auroq-os 2.5.10 → 2.5.12

package/.auroq-core/core/synapse/engine.js

@@ -123,9 +123,8 @@ class PipelineMetrics {
    * Record that a layer encountered an error.
    *
    * @param {string} name - Layer name
-   * @param {Error} error - The error object
    */
-  errorLayer(name, error) {
+  errorLayer(name) {
     const existing = this.layers[name] || {};
     if (existing.start) {
       const endTime = process.hrtime.bigint();
@@ -135,7 +134,7 @@ class PipelineMetrics {
     this.layers[name] = {
       ...existing,
       status: 'error',
-      error: error && error.message ? error.message : String(error),
+      errorCode: 'SYNAPSE_LAYER_FAILED',
     };
   }
 
@@ -170,8 +169,27 @@ class PipelineMetrics {
 // SynapseEngine
 // ---------------------------------------------------------------------------
 
-/** Hard pipeline timeout in milliseconds. */
+/** Cooperative budget between layers; synchronous work cannot be interrupted. */
 const PIPELINE_TIMEOUT_MS = 100;
+// Keep substantial headroom below the outer hook's 5000 ms safety timeout.
+const MAX_PIPELINE_TIMEOUT_MS = 1000;
+const SYNAPSE_PIPELINE_TIMEOUT_ENV = 'AUROQ_SYNAPSE_PIPELINE_TIMEOUT_MS';
+
+/** Resolve a short pipeline budget. Invalid values preserve the safe default. */
+function resolvePipelineTimeoutMs(config = {}) {
+  const fromEnv = process.env[SYNAPSE_PIPELINE_TIMEOUT_ENV];
+  const value = fromEnv !== undefined && fromEnv !== ''
+    ? fromEnv
+    : config.synapse?.pipelineTimeoutMs;
+  if (value === undefined || value === null) return PIPELINE_TIMEOUT_MS;
+  const timeout = typeof value === 'number' || typeof value === 'string' ? Number(value) : NaN;
+  if (!Number.isInteger(timeout) || timeout <= 0 || timeout > MAX_PIPELINE_TIMEOUT_MS) {
+    // Do not echo invalid values: environment/config may contain private text.
+    console.warn('[synapse:engine] SYNAPSE_INVALID_PIPELINE_TIMEOUT');
+    return PIPELINE_TIMEOUT_MS;
+  }
+  return timeout;
+}
 
 /**
  * NOG-18: Default active layers (L0-L2 only).
@@ -250,8 +268,13 @@ class SynapseEngine {
   async process(prompt, session, processConfig) {
     const safeProcessConfig = (processConfig && typeof processConfig === 'object') ? processConfig : {};
     const mergedConfig = { ...this.config, ...safeProcessConfig };
+    mergedConfig.synapse = { ...(this.config.synapse || {}), ...(safeProcessConfig.synapse || {}) };
+    const pipelineTimeoutMs = resolvePipelineTimeoutMs(mergedConfig);
+    const pipelineNow = typeof safeProcessConfig.nowNs === 'function'
+      ? safeProcessConfig.nowNs
+      : process.hrtime.bigint;
     const metrics = new PipelineMetrics();
-    metrics.totalStart = process.hrtime.bigint();
+    metrics.totalStart = pipelineNow();
 
     // 1. Calculate bracket (or use fixed layers in non-legacy mode)
     const promptCount = (session && session.prompt_count) || 0;
@@ -266,7 +289,7 @@ class SynapseEngine {
 
       // Guard: no layer config (invalid bracket — should not happen)
       if (!layerConfig) {
-        metrics.totalEnd = process.hrtime.bigint();
+        metrics.totalEnd = pipelineNow();
         return { xml: '', metrics: metrics.getSummary() };
       }
       activeLayers = layerConfig.layers;
@@ -291,8 +314,8 @@ class SynapseEngine {
         continue;
       }
 
-      // Check hard pipeline timeout (convert hrtime to ms for comparison)
-      if (Number(process.hrtime.bigint() - metrics.totalStart) / 1e6 > PIPELINE_TIMEOUT_MS) {
+      // Cooperative check between layers; the host owns interruption of a stuck process.
+      if (Number(pipelineNow() - metrics.totalStart) / 1e6 >= pipelineTimeoutMs) {
         // Log remaining layers as skipped
         const remaining = this.layers.slice(this.layers.indexOf(layer));
         for (const r of remaining) {
@@ -314,14 +337,28 @@ class SynapseEngine {
         previousLayers,
       });
 
-      const result = layer._safeProcess(context);
+      let result;
+      try {
+        result = layer._safeProcess(context);
+      } catch (_error) {
+        metrics.errorLayer(layer.name);
+        continue;
+      }
 
       if (result && Array.isArray(result.rules)) {
         metrics.endLayer(layer.name, result.rules.length);
         results.push(result);
         previousLayers.push(result);
       } else if (result === null || result === undefined) {
-        metrics.skipLayer(layer.name, 'Returned null');
+        try {
+          if (typeof layer.getLastError === 'function' && layer.getLastError()) {
+            metrics.errorLayer(layer.name);
+          } else {
+            metrics.skipLayer(layer.name, 'Returned null');
+          }
+        } catch (_error) {
+          metrics.errorLayer(layer.name);
+        }
       } else {
         metrics.skipLayer(layer.name, 'Invalid result format');
       }
@@ -341,8 +378,9 @@ class SynapseEngine {
       }
     }
 
-    metrics.totalEnd = process.hrtime.bigint();
+    metrics.totalEnd = pipelineNow();
     const summary = metrics.getSummary();
+    summary.pipeline_timeout_ms = pipelineTimeoutMs;
 
     // Persist hook metrics (fire-and-forget)
     this._persistHookMetrics(summary, bracket, mergedConfig);
@@ -382,6 +420,7 @@ class SynapseEngine {
       const hookBootMs = hookBootTime ? Number(process.hrtime.bigint() - hookBootTime) / 1e6 : 0;
       const data = {
         totalDuration: summary.total_ms,
+        pipelineTimeoutMs: summary.pipeline_timeout_ms,
         hookBootMs,
         bracket,
         layersLoaded: summary.layers_loaded,
@@ -397,6 +436,7 @@ class SynapseEngine {
           duration: info.duration || 0,
           status: info.status || 'unknown',
           rules: info.rules || 0,
+          ...(info.errorCode ? { errorCode: info.errorCode } : {}),
         };
       }
       fs.writeFileSync(
@@ -413,4 +453,7 @@ module.exports = {
   SynapseEngine,
   PipelineMetrics,
   PIPELINE_TIMEOUT_MS,
+  MAX_PIPELINE_TIMEOUT_MS,
+  SYNAPSE_PIPELINE_TIMEOUT_ENV,
+  resolvePipelineTimeoutMs,
 };

package/.auroq-core/core/synapse/layers/layer-processor.js

@@ -34,6 +34,7 @@ class LayerProcessor {
     this.name = name;
     this.layer = layer;
     this.timeout = timeout;
+    this._lastError = null;
   }
 
   /**
@@ -65,6 +66,7 @@ class LayerProcessor {
    */
   _safeProcess(context) {
     const start = Date.now();
+    this._lastError = null;
     try {
       const result = this.process(context);
       const elapsed = Date.now() - start;
@@ -72,11 +74,18 @@ class LayerProcessor {
         console.warn(`[synapse:${this.name}] Warning: Layer exceeded timeout (${elapsed}ms > ${this.timeout}ms)`);
       }
       return result;
-    } catch (error) {
-      console.warn(`[synapse:${this.name}] Error: ${error.message}`);
+    } catch (_error) {
+      // Raw error messages/stacks can contain prompt or domain content.
+      this._lastError = new Error('SYNAPSE_LAYER_FAILED');
+      console.warn(`[synapse:${this.name}] SYNAPSE_LAYER_FAILED`);
       return null;
     }
   }
+
+  /** Return a content-free failure marker for the engine's metrics. */
+  getLastError() {
+    return this._lastError;
+  }
 }
 
 module.exports = LayerProcessor;

package/.auroq-core/core/synapse/runtime/hook-runtime.js

@@ -6,25 +6,29 @@ const fs = require('fs');
 const DEFAULT_STALE_TTL_HOURS = 168; // 7 days
 
 /**
- * Read stale session TTL from core-config.yaml.
- * Falls back to DEFAULT_STALE_TTL_HOURS (168h = 7 days).
+ * Read optional project configuration without disclosing parse failures.
  *
  * @param {string} cwd - Working directory
- * @returns {number} TTL in hours
+ * @returns {object} Configuration or an empty object
  */
-function getStaleSessionTTL(cwd) {
+function loadCoreConfig(cwd) {
   try {
-    const yaml = require('js-yaml');
     const configPath = path.join(cwd, '.auroq-core', 'core-config.yaml');
-    if (!fs.existsSync(configPath)) return DEFAULT_STALE_TTL_HOURS;
+    if (!fs.existsSync(configPath)) return {};
+    const yaml = require('js-yaml');
     const config = yaml.load(fs.readFileSync(configPath, 'utf8'));
-    const ttl = config && config.synapse && config.synapse.session && config.synapse.session.staleTTLHours;
-    return typeof ttl === 'number' && ttl > 0 ? ttl : DEFAULT_STALE_TTL_HOURS;
+    return config && typeof config === 'object' ? config : {};
   } catch (_err) {
-    return DEFAULT_STALE_TTL_HOURS;
+    // YAML errors can contain configuration values; never log their text.
+    return {};
   }
 }
 
+function getStaleSessionTTL(config) {
+  const ttl = config && config.synapse && config.synapse.session && config.synapse.session.staleTTLHours;
+  return typeof ttl === 'number' && ttl > 0 ? ttl : DEFAULT_STALE_TTL_HOURS;
+}
+
 /**
  * Resolve runtime dependencies for Synapse hook execution.
  *
@@ -46,7 +50,7 @@ function resolveHookRuntime(input) {
   if (!fs.existsSync(synapsePath)) return null;
 
   try {
-    const { loadSession, cleanStaleSessions } = require(
+    const { loadSession, createSession, cleanStaleSessions } = require(
       path.join(cwd, '.auroq-core', 'core', 'synapse', 'session', 'session-manager.js'),
     );
     const { SynapseEngine } = require(
@@ -54,13 +58,21 @@ function resolveHookRuntime(input) {
     );
 
     const sessionsDir = path.join(synapsePath, 'sessions');
-    const session = loadSession(sessionId, sessionsDir) || { prompt_count: 0 };
-    const engine = new SynapseEngine(synapsePath);
+    let session = sessionId ? loadSession(sessionId, sessionsDir) : null;
+    // loadSession validates the ID before we use it as a filename. Create only
+    // a missing session: an unreadable/corrupt existing file is kept intact.
+    if (!session && sessionId && !fs.existsSync(path.join(sessionsDir, `${sessionId}.json`))) {
+      session = createSession(sessionId, cwd, sessionsDir);
+    }
+    const shouldCleanStaleSessions = session?.prompt_count === 0;
+    session = session || { prompt_count: 0 };
+    const coreConfig = loadCoreConfig(cwd);
+    const engine = new SynapseEngine(synapsePath, { synapse: coreConfig.synapse || {} });
 
     // AC3: Run cleanup on first prompt only (fire-and-forget)
-    if (session.prompt_count === 0) {
+    if (shouldCleanStaleSessions) {
       try {
-        const ttlHours = getStaleSessionTTL(cwd);
+        const ttlHours = getStaleSessionTTL(coreConfig);
         const removed = cleanStaleSessions(sessionsDir, ttlHours);
         if (removed > 0 && process.env.DEBUG === '1') {
           console.error(`[hook-runtime] Cleaned ${removed} stale session(s) (TTL: ${ttlHours}h)`);
@@ -73,7 +85,7 @@ function resolveHookRuntime(input) {
     return { engine, session, sessionId, sessionsDir, cwd };
   } catch (error) {
     if (process.env.DEBUG === '1') {
-      console.error(`[hook-runtime] Failed to resolve runtime: ${error.message}`);
+      console.error('[hook-runtime] SYNAPSE_RUNTIME_FAILED');
     }
     return null;
   }

package/.auroq-core/core-config.yaml

@@ -1,7 +1,7 @@
 project:
   name: "Auroq OS"
   type: greenfield
-  version: 2.5.10
+  version: 2.5.12
   installedAt: '2026-03-16'
 
 ide:

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 2.5.12 — 2026-09-21
+
+- SYNAPSE persiste a sessao desde o primeiro prompt, limita o orcamento total entre camadas e distingue falhas sem expor mensagens/conteudo privado. Mantem manifest, eventos dos hosts e camadas opcionais desligadas.
+- Pacote real passa por inventario SHA-256 apos a casca, arquivos obrigatorios/proibidos e referencias locais do runtime. O empacotamento restaura o checkout, inclusive em falhas. Integridade de conteudo nao equivale a assinatura de autoria.
+- Atualiza js-yaml para 4.3.2, corrigindo avisos de consumo excessivo de CPU no parser usado pelo motor.
+- Manutencao reconhece as versoes oficiais anteriores do SYNAPSE e preserva arquivos personalizados e dados do negocio. Mantem arcane-mcp@0.6.1.
+- Instaladores preparados para esta versao; copias publicas so sao promovidas depois dos gates nativos macOS/Windows Node 22/24 e da verificacao no npm. Maquinas existentes atualizam pelo fluxo de manutencao.
+
+## 2.5.11 — 2026-09-21
+
+### O diagnostico passa a dizer o que achou (EMB-050)
+
+- Sair com 1 no `doctor` nao e mais `INSTALL_FAILED`: agora e `DOCTOR_FINDINGS`. Pendencia encontrada e o diagnostico trabalhando, nao instalacao quebrada — na janela de 20/09 isso gerou 3 alarmes de gravidade maxima para zero instalacoes quebradas.
+- O `doctor` grava o resultado em `~/.auroq/install.log`: `pendencias=N etiqueta,etiqueta` quando acha algo e `ok` quando fecha limpo. As etiquetas sao vocabulario fechado (`arquivos-faltando`, `motor-fora-do-perfil`, `sem-login`, ...) e nunca levam caminho, e-mail, token nem nome de maquina. O suporte pede uma linha: `cat ~/.auroq/install.log`.
+- Registro MCP passa a `arcane-mcp@0.6.1` (publicado no npm em 21/09/2026), que conhece o codigo novo: os dois clientes compartilham a mesma fila local e qualquer um dos dois a envia, entao a lista de codigos tem que ser a mesma nos dois e no servidor. Feche e abra o Claude Code e o Codex depois da manutencao.
+- Instaladores oficiais continuam fixando 2.5.10; promover a versao que instalacoes NOVAS recebem segue sendo ato explicito.
+
 ## 2.5.10 — 2026-09-19
 
 ### Conteudo ao vivo passa a usar o cliente 0.6.0

package/README.md

@@ -228,14 +228,14 @@ agents/             → Seu exercito (companion, workers, minds, squads)
 *Auroq OS — by Euriler Jube / Arka*
 
 
-## Observabilidade do motor (candidato 2.5.2)
+## Observabilidade e integridade do motor
 
-Apos publicacao, `npx -y auroq-os@2.5.10 doctor` mostra a fila local segura e os comandos pinados de
-manutencao/diagnostico. `npx -y auroq-os@2.5.10 manutencao` preserva o caminho existente
+`npx -y auroq-os@2.5.12 doctor` mostra a fila local segura e os comandos pinados de
+manutencao/diagnostico. `npx -y auroq-os@2.5.12 manutencao` preserva o caminho existente
 de consentimento legado, studentFiles, customizacoes e dados do negocio. Nao ha
-migracao forcada. O registro MCP aponta para `arcane-mcp@0.6.0`, publicado no npm em
-19/09/2026; `npm run release:verify` recusa publicar com um pin que o npm nao resolva.
-Os instaladores oficiais devem fixar 2.5.10 depois da publicacao e da verificacao do tarball.
+migracao forcada. O registro MCP aponta para `arcane-mcp@0.6.1`, publicado no npm em
+21/09/2026; `npm run release:verify` recusa publicar com um pin que o npm nao resolva.
+A versao 2.5.12 so deve chegar aos instaladores publicos apos os gates nativos e a verificacao do tarball publicado. O pacote inclui `lib/runtime-integrity.json`: inventario SHA-256 gerado depois da montagem da casca, verificavel com `npm run integrity:verify` dentro do pacote extraido. Ele comprova consistencia do conteudo; nao e uma assinatura de autoria.
 
 O CLI inicia captura antes das dependencias pesadas e registra resultado ao sair.
 Eventos com identidade ja existente podem seguir pela rota autenticada na proxima
@@ -254,8 +254,7 @@ instalacao/manutencao/doctor/login/register-mcp. Bootstrap conversacional e o tr
 final do squad nao sao inferidos como sucesso por sair do CLI ou preparar arquivos.
 Antes de o script chegar ou em computador que nunca executa nosso codigo, nao ha sinal.
 A rota events continua autenticada, limitada e idempotente. A plataforma deve receber
-a whitelist antes de distribuir/promover os clientes; os instaladores sincronizados
-mantem o pin 2.5.1 publicado ate a promocao npm ser possivel. Nao precisa migration adicional.
+a whitelist antes de distribuir/promover os clientes; a promocao dos instaladores sincronizados depende da publicacao e verificacao da versao fixada. Nao precisa migration adicional.
 
 O canal de adocao e o instalador oficial, o README/changelog, o doctor e o aviso de
 comando aposentado quando a versao nova e executada. Isso nao atualiza silenciosamente

package/bin/auroq-os.js

@@ -20,7 +20,10 @@ async function observedMain() {
  const record = (outcome, error_code) => telemetry.enqueue(owner,{endpoint:'lifecycle',stage,outcome,error_code});
  telemetry.setHost('auroq-os');telemetry.importInstallerSpool();record('started');
  let importing = true;
- process.once('exit',code=>record(code===0?'ok':'error',code===0?null:importing?'BOOTSTRAP_IMPORT':stage==='update'?'UPDATE_FAILED':'INSTALL_FAILED'));
+ // Sair com 1 no `doctor` e o diagnostico fazendo o trabalho dele, nao a instalacao quebrando:
+ // `DOCTOR_FINDINGS` = achou pendencia pra resolver. Chamar isso de INSTALL_FAILED gerava alarme
+ // de gravidade maxima pra aluno com o caminho inteiro de pe (Marinei e Alessandra, 20/09).
+ process.once('exit',code=>record(code===0?'ok':'error',code===0?null:importing?'BOOTSTRAP_IMPORT':stage==='update'?'UPDATE_FAILED':stage==='doctor'?'DOCTOR_FINDINGS':'INSTALL_FAILED'));
  process.once('uncaughtException',()=>{console.error('[auroq-os] RUNTIME_FAILURE');process.exit(1);});
  process.once('unhandledRejection',()=>{console.error('[auroq-os] RUNTIME_FAILURE');process.exit(1);});
  const cred = credentials.load();await telemetry.flush(cred?.user?.id,cred?.access_token);
@@ -28,7 +31,7 @@ async function observedMain() {
 telemetry.runtimeReady=()=>{importing=false;};
 runRuntime(telemetry);
  } catch {
-  console.error('[auroq-os] '+(importing?'BOOTSTRAP_IMPORT':'RUNTIME_FAILURE')+'. Rode: npx -y auroq-os@2.5.10 doctor');
+  console.error('[auroq-os] '+(importing?'BOOTSTRAP_IMPORT':'RUNTIME_FAILURE')+'. Rode: npx -y auroq-os@2.5.12 doctor');
   process.exitCode=1;
  }
 }
@@ -214,13 +217,45 @@ function registrarInstallLog(evento, detalhe = '') {
     const dir = path.join(require('os').homedir(), '.auroq');
     fs.ensureDirSync(dir);
     const quando = new Date().toISOString().replace(/\.\d+Z$/, 'Z');
-    const limpo = String(detalhe).replace(/[^\w .:=+/\\-]/g, '');
+    const limpo = String(detalhe).replace(/[^\w ,.:=+/\\-]/g, '');
     fs.appendFileSync(path.join(dir, 'install.log'), `${quando}\t${evento}\t${limpo}\n`);
   } catch {
     /* registro e conveniencia pro suporte */
   }
 }
 
+/**
+ * Etiqueta curta e FIXA pra cada pendencia que o `doctor` lista (EMB-050).
+ *
+ * O suporte precisa saber "falhou no que", nao so "falhou": a lista do doctor morria na tela do
+ * aluno e o plantao ficava adivinhando (da Alessandra nunca soubemos qual item era). A etiqueta e
+ * vocabulario fechado de proposito — nunca caminho, e-mail, token, nome de maquina nem o texto da
+ * pendencia. O casamento e por trecho estavel da mensagem; o teste `doctor-recibo` reprova qualquer
+ * pendencia nova que caia em `outro`.
+ */
+const ETIQUETAS_DOCTOR = [
+  ['repor o que falta', 'arquivos-faltando'],
+  ['sem tirar nada seu', 'synapse-nao-registrado'],
+  ['Synapse antigo', 'synapse-antigo'],
+  ['no Windows, install.ps1', 'motor-ausente'],
+  ['FECHE e abra', 'motor-fora-do-perfil'],
+  ['2 minutos de espera', 'mcp-timeout-curto'],
+  ['com o tempo certo', 'codex-timeout-curto'],
+  ['mais tempo ao Codex', 'arranque-lento'],
+  ['reescreve o registro)', 'mcp-nao-registrado'],
+  ['register-mcp na pasta. Depois', 'mcp-pin-antigo'],
+  ['arcane-mcp login', 'sem-login'],
+  ['fora do ar', 'servidor-fora'],
+  ['Confira sua internet', 'servidor-fora'],
+  ['whoami', 'mcp-nao-abre'],
+  ['tela INTEIRA', 'codex-sem-conteudo'],
+];
+function rotulo(pendencia) {
+  const texto = String(pendencia || '');
+  for (const [marca, etiqueta] of ETIQUETAS_DOCTOR) if (texto.includes(marca)) return etiqueta;
+  return 'outro';
+}
+
 /**
  * Identificador curto e nao reversivel da maquina — so pro suporte casar dois
  * registros do mesmo computador. Nao sai da maquina e nao contem nome nem e-mail.
@@ -503,12 +538,22 @@ async function runDoctor(targetDir) {
   }
 
   log('');
+  // Recibo duravel pro suporte, inclusive quando fechou limpo: sem o historico completo o plantao
+  // nao sabe se a pendencia de ontem foi resolvida. Conveniencia — nunca pode derrubar o doctor,
+  // por isso montar o texto tambem fica DENTRO do try.
+  const recibo = pendencias => {
+    try {
+      registrarInstallLog('doctor', pendencias.length ? `pendencias=${pendencias.length} ${pendencias.map(p => rotulo(p)).join(',')}` : 'ok');
+    } catch { /* recibo e conveniencia pro suporte */ }
+  };
   if (problemas.length === 0) {
     success('Tudo certo. Pode chamar o Companion.');
+    recibo(problemas);
     return 0;
   }
   error(`${problemas.length} coisa(s) pra resolver:`);
   for (const p of problemas) log(`  ${DIM}- ${p}${RESET}`);
+  recibo(problemas);
   log('');
   log(`${DIM}Se travar, chame o suporte: 11 93621-4486${RESET}`);
   return 1;
@@ -524,7 +569,7 @@ async function runDoctor(targetDir) {
 // 2.5.4/2.5.5 pinaram uma versao que ainda nao estava no npm e o MCP fechava a conexao.
 // Por isso `scripts/assert-mcp-pin.mjs` (release:verify/prepublishOnly) recusa publicar
 // com um pin que o `npm view` nao resolva exatamente. Trocar o pin aqui exige o pacote ja publicado.
-const ARCANE_MCP_PIN = 'arcane-mcp@0.6.0';
+const ARCANE_MCP_PIN = 'arcane-mcp@0.6.1';
 const CODEX_MCP_STARTUP_SEC = 120;
 // O Claude Code tambem desistia aos 30s (MCP_TIMEOUT) e o aluno via CONNECT_TIMEOUT com o
 // servidor no ar e nenhum pedido chegando nele (11/09, EMB-041). Ele le o tempo do `env` das
@@ -577,7 +622,7 @@ function blocoCodexArcane(pin, opcoes) {
 }
 
 // Baixa o pacote do conteudo ao vivo com o MESMO nome que o registro usa (o cache do
-// npx e por nome+versao: `arcane-mcp` e `arcane-mcp@0.6.0` sao caches diferentes).
+// npx e por nome+versao: `arcane-mcp` e `arcane-mcp@0.6.1` sao caches diferentes).
 // `npx` no Windows e um .cmd: sem shell o Node recusa (EINVAL) e com `shell: true` o Node 24
 // imprime um DeprecationWarning na tela do aluno (DEP0190). Chamar o cmd.exe direto, sem shell.
 function comandoNpx(args) {
@@ -1803,7 +1848,7 @@ if (['init', 'install', 'update'].includes(command)) {
   error('Comando aposentado. Nada foi instalado ou alterado.');
   error('Primeira instalacao: https://arcane.arka.education/auroq');
   error('No negocio existente, peca ao Ops: manutencao do motor. Conteudo chega pelo MCP.');
-  error('Diagnostico: npx -y auroq-os@2.5.10 doctor. Manutencao: npx -y auroq-os@2.5.10 manutencao.');
+  error('Diagnostico: npx -y auroq-os@2.5.12 doctor. Manutencao: npx -y auroq-os@2.5.12 manutencao.');
   process.exitCode = 1;
 } else if (command === 'instalar' || command === 'manutencao') {
   // `--pasta <nome>`: o instalador manda o CLI criar e entrar na pasta do negocio,
@@ -1930,6 +1975,6 @@ if (['init', 'install', 'update'].includes(command)) {
   log('');
 }
 
-if (process.env.AUROQ_EXPORTA_INTERNOS === '1') module.exports = { blocoCodexArcane, envCodexArcane, lerBlocoArcane, lerEnvDoBloco, limparArcaneDoGlobal, envComoCodex, argumentosCodexSmoke, avaliarEventosCodex, ARCANE_MCP_PIN };
+if (process.env.AUROQ_EXPORTA_INTERNOS === '1') module.exports = { blocoCodexArcane, envCodexArcane, lerBlocoArcane, lerEnvDoBloco, limparArcaneDoGlobal, envComoCodex, argumentosCodexSmoke, avaliarEventosCodex, rotulo, ARCANE_MCP_PIN };
 
 }

package/installer/install.ps1

@@ -589,7 +589,7 @@ function Invoke-AuroqLogin {
   # sucesso. Usado como pergunta de sim/nao, ele dizia "voce ja estava logado"
   # pra quem nunca logou, pulava o portao e deixava a conta sem acesso chegar ate
   # a criacao da pasta.
-  & (Get-AuroqNpx) -y auroq-os@2.5.10 check-access
+  & (Get-AuroqNpx) -y auroq-os@2.5.12 check-access
   if ($LASTEXITCODE -ne 0) {
     Write-AuroqLog 'login' 'recusado'
     Write-Host ''
@@ -677,7 +677,7 @@ function Invoke-AuroqInit {
   if ($env:AUROQ_INSTALL_DRY_RUN) { Write-AuroqOk 'Sistema - seria montado aqui'; return }
 
   Set-Location $script:AuroqPastaAlvo
-  & (Get-AuroqNpx) -y auroq-os@2.5.10 instalar
+  & (Get-AuroqNpx) -y auroq-os@2.5.12 instalar
   if ($LASTEXITCODE -ne 0) {
     Write-AuroqLog 'init' 'falhou'
     Write-AuroqErro 'A montagem do sistema parou no meio.' 'Rode o mesmo comando de novo. Se repetir, mande pro suporte o arquivo install.log da pasta .auroq.'

package/installer/install.sh

@@ -219,9 +219,9 @@ auroq_tem_terminal() {
 # recebem pedaco do script no lugar da resposta dele.
 auroq_npx_aluno() {
   if [ -t 0 ]; then
-    npx -y auroq-os@2.5.10 "$@"
+    npx -y auroq-os@2.5.12 "$@"
   else
-    npx -y auroq-os@2.5.10 "$@" < /dev/tty
+    npx -y auroq-os@2.5.12 "$@" < /dev/tty
   fi
 }
 

package/lib/runtime-integrity.json

@@ -0,0 +1,288 @@
+{
+  "schema": 1,
+  "algorithm": "sha256",
+  "scope": "packaged-runtime-and-cascas",
+  "version": "2.5.12",
+  "files": [
+    {
+      "path": ".auroq-core/constitution.md",
+      "sha256": "8b6df553e2708e3d9eff3f12627808ca953a4272cfbd2f94cb9ae3d4c70a73de"
+    },
+    {
+      "path": ".auroq-core/core-config.yaml",
+      "sha256": "bb98d40d411423cfd4e92100a003a029309d5db1a5514b1a7fed880b96fc1f56"
+    },
+    {
+      "path": ".auroq-core/core/synapse/context/context-builder.js",
+      "sha256": "121cd0a1df8a44098831cd4335536e8facf4e65b8aec48f4ce9c2d432dc6252a"
+    },
+    {
+      "path": ".auroq-core/core/synapse/context/context-tracker.js",
+      "sha256": "48e94db7b1778dedecc8eae829139579ad7778ff47668597ebe766610696553f"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/consistency-collector.js",
+      "sha256": "65f4255f87c9900400649dc8b9aedaac4851b5939d93e127778bd93cee99db12"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/hook-collector.js",
+      "sha256": "c2cfa1b760bcb05decf5ad05f9159140cbe0cdc6b0f91581790e44d83dc6b660"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/manifest-collector.js",
+      "sha256": "3dc895eb94485320ecbaca3a1d29e3776cfb691dd7dcc71cf44b34af30e8ebb6"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/output-analyzer.js",
+      "sha256": "e6846b1aba0a6cba17c297a871861d4f8199d7500220bff296a6a3291e32493e"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/pipeline-collector.js",
+      "sha256": "8655b6240e2f54b70def1a8c2fae00d40e2615cb95fd7ca0d64c2e0a6dfe3b73"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/quality-collector.js",
+      "sha256": "30ae299eab6d569d09afe3530a5b2f1ff35ef75366a1ab56a9e2a57d39d3611c"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/relevance-matrix.js",
+      "sha256": "f92c4f7061dc82eed4310a27b69eade33d3015f9beb1bed688601a2dccbad22e"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/safe-read-json.js",
+      "sha256": "dc7bcd13779207ad67b1c3929b7e1e0ccfa3563f3458c20cad28cb1922e9a74c"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/session-collector.js",
+      "sha256": "a116d884d6947ddc8e5f3def012d93696576c584c4fde1639b8d895924fc09ea"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/timing-collector.js",
+      "sha256": "2523ce93f863a28f798d992c4f2fab041c91a09413b3186fd290e6035b391587"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/collectors/uap-collector.js",
+      "sha256": "dd025894f8f0d3bd22a147dbc0debef8b83e96f3c59483653404b3cd5a01d5aa"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/report-formatter.js",
+      "sha256": "1aa2853928df194b669ce32c3b050a90de1311739045074f699d10210ed8d381"
+    },
+    {
+      "path": ".auroq-core/core/synapse/diagnostics/synapse-diagnostics.js",
+      "sha256": "de9dffce0e380637027cbd64b062d3eeffc37e42a84a337e5758fbef39fe3a00"
+    },
+    {
+      "path": ".auroq-core/core/synapse/domain/domain-loader.js",
+      "sha256": "af788f9da956b89eef1e5eb4ef4efdf05ca758c8969a2c375f568119495ebc05"
+    },
+    {
+      "path": ".auroq-core/core/synapse/engine.js",
+      "sha256": "775d232f67c92596f4a4a4302d5f4c69b6473680badead6ff4772f46e157381c"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l0-constitution.js",
+      "sha256": "2123a6a44915aaac2a6bbd26c67c285c9d1e12b50fe42a8ada668306b07d1c4a"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l1-global.js",
+      "sha256": "21f6969e6d64e9a85c876be6799db4ca7d090f0009057f4a06ead8da12392d45"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l2-agent.js",
+      "sha256": "a8677dc58ae7927c5292a4b52883bbc905c8112573b8b8631f0b8bc01ea2b6e6"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l3-workflow.js",
+      "sha256": "496cbd71d7dac9c1daa534ffac45c622d0c032f334fedf493e9322a565b2b181"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l4-task.js",
+      "sha256": "30df70c04b16e3aff95899211ef6ae3d9f0a8097ebdc7de92599fc6cb792e5f0"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l5-squad.js",
+      "sha256": "d6d35cbf966deb5a7d2df2b09f5abe8da8c6d4e346b385418f8dc1fae3ddf830"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l6-keyword.js",
+      "sha256": "8e5405999a2ce2f3ca4e62e863cf702ba27448914241f5eb8f02760bc7477523"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/l7-star-command.js",
+      "sha256": "3b8372ac1c51830c1ef560b1012b112a3559651b0750e42f2037f7fe9e6787d6"
+    },
+    {
+      "path": ".auroq-core/core/synapse/layers/layer-processor.js",
+      "sha256": "46a7d08e088017a61fa6033ce4d9b3b8caba622e2c732fe158e0f531690fa3d9"
+    },
+    {
+      "path": ".auroq-core/core/synapse/memory/memory-bridge.js",
+      "sha256": "820875f97ceea80fc6402c0dab1706cfe58de527897b22dea68db40b0d6ec368"
+    },
+    {
+      "path": ".auroq-core/core/synapse/memory/synapse-memory-provider.js",
+      "sha256": "5d613d1fac7ee82c49a3f03b38735fd3cabfe87dd868494672ddfef300ea3145"
+    },
+    {
+      "path": ".auroq-core/core/synapse/output/formatter.js",
+      "sha256": "3e722c4736642ef96ec73a54cd2011eed7bd1074394a38eac66cb6f0af2c855b"
+    },
+    {
+      "path": ".auroq-core/core/synapse/runtime/hook-runtime.js",
+      "sha256": "77a88b9324940b4feb14de6fe4de51c0fd82e2062ef4470b93de2e57bd02c88a"
+    },
+    {
+      "path": ".auroq-core/core/synapse/scripts/generate-constitution.js",
+      "sha256": "e2f645d5de44e6b3721a5de9b19982bc7b8cf7eed3ca4d62bc53221649c59af1"
+    },
+    {
+      "path": ".auroq-core/core/synapse/session/session-manager.js",
+      "sha256": "98e8c8fa15b074b6102bcd51c6f91f101743338e8cde6de9c31d6b6eea5d6580"
+    },
+    {
+      "path": ".auroq-core/core/synapse/utils/atomic-write.js",
+      "sha256": "efeef0fbcebb184df5b79f4ba4b4b7fe274c3ba7d1c705ce1af92628e920bd8b"
+    },
+    {
+      "path": ".auroq-core/core/synapse/utils/paths.js",
+      "sha256": "bf8cf93c1a16295e7de055bee292e2778a152b6e7d6c648dbc054a4b04dffc10"
+    },
+    {
+      "path": ".auroq-core/core/synapse/utils/tokens.js",
+      "sha256": "3b927daec51d0a791f3fe4ef9aafc362773450e7cf50eb4b6d8ae9011d70df9a"
+    },
+    {
+      "path": ".auroq-core/dna-operacional.md",
+      "sha256": "36d3118831d1d406a1e5eef2394fef6628396712534c59888a5968f9ffdba796"
+    },
+    {
+      "path": ".claude/commands/AuroqOS/agents/ops.md",
+      "sha256": "6f0df7c0dfbe28f4efa4d49d010f5a2520293c972623eb5c7dc25aa62ba7fc37"
+    },
+    {
+      "path": ".claude/commands/auroq-companion.md",
+      "sha256": "789bb61f076847f5695be0ea1133cfe026024c3e7a77a48f142297cc30e02196"
+    },
+    {
+      "path": ".claude/hooks/ahi-capture.cjs",
+      "sha256": "d99564a5bebc23281da5dbba2e82ef099c390768bed2b63f70be17c75ab8fd57"
+    },
+    {
+      "path": ".claude/hooks/ahi/auth-config.cjs",
+      "sha256": "bbe1f01165f0cf4562b8685a59bd2aac94758dbd0b072d287c09db10d9c6e0eb"
+    },
+    {
+      "path": ".claude/hooks/ahi/runtime.cjs",
+      "sha256": "82c0b93351f25959e5cbe0a9a57b7ae29a3b497298ab351bddd7361a2ef6ce1a"
+    },
+    {
+      "path": ".claude/hooks/ahi/security.cjs",
+      "sha256": "dc27db1392acd0abd8102490860bfad6a94276bbc92f63e086dc997dbe6b208c"
+    },
+    {
+      "path": ".claude/hooks/ahi/worker.cjs",
+      "sha256": "3eabd293f3c9c6887f6850ca4be9ad7021d6659967f2f5eecadefb2bb78e9b85"
+    },
+    {
+      "path": ".claude/hooks/auroq-sync.cjs",
+      "sha256": "2655dbd0a6f73ae83d0fabfb9567fc7dbf79708adcf9bfa455ea6da6fc183b9f"
+    },
+    {
+      "path": ".claude/hooks/precompact-session-digest.cjs",
+      "sha256": "cca89df5591fd52581d62bd35cc097d7e3d2622bd2227e7e53b425d5a6d8bdb2"
+    },
+    {
+      "path": ".claude/hooks/synapse-engine.cjs",
+      "sha256": "4d01f376993b570b9ca995b839d292ce9b73c597a0a1ebc8cb1ffbd214093bfe"
+    },
+    {
+      "path": ".claude/settings.json",
+      "sha256": "3d0a9836997e7524d1538e96799bd5ea06575620c97a2eb03d3410b6df5d0e5a"
+    },
+    {
+      "path": ".claude/settings.local.json",
+      "sha256": "cb81d47fef6536bd472841811bb85f36a8219994d55399eac85732f920c566c6"
+    },
+    {
+      "path": "bin/auroq-os.js",
+      "sha256": "b043982de702e524799b51968b29578c04e8a6ed5f66c318d661bf776f0ef838"
+    },
+    {
+      "path": "lib/ahi/client.mjs",
+      "sha256": "ded0ba89b58193e59b4ced26321965f85b8b19abc498ed8b079cab956806d789"
+    },
+    {
+      "path": "lib/ahi/historico.mjs",
+      "sha256": "cb85e53dae59e793bdb83f59c3f8d14342912953b43dd9408d757a7b7182733a"
+    },
+    {
+      "path": "lib/ahi/install.cjs",
+      "sha256": "f3a9fec92e64b8624fb45e062b51777788831337dec6a89ce8222d7813baca9d"
+    },
+    {
+      "path": "lib/auth.js",
+      "sha256": "e775938f20b86c305e44c2b5834eeb886fec0316dccc0f3565536689b7bfb46a"
+    },
+    {
+      "path": "lib/credentials.js",
+      "sha256": "92ecfba2b7ded12de5b236d64b24781ffdf05c1e770614a8d02bf05ab78d59e0"
+    },
+    {
+      "path": "lib/diagnostico.js",
+      "sha256": "a7c15e8aa9dd3a7ceca3784ce7207f9593baaabedc87e88d0a674096b20c6835"
+    },
+    {
+      "path": "lib/legacy-shims.json",
+      "sha256": "1ea331604dfcadc579a7a27d53bfb2c1d1a2263e1d2ca83ed780c5ce5d2fe877"
+    },
+    {
+      "path": "lib/onepassword.js",
+      "sha256": "a65d425182e0698d3f80b8d81bb088b13c5e5b60ae1aa92b095ab38d60e22ea9"
+    },
+    {
+      "path": "lib/supabase.js",
+      "sha256": "a922dee14500e95b4b1f7a8d2a67baedee71c547f863e69e63f25830f9786f28"
+    },
+    {
+      "path": "lib/synapse-hashes.json",
+      "sha256": "061dfe2e2c7e2a75472ae133e3465931c1267cc18e0740e7c1515404095b47e6"
+    },
+    {
+      "path": "lib/telemetry.mjs",
+      "sha256": "13643a1f8c33d7063a07b37190ba157755f8e26aadd4059e1afdc25fada0cf38"
+    },
+    {
+      "path": "package.json",
+      "sha256": "17d5e5a26ffd8044fd8b98260ca7961b37a326acbe8b63dd3a65af73edff1317"
+    },
+    {
+      "path": "scripts/build-pack.mjs",
+      "sha256": "c4f7bbc40320dcf848307ab9d7d7c84c864ddc70a0e4db933a35406f55dcf881"
+    },
+    {
+      "path": "scripts/pack-state.mjs",
+      "sha256": "7399b388eab97dd35da49055b126aba39a0c95d82cf422c62b603e9bf5de7f36"
+    },
+    {
+      "path": "scripts/postpack-casca.mjs",
+      "sha256": "e361ed44a688d0cd6804bdbf3e240649b69171c2396433f0fdb55cb0f739d993"
+    },
+    {
+      "path": "scripts/prepack-casca.mjs",
+      "sha256": "ecd4381a411d275af339e0bdc3acc5a0ea33ad65c1eaafad6ff3d6c79b415aff"
+    },
+    {
+      "path": "scripts/runtime-integrity.mjs",
+      "sha256": "af0cb75622dcf4c049da3fc053817087648a86fc31df3be4762e974279eb87a3"
+    },
+    {
+      "path": "scripts/sync-codex-skills.mjs",
+      "sha256": "36e703e8d298a5fc4cff3a85828b93a5123ab9563eeb2808c30f23f3eefd58f8"
+    },
+    {
+      "path": "scripts/validate-hybrid.mjs",
+      "sha256": "d70636ad4fd6a7975df552de5cc4a88d535f0ec8596b7cf74c20e9ff73f02505"
+    }
+  ]
+}

package/lib/synapse-hashes.json

@@ -49,7 +49,8 @@
   ],
   "engine.js": [
     "47bab93a2144edce875ee68cc2717fee1bd824c9affdd5964454f5141310b8e0",
-    "c061df38ec24956da9a752f13f9455c7cd69546adb330c7587b9d456e79b4aa1"
+    "c061df38ec24956da9a752f13f9455c7cd69546adb330c7587b9d456e79b4aa1",
+    "775d232f67c92596f4a4a4302d5f4c69b6473680badead6ff4772f46e157381c"
   ],
   "layers/l0-constitution.js": [
     "2123a6a44915aaac2a6bbd26c67c285c9d1e12b50fe42a8ada668306b07d1c4a"
@@ -76,7 +77,8 @@
     "3b8372ac1c51830c1ef560b1012b112a3559651b0750e42f2037f7fe9e6787d6"
   ],
   "layers/layer-processor.js": [
-    "73cb0e5b4bada80d8e256009004679e483792077fac4358c6466cd77136f79fa"
+    "73cb0e5b4bada80d8e256009004679e483792077fac4358c6466cd77136f79fa",
+    "46a7d08e088017a61fa6033ce4d9b3b8caba622e2c732fe158e0f531690fa3d9"
   ],
   "memory/memory-bridge.js": [
     "820875f97ceea80fc6402c0dab1706cfe58de527897b22dea68db40b0d6ec368"
@@ -90,7 +92,8 @@
   ],
   "runtime/hook-runtime.js": [
     "5518692eeee7dcb570507c4bb96ef68a1ef51d6ad6c417e9d1f649cd8b21b199",
-    "7c34b84c5693045a007356081959c335493bbd3afc69822fb6661e19cc10d56c"
+    "7c34b84c5693045a007356081959c335493bbd3afc69822fb6661e19cc10d56c",
+    "77a88b9324940b4feb14de6fe4de51c0fd82e2062ef4470b93de2e57bd02c88a"
   ],
   "scripts/generate-constitution.js": [
     "e2f645d5de44e6b3721a5de9b19982bc7b8cf7eed3ca4d62bc53221649c59af1"

package/lib/telemetry.mjs

@@ -20,7 +20,10 @@ export function networkCode(e) {
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const uuid = v => typeof v === 'string' && UUID.test(v) ? v : null;
-const ERRORS = new Set(['NETWORK_TLS','NETWORK_DNS','NETWORK_TIMEOUT','NETWORK_OTHER','AUTH_MISSING','AUTH_REFRESH','HTTP_ERROR','CLIENT_ERROR','BOOTSTRAP_IMPORT','RUNTIME_FAILURE','INSTALL_FAILED','UPDATE_FAILED']);
+// DOCTOR_FINDINGS: o doctor achou pendencia e saiu com 1 — diagnostico trabalhando, nao instalacao
+// quebrada. Os dois clientes gravam no MESMO outbox e qualquer um faz o flush, entao a lista tem que
+// ser a mesma nos dois (e no servidor): o que falta aqui vira null e apaga o alarme (EMB-050).
+const ERRORS = new Set(['NETWORK_TLS','NETWORK_DNS','NETWORK_TIMEOUT','NETWORK_OTHER','AUTH_MISSING','AUTH_REFRESH','HTTP_ERROR','CLIENT_ERROR','BOOTSTRAP_IMPORT','RUNTIME_FAILURE','INSTALL_FAILED','UPDATE_FAILED','DOCTOR_FINDINGS']);
 const STAGES = new Set(['startup','runtime','install','update','doctor','login','bootstrap','git','node','access','folder','framework']);
 const tools = new Set(['catalogo_listar','squad_ativar','squad_passo','squad_conhecimento','forja_bundle','busca']);
 const TTL = 7*86400000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auroq-os",
-  "version": "2.5.10",
+  "version": "2.5.12",
   "description": "Auroq OS — Sistema Operacional de IA para Experts",
   "bin": {
     "auroq-os": "bin/auroq-os.js"
@@ -18,14 +18,15 @@
     "auroq:sync:codex:check": "npm run sync:codex:check",
     "auroq:validate": "npm run validate:hybrid",
     "validate:hybrid": "node scripts/validate-hybrid.mjs",
-    "lint": "node --check bin/auroq-os.js && node --check lib/auth.js && node --check lib/diagnostico.js && node --check lib/credentials.js && node --check lib/onepassword.js && node --check lib/supabase.js && node --check scripts/sync-codex-skills.mjs && node --check scripts/validate-hybrid.mjs && node --check scripts/prepack-casca.mjs && node --check scripts/postpack-casca.mjs && node --check scripts/assert-mcp-pin.mjs && node --check lib/telemetry.mjs && node --check scripts/synapse-hashes.mjs && node --check lib/ahi/historico.mjs && node --check .claude/hooks/ahi-capture.cjs && node --check .claude/hooks/ahi/security.cjs && node --check .claude/hooks/ahi/runtime.cjs && node --check .claude/hooks/ahi/worker.cjs && node --check lib/ahi/install.cjs && node --check .claude/hooks/ahi/auth-config.cjs && node --check lib/ahi/client.mjs && node --check scripts/build-pack.mjs && node --check scripts/assert-native-release.mjs",
+    "lint": "node --check bin/auroq-os.js && node --check lib/auth.js && node --check lib/diagnostico.js && node --check lib/credentials.js && node --check lib/onepassword.js && node --check lib/supabase.js && node --check scripts/sync-codex-skills.mjs && node --check scripts/validate-hybrid.mjs && node --check scripts/prepack-casca.mjs && node --check scripts/postpack-casca.mjs && node --check scripts/assert-mcp-pin.mjs && node --check lib/telemetry.mjs && node --check scripts/synapse-hashes.mjs && node --check lib/ahi/historico.mjs && node --check .claude/hooks/ahi-capture.cjs && node --check .claude/hooks/ahi/security.cjs && node --check .claude/hooks/ahi/runtime.cjs && node --check .claude/hooks/ahi/worker.cjs && node --check lib/ahi/install.cjs && node --check .claude/hooks/ahi/auth-config.cjs && node --check lib/ahi/client.mjs && node --check scripts/build-pack.mjs && node --check scripts/assert-native-release.mjs && node --check scripts/runtime-integrity.mjs && node --check scripts/pack-state.mjs",
     "typecheck": "npm run validate:hybrid",
     "test": "node --test tests/*.test.mjs",
     "release:verify": "node scripts/assert-mcp-pin.mjs && node scripts/assert-native-release.mjs",
     "prepublishOnly": "npm run release:verify",
     "prepack": "node scripts/prepack-casca.mjs",
     "postpack": "node scripts/postpack-casca.mjs",
-    "build": "node scripts/build-pack.mjs"
+    "build": "node scripts/build-pack.mjs",
+    "integrity:verify": "node scripts/runtime-integrity.mjs --verify"
   },
   "files": [
     "bin/",
@@ -56,7 +57,7 @@
   "dependencies": {
     "@supabase/supabase-js": "^2.103.0",
     "fs-extra": "^11.3.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.2",
     "prompts": "^2.4.2"
   },
   "author": "Euriler Jube / Arka",

package/scripts/build-pack.mjs

@@ -1,13 +1,44 @@
 #!/usr/bin/env node
-// Portable dry-run package validation. npm lifecycle still checks/restores the casca overlay.
-import { spawnSync } from 'node:child_process';
-const command = process.platform === 'win32' ? (process.env.ComSpec || 'cmd.exe') : 'npm';
-const args = process.platform === 'win32' ? ['/d', '/s', '/c', 'npm pack --dry-run --json'] : ['pack', '--dry-run', '--json'];
-const result = spawnSync(command, args, { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, windowsHide: true });
-if (result.status !== 0 || result.error) { process.stderr.write(result.stderr || 'Package validation failed.\n'); process.exit(1); }
-// npm versions may print lifecycle logs before/after the JSON manifest.
-const manifest = result.stdout.match(/(\[\s*\{[\s\S]*\}\s*\])/);
-if (!manifest) throw new Error('Package manifest unavailable');
-const packages = JSON.parse(manifest[1]);
-if (!packages[0]?.files?.some(file => file.path === '.claude/hooks/ahi/runtime.cjs')) throw new Error('AHI runtime missing from package');
-process.stdout.write('Package validated with AHI runtime.\n');
+// Validate actual tarball bytes AFTER the casca overlay; never pack this checkout.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { verifyRuntimeInventory } from './runtime-integrity.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), 'auroq-build-pack-'));
+try {
+  const copy = path.join(temporary, 'source');
+  const excluded = new Set(['.git', 'node_modules', '.pack-casca-backup']);
+  if (fs.existsSync(path.join(root, '.pack-casca-backup'))) throw new Error('Pending casca backup: restore the checkout before building.');
+  fs.cpSync(root, copy, { recursive: true, filter: source => !path.relative(root, source).split(path.sep).some(part => excluded.has(part) || part.endsWith('.tgz')) });
+  const cli = process.env.npm_execpath || (process.platform === 'win32'
+    ? path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js') : null);
+  const args = ['pack', '--json', '--pack-destination', temporary];
+  const output = execFileSync(cli ? process.execPath : 'npm', cli ? [cli, ...args] : args,
+    { cwd: copy, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+  const match = output.match(/(\[\s*\{[\s\S]*\}\s*\])/);
+  if (!match) throw new Error('Package manifest unavailable');
+  const packages = JSON.parse(match[1]);
+  if (packages.length !== 1 || !packages[0].filename || path.basename(packages[0].filename) !== packages[0].filename) throw new Error('Invalid package result');
+  const artifact = path.join(temporary, packages[0].filename);
+  const listing = execFileSync('tar', ['-tzf', artifact], { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+  const packedPaths = listing.split(/\r?\n/).filter(Boolean).map(file => {
+    if (!file.startsWith('package/') || file.endsWith('/') || file.includes('..') || file.includes('\\')) throw new Error('Invalid tarball path');
+    return file.slice('package/'.length);
+  });
+  const extracted = path.join(temporary, 'extracted');
+  fs.mkdirSync(extracted);
+  execFileSync('tar', ['-xzf', artifact, '-C', extracted], { stdio: ['ignore', 'pipe', 'pipe'] });
+  const result = verifyRuntimeInventory(path.join(extracted, 'package'), packedPaths);
+  if (fs.existsSync(path.join(copy, '.pack-casca-backup'))) throw new Error('Pack did not restore its casca overlay');
+  process.stdout.write(`Package validated: ${result.files} protected files, SHA256 and local runtime references.\n`);
+} catch (error) {
+  // Do not print npm lifecycle output: it may include environment-specific data.
+  console.error(`Package validation failed: ${error.status !== undefined ? 'pack/extraction command failed' : error.message}`);
+  process.exitCode = 1;
+} finally {
+  fs.rmSync(temporary, { recursive: true, force: true });
+}

package/scripts/pack-state.mjs

@@ -0,0 +1,64 @@
+/** Journal the temporary casca overlay, including files absent before packing. */
+import fs from 'node:fs';
+import path from 'node:path';
+
+const BACKUP = '.pack-casca-backup';
+const JOURNAL = 'overlay-state.json';
+
+function assertPath(relative) {
+  if (!relative || path.isAbsolute(relative) || /^[A-Za-z]:/.test(relative) || relative.includes('\\') || relative.split('/').some(p => !p || p === '.' || p === '..')) {
+    throw new Error('Invalid overlay path');
+  }
+}
+
+function assertNoSymlink(root, relative) {
+  let current = root;
+  for (const segment of relative.split('/')) {
+    current = path.join(current, segment);
+    let stat;
+    try { stat = fs.lstatSync(current); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in overlay path: ${relative}`);
+  }
+}
+
+export function beginOverlay(root) {
+  const backup = path.join(root, BACKUP);
+  if (fs.existsSync(backup)) throw new Error('Pending casca backup: restore with node scripts/postpack-casca.mjs before packing again.');
+  fs.mkdirSync(backup);
+  fs.writeFileSync(path.join(backup, JOURNAL), '[]\n');
+}
+
+export function preserveOverlayFile(root, relative) {
+  assertPath(relative);
+  assertNoSymlink(root, relative);
+  const backup = path.join(root, BACKUP);
+  const journalFile = path.join(backup, JOURNAL);
+  const journal = JSON.parse(fs.readFileSync(journalFile, 'utf8'));
+  if (journal.some(entry => entry.path === relative)) return;
+  const source = path.join(root, relative);
+  const existed = fs.existsSync(source);
+  if (existed) {
+    if (!fs.lstatSync(source).isFile()) throw new Error(`Overlay target is not a regular file: ${relative}`);
+    const target = path.join(backup, 'files', relative);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.copyFileSync(source, target);
+  }
+  journal.push({ path: relative, existed });
+  fs.writeFileSync(journalFile, `${JSON.stringify(journal)}\n`);
+}
+
+export function restoreOverlay(root) {
+  const backup = path.join(root, BACKUP);
+  if (!fs.existsSync(backup)) return;
+  const journal = JSON.parse(fs.readFileSync(path.join(backup, JOURNAL), 'utf8'));
+  for (const entry of journal.reverse()) {
+    assertPath(entry.path);
+    assertNoSymlink(root, entry.path);
+    const target = path.join(root, entry.path);
+    if (entry.existed) {
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(backup, 'files', entry.path), target);
+    } else fs.rmSync(target, { force: true });
+  }
+  fs.rmSync(backup, { recursive: true });
+}

package/scripts/postpack-casca.mjs

@@ -1,32 +1,9 @@
 #!/usr/bin/env node
 /** Restaura o miolo depois do npm pack/publish. */
-import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { restoreOverlay } from './pack-state.mjs';
 
-const root = fs.realpathSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '..'));
-const cascaRoot = path.join(root, 'casca');
-const backupRoot = path.join(root, '.pack-casca-backup');
-
-function walk(dir) {
-  const out = [];
-  if (!fs.existsSync(dir)) return out;
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) out.push(...walk(full));
-    else out.push(full);
-  }
-  return out;
-}
-
-if (!fs.existsSync(backupRoot)) process.exit(0);
-
-for (const bak of walk(backupRoot)) {
-  const rel = path.relative(backupRoot, bak);
-  const dest = path.join(root, rel);
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.copyFileSync(bak, dest);
-}
-
-fs.rmSync(backupRoot, { recursive: true, force: true });
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+restoreOverlay(root);
 console.log('postpack-casca: working tree restaurado');

package/scripts/prepack-casca.mjs

@@ -6,10 +6,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { beginOverlay, preserveOverlayFile, restoreOverlay } from './pack-state.mjs';
+import { INVENTORY_PATH, writeRuntimeInventory, verifyRuntimeInventory } from './runtime-integrity.mjs';
 
 const root = fs.realpathSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '..'));
 const cascaRoot = path.join(root, 'casca');
-const backupRoot = path.join(root, '.pack-casca-backup');
 
 function walk(dir) {
   const out = [];
@@ -22,45 +23,44 @@ function walk(dir) {
   return out;
 }
 
-if (fs.existsSync(backupRoot)) {
-  fs.rmSync(backupRoot, { recursive: true, force: true });
-}
-
 const files = walk(cascaRoot);
 if (!files.length) {
   console.error('casca/ vazia — recusando pack');
   process.exit(1);
 }
 
-for (const src of files) {
-  const rel = path.relative(cascaRoot, src);
-  const dest = path.join(root, rel);
-  if (fs.existsSync(dest)) {
-    const bak = path.join(backupRoot, rel);
-    fs.mkdirSync(path.dirname(bak), { recursive: true });
-    fs.copyFileSync(dest, bak);
+// A missing validator fails at import time, before touching the checkout.
+beginOverlay(root);
+try {
+  for (const src of files) {
+    const rel = path.relative(cascaRoot, src).split(path.sep).join('/');
+    const dest = path.join(root, rel);
+    preserveOverlayFile(root, rel);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(src, dest);
   }
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.copyFileSync(src, dest);
-}
 
-// O hook auroq-sync compara a versao lida de .auroq-core/core-config.yaml com a
-// do npm para avisar de update. Se o core-config ficar para tras, TODO aluno ja
-// atualizado ve "saiu versao nova" para sempre. Sincroniza no pack.
-const pkgVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
-const cfgPath = path.join(root, '.auroq-core', 'core-config.yaml');
-if (fs.existsSync(cfgPath)) {
-  const cfg = fs.readFileSync(cfgPath, 'utf8');
-  const synced = cfg.replace(/^(\s*version:\s*)["']?\d+\.\d+\.\d+["']?/m, `$1${pkgVersion}`);
-  if (synced !== cfg) {
-    const bak = path.join(backupRoot, '.auroq-core', 'core-config.yaml');
-    if (!fs.existsSync(bak)) {
-      fs.mkdirSync(path.dirname(bak), { recursive: true });
-      fs.copyFileSync(cfgPath, bak);
+  // O hook auroq-sync compara a versao lida de .auroq-core/core-config.yaml com a
+  // do npm para avisar de update. Se o core-config ficar para tras, TODO aluno ja
+  // atualizado ve "saiu versao nova" para sempre. Sincroniza no pack.
+  const pkgVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  const cfgPath = path.join(root, '.auroq-core', 'core-config.yaml');
+  if (fs.existsSync(cfgPath)) {
+    const cfg = fs.readFileSync(cfgPath, 'utf8');
+    const synced = cfg.replace(/^(\s*version:\s*)["']?\d+\.\d+\.\d+["']?/m, `$1${pkgVersion}`);
+    if (synced !== cfg) {
+      preserveOverlayFile(root, '.auroq-core/core-config.yaml');
+      fs.writeFileSync(cfgPath, synced);
+      console.log(`prepack-casca: core-config.yaml sincronizado para ${pkgVersion}`);
     }
-    fs.writeFileSync(cfgPath, synced);
-    console.log(`prepack-casca: core-config.yaml sincronizado para ${pkgVersion}`);
   }
-}
 
-console.log(`prepack-casca: ${files.length} arquivos sobrepostos`);
+  preserveOverlayFile(root, INVENTORY_PATH);
+  writeRuntimeInventory(root);
+  const verified = verifyRuntimeInventory(root);
+  console.log(`prepack-casca: ${files.length} arquivos sobrepostos`);
+  console.log(`prepack-casca: inventario SHA256 de ${verified.files} arquivos (nao e assinatura)`);
+} catch (error) {
+  restoreOverlay(root);
+  throw error;
+}

package/scripts/runtime-integrity.mjs

@@ -0,0 +1,173 @@
+#!/usr/bin/env node
+/** Package completeness and accidental-change checks; SHA256 is not a signature.
+ * Scope: shipped engine/cascas only. Business files and optional legacy modules
+ * are not a source of dependencies. Generate AFTER the casca overlay.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+export const INVENTORY_PATH = 'lib/runtime-integrity.json';
+const SYNAPSE_ROOT = '.auroq-core/core/synapse/';
+const SYNAPSE_LAYERS = ['l0-constitution', 'l1-global', 'l2-agent', 'l3-workflow', 'l4-task', 'l5-squad', 'l6-keyword', 'l7-star-command'];
+export const REQUIRED_FILES = [
+  'package.json', 'bin/auroq-os.js',
+  'lib/auth.js', 'lib/credentials.js', 'lib/diagnostico.js', 'lib/supabase.js',
+  'lib/onepassword.js', 'lib/telemetry.mjs', 'lib/synapse-hashes.json', 'lib/legacy-shims.json',
+  'lib/ahi/install.cjs', 'lib/ahi/client.mjs', 'lib/ahi/historico.mjs',
+  'scripts/runtime-integrity.mjs', 'scripts/pack-state.mjs',
+  'scripts/prepack-casca.mjs', 'scripts/postpack-casca.mjs', 'scripts/build-pack.mjs',
+  'scripts/sync-codex-skills.mjs', 'scripts/validate-hybrid.mjs',
+  '.auroq-core/core-config.yaml', '.auroq-core/constitution.md', '.auroq-core/dna-operacional.md',
+  '.auroq-core/core/synapse/engine.js', '.auroq-core/core/synapse/runtime/hook-runtime.js',
+  '.auroq-core/core/synapse/session/session-manager.js', '.auroq-core/core/synapse/domain/domain-loader.js',
+  ...SYNAPSE_LAYERS.map(layer => `${SYNAPSE_ROOT}layers/${layer}.js`),
+  '.claude/settings.json', '.claude/settings.local.json',
+  '.claude/commands/AuroqOS/agents/ops.md', '.claude/commands/auroq-companion.md',
+  '.claude/hooks/synapse-engine.cjs', '.claude/hooks/auroq-sync.cjs',
+  '.claude/hooks/ahi-capture.cjs', '.claude/hooks/ahi/runtime.cjs',
+  '.claude/hooks/ahi/security.cjs', '.claude/hooks/ahi/worker.cjs', '.claude/hooks/ahi/auth-config.cjs',
+];
+const PROTECTED_TREES = ['lib/', '.auroq-core/core/synapse/', '.claude/hooks/'];
+const FORBIDDEN_PREFIXES = ['business/', 'docs/knowledge/', 'casca/', '.git/', '.pack-casca-backup/'];
+
+function safeRelative(relative) {
+  if (typeof relative !== 'string' || !relative || relative.includes('\\') || relative.startsWith('/')
+    || relative.split('/').some(part => !part || part === '.' || part === '..') || /^[A-Za-z]:/.test(relative)) {
+    throw new Error('Invalid package path');
+  }
+  return relative;
+}
+
+function checkedFile(root, relative) {
+  safeRelative(relative);
+  let current = root;
+  for (const segment of relative.split('/')) {
+    current = path.join(current, segment);
+    if (fs.lstatSync(current).isSymbolicLink()) throw new Error(`Symlink in protected path: ${relative}`);
+  }
+  if (!fs.statSync(current).isFile()) throw new Error(`Not a regular file: ${relative}`);
+  return current;
+}
+
+function walk(root, relative) {
+  const out = [];
+  const dir = path.join(root, relative);
+  if (!fs.existsSync(dir)) throw new Error(`Missing protected directory: ${relative}`);
+  if (fs.lstatSync(dir).isSymbolicLink()) throw new Error(`Symlink in protected directory: ${relative}`);
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    const rel = `${relative}${item.name}`;
+    if (item.isSymbolicLink()) throw new Error(`Symlink in protected path: ${rel}`);
+    if (item.isDirectory()) out.push(...walk(root, `${rel}/`));
+    else if (item.isFile() && rel !== INVENTORY_PATH) out.push(rel);
+  }
+  return out;
+}
+
+function inventoryPaths(root) {
+  return [...new Set([...REQUIRED_FILES, ...PROTECTED_TREES.flatMap(dir => walk(root, dir))])].sort();
+}
+
+function digest(root, relative) {
+  return crypto.createHash('sha256').update(fs.readFileSync(checkedFile(root, relative))).digest('hex');
+}
+
+function resolveLocal(root, source, reference) {
+  const relative = path.posix.normalize(path.posix.join(path.posix.dirname(source), reference));
+  safeRelative(relative);
+  const candidates = path.posix.extname(relative) ? [relative] : [relative, `${relative}.js`, `${relative}.json`, `${relative}/index.js`];
+  const found = candidates.find(candidate => fs.existsSync(path.join(root, candidate)) && fs.statSync(path.join(root, candidate)).isFile());
+  if (!found) throw new Error(`Broken required local reference: ${source} -> ${reference}`);
+  checkedFile(root, found);
+  return found;
+}
+
+/** Literal imports/requires in active CLI/lib/AHI/SYNAPSE code.
+ * Dynamic SYNAPSE layers/entry targets are explicitly required above. Diagnostic
+ * tooling is outside this runtime scope; only the precise optional Pro edge is exempt.
+ */
+function verifyReferences(root, paths) {
+  const sources = paths.filter(p => p === 'bin/auroq-os.js'
+    || (/\.(?:js|mjs|cjs)$/.test(p) && (p.startsWith('lib/') || p.startsWith('.claude/hooks/ahi/')))
+    || p === `${SYNAPSE_ROOT}engine.js`
+    || /^\.auroq-core\/core\/synapse\/(?:context|domain|layers|output|session|runtime|memory|utils)\/.*\.js$/.test(p)
+    || p === '.claude/hooks/ahi-capture.cjs');
+  const protectedSet = new Set(paths);
+  for (const source of sources) {
+    const content = fs.readFileSync(checkedFile(root, source), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+    const references = /(?:\brequire\s*\(\s*|\bimport\s*\(\s*|\bfrom\s+|\bimport\s+)['"](\.[^'"\r\n]+)['"]/g;
+    for (const match of content.matchAll(references)) {
+      if (source === `${SYNAPSE_ROOT}memory/synapse-memory-provider.js`
+        && match[1] === '../../../../pro/memory/memory-loader') continue;
+      const target = resolveLocal(root, source, match[1]);
+      if (!protectedSet.has(target)) throw new Error(`Required reference outside protected inventory: ${source} -> ${match[1]}`);
+    }
+  }
+  for (const source of ['.claude/settings.json', '.claude/settings.local.json']) {
+    const settings = JSON.parse(fs.readFileSync(checkedFile(root, source), 'utf8'));
+    for (const groups of Object.values(settings.hooks || {})) {
+      for (const group of groups) for (const hook of group.hooks || []) {
+        const match = typeof hook.command === 'string' && hook.command.match(/^node\s+(\.claude\/hooks\/[^\s]+)(?:\s|$)/);
+        if (match) checkedFile(root, match[1]);
+      }
+    }
+  }
+}
+
+export function writeRuntimeInventory(root) {
+  const paths = inventoryPaths(root);
+  verifyReferences(root, paths);
+  const version = JSON.parse(fs.readFileSync(checkedFile(root, 'package.json'), 'utf8')).version;
+  const inventory = { schema: 1, algorithm: 'sha256', scope: 'packaged-runtime-and-cascas', version,
+    files: paths.map(file => ({ path: file, sha256: digest(root, file) })) };
+  fs.writeFileSync(path.join(root, INVENTORY_PATH), `${JSON.stringify(inventory, null, 2)}\n`);
+  return inventory;
+}
+
+export function verifyRuntimeInventory(root, packedPaths) {
+  const inventory = JSON.parse(fs.readFileSync(checkedFile(root, INVENTORY_PATH), 'utf8'));
+  const version = JSON.parse(fs.readFileSync(checkedFile(root, 'package.json'), 'utf8')).version;
+  if (inventory.schema !== 1 || inventory.algorithm !== 'sha256' || inventory.scope !== 'packaged-runtime-and-cascas'
+    || inventory.version !== version || !Array.isArray(inventory.files)) throw new Error('Invalid runtime inventory');
+  const expected = inventoryPaths(root);
+  const entries = new Map();
+  for (const entry of inventory.files) {
+    safeRelative(entry.path);
+    if (entries.has(entry.path) || !/^[a-f0-9]{64}$/.test(entry.sha256)) throw new Error('Invalid or duplicate inventory entry');
+    entries.set(entry.path, entry.sha256);
+  }
+  if (entries.size !== expected.length || expected.some(file => !entries.has(file))) throw new Error('Protected inventory is incomplete or changed');
+  for (const file of expected) {
+    if (digest(root, file) !== entries.get(file)) throw new Error(`Runtime hash mismatch: ${file}`);
+  }
+  verifyReferences(root, expected);
+  if (packedPaths) {
+    const included = new Set(packedPaths.map(safeRelative));
+    for (const file of [...expected, INVENTORY_PATH]) {
+      if (!included.has(file)) throw new Error(`Protected file missing from package: ${file}`);
+    }
+    for (const file of included) {
+      const parts = file.split('/');
+      if (FORBIDDEN_PREFIXES.some(prefix => file.startsWith(prefix))
+        || (file.startsWith('agents/') && !file.startsWith('agents/organizer/'))
+        || parts.some(part => part === '.npmrc' || part === '.env' || (part.startsWith('.env.') && part !== '.env.example'))
+        || file.includes('arcane-method') || file.includes('consultor/knowledge')) throw new Error(`Forbidden package file: ${file}`);
+    }
+  }
+  return { version, files: expected.length };
+}
+
+if (process.argv[1] && fs.existsSync(process.argv[1])
+  && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))) {
+  try {
+    const args = process.argv.slice(2).filter(arg => arg !== '--verify');
+    if (args.length > 1 || args.some(arg => arg.startsWith('--'))) throw new Error('Usage: runtime-integrity.mjs [--verify] [package-root]');
+    const result = verifyRuntimeInventory(path.resolve(args[0] || '.'));
+    console.log(`Runtime inventory verified: ${result.files} files (SHA256; not a signature).`);
+  } catch (error) {
+    console.error(`Runtime inventory failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}