ast-mcp-server 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -6,7 +6,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.13.0] — local release candidate, pending release (2026-08-27)
+## [0.14.0] — not yet published (2026-10-25)
+
+### Changed
+
+- Migrated schema validation to Zod 4 (`^4.6.7`). The published `tools/list` contract changes shape and Zod's validation error messages differ: tool input schemas no longer all declare `additionalProperties: false` (16 of 16 before, 1 of 16 now), shared `$ref` definitions are inlined (27 before, 0 now), the serialized `tools/list` grows from 100,923 to 126,562 bytes, integer fields declare a maximum of 9007199254740991, and UUID fields gain a `pattern`. Clients that cache or diff the advertised schemas should refresh them.
+
+### Security
+
+- Upgraded `@modelcontextprotocol/sdk` to `^1.32.1` (GHSA-6qxp-vccf-f47h), `body-parser` to 2.4.0, and `zod` to 4.6.7 for the memory-exhaustion advisory, and raised the `hono` and `fast-uri` resolutions to 4.13.13 and 3.1.9. `yarn audit` reports no suggestions.
+
+## [0.13.1] — published to `latest` and `next`, registry verified (2026-09-01)
+
+### Fixed
+
+- The DeepSeek Harness adapter now opts into a bounded canonical-JSON text projection when a successful MCP result has structured data but no ordinary text, preserving lossless `structuredContent` while making native Agent/Session results useful and durable. The mandatory pinned-host smoke freezes the public 0.13.0 RED baseline and verifies the released correction across the next model request, persisted `tool/result`, cold replay, guarded catalog, and cleanup readback.
+- `ast_explore` now publishes its complete object input schema while retaining all cross-field runtime rejection, and `ast_get_impact` no longer advertises one false output shape across JSON and TOON. The pinned Harness gate binds the public empty-schema RED to released registry/native parity and unchanged hashes for the other 14 model schemas.
+- Timeout ownership is now explicit across the Harness, queue, and AST worker: the shipped outer timeout exceeds the complete queue/execution/margin budget, deterministic slow work returns bounded AST-owned operational errors, queued work never starts after its deadline, cancellation remains correlated across worker generations, and cleanup proves zero active work, held requests, listeners, or owned processes.
+- Harness lifecycle handling now converges deterministically through MCP removal and reconnect, rejects retired-generation effects, preserves AST `REQUEST_CANCELLED` authority separately from bridge transport observations, and completes correlated shutdown without residual state. The pinned native and rendered-GUI gates verify the `15→0→15` catalog sequence, request/header identity, secret-safe diagnostics, and ordered cleanup that still runs every owner check after an earlier cleanup failure.
+
+### Release status
+
+- npm published immutable `0.13.1` bytes with integrity `sha512-jqgGoYs8fe7J+E25lZusLK4wV6sjM5n5qiWnfe1RJIxOFo1r5nbtcBr1a/fdSWTYf/37bUNkshQp86UrdBHOsA==`. Public-registry verification passed; `latest` and `next` both resolve to `0.13.1`; and npm `gitHead`, the annotated `v0.13.1` tag, and the GitHub Release target exact commit `27b80a3da169b473a3b5c5dfea69ed52903ed4c7`.
+- Main CI `33460585683`, Security `33460585625`, publish `33461292810`, verification `33461385440`, and promotion retry `33461651288` are green. Initial promotion run `33461571363` changed `latest` successfully but its bounded readback timed out; the verified idempotent retry is authoritative.
+
+## [0.13.0] — published to `latest` and `next`, registry verified (2026-08-29)
 
 ### Added
 

package/README.md

@@ -46,8 +46,8 @@ Reads can start with a bounded file slice, a compact outline, or exact source on
 - Use `ast_explore` when the question spans discovery and evidence. Its default summary is bounded; use `detail: "context"` for selected source and `detail: "full"` for source plus compiler references.
 - Use `ast_get_outline` for a compact body-free view of a known file without source lines.
 - Use `ast_get_symbol_source` when one declaration or implementation is the required evidence.
-- Use `ast_get_impact` when the exact symbol is known and bounded direct/transitive compiler relationships are needed; it is read-only evidence, not a mutation plan.
-- Use `ast_find_test_candidates` when an exact symbol should map to conservative test candidates. It forces incoming compiler traversal, returns complete relationship paths, and never executes tests.
+- Use `ast_get_impact` when the exact symbol is known and bounded direct/transitive compiler relationships are needed. Check `coverage`, `work`, `truncation`, `incomplete`, and `proven_empty`; this is read-only evidence, not a mutation plan.
+- Use `ast_find_test_candidates` when an exact symbol should map to conservative tests. It admits only complete incoming `reference`, `import`, `export`, `extends`, `implements`, and `call` evidence, returns whole paths, and never executes tests.
 
 `snapshot_state: "fresh"` means that the returned file bytes match the synchronized compiler snapshot. The separate `freshness` object describes the project/session state and preserves causes such as source changes or watcher failure. Neither field means that the project has zero TypeScript diagnostics; use `ast_get_diagnostics` for compiler errors and warnings.
 
@@ -64,7 +64,20 @@ The server exposes evidence labels instead of collapsing every result into an un
 
 Freshness is orthogonal to TypeScript diagnostics. `fresh` means the evidence matches the synchronized snapshot; `pending`, `rebuilding`, `stale`, or `degraded` means the response must not be presented as current compiler evidence. Read tools expose the state, causes (`source_change`, `config_change`, `index_failure`, `watcher_failure`, or `compiler_rebuild`), and bounded `checked_at` timestamp. `ast_get_impact` refuses non-fresh compiler relationships. `ast_explore` returns the state together with `completeness`, `unresolved`, `budget`, and `truncation` metadata rather than silently dropping evidence.
 
-All reads are budgeted. Callers control pagination and, where applicable, `max_bytes`, `reference_limit`, `max_depth`, `max_nodes`, and `max_edges`; responses report the effective limits and whether a record, byte, depth, edge, invocation, or serialization limit truncated the result. A truncated or unresolved result is incomplete evidence, not an empty negative result. `ast_find_test_candidates` follows the same rule: it accepts only fresh, exact compiler-backed impact, emits direct/transitive evidence and bounded relationship IDs, and never executes tests or guesses from filenames alone. Only a complete authoritative traversal may return `candidates: []` with `proven_empty: true`.
+All reads are budgeted. Callers control pagination and, where applicable, `max_bytes`, `reference_limit`, `max_depth`, `max_nodes`, and `max_edges`; responses report effective limits. A bounded stop is incomplete evidence, not an empty negative result.
+
+Impact has two independent completeness channels:
+
+| Channel           | Evidence                                                                                                                            | Incomplete when                                      |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| Semantic coverage | One canonical cell per requested kind, direction, and endpoint class: `not_applicable`, `completed`, `unsupported`, or `unfinished` | Any applicable cell is `unsupported` or `unfinished` |
+| Traversal/work    | `truncation` plus `work.work_limit_reached` and its counters                                                                        | A depth/node/edge/work bound prevents completion     |
+
+`incomplete` is true when either channel is incomplete. `proven_empty` is true only when there are zero edges, every applicable cell completed, and no bound was exhausted. The public seven-kind/default impact request includes `contains`; because no scoped `contains` producer exists, applicable default or explicit containment is `unsupported`, so the result is incomplete even when traversal was not truncated.
+
+`ast_find_test_candidates` deliberately excludes `contains` and fixes the admission scope to six incoming kinds: `reference`, `import`, `export`, `extends`, `implements`, and `call`. It returns `INCOMPLETE_EVIDENCE` before pagination for stale, inexact, unresolved, truncated, work-exhausted, unsupported, or unfinished evidence. Only complete six-kind authority may return `candidates: []` with `completeness.proven_empty: true`; pagination slices deterministic candidates while each proof and the unpaginated `coverage`, `work`, and traversal metadata stay whole.
+
+These fields are additive: existing edge shapes, kind strings, defaults, and public errors remain stable. MCP `ast_get_impact` JSON and TOON represent the same logical coverage/work result; candidate MCP output remains canonical JSON, while read-only batch output may encode that same candidate result as TOON. Property, element, dynamic, computed-key, and external-alternative dispatch remains edge-free and unfinished—this contract does not certify the deferred #219 or #220 classifiers.
 
 ## Why this helps
 
@@ -84,7 +97,7 @@ The included batch benchmark records a 50% reduction in model round-trips and a
 
 ## Supported environment and trust boundary
 
-Published v0.12.0 requires Node.js `>=22.13.0`; its immutable evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Managed setup-file publication additionally requires GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, and `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures or systems without those filesystem primitives, macOS, and Windows remain unverified.
+Published v0.12.0 requires Node.js `>=22.13.0`; its immutable evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Structural apply and managed setup-file publication are verified only on Linux x64 with GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`/`O_NOFOLLOW`, and a destination filesystem that passes the owned link/exchange identity probe. A failed or denied primitive blocks mutation before source effects; there is no rename, copy/delete, or pathname-only fallback. Other Linux architectures or systems without this complete matrix, macOS, and Windows remain unverified.
 
 This is a local stdio server. It runs with the invoking user's filesystem permissions, and clients may request any `project_root` that user can access. It does not provide HTTP authentication, sandboxing, tenant isolation, or a remote-service security boundary. Remote, untrusted, and multi-tenant operation is unsupported.
 
@@ -329,30 +342,47 @@ A thin adapter ships inside this package: `cordis.patch.yml` mounts the packaged
 [`@deepseek-ai/dsh-mcp-client`](https://github.com/deepseek-ai/deepseek-harness/blob/cd5ef8148158c3a752a658978873241fdf8e2bbc/packages/mcp/mcp-client/README.md)
 bridge, declared through exactly `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }`.
 This is a Developer Preview against a pinned, **source-built** Harness revision
-(`dsh-v0.1.2-alpha.1` at `cd5ef8148158c3a752a658978873241fdf8e2bbc`); that revision
-is validated from source, and `ast-mcp-server@0.13.0` is not published yet. Install a
-locally packed tarball instead:
+(`dsh-v0.1.2-alpha.1` at `cd5ef8148158c3a752a658978873241fdf8e2bbc`). The published
+`ast-mcp-server@0.13.0` package is the compatibility baseline:
+
+```bash
+dsh plugin --profile web add ast-mcp-server@0.13.0
+```
+
+For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.13.0.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.14.0.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is
 denied by a fail-closed guard: `ast_apply_operation` is not registered unless
 `AST_MCP_APPLY_GUARD=allow` is set explicitly (the shipped patch instead pins `deny`,
-so the Harness surface stays deny-by-default; an unset or invalid value also denies). Known upstream
-gaps apply and are never safety authority: the official bridge drops MCP tool
-annotations (`readOnlyHint`/`destructiveHint`) and launches the stdio child outside
-the Harness sandbox.
-
-`yarn test:dsh-adapter` is the mandatory verification: it packs the exact tarball,
-installs it into an isolated profile on the pinned Harness, proves `--dump-config`
-composition including effective `tools.mode: native`, and — through the Harness registry
-itself — invokes the server-qualified read, dry-run rename prepare, and preview tools.
-It separately proves `mcp__ast__ast_apply_operation` is absent and that a bounded direct
-registry invocation is rejected. The smoke fails (never skips) if the pinned Harness
-revision, tag, CLI/client version, clean source identity, or a prerequisite is missing.
+so the Harness surface stays deny-by-default; an unset or invalid value also denies).
+The adapter also sets `AST_MCP_TEXT_PROJECTION=canonical_json`: successful structured
+results keep their lossless `structuredContent` and gain canonical JSON text only when
+ordinary MCP text is empty, because the pinned native presenter otherwise exposes only a
+non-useful empty-result marker. The projection is adapter-specific, never replaces existing
+text, and reports an explicit size-limit marker when the complete supervised frame has room.
+If even the unchanged structured-only result exceeds the existing worker frame, supervised mode
+fails closed rather than truncating or corrupting it. Known upstream gaps remain non-authoritative:
+the official bridge drops MCP tool annotations
+(`readOnlyHint`/`destructiveHint`) and launches the stdio child outside the Harness sandbox.
+
+`yarn test:dsh-adapter` is the mandatory verification. It binds the public 0.13.0 npm
+integrity, packs the candidate, builds the pinned Harness and bridge from source, and proves
+`tools.mode: native`, the 15-tool scoped catalog, complete executable input schemas,
+read/prepare/preview, all three invalid `ast_explore` combinations, apply absence, and rejected direct apply.
+The schema gate freezes the public empty `ast_explore` contract as RED, requires the candidate
+registry/native definitions to match, and hashes all 14 unaffected model schemas. A deterministic
+two-step model then invokes
+`mcp__ast__ast_get_project_status` through a real headless Agent/Session: the public baseline
+must reproduce the empty-result marker, while the corrected candidate must deliver lossless
+canonical JSON to the next model request, the durable `tool/result`, and a cold Agent
+resume/replay reconstructed from persistence. The smoke removes and read-backs its disposable
+profile/workspace state and fails
+(never skips) on an identity mismatch, missing prerequisite, lifecycle leak, or evidence gap.
 
 ## MCP tools
 
@@ -512,12 +542,13 @@ Apply loads the exact retained postimages, requires the separately supplied revi
 
 ### Guarantee boundary
 
-The server does **not** claim a filesystem-wide transaction:
+The server does **not** claim a filesystem-wide transaction or safety against a continuously mutating writer:
 
-- Replacement is atomic per file where the local filesystem provides atomic rename.
-- A multi-file apply has a short interval in which some replacements may already be visible.
-- Rollback is best effort and refuses to overwrite a file changed by another writer after replacement.
-- MCP and CLI apply share a fail-closed filesystem lock keyed by canonical `tsconfig.json` when they use the same state directory. It does not coordinate editors, NFS writers, or hostile external processes.
+- Each replacement exchanges and authenticates one staged/destination pair. Multi-file apply remains sequential, so earlier postimages may be visible before later files commit.
+- Reverse rollback restores only an exact operation-owned pair. Lost ownership preserves the observable entries and returns `AMBIGUOUS_APPLY`; it never falls back to pathname replacement.
+- Creation is no-clobber. Once a created inode is published, a later failure cannot safely infer unlink ownership, so the destination and hidden stage are preserved and rollback fails closed as ambiguous.
+- MCP and CLI apply share a fail-closed filesystem lock keyed by canonical `tsconfig.json` when they use the same state directory. It does not coordinate editors, NFS writers, writers using another configuration, or hostile external processes.
+- Deterministic promise barriers prove the tested publication/rollback interleavings. They are a threat-boundary test seam, not a global atomicity or continuous-writer guarantee.
 - Receipt persistence runs before that lock is released. If receipt storage fails after source replacement, apply exits non-zero and reports that verified postimages may be present; retry recovers the receipt only when the complete workspace exactly matches the reviewed post-workspace fingerprint.
 - A hard process crash can leave a stale lock. Remove it only after inspecting its metadata and proving no apply is running; exact complete postimages can then recover the receipt, while partial or divergent state remains a conflict.
 - Source encoding support is UTF-8, with or without BOM. Unsupported encodings are rejected.

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.13.0.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.0.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied
@@ -13,6 +13,8 @@
 # - the official bridge drops MCP tool.annotations, incl. readOnlyHint and
 #   destructiveHint, so the guard enumerates tool names instead of hints;
 # - the stdio child runs outside the Harness sandbox.
+# Harness native presentation reads text content, so this adapter explicitly
+# requests a lossless canonical JSON projection while preserving structuredContent.
 - insert:
     - id: mcp-ast
       name: "@deepseek-ai/dsh-mcp-client"
@@ -27,5 +29,10 @@
             )
         env:
           AST_MCP_APPLY_GUARD: "deny"
+          AST_MCP_TEXT_PROJECTION: "canonical_json"
         cwd: !!js process.cwd()
+        toolCallTimeoutMs: !!js >-
+          JSON.parse(process.getBuiltinModule('node:fs').readFileSync(
+            new URL('node_modules/ast-mcp-server/package.json', baseUrl), 'utf8'
+          )).deepseekHarness.timeoutBudget.outerToolCallMs
         failOnStartupError: true

package/dist/batch/schema.js

@@ -20,7 +20,7 @@ const BatchStepSchema = z
     .object({
     id: z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/),
     tool: BatchToolSchema,
-    input: z.record(z.unknown()).default({}),
+    input: z.record(z.string(), z.unknown()).default({}),
     foreach: z
         .object({ $ref: z.string().min(1) })
         .strict()

package/dist/server.js

@@ -2,9 +2,20 @@ import { createRequire } from "node:module";
 import { McpServer, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { PublicOperationalError } from "./services/public-errors.js";
 import { toolCatalog } from "./tools/catalog.js";
-import { createToolErrorContext, errorResult } from "./tools/result.js";
+import { createToolErrorContext, errorResult, projectStructuredContentAsText, } from "./tools/result.js";
 const packageMetadata = createRequire(import.meta.url)("../package.json");
 export const PACKAGE_VERSION = packageMetadata.version;
+function installStructuredContentTextProjection(server) {
+    const registerTool = server.registerTool.bind(server);
+    function projectedRegisterTool(name, config, callback) {
+        const projectedCallback = (async (...args) => {
+            const result = await Reflect.apply(callback, undefined, args);
+            return projectStructuredContentAsText(result, true);
+        });
+        return registerTool(name, config, projectedCallback);
+    }
+    server.registerTool = projectedRegisterTool;
+}
 function installRuntimeActivityTracking(server, runtimeActivity) {
     const registerTool = server.registerTool.bind(server);
     function trackedRegisterTool(name, config, callback) {
@@ -25,6 +36,9 @@ export function createServer(options = {}) {
     });
     if (options.runtimeActivity)
         installRuntimeActivityTracking(server, options.runtimeActivity);
+    if (options.projectStructuredContentAsText === true) {
+        installStructuredContentTextProjection(server);
+    }
     if (options.denyApply === undefined) {
         toolCatalog.registerAll(server);
     }

package/dist/services/authenticated-publication.js

@@ -0,0 +1,181 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+function sameStat(left, right) {
+    const fields = ["dev", "ino", "size", "mode", "mtimeNs", "ctimeNs"];
+    return fields.every((field) => left[field] === right[field]);
+}
+export async function snapshotHeldFile(handle) {
+    const before = await handle.stat({ bigint: true });
+    if (!before.isFile() || before.size > BigInt(Number.MAX_SAFE_INTEGER))
+        throw new Error("Publication descriptor cannot be authenticated");
+    const bytes = await readFile(`/proc/self/fd/${handle.fd}`);
+    const after = await handle.stat({ bigint: true });
+    if (!after.isFile() || !sameStat(before, after))
+        throw new Error("Publication descriptor changed during read");
+    return {
+        dev: after.dev.toString(),
+        ino: after.ino.toString(),
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+        mode: Number(after.mode & 511n),
+    };
+}
+function equal(left, right) {
+    return (left !== undefined &&
+        right !== undefined &&
+        left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.sha256 === right.sha256 &&
+        left.mode === right.mode);
+}
+async function entry(directory, basename) {
+    const target = `/proc/self/fd/${directory.fd}/${basename}`;
+    let handle;
+    try {
+        handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const snapshot = await snapshotHeldFile(handle);
+        const current = await lstat(target, { bigint: true });
+        return current.dev.toString() === snapshot.dev && current.ino.toString() === snapshot.ino
+            ? snapshot
+            : undefined;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    finally {
+        await handle?.close();
+    }
+}
+export async function runPublicationPrimitive(executable, args, fds) {
+    await new Promise((resolve, reject) => {
+        const child = spawn(executable, args, {
+            env: { LANG: "C", LC_ALL: "C", PATH: "/usr/bin:/bin" },
+            shell: false,
+            stdio: ["ignore", "ignore", "pipe", ...fds],
+            windowsHide: true,
+        });
+        let failure;
+        let stderrBytes = 0;
+        const fail = (message, cause) => {
+            if (failure)
+                return;
+            failure = new Error(message, cause === undefined ? undefined : { cause });
+            child.kill("SIGKILL");
+        };
+        const timeout = setTimeout(() => fail("Publication primitive timed out"), 5_000);
+        child.stderr.on("data", (chunk) => {
+            stderrBytes += chunk.byteLength;
+            if (stderrBytes > 4_096)
+                fail("Publication primitive stderr exceeded limit");
+        });
+        child.on("error", (error) => fail("Publication primitive unavailable", error));
+        child.on("close", (code, signal) => {
+            clearTimeout(timeout);
+            if (failure)
+                reject(failure);
+            else if (code === 0 && signal === null)
+                resolve();
+            else
+                reject(new Error(`Publication primitive failed (${signal ?? code ?? "unknown"})`));
+        });
+    });
+}
+export const exchangeDirectoryEntries = (directory, left, right) => runPublicationPrimitive("/usr/bin/mv", ["--exchange", "--no-copy", "-T", "--", `/proc/self/fd/3/${left}`, `/proc/self/fd/3/${right}`], [directory.fd]);
+export const linkHeldFile = (source, directory, basename) => runPublicationPrimitive("/usr/bin/ln", ["-L", "-T", "--", "/proc/self/fd/3", `/proc/self/fd/4/${basename}`], [source.fd, directory.fd]);
+export async function removeOwnedPublicationEntry(directory, basename, expected) {
+    if (!equal(await entry(directory, basename), expected))
+        return false;
+    await rm(`/proc/self/fd/${directory.fd}/${basename}`);
+    return (await entry(directory, basename)) === undefined;
+}
+export async function rollbackOwnedCommit(token, hooks = {}) {
+    if (token.kind === "creation")
+        return { state: "ambiguous", phase: "rollback" };
+    await hooks.beforeRollback?.();
+    if (!equal(await entry(token.directory, token.destinationBasename), token.destinationIdentity) ||
+        !equal(await entry(token.directory, token.displacedBasename), token.displacedIdentity))
+        return { state: "ambiguous", phase: "rollback" };
+    await exchangeDirectoryEntries(token.directory, token.displacedBasename, token.destinationBasename).catch(() => undefined);
+    const restored = equal(await entry(token.directory, token.destinationBasename), token.displacedIdentity) &&
+        equal(await entry(token.directory, token.displacedBasename), token.destinationIdentity);
+    if (!restored)
+        return { state: "ambiguous", phase: "rollback" };
+    return { state: "rolled_back", reason: "conflict" };
+}
+export async function publishAuthenticated(plan) {
+    if (process.platform !== "linux")
+        return { state: "pre_effect", reason: "unsupported" };
+    await plan.beforePublish?.();
+    if (plan.kind === "creation") {
+        await linkHeldFile(plan.stage, plan.directory, plan.destinationBasename).catch(() => undefined);
+        const destination = await entry(plan.directory, plan.destinationBasename);
+        if (equal(destination, plan.stageIdentity))
+            return {
+                state: "committed",
+                token: {
+                    kind: "creation",
+                    directory: plan.directory,
+                    destinationBasename: plan.destinationBasename,
+                    destinationIdentity: plan.stageIdentity,
+                },
+            };
+        if (destination?.dev === plan.stageIdentity.dev && destination.ino === plan.stageIdentity.ino)
+            return { state: "ambiguous", phase: "commit" };
+        return { state: "pre_effect", reason: destination ? "conflict" : "unsupported" };
+    }
+    await exchangeDirectoryEntries(plan.directory, plan.stageBasename, plan.destinationBasename).catch(() => undefined);
+    const destination = await entry(plan.directory, plan.destinationBasename);
+    const displaced = await entry(plan.directory, plan.stageBasename);
+    if (equal(destination, plan.stageIdentity) && displaced) {
+        const token = {
+            kind: "replacement",
+            directory: plan.directory,
+            destinationBasename: plan.destinationBasename,
+            displacedBasename: plan.stageBasename,
+            destinationIdentity: destination,
+            displacedIdentity: displaced,
+        };
+        const held = plan.preimage && (await snapshotHeldFile(plan.preimage));
+        if (equal(displaced, plan.preimageIdentity) && equal(held, plan.preimageIdentity))
+            return { state: "committed", token };
+        return rollbackOwnedCommit(token, plan);
+    }
+    if (equal(destination, plan.preimageIdentity) && equal(displaced, plan.stageIdentity))
+        return { state: "pre_effect", reason: "unsupported" };
+    return { state: "ambiguous", phase: "commit" };
+}
+export async function probePublicationCapability(parent) {
+    const probe = path.join(parent, `.ast-publication-probe-${randomUUID()}`);
+    const handles = [];
+    try {
+        await mkdir(probe);
+        const directory = await open(probe, "r");
+        handles.push(directory);
+        for (const [name, bytes] of [
+            ["stage", "stage"],
+            ["replacement", "replacement"],
+        ])
+            await writeFile(path.join(probe, name), bytes);
+        const stage = await open(path.join(probe, "stage"), "r");
+        handles.push(stage);
+        const replacement = await open(path.join(probe, "replacement"), "r");
+        handles.push(replacement);
+        const stageIdentity = await snapshotHeldFile(stage);
+        const replacementIdentity = await snapshotHeldFile(replacement);
+        await linkHeldFile(stage, directory, "created");
+        if (!equal(await entry(directory, "created"), stageIdentity))
+            throw new Error("Link unsupported");
+        await exchangeDirectoryEntries(directory, "replacement", "created");
+        if (!equal(await entry(directory, "created"), replacementIdentity) ||
+            !equal(await entry(directory, "replacement"), stageIdentity))
+            throw new Error("Publication exchange unsupported");
+    }
+    finally {
+        await Promise.allSettled(handles.map((handle) => handle.close()));
+        await rm(probe, { recursive: true, force: true });
+    }
+}

package/dist/services/call-spines.js

@@ -17,11 +17,7 @@ export function planCallSpines(root, edges, options) {
     const maxEdges = assertLimit(options.max_edges, 1, "max_edges");
     const accepted = edges.filter(exactCall);
     const freshness = options.freshness?.state ?? edges[0]?.freshness.state;
-    const authorityState = freshness !== "fresh" || accepted.length !== edges.length
-        ? "untrusted"
-        : options.discovery_complete === false
-            ? "incomplete"
-            : "authoritative";
+    const trusted = freshness === "fresh" && accepted.length === edges.length;
     const reasons = new Set();
     const rootKey = endpointKey(root);
     const initial = { endpoint: root, endpoints: [root], relationshipIds: [], depth: 0 };
@@ -82,6 +78,15 @@ export function planCallSpines(root, edges, options) {
         endpoints: record.endpoints,
         relationship_ids: record.relationshipIds,
     }));
+    const reached = new Set(records.keys());
+    const relevantGap = (options.unfinished_gaps ?? []).some((gap) => options.direction === "outgoing"
+        ? reached.has(endpointKey(gap.source))
+        : gap.alternatives.some((alternative) => reached.has(endpointKey(alternative))));
+    const authorityState = !trusted
+        ? "untrusted"
+        : options.discovery_complete === false || relevantGap
+            ? "incomplete"
+            : "authoritative";
     const incomplete = authorityState !== "authoritative" || reasons.size > 0;
     return {
         root,

package/dist/services/compiler-worker-host.js

@@ -4,8 +4,9 @@ import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
 import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
-import { decodeCompilerWorkerEnvelope, startCompilerWorker } from "./compiler-worker-protocol.js";
-import { createCompilerWorkerSpawnSpec, readRuntimePolicy, } from "./runtime-policy.js";
+import { COMPILER_WORKER_MAX_FRAME_BYTES, decodeCompilerWorkerEnvelope, decodeCompilerWorkerResponse, isCompilerWorkerRequestIdWithinBudget, startCompilerWorker, } from "./compiler-worker-protocol.js";
+import { emitConfiguredH03HostEvent } from "./h03-timeout-fixture.js";
+import { createCompilerWorkerSpawnSpec, parseH03FixtureDescriptor, parseH05FixtureDescriptor, readRuntimePolicy, } from "./runtime-policy.js";
 import { emitCompilerWorkerEvent } from "./runtime-logger.js";
 import { PublicOperationalError, renderPublicError } from "./public-errors.js";
 export class CompilerWorkerHostError extends Error {
@@ -17,7 +18,7 @@ export class CompilerWorkerHostError extends Error {
         this.recovery = recovery;
     }
 }
-const bounded = (value) => Buffer.byteLength(JSON.stringify(value)) <= 256 * 1024;
+const bounded = (value) => Buffer.byteLength(JSON.stringify(value)) <= COMPILER_WORKER_MAX_FRAME_BYTES;
 const within = (promise, ms) => Promise.race([
     promise,
     delay(ms, undefined, { ref: false }).then(() => {
@@ -34,7 +35,11 @@ function deferred() {
     return { promise, resolve, reject };
 }
 export function spawnCompilerWorkerProcess(options) {
-    const spec = createCompilerWorkerSpawnSpec(options.workerEntryPath, options.environment);
+    const fixture = parseH03FixtureDescriptor(options.environment.AST_H03_FIXTURE);
+    const lifecycleFixture = parseH05FixtureDescriptor(options.environment.AST_H05_FIXTURE);
+    // prettier-ignore
+    const environment = fixture || lifecycleFixture ? { ...options.environment, ...(fixture ? { AST_H03_FIXTURE: JSON.stringify({ ...fixture, generation: options.generation }) } : {}), ...(lifecycleFixture ? { AST_H05_FIXTURE: JSON.stringify({ ...lifecycleFixture, generation: options.generation }) } : {}) } : options.environment;
+    const spec = createCompilerWorkerSpawnSpec(options.workerEntryPath, environment);
     if (!spec.ok || !spec.command)
         throw new CompilerWorkerHostError("startup");
     const child = spawn(spec.command, spec.args, {
@@ -86,17 +91,12 @@ export function spawnCompilerWorkerProcess(options) {
             snapshots.shift()?.resolve(decoded.value);
     });
     createInterface({ input: child.stdout }).on("line", (line) => {
-        if (Buffer.byteLength(line) > 256 * 1024)
+        const decoded = decodeCompilerWorkerResponse(line);
+        if (!decoded.ok)
             return fail(new CompilerWorkerHostError("protocol"));
-        let message;
-        try {
-            message = JSON.parse(line);
-        }
-        catch {
-            return fail(new CompilerWorkerHostError("protocol"));
-        }
-        if (!("id" in message) || message.id === undefined)
+        if (decoded.kind === "notification")
             return;
+        const message = decoded.value;
         const request = pending.get(message.id);
         if (!request)
             return;
@@ -108,7 +108,10 @@ export function spawnCompilerWorkerProcess(options) {
         });
     });
     const write = (message, acknowledge = false) => {
-        if (!bounded(message) || !child.stdin?.writable)
+        const requestIdWithinBudget = !("id" in message) ||
+            message.id === undefined ||
+            isCompilerWorkerRequestIdWithinBudget(message.id);
+        if (!requestIdWithinBudget || !bounded(message) || !child.stdin?.writable)
             return Promise.reject(new CompilerWorkerHostError("protocol"));
         options.beforeWrite?.(message);
         const writeSequence = ++writes, processed = acknowledge ? deferred() : undefined;
@@ -217,7 +220,7 @@ export class CompilerWorkerHost {
         return this.scheduleIdle(); this.parentAdmission = "closed"; const second = await child.snapshot(); if (child !== this.child || generation !== this.generation || sequence !== this.sequence || activity !== this.activity || !CompilerWorkerHost.quiescent(second)) {
         this.parentAdmission = "open";
         return this.scheduleIdle();
-    } await this.stopChild(child, "requested"); emitCompilerWorkerEvent({ kind: "idle", generation }); this.parentAdmission = "open"; }
+    } await this.stopChild(child, "requested"); emitCompilerWorkerEvent({ kind: "idle", generation }); emitConfiguredH03HostEvent("recycled", generation); this.parentAdmission = "open"; }
     // prettier-ignore
     async stopChild(child, trigger) { const completion = child.shutdown(trigger); try {
         await within(completion, this.timeoutMs);
@@ -412,7 +415,24 @@ export async function runSupervisedStdioServer() {
                 const rendered = ambiguous
                     ? renderPublicError(new PublicOperationalError("AMBIGUOUS_APPLY", "The apply outcome is ambiguous."), ambiguous.correlation_id).envelope.error
                     : undefined;
-                process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id: message.id, error: { code: -32603, message: rendered?.message ?? "Compiler worker request failed.", ...(ambiguous ? { data: { code: "AMBIGUOUS_APPLY", ...ambiguous } } : {}) } })}\n`);
+                const responseId = isCompilerWorkerRequestIdWithinBudget(message.id) ? message.id : null;
+                const candidate = {
+                    jsonrpc: "2.0",
+                    id: responseId,
+                    error: {
+                        code: -32603,
+                        message: rendered?.message ?? "Compiler worker request failed.",
+                        ...(ambiguous ? { data: { code: "AMBIGUOUS_APPLY", ...ambiguous } } : {}),
+                    },
+                };
+                const response = bounded(candidate)
+                    ? candidate
+                    : {
+                        jsonrpc: "2.0",
+                        id: null,
+                        error: { code: -32603, message: "Compiler worker request failed." },
+                    };
+                process.stdout.write(`${JSON.stringify(response)}\n`);
             }
         }
     };