES = deepFreeze({

package/dist/registries/personalGlossaryContracts.js

@@ -0,0 +1 @@
+export {};

package/dist/release/releaseMetadata.js

@@ -184,7 +184,7 @@ function readPackageJson(root) {
     }
     return readJson(candidate);
 }
-function readUpdateChannels(root) {
+export function readUpdateChannels(root) {
     const candidate = path.join(root, "references/cli/update-channels.yaml");
     if (!fs.existsSync(candidate)) {
         return null;
@@ -231,22 +231,22 @@ function pickChannelDefaults(authority) {
         stable: typeof defaults.stable === "string" ? defaults.stable : null,
     };
 }
-export function readReleaseMetadata(root = rootDefault()) {
+export function readReleaseMetadata(root = rootDefault(), packageOverride) {
     const resolved = resolvePath(root);
     const registry = readRegistryVersion(resolved);
     const pkg = readPackageJson(resolved);
     const channels = readUpdateChannels(resolved);
     const bundle = readBundleSentinel(resolved);
-    const topVersion = pkg && typeof pkg.version === "string" ? pkg.version : null;
+    const topVersion = packageOverride?.version ?? (pkg && typeof pkg.version === "string" ? pkg.version : null);
     const agenteraBlock = pkg && typeof pkg.agentera === "object" && pkg.agentera !== null
         ? pkg.agentera
         : null;
     const suiteVersion = agenteraBlock && typeof agenteraBlock.suiteVersion === "string"
         ? agenteraBlock.suiteVersion
         : null;
-    const gitRef = agenteraBlock && typeof agenteraBlock.gitRef === "string"
+    const gitRef = packageOverride?.gitRef ?? (agenteraBlock && typeof agenteraBlock.gitRef === "string"
         ? agenteraBlock.gitRef
-        : null;
+        : null);
     const { development, stable } = pickChannelDefaults(channels);
     return {
         authoritativeVersion: registry.version,
@@ -263,7 +263,7 @@ export function readReleaseMetadata(root = rootDefault()) {
  * Validate release-metadata coherence. Returns an empty array when the
  * source-tree version surfaces agree on a single release train.
  */
-export function validateReleaseMetadata(root = rootDefault(), adapter = "development") {
+export function validateReleaseMetadata(root = rootDefault(), adapter = "development", packageOverride) {
     if (adapter === "stable") {
         const manifestPath = "packages/cli/shim/package.json";
         const shim = readJson(path.join(resolvePath(root), manifestPath));
@@ -279,7 +279,7 @@ export function validateReleaseMetadata(root = rootDefault(), adapter = "develop
         return validateStableShimGitRefProvenance(resolvePath(root), gitRef);
     }
     const errors = [];
-    const snap = readReleaseMetadata(root);
+    const snap = readReleaseMetadata(root, packageOverride);
     const rootLabel = path.basename(resolvePath(root)) || "repo root";
     // 1. registry.json must publish a valid semver `skills[0].version`.
     if (snap.authoritativeVersion === null) {
@@ -373,7 +373,14 @@ export function releaseMetadataMain(opts = {}) {
     const root = resolvePath(opts.root ?? rootDefault());
     const out = opts.out ?? ((line) => process.stdout.write(line + "\n"));
     const err = opts.err ?? ((line) => process.stderr.write(line + "\n"));
-    const errors = validateReleaseMetadata(root, opts.adapter);
+    const overrideVersion = process.env.AGENTERA_RELEASE_PACKAGE_VERSION;
+    const overrideGitRef = process.env.AGENTERA_RELEASE_GIT_REF;
+    if ((overrideVersion === undefined) !== (overrideGitRef === undefined)) {
+        out("release-metadata validation failed:");
+        out("- AGENTERA_RELEASE_PACKAGE_VERSION and AGENTERA_RELEASE_GIT_REF must be supplied together");
+        return 1;
+    }
+    const errors = validateReleaseMetadata(root, opts.adapter, overrideVersion === undefined ? undefined : { version: overrideVersion, gitRef: overrideGitRef });
     if (errors.length > 0) {
         out("release-metadata validation failed:");
         for (const message of errors)

package/dist/upgrade/npxPlatformStatus.js

@@ -1,4 +1,5 @@
 import { expanduser } from "../core/paths.js";
+import { SOURCE_LABELS } from "../state/installRoot.js";
 import { resolvePlatformAppHome } from "./appModel.js";
 import { buildDoctorStatus } from "./doctor.js";
 /** Shared npx platform app-home resolution for prime and projectIntegration. */
@@ -6,7 +7,7 @@ export function resolveNpxPlatformStatus(opts) {
     const env = { ...process.env, ...(opts.env ?? {}), HOME: expanduser(opts.home) };
     const platformRoot = resolvePlatformAppHome(opts.home, env);
     const doctorOpts = {
-        rootSource: "default",
+        rootSource: SOURCE_LABELS.default,
         sourceRoot: opts.sourceRoot,
         home: opts.home,
         project: opts.project,

package/dist/upgrade/projectIntegration.js

@@ -65,10 +65,16 @@ function resolveIntegrationTargets(args) {
         project: args.project,
         env: args.env,
     });
+    // The executing npm bundle is already a complete app. A missing optional
+    // platform install therefore needs no integration work, while an existing
+    // stale or damaged platform install still retains its observed status.
+    const platformBundleStatus = platformStatus.rootStatus === "missing"
+        ? APP_UP_TO_DATE
+        : platformStatus.status;
     return {
         installRoot: platformRoot,
         bundleStatus: args.bundleStatus,
-        platformBundleStatus: platformStatus.status,
+        platformBundleStatus,
         crossMajorBoundary: Boolean(platformStatus.crossMajorBoundary),
         crossMajorBoundaryDetected: Boolean(platformStatus.crossMajorBoundaryDetected),
     };

package/dist/validate/activationArtifactEvidence.js

@@ -452,6 +452,12 @@ function createRecord(producerKind, artifactClass, artifactIdentity, artifactCon
 function finishEvidence(value) {
     return { ...value, evidenceDigest: observationDigest(value) };
 }
+function packageManifestSummary(files) {
+    const normalized = [...files]
+        .map(({ path: file, size, mode }) => ({ path: file, size, mode }))
+        .sort((left, right) => left.path.localeCompare(right.path));
+    return { count: normalized.length, digest: observationDigest(normalized) };
+}
 function packageRecord(root) {
     return loadRegistry(path.join(root, "references/adapters/package-registry.yaml"), root).get("agentera");
 }
@@ -639,6 +645,7 @@ export async function finalizePackageOwnerEvidence(options) {
     const record = packageRecord(path.join(runtimeRoot, "bundle"));
     const packageArtifact = packageArtifactObservation(runtimeRoot, fixture, options.requiredFiles, options.snapshotDirectory);
     const integrity = packageArtifact.integrity;
+    const secondManifestFiles = fixture.pathIndependence.secondManifest.files;
     const portability = {
         deterministicPackRuns: fixture.deterministicBytes.packRuns,
         deterministicTarballSha256: fixture.deterministicBytes.sha256,
@@ -655,7 +662,7 @@ export async function finalizePackageOwnerEvidence(options) {
             filename: fixture.pathIndependence.secondManifest.filename,
             integrity: fixture.pathIndependence.secondManifest.integrity,
             shasum: fixture.pathIndependence.secondManifest.shasum,
-            files: fixture.pathIndependence.secondManifest.files,
+            files: packageManifestSummary(secondManifestFiles),
         },
     };
     const records = {
@@ -716,7 +723,7 @@ export function createGeneratedOwnerEvidence(options) {
     const bundleRoot = path.join(options.generationRoot, "bundle");
     const record = packageRecord(bundleRoot);
     const bootstrap = runtimeObservation.bootstrap;
-    const generationFiles = [".agentera-generation.json", "dist/.agentera-generation.json", "bundle/.agentera-generation.json", "bundle/.agentera-npx-bundle.json", "bundle/extract-corpus-parity.json"]
+    const generationFiles = [".agentera-generation.json", "dist/.agentera-generation.json", "bundle/.agentera-generation.json", "dist/.agentera-build-source.json", "bundle/.agentera-build-source.json", "bundle/.agentera-npx-bundle.json", "bundle/extract-corpus-parity.json"]
         .filter((file) => fs.existsSync(path.join(options.generationRoot, file)));
     const records = {
         "capability.generated-modules": createRecord("generated-owner", "capability-generated-modules", "generation/dist/capabilities/*/instructions.js", capabilities.artifacts.modules, capabilities.modules, options.generation, null),
@@ -746,8 +753,15 @@ export function createGeneratedOwnerEvidence(options) {
 export function writeContentAddressedOwnerEvidence(directory, evidence) {
     const bytes = `${canonicalObservationJson(evidence)}\n`;
     const byteLength = Buffer.byteLength(bytes, "utf8");
-    if (byteLength > OWNER_EVIDENCE_MAX_BYTES)
-        throw new Error(`activation owner evidence exceeds ${OWNER_EVIDENCE_MAX_BYTES} bytes`);
+    if (byteLength > OWNER_EVIDENCE_MAX_BYTES) {
+        const contributors = Object.entries(evidence.records)
+            .map(([ref, record]) => [ref, Buffer.byteLength(canonicalObservationJson(record), "utf8")])
+            .sort((left, right) => right[1] - left[1])
+            .slice(0, 3)
+            .map(([ref, length]) => `${ref}=${length}`)
+            .join(", ");
+        throw new Error(`activation owner evidence is ${byteLength} bytes, over the ${OWNER_EVIDENCE_MAX_BYTES}-byte bound; largest records: ${contributors}`);
+    }
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     const name = `${evidence.producerKind}-${evidence.evidenceDigest}.json`;
     const target = path.join(directory, name);

package/dist/validate/activationEvidenceManifest.js

@@ -185,6 +185,57 @@ export function createActivationEvidenceManifest(options) {
     };
     return { ...unsigned, manifestDigest: observationDigest(unsigned) };
 }
+function deepFreeze(value, seen = new WeakSet()) {
+    if (!value || typeof value !== "object" || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const child of Object.values(value))
+        deepFreeze(child, seen);
+    return Object.freeze(value);
+}
+/** Observe, snapshot, assemble, and validate immediate release evidence inside one trust boundary. */
+export function assembleAndValidateActivationEvidence(context) {
+    let sourceObserverCalls = 0;
+    let generatedObserverCalls = 0;
+    sourceObserverCalls += 1;
+    const sourceEvidence = deepFreeze(structuredClone(context.sourceEvidence));
+    generatedObserverCalls += 1;
+    const observedGeneratedEvidence = createGeneratedOwnerEvidence({
+        root: context.root,
+        generationRoot: context.generationRoot,
+        generation: context.generation,
+        productionInputs: context.productionInputs,
+    });
+    const generatedEvidence = deepFreeze(structuredClone(observedGeneratedEvidence));
+    const productionEvidence = deepFreeze(structuredClone(context.productionEvidence));
+    const packageEvidence = deepFreeze(structuredClone(context.packageEvidence));
+    const expectedPackageIdentity = deepFreeze(structuredClone(context.expectedPackageIdentity));
+    const manifest = deepFreeze(createActivationEvidenceManifest({
+        root: context.root,
+        generation: context.generation,
+        productionEvidence,
+        sourceEvidence,
+        generatedEvidence,
+        packageEvidence,
+    }));
+    const violations = activationEvidenceViolationsInternal(manifest, {
+        root: context.root,
+        generationRoot: context.generationRoot,
+        generation: context.generation,
+        sourceEvidence,
+        generatedEvidence,
+        expectedPackageIdentity,
+    });
+    if (violations.length > 0)
+        throw new Error(violations[0]);
+    return {
+        manifest: structuredClone(manifest),
+        observerCalls: {
+            source: sourceObserverCalls,
+            generated: generatedObserverCalls,
+        },
+    };
+}
 function validateOwnerEvidence(owner, producerKind, schemaVersion, sourceDigest, generation, packageIntegrity, violations) {
     if (!owner || owner.schemaVersion !== schemaVersion || owner.producerKind !== producerKind) {
         violations.push(`${producerKind} evidence schema or producer is wrong`);
@@ -326,12 +377,25 @@ function validateExecutedArtifactSemantics(manifest, violations) {
         violations.push("complete extracted package tree is not bound to the current tarball payload");
     }
     const portability = records.get("package.portability")?.content;
+    const extractedManifestFiles = Array.isArray(extractedEntries)
+        ? extractedEntries
+            .filter((entry) => entry.type === "file")
+            .map((entry) => ({ path: entry.path, size: entry.size, mode: entry.mode }))
+            .sort((left, right) => left.path.localeCompare(right.path))
+        : null;
+    const secondManifest = portability?.secondManifest;
     if (portability?.deterministicPackRuns !== 2
         || !/^[a-f0-9]{64}$/.test(portability?.deterministicTarballSha256 ?? "")
         || portability?.secondTarballSha256 !== portability?.deterministicTarballSha256
         || portability?.constructionRootCount !== 2 || portability?.constructionRootsDistinct !== true
         || portability?.extractedRootCount !== 1 || portability?.extractedRootsDistinct !== true
-        || portability?.forbiddenPathMatches?.length !== 0 || !/^[a-f0-9]{64}$/.test(portability?.contentSha256 ?? "")) {
+        || portability?.forbiddenPathMatches?.length !== 0 || !/^[a-f0-9]{64}$/.test(portability?.contentSha256 ?? "")
+        || secondManifest?.filename !== manifest.packageArtifact.filename
+        || secondManifest?.integrity !== manifest.packageArtifact.integrity
+        || secondManifest?.shasum !== manifest.packageArtifact.shasum
+        || !Array.isArray(extractedManifestFiles)
+        || secondManifest?.files?.count !== extractedManifestFiles.length
+        || secondManifest?.files?.digest !== observationDigest(extractedManifestFiles)) {
         violations.push("extracted package portability evidence is incomplete or failed");
     }
     const sourceAuthority = records.get("bootstrap.source-authority")?.content;
@@ -453,15 +517,13 @@ function validateChecks(manifest, violations) {
     if (used.size !== Object.keys(PROVENANCE).length)
         violations.push("activation evidence contains unconsumed or multiply consumed producer records");
 }
-export function activationEvidenceViolations(actual, expectedOrContext) {
+function activationEvidenceViolationsInternal(actual, context) {
     const manifest = actual;
     if (!manifest || typeof manifest !== "object")
         return ["activation evidence manifest is missing"];
     const violations = [];
-    const context = "root" in expectedOrContext ? expectedOrContext : null;
-    const expected = context ? null : expectedOrContext;
-    const generation = context?.generation ?? expected.generation;
-    const sourceDigest = context ? activationSourceDigest(context.root) : expected.currentSourceDigest;
+    const generation = context?.generation ?? manifest.generation;
+    const sourceDigest = context ? activationSourceDigest(context.root) : manifest.currentSourceDigest;
     const packageIntegrity = context
         ? context.expectedPackageIdentity?.packageArtifact?.integrity ?? null
         : manifest.packageArtifact?.integrity ?? null;
@@ -491,21 +553,8 @@ export function activationEvidenceViolations(actual, expectedOrContext) {
     if (Buffer.byteLength(`${canonicalObservationJson(manifest)}\n`, "utf8") > ACTIVATION_EVIDENCE_MAX_BYTES)
         violations.push("activation evidence manifest exceeds its byte bound");
     if (context) {
-        const authoritativeSource = createSourceOwnerEvidence(context.root, context.productionInputs);
-        const authoritativeGenerated = createGeneratedOwnerEvidence({
-            root: context.root,
-            generationRoot: context.generationRoot,
-            generation: context.generation,
-            productionInputs: context.productionInputs,
-        });
-        validateAuthoritativeOwner(manifest.producers?.source, authoritativeSource, violations);
-        validateAuthoritativeOwner(manifest.producers?.generated, authoritativeGenerated, violations);
-        if (!/^[a-f0-9]{64}$/.test(context.expectedManifestDigest)) {
-            violations.push("trusted release activation evidence digest is missing or malformed");
-        }
-        else if (manifest.manifestDigest !== context.expectedManifestDigest) {
-            violations.push("activation evidence manifest differs from the trusted release observation");
-        }
+        validateAuthoritativeOwner(manifest.producers?.source, context.sourceEvidence, violations);
+        validateAuthoritativeOwner(manifest.producers?.generated, context.generatedEvidence, violations);
         violations.push(...activationPackageIdentityViolations(context.expectedPackageIdentity, manifest.producers?.package));
         for (const relative of [".agentera-generation.json", "dist/.agentera-generation.json", "bundle/.agentera-generation.json"]) {
             try {
@@ -517,8 +566,38 @@ export function activationEvidenceViolations(actual, expectedOrContext) {
             }
         }
     }
-    if (expected && canonicalObservationJson(manifest) !== canonicalObservationJson(expected))
+    return [...new Set(violations)];
+}
+export function activationEvidenceManifestViolations(actual, expected) {
+    const violations = activationEvidenceViolationsInternal(actual, null);
+    if (canonicalObservationJson(actual) !== canonicalObservationJson(expected)) {
         violations.push("activation evidence differs from the expected independently observed manifest");
+    }
+    return [...new Set(violations)];
+}
+export function activationEvidenceViolations(actual, context) {
+    const sourceEvidence = createSourceOwnerEvidence(context.root, context.productionInputs);
+    const generatedEvidence = createGeneratedOwnerEvidence({
+        root: context.root,
+        generationRoot: context.generationRoot,
+        generation: context.generation,
+        productionInputs: context.productionInputs,
+    });
+    const violations = activationEvidenceViolationsInternal(actual, {
+        root: context.root,
+        generationRoot: context.generationRoot,
+        generation: context.generation,
+        sourceEvidence,
+        generatedEvidence,
+        expectedPackageIdentity: context.expectedPackageIdentity,
+    });
+    const manifest = actual;
+    if (!/^[a-f0-9]{64}$/.test(context.expectedManifestDigest)) {
+        violations.push("trusted release activation evidence digest is missing or malformed");
+    }
+    else if (manifest?.manifestDigest !== context.expectedManifestDigest) {
+        violations.push("activation evidence manifest differs from the trusted release observation");
+    }
     return [...new Set(violations)];
 }
 export function readActivationEvidenceManifest(generationRoot) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentera",
-  "version": "3.0.0-dev.72",
+  "version": "3.0.0-dev.75",
   "description": "One CLI, many capabilities: project state, artifact validation, and capability routing for AI coding agents",
   "keywords": [
     "agentera",
@@ -43,8 +43,6 @@
     "generated:cleanup": "node scripts/build-package.mjs --cleanup",
     "pack:dry-run": "node scripts/pack-package.mjs --dry-run",
     "release:prepare": "node scripts/publication-transaction.mjs prepare development",
-    "release:prepare:push": "node scripts/publication-transaction.mjs prepare-push development",
-    "release:validate:push": "node scripts/publication-transaction.mjs validate-push development",
     "release:qualify:source": "node scripts/release-qualification.mjs source",
     "release:ready": "node scripts/release-readiness.mjs development",
     "release:qualify:candidate": "node scripts/release-qualification.mjs candidate --adapter development",
@@ -82,6 +80,6 @@
   },
   "agentera": {
     "suiteVersion": "3.0.0",
-    "gitRef": "35a1f8b54ec1670123401be27cad8a9432286863"
+    "gitRef": "01a0c460f2310bae5805a637973021af30960ee5"
   }
 }