archctx 0.6.1 → 0.6.3

package/bin/archctx.mjs

@@ -1331,7 +1331,7 @@ function productVersionManifest() {
     }
   };
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.6.1", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.4.0", ARCHCONTEXT_NODE_RANGE = ">=22.22 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.6.3", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.4.0", ARCHCONTEXT_NODE_RANGE = ">=22.22 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
 
 // packages/contracts/src/refactor.ts
 function refactorProposalDigest(proposal) {
@@ -18114,6 +18114,14 @@ ${wrapped}`;
   }
   return `${existing.slice(0, region.start)}${wrapped}${existing.slice(region.end)}`;
 }
+function comparableExpectedManifestDigest(expected, actual) {
+  const baseline = actual && typeof actual === "object" && !Array.isArray(actual) ? actual.semanticBaseline : undefined;
+  if (!baseline || typeof baseline !== "object" || Array.isArray(baseline) || "evidence" in baseline)
+    return expected.digest;
+  const value = JSON.parse(expected.body);
+  const { evidence: _evidence, ...semanticBaseline } = value.semanticBaseline;
+  return digestJson({ ...value, semanticBaseline });
+}
 function architectureDocumentationProjectionDrift(input) {
   const existingByPath = new Map(input.existingFiles.map((file) => [file.path, file]));
   const expectedByPath = new Map(input.expectedFiles.map((file) => [file.path, file]));
@@ -18130,7 +18138,7 @@ function architectureDocumentationProjectionDrift(input) {
     try {
       const parsed = JSON.parse(existingManifest.body);
       const actualDigest = digestJson(parsed);
-      if (actualDigest !== input.expectedManifest.digest) {
+      if (actualDigest !== comparableExpectedManifestDigest(input.expectedManifest, parsed)) {
         diffs.push({
           path: input.expectedManifest.path,
           reasonCode: "projection-manifest-stale",
@@ -19981,8 +19989,8 @@ function localEgressStatus(env = process.env, live = {}) {
 
 // packages/surfaces/cli/src/main.ts
 import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { accessSync as accessSync2, closeSync as closeSync10, constants as constants2, existsSync as existsSync25, mkdirSync as mkdirSync13, openSync as openSync10, readFileSync as readFileSync27, rmSync as rmSync16, statSync as statSync10 } from "fs";
-import { dirname as dirname15, join as join18, resolve as resolve26 } from "path";
+import { accessSync as accessSync2, closeSync as closeSync10, constants as constants2, existsSync as existsSync26, mkdirSync as mkdirSync13, openSync as openSync10, readFileSync as readFileSync27, rmSync as rmSync16, statSync as statSync10 } from "fs";
+import { dirname as dirname15, join as join18, resolve as resolve27 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/contracts/src/index.ts
@@ -46938,6 +46946,12 @@ function recommendationActorKind(input) {
   return "cli";
 }
 
+// packages/local-runtime/runtime-daemon/src/changeset-authority.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { existsSync as existsSync24, readFileSync as readFileSync26 } from "node:fs";
+import { resolve as resolve25 } from "node:path";
+init_src();
+
 // packages/local-runtime/runtime-daemon/src/committed-change-acceptance.ts
 import { execFileSync as execFileSync10 } from "node:child_process";
 import { closeSync as closeSync8, constants as fsConstants3, fstatSync as fstatSync3, lstatSync as lstatSync11, openSync as openSync9, readdirSync as readdirSync12, readFileSync as readFileSync25 } from "node:fs";
@@ -47369,12 +47383,546 @@ function sameStrings(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
 
+// packages/local-runtime/runtime-daemon/src/changeset-authority.ts
+class RuntimeUpdateInputError extends Error {
+}
+function decodeRuntimeWorktreeDigestProfile(value, field) {
+  switch (value) {
+    case "repository":
+    case "architecture-documentation-projection":
+      return value;
+    default:
+      throw new RuntimeUpdateInputError(`${field} must be repository or architecture-documentation-projection`);
+  }
+}
+function decodeRuntimePlanUpdateInput(value) {
+  const input = runtimeUpdateInputRecord(value, "plan_update input");
+  if (typeof input.id !== "string" || input.id.length === 0) {
+    throw new RuntimeUpdateInputError("plan_update id must be a non-empty string");
+  }
+  if (!Array.isArray(input.operations)) {
+    throw new RuntimeUpdateInputError("plan_update operations must be an array");
+  }
+  if (input.approvalChannel !== undefined && input.approvalChannel !== "mcp") {
+    throw new RuntimeUpdateInputError("plan_update approvalChannel must be mcp");
+  }
+  let worktreeDigestPrecondition;
+  if (input.worktreeDigestPrecondition !== undefined) {
+    const precondition = runtimeUpdateInputRecord(input.worktreeDigestPrecondition, "plan_update worktreeDigestPrecondition");
+    const profile = decodeRuntimeWorktreeDigestProfile(precondition.profile, "plan_update worktreeDigestPrecondition.profile");
+    if (profile !== "architecture-documentation-projection") {
+      throw new RuntimeUpdateInputError("plan_update worktreeDigestPrecondition.profile must be architecture-documentation-projection");
+    }
+    if (typeof precondition.expectedDigest !== "string" || precondition.expectedDigest.length === 0) {
+      throw new RuntimeUpdateInputError("plan_update worktreeDigestPrecondition.expectedDigest must be a non-empty string");
+    }
+    worktreeDigestPrecondition = { profile, expectedDigest: precondition.expectedDigest };
+  }
+  return {
+    id: input.id,
+    operations: input.operations,
+    ...input.approvalChannel === "mcp" ? { approvalChannel: "mcp" } : {},
+    ...input.reason === undefined ? {} : { reason: input.reason },
+    ...worktreeDigestPrecondition === undefined ? {} : { worktreeDigestPrecondition }
+  };
+}
+function decodeRuntimeApplyUpdateInput(value) {
+  const input = runtimeUpdateInputRecord(value, "apply_update input");
+  if (typeof input.id !== "string" || input.id.length === 0) {
+    throw new RuntimeUpdateInputError("apply_update id must be a non-empty string");
+  }
+  if (typeof input.approved !== "boolean") {
+    throw new RuntimeUpdateInputError("apply_update approved must be a boolean");
+  }
+  if (typeof input.expectedWorktreeDigest !== "string" || input.expectedWorktreeDigest.length === 0) {
+    throw new RuntimeUpdateInputError("apply_update expectedWorktreeDigest must be a non-empty string");
+  }
+  const worktreeDigestProfile = input.worktreeDigestProfile === undefined ? undefined : decodeRuntimeWorktreeDigestProfile(input.worktreeDigestProfile, "apply_update worktreeDigestProfile");
+  return {
+    id: input.id,
+    approved: input.approved,
+    expectedWorktreeDigest: input.expectedWorktreeDigest,
+    ...worktreeDigestProfile === undefined ? {} : { worktreeDigestProfile },
+    ...input.projectionApplyReceipt === undefined ? {} : { projectionApplyReceipt: input.projectionApplyReceipt }
+  };
+}
+function runtimeUpdateInputRecord(value, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new RuntimeUpdateInputError(`${field} must be an object`);
+  }
+  return value;
+}
+
+class ChangeSetAuthorityService {
+  context;
+  readModelStore;
+  localStore;
+  changeSetEngine;
+  architectureLedger;
+  changesets = new Map;
+  changeSetRoots = new Map;
+  mcpChangeSets = new Set;
+  mcpApprovals = new Map;
+  changeSetWorktreeDigestProfiles = new Map;
+  constructor(context) {
+    this.context = context;
+    this.readModelStore = context.readModelStore;
+    this.localStore = context.localStore;
+    this.changeSetEngine = context.changeSetEngine;
+    this.architectureLedger = context.architectureLedger;
+  }
+  clearApprovals() {
+    this.mcpApprovals.clear();
+  }
+  async planPracticeWaiver(root, input) {
+    this.assertRunning();
+    const session = await this.openSession(root);
+    const model = await this.readModelStore.validateModel(session.workspace);
+    let ownerRegistry;
+    try {
+      ownerRegistry = loadPracticeWaiverOwnerRegistry(session.workspace.root);
+    } catch (error) {
+      return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
+    }
+    const waiver = {
+      schemaVersion: "archcontext.practice-waiver/v1",
+      practiceId: input.practiceId,
+      ...input.checkId === undefined ? {} : { checkId: input.checkId },
+      scope: {
+        ...input.pathGlobs && input.pathGlobs.length > 0 ? { pathGlobs: input.pathGlobs } : {},
+        ...input.subjects && input.subjects.length > 0 ? { subjects: input.subjects } : {}
+      },
+      owner: input.owner,
+      reason: input.reason,
+      createdAt: input.createdAt ?? this.clock(),
+      reviewAt: input.reviewAt,
+      expiresAt: input.expiresAt,
+      evidenceDigest: input.evidenceDigest
+    };
+    let waiverId;
+    try {
+      validatePracticeWaiver(waiver, "practice waiver input", { allowedOwners: ownerRegistry.owners });
+      waiverId = safePracticeWaiverId(input.waiverId, waiver);
+    } catch (error) {
+      return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
+    }
+    const path = `.archcontext/waivers/${waiverId}.json`;
+    const absolute = resolve25(session.workspace.root, path);
+    const body = `${JSON.stringify(waiver, null, 2)}
+`;
+    const expectedHash = existsSync24(absolute) ? digestJson({ body: readFileSync26(absolute, "utf8") }) : "missing";
+    const draft = this.changeSetEngine.plan({
+      id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest: session.snapshot.worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: { taskSessionId: input.taskSessionId ?? "task_runtime" },
+      operations: [{ op: "write_waiver", path, expectedHash, body }]
+    });
+    this.changesets.set(draft.id, draft);
+    this.changeSetRoots.set(draft.id, canonicalRepositoryRoot(root));
+    this.changeSetWorktreeDigestProfiles.set(draft.id, "repository");
+    this.mcpChangeSets.delete(draft.id);
+    return okEnvelope("practices.waive", {
+      schemaVersion: "archcontext.practice-waiver-plan/v1",
+      waiver,
+      waiverDigest: digestJson(waiver),
+      ownerRegistry,
+      path,
+      draft,
+      preview: this.changeSetEngine.preview(session.workspace.root, draft)
+    });
+  }
+  async planUpdate(root, rawInput) {
+    this.assertRunning();
+    let input;
+    try {
+      input = decodeRuntimePlanUpdateInput(rawInput);
+    } catch (error) {
+      if (error instanceof RuntimeUpdateInputError) {
+        return errorEnvelope("plan_update", "AC_SCHEMA_INVALID", error.message);
+      }
+      throw error;
+    }
+    const session = await this.openSession(root);
+    const model = await this.readModelStore.validateModel(session.workspace);
+    const worktreeDigestProfile = input.worktreeDigestPrecondition?.profile ?? "repository";
+    const worktreeDigest = runtimeWorktreeDigest(root, worktreeDigestProfile);
+    if (input.worktreeDigestPrecondition && input.worktreeDigestPrecondition.expectedDigest !== worktreeDigest) {
+      throw new Error("Worktree digest changed before plan");
+    }
+    const draft = this.changeSetEngine.plan({
+      id: input.id,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: input.reason ?? { taskSessionId: "task_runtime" },
+      operations: input.operations
+    });
+    this.changesets.set(draft.id, draft);
+    this.changeSetRoots.set(draft.id, canonicalRepositoryRoot(root));
+    this.changeSetWorktreeDigestProfiles.set(draft.id, worktreeDigestProfile);
+    if (input.approvalChannel === "mcp")
+      this.mcpChangeSets.add(draft.id);
+    else
+      this.mcpChangeSets.delete(draft.id);
+    return okEnvelope("plan_update", {
+      draft,
+      changeSetDigest: digestJson(draft),
+      preview: this.changeSetEngine.preview(root, draft)
+    });
+  }
+  async approveMcpProjection(root, input) {
+    this.assertRunning();
+    try {
+      validateProjectionInvocation(input);
+      if (!projectionInvocationWrites(input))
+        throw new Error("Projection approval requires an apply, adopt or recover invocation");
+      assertProjectionInvocationSnapshot(root, input);
+    } catch (error) {
+      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+    }
+    const now = Date.parse(this.clock());
+    if (!Number.isFinite(now))
+      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", "Approval clock is invalid");
+    for (const [key, grant] of this.mcpApprovals)
+      if (grant.expiresAt <= now)
+        this.mcpApprovals.delete(key);
+    if (this.mcpApprovals.size >= 256)
+      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", "Too many outstanding approvals; consume an approval or wait for expiry");
+    const approvalToken = randomBytes5(32).toString("hex");
+    const expiresAt = now + 5 * 60000;
+    this.mcpApprovals.set(digestJson(approvalToken), { scope: "projection", root: canonicalRepositoryRoot(root), invocationDigest: digestJson(input), expiresAt });
+    return okEnvelope("projection.approve", { approvalToken, expiresAt: new Date(expiresAt).toISOString() });
+  }
+  async mcpProjection(root, input, approvalToken) {
+    this.assertRunning();
+    try {
+      validateProjectionInvocation(input);
+    } catch (error) {
+      return errorEnvelope("projection", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
+    }
+    if (projectionInvocationWrites(input)) {
+      const denied = () => errorEnvelope("projection", "AC_USER_CONFIRMATION_REQUIRED", "A fresh one-time token from archctx projection approve is required");
+      if (typeof approvalToken !== "string" || !/^[a-f0-9]{64}$/.test(approvalToken))
+        return denied();
+      const key = digestJson(approvalToken);
+      const grant = this.mcpApprovals.get(key);
+      this.mcpApprovals.delete(key);
+      const now = Date.parse(this.clock());
+      if (!grant || grant.scope !== "projection" || !Number.isFinite(now) || grant.expiresAt <= now || grant.root !== canonicalRepositoryRoot(root) || grant.invocationDigest !== digestJson(input))
+        return denied();
+    }
+    return this.projection(root, input);
+  }
+  async approveMcpUpdate(root, input) {
+    this.assertRunning();
+    const draft = this.changesets.get(input?.id);
+    const canonicalRoot = canonicalRepositoryRoot(root);
+    const now = Date.parse(this.clock());
+    if (!draft || this.changeSetRoots.get(input.id) !== canonicalRoot || this.changeSetWorktreeDigestProfiles.get(input.id) !== "repository" || input.expectedChangeSetDigest !== digestJson(draft) || input.expectedWorktreeDigest !== draft.base.worktreeDigest || input.expectedWorktreeDigest !== runtimeWorktreeDigest(root, "repository") || !Number.isFinite(now)) {
+      return errorEnvelope("approve_mcp_update", "AC_PRECONDITION_FAILED", "Approval must match the current ChangeSet preview and repository");
+    }
+    for (const [key, grant] of this.mcpApprovals)
+      if (grant.expiresAt <= now)
+        this.mcpApprovals.delete(key);
+    if (this.mcpApprovals.size >= 256)
+      return errorEnvelope("approve_mcp_update", "AC_PRECONDITION_FAILED", "Too many outstanding approvals; consume an approval or wait for expiry");
+    const approvalToken = randomBytes5(32).toString("hex");
+    const expiresAt = now + 5 * 60000;
+    this.mcpApprovals.set(digestJson(approvalToken), {
+      scope: "changeset",
+      root: canonicalRoot,
+      id: input.id,
+      draftDigest: input.expectedChangeSetDigest,
+      worktreeDigest: input.expectedWorktreeDigest,
+      expiresAt
+    });
+    return okEnvelope("approve_mcp_update", { approvalToken, expiresAt: new Date(expiresAt).toISOString() });
+  }
+  async applyMcpUpdate(root, input) {
+    this.assertRunning();
+    const denied = () => errorEnvelope("apply_update", "AC_USER_CONFIRMATION_REQUIRED", "A fresh one-time token from archctx approve is required");
+    if (typeof input?.approvalToken !== "string" || !/^[a-f0-9]{64}$/.test(input.approvalToken))
+      return denied();
+    const key = digestJson(input.approvalToken);
+    const grant = this.mcpApprovals.get(key);
+    if (!grant)
+      return denied();
+    this.mcpApprovals.delete(key);
+    const draft = this.changesets.get(input.id);
+    const now = Date.parse(this.clock());
+    if (grant.scope !== "changeset" || !Number.isFinite(now) || grant.expiresAt <= now || grant.root !== canonicalRepositoryRoot(root) || grant.id !== input.id || grant.worktreeDigest !== input.expectedWorktreeDigest || !draft || grant.draftDigest !== digestJson(draft))
+      return denied();
+    return this.applyAuthorizedUpdate(root, { id: input.id, expectedWorktreeDigest: input.expectedWorktreeDigest, approved: true });
+  }
+  async applyUpdate(root, rawInput) {
+    this.assertRunning();
+    if (this.mcpChangeSets.has(rawInput?.id)) {
+      return errorEnvelope("apply_update", "AC_USER_CONFIRMATION_REQUIRED", "MCP ChangeSets require a one-time approval token through applyMcpUpdate");
+    }
+    return this.applyAuthorizedUpdate(root, rawInput);
+  }
+  async applyAuthorizedUpdate(root, rawInput) {
+    this.assertRunning();
+    let input;
+    try {
+      input = decodeRuntimeApplyUpdateInput(rawInput);
+    } catch (error) {
+      if (error instanceof RuntimeUpdateInputError) {
+        return errorEnvelope("apply_update", "AC_SCHEMA_INVALID", error.message);
+      }
+      throw error;
+    }
+    return this.withWriter(async () => {
+      const draft = this.changesets.get(input.id);
+      if (!draft)
+        throw new Error(`Unknown ChangeSet: ${input.id}`);
+      const plannedProfile = this.changeSetWorktreeDigestProfiles.get(input.id);
+      if (!plannedProfile)
+        throw new Error("ChangeSet worktree digest profile missing before apply");
+      const requestedProfile = input.worktreeDigestProfile ?? "repository";
+      if (requestedProfile !== plannedProfile)
+        throw new Error("ChangeSet worktree digest profile changed before apply");
+      const current = runtimeWorktreeDigest(root, plannedProfile);
+      if (current !== input.expectedWorktreeDigest)
+        throw new Error("Worktree digest changed before apply");
+      const session = await this.openSession(root);
+      if (draft.base.headSha !== session.workspace.headSha)
+        throw new Error("ChangeSet HEAD changed before apply");
+      if (draft.base.worktreeDigest !== current)
+        throw new Error("ChangeSet worktree digest changed before apply");
+      const currentModel = await this.readModelStore.validateModel(session.workspace);
+      const baseErrors = baseModelBlockingErrors(currentModel);
+      if (baseErrors.length > 0) {
+        throw new Error(`ChangeSet base model is invalid: ${baseErrors.join("; ")}`);
+      }
+      if (draft.base.modelDigest !== currentModel.modelDigest)
+        throw new Error("ChangeSet model digest changed before apply");
+      if (input.projectionApplyReceipt && await this.localStore.inspectProjectionApplyReceipt(input.projectionApplyReceipt.identity.lookupKey)) {
+        return errorEnvelope("apply_update", "AC_PRECONDITION_FAILED", "committed projection receipt requires explicit projection recover");
+      }
+      const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
+      const transitionBase = captureModelTransitionBase(root, approved);
+      let ledgerAppend;
+      let appliedJournalId;
+      const writesLedger = architectureLedgerWriteAppendsEvents(this.architectureLedger.writeMode);
+      const result = await this.changeSetEngine.apply(root, approved, {
+        approved: input.approved,
+        afterModelValidatedBeforeCommit: async ({ journalId }) => {
+          appliedJournalId = journalId;
+          if (transitionBase && journalId)
+            await recordModelTransitionEvidence(this.localStore, root, journalId, transitionBase);
+          if (journalId && this.context.projectionPlannedDrafts.has(draft))
+            await this.localStore.recordChangeSetProjectionOwner(journalId);
+          if (input.projectionApplyReceipt) {
+            if (!journalId)
+              throw new Error("projection apply receipt requires a durable ChangeSet journal");
+            await this.localStore.recordProjectionApplyReceipt(journalId, input.projectionApplyReceipt);
+          }
+          if (writesLedger) {
+            const appended = await this.appendAppliedChangeSetToArchitectureLedger(root, session, approved, journalId);
+            ledgerAppend = {
+              status: "appended",
+              appendedEventCount: appended.appendedEvents.length,
+              duplicateEventCount: appended.duplicateEvents.length,
+              graphDigest: appended.graphDigest,
+              entityCount: appended.entityCount,
+              relationCount: appended.relationCount,
+              constraintCount: appended.constraintCount
+            };
+          }
+          return { journalCommitted: writesLedger && Boolean(journalId) };
+        }
+      });
+      return okEnvelope("apply_update", {
+        ...result,
+        ...appliedJournalId ? { journalId: appliedJournalId } : {},
+        architectureLedger: {
+          ...this.architectureLedger,
+          append: writesLedger ? ledgerAppend ?? { status: "not-appended" } : { status: "not-applicable" }
+        }
+      });
+    });
+  }
+  async appendAppliedChangeSetToArchitectureLedger(root, session, draft, journalId) {
+    const paths = runtimeStatePaths(root);
+    const scope = {
+      repository: {
+        repositoryId: session.workspace.repositoryId,
+        storageRepositoryId: paths.storageRepositoryId
+      },
+      worktree: {
+        workspaceId: paths.workspaceId,
+        storageWorkspaceId: paths.storageWorkspaceId,
+        branch: readCurrentBranch(root),
+        headSha: session.workspace.headSha,
+        worktreeDigest: computeWorktreeDigest(root)
+      }
+    };
+    const plan = planChangeSetApplyToArchitectureLedgerEvent({
+      ...scope,
+      draft,
+      files: listModelFiles(root),
+      previousEvidenceState: await this.localStore.replayArchitectureLedgerEvidence(scope),
+      createdAt: this.clock(),
+      writeMode: this.architectureLedger.writeMode === "ledger-with-projection" ? "ledger-with-projection" : "dual",
+      command: "archctx apply"
+    });
+    if (journalId)
+      await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
+    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
+    const result = await this.appendArchitectureEventsWithFeed(root, appendInput, journalId);
+    return result;
+  }
+  async acceptCommittedChange(root, rawInput) {
+    this.assertRunning();
+    let input;
+    try {
+      input = decodeAcceptCommittedChangeInput(rawInput);
+    } catch (error) {
+      if (error instanceof AcceptCommittedChangeInputError)
+        return errorEnvelope("ledger.accept-committed", "AC_SCHEMA_INVALID", error.message);
+      throw error;
+    }
+    if (this.architectureLedger.readMode !== "yaml" || this.architectureLedger.writeMode !== "yaml") {
+      return errorEnvelope("ledger.accept-committed", "AC_PRECONDITION_FAILED", "committed YAML acceptance requires YAML read and write authority");
+    }
+    return this.withWriter(async () => {
+      try {
+        const canonicalRoot = canonicalRepositoryRoot(root);
+        const journals = [];
+        for (const ref of input.journals)
+          journals.push(await this.localStore.readCommittedChangeSet(canonicalRoot, ref.journalId));
+        const model = loadNativeModelFromArchContext(canonicalRoot);
+        const worktreeDigest = architectureDocumentationProjectionWorktreeDigest(canonicalRoot, model);
+        const projection3 = buildArchitectureDocsProjection(this.projectionHost(), canonicalRoot, new Date(0).toISOString(), "repo-harness/v1");
+        const scope = acceptedCommittedChangeScope(canonicalRoot, worktreeDigest, resolveAcceptanceHeadSha(canonicalRoot));
+        const manifestWrite = await this.localStore.readLatestCommittedChangeSetFile(canonicalRoot, "docs/architecture/.projection-manifest.json");
+        const acceptance = planCommittedChangeAcceptance(canonicalRoot, {
+          requested: input.journals,
+          journals,
+          model,
+          existingFiles: projection3.loaded.existingFiles,
+          latestJournaledManifest: manifestWrite,
+          projection: projection3.plan,
+          currentEvidence: projection3.snapshotEvidence,
+          projectionWorktreeDigest: worktreeDigest,
+          scope
+        });
+        if (!input.approved) {
+          return okEnvelope("ledger.accept-committed", { status: "preview", plan: acceptance.plan, acceptancePlanId: acceptance.acceptancePlanId, expectedWorktreeDigest: worktreeDigest });
+        }
+        if (input.expectedWorktreeDigest !== worktreeDigest)
+          throw new Error("accepted ChangeSet expected worktree digest mismatch");
+        if (input.acceptancePlanId !== acceptance.acceptancePlanId)
+          throw new Error("accepted ChangeSet acceptance plan changed since preview");
+        const accepted = (event2, replayed) => {
+          const recorded = acceptedChangeFromEventV2(event2);
+          if (!recorded || !event2.eventHash)
+            throw new Error("committed ChangeSet acceptance readback failed");
+          return okEnvelope("ledger.accept-committed", {
+            status: "accepted",
+            replayed,
+            acceptedChange: recorded.acceptedChange,
+            acceptancePlanId: recorded.acceptancePlanId,
+            journalIds: input.journals.map((journal) => journal.journalId),
+            eventHash: event2.eventHash,
+            fileSetDigest: acceptance.plan.fileSetDigest
+          });
+        };
+        const existing = await this.localStore.readArchitectureEvent({ ...scope, eventId: acceptance.acceptedChange.eventId });
+        if (existing) {
+          if (acceptedChangeFromEventV2(existing)?.acceptancePlanId === acceptance.acceptancePlanId)
+            return accepted(existing, true);
+          throw new Error(`committed ChangeSet already has a different acceptance event at this snapshot: ${existing.eventId}`);
+        }
+        const ledgerGraphDigest = architectureLedgerStateDigest(await this.localStore.readArchitectureLedgerState(scope));
+        const event = acceptedCommittedChangeEventV2({ acceptance, scope, ledgerGraphDigest, timestamp: this.clock() });
+        const appended = await this.appendArchitectureEventsWithFeed(canonicalRoot, { writer: "runtime-daemon", events: [event] });
+        if (appended.appendedEvents.length !== 1)
+          throw new Error("committed ChangeSet acceptance event was not appended");
+        const readback = await this.localStore.readArchitectureEvent({ ...scope, eventId: event.eventId });
+        if (!readback || readback.eventType !== event.eventType || readback.payloadVersion !== event.payloadVersion) {
+          throw new Error("committed ChangeSet acceptance readback failed");
+        }
+        return accepted(readback, false);
+      } catch (error) {
+        return errorEnvelope("ledger.accept-committed", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+      }
+    });
+  }
+  assertRunning() {
+    this.context.assertRunning();
+  }
+  clock() {
+    return this.context.clock();
+  }
+  openSession(root) {
+    return this.context.openSession(root);
+  }
+  withWriter(fn) {
+    return this.context.withWriter(fn);
+  }
+  appendArchitectureEventsWithFeed(root, input, journalId) {
+    return this.context.appendArchitectureEventsWithFeed(root, input, journalId);
+  }
+  projectionHost() {
+    return this.context.projectionHost();
+  }
+  projection(root, input) {
+    return this.context.projection(root, input);
+  }
+}
+function runtimeWorktreeDigest(root, profile) {
+  switch (profile) {
+    case "repository":
+      return computeWorktreeDigest(root);
+    case "architecture-documentation-projection":
+      return architectureDocumentationProjectionWorktreeDigest(root, loadNativeModelFromArchContext(root));
+    default:
+      throw new RuntimeUpdateInputError(`unsupported worktree digest profile: ${String(profile)}`);
+  }
+}
+function acceptedCommittedChangeScope(root, worktreeDigest, headSha) {
+  const paths = runtimeStatePaths(root);
+  return {
+    repository: { repositoryId: repositoryFingerprint(root), storageRepositoryId: paths.storageRepositoryId },
+    worktree: {
+      workspaceId: projectionWorkspaceId(root),
+      storageWorkspaceId: paths.storageWorkspaceId,
+      branch: readCurrentBranch(root),
+      headSha,
+      worktreeDigest
+    }
+  };
+}
+function safePracticeWaiverId(explicit, waiver) {
+  const explicitTrimmed = explicit?.trim();
+  if (explicitTrimmed && (explicitTrimmed === "." || explicitTrimmed === ".." || explicitTrimmed.includes("/") || explicitTrimmed.includes("\\"))) {
+    throw new Error("practice-waiver-id-invalid");
+  }
+  const evidencePrefix = waiver.evidenceDigest.startsWith("sha256:") ? waiver.evidenceDigest.slice("sha256:".length, "sha256:".length + 12) : waiver.evidenceDigest.slice(0, 12);
+  const candidate = (explicitTrimmed || [waiver.practiceId.replace(/\./g, "-"), waiver.checkId ?? "all", evidencePrefix].join("-")).replace(/[^A-Za-z0-9_.-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 96);
+  if (!candidate || candidate === "." || candidate === ".." || candidate.includes("/") || candidate.includes("\\")) {
+    throw new Error("practice-waiver-id-invalid");
+  }
+  return candidate;
+}
+function architectureLedgerWriteAppendsEvents(mode) {
+  return mode === "dual" || mode === "ledger-with-projection";
+}
+
 // packages/local-runtime/runtime-daemon/src/rpc-server.ts
 init_src();
 import { createServer as createServer2 } from "node:http";
 import { closeSync as closeSync9, mkdirSync as mkdirSync12, rmSync as rmSync15 } from "node:fs";
 import { dirname as dirname14 } from "node:path";
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 var DEFAULT_DAEMON_IDLE_TIMEOUT_MS = 30 * 60000;
 var DAEMON_IDLE_TIMEOUT_ENV = "ARCHCONTEXT_DAEMON_IDLE_TIMEOUT_MS";
 function resolveDaemonIdleTimeoutMs(explicit) {
@@ -47444,7 +47992,7 @@ class ArchctxRuntimeRpcServer {
     mkdirSync12(dirname14(connectionPath), { recursive: true });
     mkdirSync12(dirname14(lockPath), { recursive: true });
     this.lockFd = acquireDaemonLock(lockPath, root);
-    const token = this.options.token ?? randomBytes5(18).toString("base64url");
+    const token = this.options.token ?? randomBytes6(18).toString("base64url");
     const server = createServer2((request, response) => {
       this.handleRequest(request, response).catch((error) => {
         writeJson(response, 500, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: error instanceof Error ? error.message : String(error) });
@@ -47710,10 +48258,9 @@ async function readRpcRequestBody(request, limits) {
 }
 
 // packages/local-runtime/runtime-daemon/src/index.ts
-import { randomBytes as randomBytes6 } from "node:crypto";
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync26 } from "node:fs";
-import { resolve as resolve25 } from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import { resolve as resolve26 } from "node:path";
 init_src();
 
 // packages/local-runtime/runtime-daemon/src/egress.ts
@@ -47783,75 +48330,6 @@ function localEgressStatus2(env = process.env, live = {}) {
 }
 
 // packages/local-runtime/runtime-daemon/src/index.ts
-class RuntimeUpdateInputError extends Error {
-}
-function decodeRuntimeWorktreeDigestProfile(value, field) {
-  switch (value) {
-    case "repository":
-    case "architecture-documentation-projection":
-      return value;
-    default:
-      throw new RuntimeUpdateInputError(`${field} must be repository or architecture-documentation-projection`);
-  }
-}
-function decodeRuntimePlanUpdateInput(value) {
-  const input = runtimeUpdateInputRecord(value, "plan_update input");
-  if (typeof input.id !== "string" || input.id.length === 0) {
-    throw new RuntimeUpdateInputError("plan_update id must be a non-empty string");
-  }
-  if (!Array.isArray(input.operations)) {
-    throw new RuntimeUpdateInputError("plan_update operations must be an array");
-  }
-  if (input.approvalChannel !== undefined && input.approvalChannel !== "mcp") {
-    throw new RuntimeUpdateInputError("plan_update approvalChannel must be mcp");
-  }
-  let worktreeDigestPrecondition;
-  if (input.worktreeDigestPrecondition !== undefined) {
-    const precondition = runtimeUpdateInputRecord(input.worktreeDigestPrecondition, "plan_update worktreeDigestPrecondition");
-    const profile = decodeRuntimeWorktreeDigestProfile(precondition.profile, "plan_update worktreeDigestPrecondition.profile");
-    if (profile !== "architecture-documentation-projection") {
-      throw new RuntimeUpdateInputError("plan_update worktreeDigestPrecondition.profile must be architecture-documentation-projection");
-    }
-    if (typeof precondition.expectedDigest !== "string" || precondition.expectedDigest.length === 0) {
-      throw new RuntimeUpdateInputError("plan_update worktreeDigestPrecondition.expectedDigest must be a non-empty string");
-    }
-    worktreeDigestPrecondition = { profile, expectedDigest: precondition.expectedDigest };
-  }
-  return {
-    id: input.id,
-    operations: input.operations,
-    ...input.approvalChannel === "mcp" ? { approvalChannel: "mcp" } : {},
-    ...input.reason === undefined ? {} : { reason: input.reason },
-    ...worktreeDigestPrecondition === undefined ? {} : { worktreeDigestPrecondition }
-  };
-}
-function decodeRuntimeApplyUpdateInput(value) {
-  const input = runtimeUpdateInputRecord(value, "apply_update input");
-  if (typeof input.id !== "string" || input.id.length === 0) {
-    throw new RuntimeUpdateInputError("apply_update id must be a non-empty string");
-  }
-  if (typeof input.approved !== "boolean") {
-    throw new RuntimeUpdateInputError("apply_update approved must be a boolean");
-  }
-  if (typeof input.expectedWorktreeDigest !== "string" || input.expectedWorktreeDigest.length === 0) {
-    throw new RuntimeUpdateInputError("apply_update expectedWorktreeDigest must be a non-empty string");
-  }
-  const worktreeDigestProfile = input.worktreeDigestProfile === undefined ? undefined : decodeRuntimeWorktreeDigestProfile(input.worktreeDigestProfile, "apply_update worktreeDigestProfile");
-  return {
-    id: input.id,
-    approved: input.approved,
-    expectedWorktreeDigest: input.expectedWorktreeDigest,
-    ...worktreeDigestProfile === undefined ? {} : { worktreeDigestProfile },
-    ...input.projectionApplyReceipt === undefined ? {} : { projectionApplyReceipt: input.projectionApplyReceipt }
-  };
-}
-function runtimeUpdateInputRecord(value, field) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new RuntimeUpdateInputError(`${field} must be an object`);
-  }
-  return value;
-}
-
 class ArchitectureLedgerReadModelStore {
   fallback;
   localStore;
@@ -47940,12 +48418,8 @@ class ArchctxDaemon {
   maxRepoSessions;
   composition;
   sessions = new Map;
-  changesets = new Map;
-  changeSetRoots = new Map;
-  mcpChangeSets = new Set;
+  changeSetAuthority;
   projectionPlannedDrafts = new WeakSet;
-  mcpApprovals = new Map;
-  changeSetWorktreeDigestProfiles = new Map;
   auditRunAbortControllers = new Map;
   landscapes;
   explorerServer;
@@ -48077,6 +48551,20 @@ class ArchctxDaemon {
       worktreeDigest: runtimeWorktreeDigest,
       loadSourceChanges: loadCapabilitySourceChangesSinceStamps
     });
+    this.changeSetAuthority = new ChangeSetAuthorityService({
+      projectionPlannedDrafts: this.projectionPlannedDrafts,
+      assertRunning: () => this.assertRunning(),
+      clock: this.clock,
+      openSession: (root) => this.openSession(root),
+      withWriter: (run) => this.withWriter(run),
+      appendArchitectureEventsWithFeed: (root, input, journalId) => this.appendArchitectureEventsWithFeed(root, input, journalId),
+      projectionHost: () => this.projectionHost(),
+      projection: (root, input) => this.projection(root, input),
+      readModelStore: this.readModelStore,
+      localStore: this.localStore,
+      changeSetEngine: this.changeSetEngine,
+      architectureLedger: this.architectureLedger
+    });
     this.developerReviewRuns = new DeveloperReviewRunService(() => this.assertRunning(), this.clock);
     this.externalDocumentation = deps.externalDocumentation ?? new Context7ExternalDocumentationAdapter({
       enabled: process.env[CONTEXT7_ENABLED_ENV] === "1",
@@ -48146,7 +48634,7 @@ class ArchctxDaemon {
     try {
       for (const controller of this.auditRunAbortControllers.values())
         controller.abort();
-      this.mcpApprovals.clear();
+      this.changeSetAuthority.clearApprovals();
       this.sessions.clear();
       this.practiceCheckpoints.clear();
       this.explorerProjections.clearDeferredChangeFeedFailures();
@@ -48290,65 +48778,7 @@ class ArchctxDaemon {
     return this.practiceCheckpoints.practiceWaivers(root);
   }
   async planPracticeWaiver(root, input) {
-    this.assertRunning();
-    const session = await this.openSession(root);
-    const model = await this.readModelStore.validateModel(session.workspace);
-    let ownerRegistry;
-    try {
-      ownerRegistry = loadPracticeWaiverOwnerRegistry(session.workspace.root);
-    } catch (error) {
-      return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
-    }
-    const waiver = {
-      schemaVersion: "archcontext.practice-waiver/v1",
-      practiceId: input.practiceId,
-      ...input.checkId === undefined ? {} : { checkId: input.checkId },
-      scope: {
-        ...input.pathGlobs && input.pathGlobs.length > 0 ? { pathGlobs: input.pathGlobs } : {},
-        ...input.subjects && input.subjects.length > 0 ? { subjects: input.subjects } : {}
-      },
-      owner: input.owner,
-      reason: input.reason,
-      createdAt: input.createdAt ?? this.clock(),
-      reviewAt: input.reviewAt,
-      expiresAt: input.expiresAt,
-      evidenceDigest: input.evidenceDigest
-    };
-    let waiverId;
-    try {
-      validatePracticeWaiver(waiver, "practice waiver input", { allowedOwners: ownerRegistry.owners });
-      waiverId = safePracticeWaiverId(input.waiverId, waiver);
-    } catch (error) {
-      return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
-    }
-    const path = `.archcontext/waivers/${waiverId}.json`;
-    const absolute = resolve25(session.workspace.root, path);
-    const body = `${JSON.stringify(waiver, null, 2)}
-`;
-    const expectedHash = existsSync24(absolute) ? digestJson({ body: readFileSync26(absolute, "utf8") }) : "missing";
-    const draft = this.changeSetEngine.plan({
-      id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
-      base: {
-        headSha: session.workspace.headSha,
-        worktreeDigest: session.snapshot.worktreeDigest,
-        modelDigest: model.modelDigest
-      },
-      reason: { taskSessionId: input.taskSessionId ?? "task_runtime" },
-      operations: [{ op: "write_waiver", path, expectedHash, body }]
-    });
-    this.changesets.set(draft.id, draft);
-    this.changeSetRoots.set(draft.id, canonicalRepositoryRoot(root));
-    this.changeSetWorktreeDigestProfiles.set(draft.id, "repository");
-    this.mcpChangeSets.delete(draft.id);
-    return okEnvelope("practices.waive", {
-      schemaVersion: "archcontext.practice-waiver-plan/v1",
-      waiver,
-      waiverDigest: digestJson(waiver),
-      ownerRegistry,
-      path,
-      draft,
-      preview: this.changeSetEngine.preview(session.workspace.root, draft)
-    });
+    return this.changeSetAuthority.planPracticeWaiver(root, input);
   }
   async docs(root, input) {
     return this.externalDocumentationService.docs(root, input);
@@ -48357,45 +48787,7 @@ class ArchctxDaemon {
     return this.externalDocumentationService.readResource(root, uri);
   }
   async planUpdate(root, rawInput) {
-    this.assertRunning();
-    let input;
-    try {
-      input = decodeRuntimePlanUpdateInput(rawInput);
-    } catch (error) {
-      if (error instanceof RuntimeUpdateInputError) {
-        return errorEnvelope("plan_update", "AC_SCHEMA_INVALID", error.message);
-      }
-      throw error;
-    }
-    const session = await this.openSession(root);
-    const model = await this.readModelStore.validateModel(session.workspace);
-    const worktreeDigestProfile = input.worktreeDigestPrecondition?.profile ?? "repository";
-    const worktreeDigest = runtimeWorktreeDigest(root, worktreeDigestProfile);
-    if (input.worktreeDigestPrecondition && input.worktreeDigestPrecondition.expectedDigest !== worktreeDigest) {
-      throw new Error("Worktree digest changed before plan");
-    }
-    const draft = this.changeSetEngine.plan({
-      id: input.id,
-      base: {
-        headSha: session.workspace.headSha,
-        worktreeDigest,
-        modelDigest: model.modelDigest
-      },
-      reason: input.reason ?? { taskSessionId: "task_runtime" },
-      operations: input.operations
-    });
-    this.changesets.set(draft.id, draft);
-    this.changeSetRoots.set(draft.id, canonicalRepositoryRoot(root));
-    this.changeSetWorktreeDigestProfiles.set(draft.id, worktreeDigestProfile);
-    if (input.approvalChannel === "mcp")
-      this.mcpChangeSets.add(draft.id);
-    else
-      this.mcpChangeSets.delete(draft.id);
-    return okEnvelope("plan_update", {
-      draft,
-      changeSetDigest: digestJson(draft),
-      preview: this.changeSetEngine.preview(root, draft)
-    });
+    return this.changeSetAuthority.planUpdate(root, rawInput);
   }
   async completeTask(root, input = {}) {
     this.assertRunning();
@@ -48504,177 +48896,19 @@ class ArchctxDaemon {
     return runProjectionProtocolCommand(input, root, this.projectionHost());
   }
   async approveMcpProjection(root, input) {
-    this.assertRunning();
-    try {
-      validateProjectionInvocation(input);
-      if (!projectionInvocationWrites(input))
-        throw new Error("Projection approval requires an apply, adopt or recover invocation");
-      assertProjectionInvocationSnapshot(root, input);
-    } catch (error) {
-      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
-    }
-    const now = Date.parse(this.clock());
-    if (!Number.isFinite(now))
-      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", "Approval clock is invalid");
-    for (const [key, grant] of this.mcpApprovals)
-      if (grant.expiresAt <= now)
-        this.mcpApprovals.delete(key);
-    if (this.mcpApprovals.size >= 256)
-      return errorEnvelope("projection.approve", "AC_PRECONDITION_FAILED", "Too many outstanding approvals; consume an approval or wait for expiry");
-    const approvalToken = randomBytes6(32).toString("hex");
-    const expiresAt = now + 5 * 60000;
-    this.mcpApprovals.set(digestJson(approvalToken), { scope: "projection", root: canonicalRepositoryRoot(root), invocationDigest: digestJson(input), expiresAt });
-    return okEnvelope("projection.approve", { approvalToken, expiresAt: new Date(expiresAt).toISOString() });
+    return this.changeSetAuthority.approveMcpProjection(root, input);
   }
   async mcpProjection(root, input, approvalToken) {
-    this.assertRunning();
-    try {
-      validateProjectionInvocation(input);
-    } catch (error) {
-      return errorEnvelope("projection", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
-    }
-    if (projectionInvocationWrites(input)) {
-      const denied = () => errorEnvelope("projection", "AC_USER_CONFIRMATION_REQUIRED", "A fresh one-time token from archctx projection approve is required");
-      if (typeof approvalToken !== "string" || !/^[a-f0-9]{64}$/.test(approvalToken))
-        return denied();
-      const key = digestJson(approvalToken);
-      const grant = this.mcpApprovals.get(key);
-      this.mcpApprovals.delete(key);
-      const now = Date.parse(this.clock());
-      if (!grant || grant.scope !== "projection" || !Number.isFinite(now) || grant.expiresAt <= now || grant.root !== canonicalRepositoryRoot(root) || grant.invocationDigest !== digestJson(input))
-        return denied();
-    }
-    return this.projection(root, input);
+    return this.changeSetAuthority.mcpProjection(root, input, approvalToken);
   }
   async approveMcpUpdate(root, input) {
-    this.assertRunning();
-    const draft = this.changesets.get(input?.id);
-    const canonicalRoot = canonicalRepositoryRoot(root);
-    const now = Date.parse(this.clock());
-    if (!draft || this.changeSetRoots.get(input.id) !== canonicalRoot || this.changeSetWorktreeDigestProfiles.get(input.id) !== "repository" || input.expectedChangeSetDigest !== digestJson(draft) || input.expectedWorktreeDigest !== draft.base.worktreeDigest || input.expectedWorktreeDigest !== runtimeWorktreeDigest(root, "repository") || !Number.isFinite(now)) {
-      return errorEnvelope("approve_mcp_update", "AC_PRECONDITION_FAILED", "Approval must match the current ChangeSet preview and repository");
-    }
-    for (const [key, grant] of this.mcpApprovals)
-      if (grant.expiresAt <= now)
-        this.mcpApprovals.delete(key);
-    if (this.mcpApprovals.size >= 256)
-      return errorEnvelope("approve_mcp_update", "AC_PRECONDITION_FAILED", "Too many outstanding approvals; consume an approval or wait for expiry");
-    const approvalToken = randomBytes6(32).toString("hex");
-    const expiresAt = now + 5 * 60000;
-    this.mcpApprovals.set(digestJson(approvalToken), {
-      scope: "changeset",
-      root: canonicalRoot,
-      id: input.id,
-      draftDigest: input.expectedChangeSetDigest,
-      worktreeDigest: input.expectedWorktreeDigest,
-      expiresAt
-    });
-    return okEnvelope("approve_mcp_update", { approvalToken, expiresAt: new Date(expiresAt).toISOString() });
+    return this.changeSetAuthority.approveMcpUpdate(root, input);
   }
   async applyMcpUpdate(root, input) {
-    this.assertRunning();
-    const denied = () => errorEnvelope("apply_update", "AC_USER_CONFIRMATION_REQUIRED", "A fresh one-time token from archctx approve is required");
-    if (typeof input?.approvalToken !== "string" || !/^[a-f0-9]{64}$/.test(input.approvalToken))
-      return denied();
-    const key = digestJson(input.approvalToken);
-    const grant = this.mcpApprovals.get(key);
-    if (!grant)
-      return denied();
-    this.mcpApprovals.delete(key);
-    const draft = this.changesets.get(input.id);
-    const now = Date.parse(this.clock());
-    if (grant.scope !== "changeset" || !Number.isFinite(now) || grant.expiresAt <= now || grant.root !== canonicalRepositoryRoot(root) || grant.id !== input.id || grant.worktreeDigest !== input.expectedWorktreeDigest || !draft || grant.draftDigest !== digestJson(draft))
-      return denied();
-    return this.applyAuthorizedUpdate(root, { id: input.id, expectedWorktreeDigest: input.expectedWorktreeDigest, approved: true });
+    return this.changeSetAuthority.applyMcpUpdate(root, input);
   }
   async applyUpdate(root, rawInput) {
-    this.assertRunning();
-    if (this.mcpChangeSets.has(rawInput?.id)) {
-      return errorEnvelope("apply_update", "AC_USER_CONFIRMATION_REQUIRED", "MCP ChangeSets require a one-time approval token through applyMcpUpdate");
-    }
-    return this.applyAuthorizedUpdate(root, rawInput);
-  }
-  async applyAuthorizedUpdate(root, rawInput) {
-    this.assertRunning();
-    let input;
-    try {
-      input = decodeRuntimeApplyUpdateInput(rawInput);
-    } catch (error) {
-      if (error instanceof RuntimeUpdateInputError) {
-        return errorEnvelope("apply_update", "AC_SCHEMA_INVALID", error.message);
-      }
-      throw error;
-    }
-    return this.withWriter(async () => {
-      const draft = this.changesets.get(input.id);
-      if (!draft)
-        throw new Error(`Unknown ChangeSet: ${input.id}`);
-      const plannedProfile = this.changeSetWorktreeDigestProfiles.get(input.id);
-      if (!plannedProfile)
-        throw new Error("ChangeSet worktree digest profile missing before apply");
-      const requestedProfile = input.worktreeDigestProfile ?? "repository";
-      if (requestedProfile !== plannedProfile)
-        throw new Error("ChangeSet worktree digest profile changed before apply");
-      const current = runtimeWorktreeDigest(root, plannedProfile);
-      if (current !== input.expectedWorktreeDigest)
-        throw new Error("Worktree digest changed before apply");
-      const session = await this.openSession(root);
-      if (draft.base.headSha !== session.workspace.headSha)
-        throw new Error("ChangeSet HEAD changed before apply");
-      if (draft.base.worktreeDigest !== current)
-        throw new Error("ChangeSet worktree digest changed before apply");
-      const currentModel = await this.readModelStore.validateModel(session.workspace);
-      const baseErrors = baseModelBlockingErrors(currentModel);
-      if (baseErrors.length > 0) {
-        throw new Error(`ChangeSet base model is invalid: ${baseErrors.join("; ")}`);
-      }
-      if (draft.base.modelDigest !== currentModel.modelDigest)
-        throw new Error("ChangeSet model digest changed before apply");
-      if (input.projectionApplyReceipt && await this.localStore.inspectProjectionApplyReceipt(input.projectionApplyReceipt.identity.lookupKey)) {
-        return errorEnvelope("apply_update", "AC_PRECONDITION_FAILED", "committed projection receipt requires explicit projection recover");
-      }
-      const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
-      const transitionBase = captureModelTransitionBase(root, approved);
-      let ledgerAppend;
-      let appliedJournalId;
-      const writesLedger = architectureLedgerWriteAppendsEvents(this.architectureLedger.writeMode);
-      const result = await this.changeSetEngine.apply(root, approved, {
-        approved: input.approved,
-        afterModelValidatedBeforeCommit: async ({ journalId }) => {
-          appliedJournalId = journalId;
-          if (transitionBase && journalId)
-            await recordModelTransitionEvidence(this.localStore, root, journalId, transitionBase);
-          if (journalId && this.projectionPlannedDrafts.has(draft))
-            await this.localStore.recordChangeSetProjectionOwner(journalId);
-          if (input.projectionApplyReceipt) {
-            if (!journalId)
-              throw new Error("projection apply receipt requires a durable ChangeSet journal");
-            await this.localStore.recordProjectionApplyReceipt(journalId, input.projectionApplyReceipt);
-          }
-          if (writesLedger) {
-            const appended = await this.appendAppliedChangeSetToArchitectureLedger(root, session, approved, journalId);
-            ledgerAppend = {
-              status: "appended",
-              appendedEventCount: appended.appendedEvents.length,
-              duplicateEventCount: appended.duplicateEvents.length,
-              graphDigest: appended.graphDigest,
-              entityCount: appended.entityCount,
-              relationCount: appended.relationCount,
-              constraintCount: appended.constraintCount
-            };
-          }
-          return { journalCommitted: writesLedger && Boolean(journalId) };
-        }
-      });
-      return okEnvelope("apply_update", {
-        ...result,
-        ...appliedJournalId ? { journalId: appliedJournalId } : {},
-        architectureLedger: {
-          ...this.architectureLedger,
-          append: writesLedger ? ledgerAppend ?? { status: "not-appended" } : { status: "not-applicable" }
-        }
-      });
-    });
+    return this.changeSetAuthority.applyUpdate(root, rawInput);
   }
   async inspectProjectionApplyReceipt(root, lookupKey) {
     return this.projectionApplies.inspectProjectionApplyReceipt(root, lookupKey);
@@ -48688,112 +48922,8 @@ class ArchctxDaemon {
   async recoverProjectionApply(root, intent) {
     return this.projectionApplies.recoverProjectionApply(root, intent);
   }
-  async appendAppliedChangeSetToArchitectureLedger(root, session, draft, journalId) {
-    const paths = runtimeStatePaths(root);
-    const scope = {
-      repository: {
-        repositoryId: session.workspace.repositoryId,
-        storageRepositoryId: paths.storageRepositoryId
-      },
-      worktree: {
-        workspaceId: paths.workspaceId,
-        storageWorkspaceId: paths.storageWorkspaceId,
-        branch: readCurrentBranch(root),
-        headSha: session.workspace.headSha,
-        worktreeDigest: computeWorktreeDigest(root)
-      }
-    };
-    const plan = planChangeSetApplyToArchitectureLedgerEvent({
-      ...scope,
-      draft,
-      files: listModelFiles(root),
-      previousEvidenceState: await this.localStore.replayArchitectureLedgerEvidence(scope),
-      createdAt: this.clock(),
-      writeMode: this.architectureLedger.writeMode === "ledger-with-projection" ? "ledger-with-projection" : "dual",
-      command: "archctx apply"
-    });
-    if (journalId)
-      await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
-    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
-    const result = await this.appendArchitectureEventsWithFeed(root, appendInput, journalId);
-    return result;
-  }
   async acceptCommittedChange(root, rawInput) {
-    this.assertRunning();
-    let input;
-    try {
-      input = decodeAcceptCommittedChangeInput(rawInput);
-    } catch (error) {
-      if (error instanceof AcceptCommittedChangeInputError)
-        return errorEnvelope("ledger.accept-committed", "AC_SCHEMA_INVALID", error.message);
-      throw error;
-    }
-    if (this.architectureLedger.readMode !== "yaml" || this.architectureLedger.writeMode !== "yaml") {
-      return errorEnvelope("ledger.accept-committed", "AC_PRECONDITION_FAILED", "committed YAML acceptance requires YAML read and write authority");
-    }
-    return this.withWriter(async () => {
-      try {
-        const canonicalRoot = canonicalRepositoryRoot(root);
-        const journals = [];
-        for (const ref of input.journals)
-          journals.push(await this.localStore.readCommittedChangeSet(canonicalRoot, ref.journalId));
-        const model = loadNativeModelFromArchContext(canonicalRoot);
-        const worktreeDigest = architectureDocumentationProjectionWorktreeDigest(canonicalRoot, model);
-        const projection3 = buildArchitectureDocsProjection(this.projectionHost(), canonicalRoot, new Date(0).toISOString(), "repo-harness/v1");
-        const scope = acceptedCommittedChangeScope(canonicalRoot, worktreeDigest, resolveAcceptanceHeadSha(canonicalRoot));
-        const manifestWrite = await this.localStore.readLatestCommittedChangeSetFile(canonicalRoot, "docs/architecture/.projection-manifest.json");
-        const acceptance = planCommittedChangeAcceptance(canonicalRoot, {
-          requested: input.journals,
-          journals,
-          model,
-          existingFiles: projection3.loaded.existingFiles,
-          latestJournaledManifest: manifestWrite,
-          projection: projection3.plan,
-          currentEvidence: projection3.snapshotEvidence,
-          projectionWorktreeDigest: worktreeDigest,
-          scope
-        });
-        if (!input.approved) {
-          return okEnvelope("ledger.accept-committed", { status: "preview", plan: acceptance.plan, acceptancePlanId: acceptance.acceptancePlanId, expectedWorktreeDigest: worktreeDigest });
-        }
-        if (input.expectedWorktreeDigest !== worktreeDigest)
-          throw new Error("accepted ChangeSet expected worktree digest mismatch");
-        if (input.acceptancePlanId !== acceptance.acceptancePlanId)
-          throw new Error("accepted ChangeSet acceptance plan changed since preview");
-        const accepted = (event2, replayed) => {
-          const recorded = acceptedChangeFromEventV2(event2);
-          if (!recorded || !event2.eventHash)
-            throw new Error("committed ChangeSet acceptance readback failed");
-          return okEnvelope("ledger.accept-committed", {
-            status: "accepted",
-            replayed,
-            acceptedChange: recorded.acceptedChange,
-            acceptancePlanId: recorded.acceptancePlanId,
-            journalIds: input.journals.map((journal) => journal.journalId),
-            eventHash: event2.eventHash,
-            fileSetDigest: acceptance.plan.fileSetDigest
-          });
-        };
-        const existing = await this.localStore.readArchitectureEvent({ ...scope, eventId: acceptance.acceptedChange.eventId });
-        if (existing) {
-          if (acceptedChangeFromEventV2(existing)?.acceptancePlanId === acceptance.acceptancePlanId)
-            return accepted(existing, true);
-          throw new Error(`committed ChangeSet already has a different acceptance event at this snapshot: ${existing.eventId}`);
-        }
-        const ledgerGraphDigest = architectureLedgerStateDigest(await this.localStore.readArchitectureLedgerState(scope));
-        const event = acceptedCommittedChangeEventV2({ acceptance, scope, ledgerGraphDigest, timestamp: this.clock() });
-        const appended = await this.appendArchitectureEventsWithFeed(canonicalRoot, { writer: "runtime-daemon", events: [event] });
-        if (appended.appendedEvents.length !== 1)
-          throw new Error("committed ChangeSet acceptance event was not appended");
-        const readback = await this.localStore.readArchitectureEvent({ ...scope, eventId: event.eventId });
-        if (!readback || readback.eventType !== event.eventType || readback.payloadVersion !== event.payloadVersion) {
-          throw new Error("committed ChangeSet acceptance readback failed");
-        }
-        return accepted(readback, false);
-      } catch (error) {
-        return errorEnvelope("ledger.accept-committed", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
-      }
-    });
+    return this.changeSetAuthority.acceptCommittedChange(root, rawInput);
   }
   async ledgerState(root) {
     this.assertRunning();
@@ -49073,7 +49203,7 @@ class ArchctxDaemon {
   }
   async restoreRepositorySessions() {
     for (const record3 of await this.localStore.listRepositorySessions()) {
-      if (!record3.root || !existsSync24(record3.root))
+      if (!record3.root || !existsSync25(record3.root))
         continue;
       if (repositoryFingerprint(record3.root) !== record3.repositoryId)
         continue;
@@ -49135,16 +49265,6 @@ class ArchctxDaemon {
 function shortDigest3(digest2) {
   return digest2.replace(/^sha256:/, "").slice(0, 16);
 }
-function runtimeWorktreeDigest(root, profile) {
-  switch (profile) {
-    case "repository":
-      return computeWorktreeDigest(root);
-    case "architecture-documentation-projection":
-      return architectureDocumentationProjectionWorktreeDigest(root, loadNativeModelFromArchContext(root));
-    default:
-      throw new RuntimeUpdateInputError(`unsupported worktree digest profile: ${String(profile)}`);
-  }
-}
 function codeFactsDigest(snapshot) {
   return digestJson({
     schemaVersion: "archcontext.code-facts-digest/v1",
@@ -49170,19 +49290,6 @@ function architectureLedgerScopeForWorkspace(workspace) {
     }
   };
 }
-function acceptedCommittedChangeScope(root, worktreeDigest, headSha) {
-  const paths = runtimeStatePaths(root);
-  return {
-    repository: { repositoryId: repositoryFingerprint(root), storageRepositoryId: paths.storageRepositoryId },
-    worktree: {
-      workspaceId: projectionWorkspaceId(root),
-      storageWorkspaceId: paths.storageWorkspaceId,
-      branch: readCurrentBranch(root),
-      headSha,
-      worktreeDigest
-    }
-  };
-}
 function validateModelFiles(files) {
   const errors2 = [];
   const paths = new Set(files.map((file) => file.path));
@@ -49227,18 +49334,6 @@ function schemaVersionFromModelBody(body) {
   } catch {}
   return "";
 }
-function safePracticeWaiverId(explicit, waiver) {
-  const explicitTrimmed = explicit?.trim();
-  if (explicitTrimmed && (explicitTrimmed === "." || explicitTrimmed === ".." || explicitTrimmed.includes("/") || explicitTrimmed.includes("\\"))) {
-    throw new Error("practice-waiver-id-invalid");
-  }
-  const evidencePrefix = waiver.evidenceDigest.startsWith("sha256:") ? waiver.evidenceDigest.slice("sha256:".length, "sha256:".length + 12) : waiver.evidenceDigest.slice(0, 12);
-  const candidate = (explicitTrimmed || [waiver.practiceId.replace(/\./g, "-"), waiver.checkId ?? "all", evidencePrefix].join("-")).replace(/[^A-Za-z0-9_.-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 96);
-  if (!candidate || candidate === "." || candidate === ".." || candidate.includes("/") || candidate.includes("\\")) {
-    throw new Error("practice-waiver-id-invalid");
-  }
-  return candidate;
-}
 async function createStartedDaemon(deps = {}) {
   const daemon = new ArchctxDaemon(deps);
   await daemon.start();
@@ -49359,9 +49454,6 @@ function readRuntimeArchitectureLedgerWriteMode(value) {
 function architectureLedgerReadAuthority(mode) {
   return mode === "ledger" ? "ledger" : "yaml";
 }
-function architectureLedgerWriteAppendsEvents(mode) {
-  return mode === "dual" || mode === "ledger-with-projection";
-}
 var GIT_OBJECT_NAME_PATTERN = /^[0-9a-f]{7,64}$/;
 function readChangedPathsSince(root, commit) {
   if (!GIT_OBJECT_NAME_PATTERN.test(commit)) {
@@ -49400,7 +49492,7 @@ function blockedProductionInjections(deps) {
   ].filter((key) => (key in deps));
 }
 function completeTaskProjectionDrift(root) {
-  if (!existsSync24(resolve25(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync25(resolve26(root, "docs/architecture/.projection-manifest.json")))
     return;
   const profile = loadArchitectureDocumentationProfile(root);
   const loaded = loadArchitectureDocumentationInputs(root, profile);
@@ -50280,7 +50372,7 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
         const subcommand = args2[0] ?? "list";
         if (subcommand === "add") {
           const root = readFlag(args2, "--root") ?? cwd;
-          if (resolve26(root) !== resolve26(cwd)) {
+          if (resolve27(root) !== resolve27(cwd)) {
             return errorEnvelope("repo.add", "AC_CAPABILITY_UNSUPPORTED", "Multi-repo architecture context is outside the Local Core MVP; run archctx inside one Git repository.");
           }
           const daemon2 = await runtime();
@@ -51517,8 +51609,8 @@ function auditManifestGateRoot(cwd) {
   }
 }
 function auditGithubIssuesEnabled(cwd) {
-  const manifestPath = resolve26(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
-  if (!existsSync25(manifestPath))
+  const manifestPath = resolve27(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
+  if (!existsSync26(manifestPath))
     return false;
   let raw;
   try {
@@ -51904,7 +51996,7 @@ async function runGithubCommand(args2, cwd, deps) {
   }
   if (subcommand === "disconnect") {
     const connection = await deps.githubConnectionReader?.readVerifiedConnection({ repositoryRoot: cwd });
-    const localRecordRemoved = existsSync25(connectionPath);
+    const localRecordRemoved = existsSync26(connectionPath);
     rmSync16(connectionPath, { force: true });
     return okEnvelope("github.disconnect", {
       connected: connection !== undefined,
@@ -52216,7 +52308,7 @@ async function readReviewChallengeV2Arg(args2, cwd, commandName = "github verify
   if (!inline && !challengePath)
     return { ok: false, message: `${commandName} requires --challenge-json or --challenge-path` };
   try {
-    const raw = inline ?? readFileSync27(resolve26(cwd, challengePath), "utf8");
+    const raw = inline ?? readFileSync27(resolve27(cwd, challengePath), "utf8");
     const parsed = JSON.parse(raw);
     const attestation = await Promise.resolve().then(() => (init_src6(), exports_src2));
     const assertReviewChallengeV23 = attestation.assertReviewChallengeV2;
@@ -52691,10 +52783,10 @@ function doctorSqlite(cwd) {
   const legacyLocalStore = inspectLegacyLocalStoreMigration(cwd);
   return {
     path,
-    exists: existsSync25(path),
+    exists: existsSync26(path),
     migrations: productVersionManifest().runtime.sqliteMigrations,
     legacyPath: paths.legacyLocalStorePath,
-    legacyExists: existsSync25(paths.legacyLocalStorePath),
+    legacyExists: existsSync26(paths.legacyLocalStorePath),
     legacyLocalStore
   };
 }
@@ -52725,7 +52817,7 @@ function runtimePathsReport(cwd) {
   };
 }
 function pathAccess(path) {
-  const exists = existsSync25(path);
+  const exists = existsSync26(path);
   return {
     path,
     exists,
@@ -53183,7 +53275,7 @@ async function waitForDaemonReady(cwd, timeoutMs, shouldStop) {
   return;
 }
 function sleep(ms) {
-  return new Promise((resolve27) => setTimeout(resolve27, ms));
+  return new Promise((resolve28) => setTimeout(resolve28, ms));
 }
 function readFileTail(path, maxBytes = 4096) {
   try {
@@ -53196,8 +53288,8 @@ function readFileTail(path, maxBytes = 4096) {
 async function runForegroundDaemon(cwd, args2) {
   const daemon = await createStartedProductionDaemon({ root: cwd });
   let resolveStopped;
-  const stopped = new Promise((resolve27) => {
-    resolveStopped = resolve27;
+  const stopped = new Promise((resolve28) => {
+    resolveStopped = resolve28;
   });
   const idleTimeoutFlag = readFlag(args2, "--idle-timeout-ms");
   const server = new ArchctxRuntimeRpcServer(daemon, {