chainlesschain 0.166.141 → 0.166.143

package/src/lib/plugin-runtime/cli-goal-capabilities.js

@@ -0,0 +1,29 @@
+/** Implemented CLI surfaces; source leases and per-call activation still gate use. */
+import { VERSION } from "../../constants.js";
+
+export const CLI_GOAL_CAPABILITIES = Object.freeze([
+  "event:goal.status.changed",
+  "event:risk.review.completed",
+  "event:action.receipt.updated",
+  "panel:goal.summary",
+  "panel:goal.evidence",
+  "proposal:task.description.update",
+  "proposal:task.create",
+]);
+
+export function cliGoalExtensionHost(activeCapabilities) {
+  if (
+    !Array.isArray(activeCapabilities) ||
+    activeCapabilities.some(
+      (value) => !CLI_GOAL_CAPABILITIES.includes(value),
+    ) ||
+    new Set(activeCapabilities).size !== activeCapabilities.length
+  )
+    throw new Error("CLI_GOAL_HOST_CAPABILITIES_INVALID");
+  return Object.freeze({
+    id: "cli",
+    version: VERSION,
+    capabilities: CLI_GOAL_CAPABILITIES,
+    activeCapabilities: Object.freeze([...activeCapabilities]),
+  });
+}

package/src/lib/plugin-runtime/cli-goal-draft-request.js

@@ -1,15 +1,13 @@
 import fs from "node:fs";
 import path from "node:path";
-import { VERSION } from "../../constants.js";
+import { cliGoalExtensionHost } from "./cli-goal-capabilities.js";
 import { createProjectGoalConnection } from "../project-goal-connection.js";
 import { collectGoalExtensions } from "./goal-extensions.js";
-import { createGoalDraftRequest } from "@chainlesschain/session-core/goal-draft-request-contract";
+import {
+  createGoalDraftRequest,
+  createGoalTaskCreateRequest,
+} from "@chainlesschain/session-core/goal-draft-request-contract";
 import { digestBusinessObjectContent as digest } from "@chainlesschain/session-core/business-object-contract";
-const HOST = Object.freeze({
-  id: "cli",
-  version: VERSION,
-  capabilities: Object.freeze(["proposal:task.description.update"]),
-});
 function fail(code) {
   throw new Error(code);
 }
@@ -53,12 +51,19 @@ export function readGoalDraftDescription(file) {
   }
 }
 export async function exportCliGoalDraftRequest(id, options = {}) {
+  return exportRequest(id, options, false);
+}
+export async function exportCliGoalTaskCreateRequest(id, options = {}) {
+  return exportRequest(id, options, true);
+}
+async function exportRequest(id, options, creation) {
   options = Object.freeze({
     ...options,
     env: Object.freeze({ ...(options.env || process.env) }),
   });
   const cwd = path.resolve(options.cwd || process.cwd()),
     env = Object.freeze({ ...(options.env || process.env) });
+  const type = creation ? "task.create" : "task.description.update";
   if (
     !options.connection ||
     !options.plugin ||
@@ -77,7 +82,7 @@ export async function exportCliGoalDraftRequest(id, options = {}) {
   const hostOptions = {
     cwd,
     env,
-    host: HOST,
+    host: cliGoalExtensionHost([`proposal:${type}`]),
     managedSettingsFile: options.managedSettingsFile,
   };
   const admitted = () =>
@@ -85,12 +90,11 @@ export async function exportCliGoalDraftRequest(id, options = {}) {
       (entry) => entry.name === options.plugin && entry.scope === options.scope,
     );
   const plugin = admitted();
-  if (
-    !plugin ||
-    !plugin.declaration.proposals.includes("task.description.update")
-  )
+  if (!plugin || !plugin.declaration.proposals.includes(type))
     fail("GOAL_DRAFT_PLUGIN_NOT_ADMITTED");
-  const request = createGoalDraftRequest({
+  const request = (
+    creation ? createGoalTaskCreateRequest : createGoalDraftRequest
+  )({
     declaredPlugin: {
       name: plugin.name,
       scope: plugin.scope,
@@ -98,7 +102,8 @@ export async function exportCliGoalDraftRequest(id, options = {}) {
     },
     declarationDigest: digest(plugin.declaration),
     proposal: {
-      type: "task.description.update",
+      type,
+      ...(creation ? { taskType: options.taskType } : {}),
       goalRef: snapshot.goalRef,
       sourceRef: options.source,
       requestId: options.requestId,
@@ -127,12 +132,17 @@ export async function exportCliGoalDraftRequest(id, options = {}) {
     fs.closeSync(fd);
   }
   return {
-    schema: "chainlesschain.goal-draft-export/v1",
+    schema: creation
+      ? "chainlesschain.goal-task-create-export/v1"
+      : "chainlesschain.goal-draft-export/v1",
     state: "request-exported",
     goalRef: request.proposal.goalRef,
     declaredPlugin: request.declaredPlugin,
     requestId: request.proposal.requestId,
     contentDigest: request.contentDigest,
     file,
+    ...(creation
+      ? { type: "task.create", taskType: request.proposal.taskType }
+      : {}),
   };
 }

package/src/lib/plugin-runtime/cli-goal-drafts.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { VERSION } from "../../constants.js";
+import { cliGoalExtensionHost } from "./cli-goal-capabilities.js";
 import { managedSettingsPath } from "../settings-loader.cjs";
 import { createProjectGoalConnection } from "../project-goal-connection.js";
 import {
@@ -11,24 +11,26 @@ import { readGoalDraftDescription } from "./cli-goal-draft-request.js";
 import { digestBusinessObjectContent as digest } from "@chainlesschain/session-core/business-object-contract";
 import {
   ACCESS_SCHEMA,
+  CREATE_ACCESS_SCHEMA,
   MAX_SUBMISSION_REFERENCE_BYTES,
   validateGoalDraftAccess,
+  validateGoalCreateDraftAccess,
   validateGoalDraftProposal,
+  validateGoalCreateDraftProposal,
   validateGoalDraftReceipt,
   validateGoalDraftSources,
   createGoalDraftSubmissionReference,
   validateGoalDraftSubmissionReference,
 } from "@chainlesschain/session-core/goal-draft-connection-contract";
 
-const HOST = Object.freeze({
-  id: "cli",
-  version: VERSION,
-  capabilities: Object.freeze(["proposal:task.description.update"]),
-});
 export const CLI_GOAL_DRAFT_SUBMISSION_SCHEMA =
   "chainlesschain.goal-draft-submission/v1";
 export const CLI_GOAL_DRAFT_SOURCES_SCHEMA =
   "chainlesschain.goal-draft-source-page/v1";
+export const CLI_GOAL_CREATE_DRAFT_SUBMISSION_SCHEMA =
+  "chainlesschain.goal-create-draft-submission/v1";
+export const CLI_GOAL_CREATE_DRAFT_SOURCES_SCHEMA =
+  "chainlesschain.goal-create-draft-source-page/v1";
 export const _deps = {
   createProjectGoalConnection,
   collectGoalExtensions,
@@ -48,7 +50,7 @@ function required(value) {
     fail("CLI_GOAL_DRAFT_ARGUMENTS_REQUIRED");
   return value;
 }
-function fixedOptions(raw) {
+function fixedOptions(raw, creation = false) {
   const options = { ...raw },
     env = Object.freeze({ ...(options.env || process.env) });
   const cwd = path.resolve(options.cwd || process.cwd());
@@ -72,6 +74,8 @@ function fixedOptions(raw) {
     );
   return Object.freeze({
     ...options,
+    creation,
+    draftType: creation ? "task.create" : "task.description.update",
     cwd,
     env,
     managedSettingsFile: managedSettingsPath({
@@ -85,7 +89,7 @@ function hostOptions(options) {
     cwd: options.cwd,
     env: options.env,
     managedSettingsFile: options.managedSettingsFile,
-    host: HOST,
+    host: cliGoalExtensionHost([`proposal:${options.draftType}`]),
   });
 }
 function admitted(options, expected) {
@@ -94,13 +98,12 @@ function admitted(options, expected) {
     .extensions.find(
       (item) => item.name === options.plugin && item.scope === options.scope,
     );
-  if (
-    !entry ||
-    !entry.declaration.proposals.includes("task.description.update")
-  )
+  if (!entry || !entry.declaration.proposals.includes(options.draftType))
     fail("CLI_GOAL_DRAFT_NOT_ADMITTED");
-  const access = validateGoalDraftAccess({
-    schema: ACCESS_SCHEMA,
+  const access = (
+    options.creation ? validateGoalCreateDraftAccess : validateGoalDraftAccess
+  )({
+    schema: options.creation ? CREATE_ACCESS_SCHEMA : ACCESS_SCHEMA,
     plugin: { name: entry.name, scope: entry.scope, version: entry.version },
     declarationDigest: digest(entry.declaration),
   });
@@ -113,7 +116,9 @@ function connected(id, options) {
   required(options.connection);
   const connection = _deps.createProjectGoalConnection(options.connection);
   if (
-    connection.drafts !== true ||
+    (options.creation
+      ? connection.createDrafts !== true || connection.drafts === true
+      : connection.drafts !== true || connection.createDrafts === true) ||
     !["read", "sources", "receipt", "enqueue"].every(
       (key) => typeof connection[key] === "function",
     )
@@ -229,9 +234,12 @@ function referenceFor(connection, access, requestId, inputDigest) {
     inputDigest,
   });
 }
-function outcome(reference, file, receipt) {
+function outcome(reference, file, receipt, creation = false) {
   return {
-    schema: CLI_GOAL_DRAFT_SUBMISSION_SCHEMA,
+    schema: creation
+      ? CLI_GOAL_CREATE_DRAFT_SUBMISSION_SCHEMA
+      : CLI_GOAL_DRAFT_SUBMISSION_SCHEMA,
+    ...(creation ? { type: "task.create" } : {}),
     state: receipt?.state ?? "unknown",
     goalRef: reference.goalRef,
     plugin: reference.plugin,
@@ -257,28 +265,40 @@ async function queryReceipt(connection, saved, file) {
       receipt.inputDigest !== saved.reference.inputDigest
     )
       fail("CLI_GOAL_DRAFT_RECEIPT_MISMATCH");
-    return outcome(saved.reference, file, receipt);
+    return outcome(
+      saved.reference,
+      file,
+      receipt,
+      connection.createDrafts === true,
+    );
   } catch {
-    return outcome(saved.reference, file);
+    return outcome(
+      saved.reference,
+      file,
+      undefined,
+      connection.createDrafts === true,
+    );
   }
 }
 
 /** Exports an identity label and declaration digest, never native authority. */
-export async function exportCliGoalDraftAccess(raw = {}) {
-  const options = fixedOptions(raw);
+async function exportAccess(raw = {}, creation = false) {
+  const options = fixedOptions(raw, creation);
   required(options.out);
   const access = admitted(options);
   writeNew(options.out, access);
   return {
-    schema: "chainlesschain.goal-draft-access-export/v1",
+    schema: options.creation
+      ? "chainlesschain.goal-create-draft-access-export/v1"
+      : "chainlesschain.goal-draft-access-export/v1",
     state: "access-exported",
     plugin: access.plugin,
     declarationDigest: access.declarationDigest,
     file: options.out,
   };
 }
-export async function readCliGoalDraftSources(id, raw = {}) {
-  const options = fixedOptions(raw),
+async function readSources(id, raw = {}, creation = false) {
+  const options = fixedOptions(raw, creation),
     { connection, access } = connected(id, options);
   if (
     options.after !== undefined &&
@@ -291,7 +311,9 @@ export async function readCliGoalDraftSources(id, raw = {}) {
   );
   admitted(options, access);
   return {
-    schema: CLI_GOAL_DRAFT_SOURCES_SCHEMA,
+    schema: options.creation
+      ? CLI_GOAL_CREATE_DRAFT_SOURCES_SCHEMA
+      : CLI_GOAL_DRAFT_SOURCES_SCHEMA,
     goalRef: connection.goalRef,
     plugin: access.plugin,
     declarationDigest: access.declarationDigest,
@@ -299,13 +321,17 @@ export async function readCliGoalDraftSources(id, raw = {}) {
     sources,
   };
 }
-export async function sendCliGoalDraft(id, raw = {}) {
-  const options = fixedOptions(raw);
+async function sendDraft(id, raw = {}, creation = false) {
+  const options = fixedOptions(raw, creation);
   required(options.record);
   required(options.descriptionFile);
   const { connection, access } = connected(id, options);
-  const proposal = validateGoalDraftProposal({
-    type: "task.description.update",
+  const validateProposal = options.creation
+    ? validateGoalCreateDraftProposal
+    : validateGoalDraftProposal;
+  const proposal = validateProposal({
+    type: options.draftType,
+    ...(options.creation ? { taskType: options.taskType } : {}),
     goalRef: connection.goalRef,
     sourceRef: options.source,
     requestId: options.requestId,
@@ -349,7 +375,7 @@ export async function sendCliGoalDraft(id, raw = {}) {
         return true;
       },
       async enqueueProposal(context) {
-        const projected = validateGoalDraftProposal(
+        const projected = validateProposal(
           Object.fromEntries(
             [
               "type",
@@ -358,6 +384,7 @@ export async function sendCliGoalDraft(id, raw = {}) {
               "requestId",
               "title",
               "description",
+              ...(options.creation ? ["taskType"] : []),
             ].map((key) => [key, context[key]]),
           ),
         );
@@ -389,16 +416,22 @@ export async function sendCliGoalDraft(id, raw = {}) {
     });
     if (!nativeReceipt) fail("CLI_GOAL_DRAFT_RECEIPT_MISMATCH");
     // A verified saved receipt is not undone by a later local admission change.
-    return outcome(reference, options.record, nativeReceipt);
+    return outcome(reference, options.record, nativeReceipt, options.creation);
   } catch (error) {
-    if (nativeReceipt) return outcome(reference, options.record, nativeReceipt);
+    if (nativeReceipt)
+      return outcome(
+        reference,
+        options.record,
+        nativeReceipt,
+        options.creation,
+      );
     if (dispatched || error.outcomeUnknown)
-      return outcome(reference, options.record);
+      return outcome(reference, options.record, undefined, options.creation);
     throw error;
   }
 }
-export async function readCliGoalDraftReceipt(id, raw = {}) {
-  const options = fixedOptions(raw);
+async function readReceipt(id, raw = {}, creation = false) {
+  const options = fixedOptions(raw, creation);
   required(options.record);
   const { connection, access } = connected(id, options),
     saved = readReference(options.record);
@@ -411,3 +444,13 @@ export async function readCliGoalDraftReceipt(id, raw = {}) {
   if (!same(expected, saved.reference)) fail("CLI_GOAL_DRAFT_RECORD_CONFLICT");
   return queryReceipt(connection, saved, options.record);
 }
+export const exportCliGoalDraftAccess = (raw) => exportAccess(raw, false);
+export const exportCliGoalCreateDraftAccess = (raw) => exportAccess(raw, true);
+export const readCliGoalDraftSources = (id, raw) => readSources(id, raw, false);
+export const readCliGoalCreateDraftSources = (id, raw) =>
+  readSources(id, raw, true);
+export const sendCliGoalDraft = (id, raw) => sendDraft(id, raw, false);
+export const sendCliGoalCreateDraft = (id, raw) => sendDraft(id, raw, true);
+export const readCliGoalDraftReceipt = (id, raw) => readReceipt(id, raw, false);
+export const readCliGoalCreateDraftReceipt = (id, raw) =>
+  readReceipt(id, raw, true);

package/src/lib/plugin-runtime/cli-goal-event-history.js

@@ -0,0 +1,284 @@
+/** One acknowledged page at a time; checkpoints contain no credentials or bodies. */
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { cliGoalExtensionHost } from "./cli-goal-capabilities.js";
+import { managedSettingsPath } from "../settings-loader.cjs";
+import { withFileLockAsync } from "../with-file-lock.js";
+import { createProjectGoalConnection } from "../project-goal-connection.js";
+import {
+  collectGoalExtensions,
+  projectGoalExtensionEvent,
+} from "./goal-extensions.js";
+import { parseGoalEventCursor } from "@chainlesschain/session-core/goal-evidence-contract";
+const TYPES = ["risk.review.completed", "action.receipt.updated"];
+const hash = (value) =>
+  createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const fail = (code) => {
+  throw Object.assign(new Error(code), { code });
+};
+export const _deps = { createProjectGoalConnection, projectGoalExtensionEvent };
+const sameFile = (a, b) =>
+  a.dev === b.dev &&
+  a.ino === b.ino &&
+  a.size === b.size &&
+  a.mtimeMs === b.mtimeMs &&
+  a.ctimeMs === b.ctimeMs;
+function readFile(file) {
+  const entry = fs.lstatSync(file);
+  if (
+    !entry.isFile() ||
+    entry.isSymbolicLink() ||
+    entry.nlink !== 1 ||
+    entry.size > 8192
+  )
+    fail("GOAL_EVENT_CHECKPOINT_INVALID");
+  const fd = fs.openSync(
+    file,
+    fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0),
+  );
+  try {
+    if (!sameFile(entry, fs.fstatSync(fd)))
+      fail("GOAL_EVENT_CHECKPOINT_CHANGED");
+    const bytes = Buffer.alloc(entry.size + 1),
+      n = fs.readSync(fd, bytes, 0, bytes.length, 0);
+    if (
+      n !== entry.size ||
+      !sameFile(entry, fs.fstatSync(fd)) ||
+      !sameFile(entry, fs.lstatSync(file))
+    )
+      fail("GOAL_EVENT_CHECKPOINT_CHANGED");
+    const body = bytes.subarray(0, n).toString("utf8");
+    return { record: JSON.parse(body), digest: hash(body) };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+/** Publish must acknowledge flushed output; a crash before checkpoint commit replays. */
+export function replayCliGoalEvents(id, raw = {}, publish) {
+  const cwd = path.resolve(raw.cwd || process.cwd()),
+    env = Object.freeze({ ...(raw.env || process.env) });
+  const required = (value) => {
+    if (
+      typeof value !== "string" ||
+      !value ||
+      value.length > 4096 ||
+      /[\u0000-\u001f]/u.test(value)
+    )
+      fail("GOAL_EVENT_ARGUMENT_REQUIRED");
+    return value;
+  };
+  const connection = path.resolve(cwd, required(raw.connection)),
+    checkpoint = path.resolve(cwd, required(raw.checkpoint));
+  const name = required(raw.plugin),
+    scope = raw.scope,
+    expectedStore = raw.expectedStore;
+  const signal = raw.signal;
+  const checkpointMode = raw.checkpointMode ?? "auto";
+  if (!["auto", "new", "resume"].includes(checkpointMode))
+    fail("GOAL_EVENT_ARGUMENT_REQUIRED");
+  if (
+    !["user", "project", "local"].includes(scope) ||
+    typeof publish !== "function"
+  )
+    fail("GOAL_EVENT_ARGUMENT_REQUIRED");
+  const policyEnv = { ...env };
+  if (policyEnv.CC_MANAGED_SETTINGS)
+    policyEnv.CC_MANAGED_SETTINGS = path.resolve(
+      cwd,
+      required(policyEnv.CC_MANAGED_SETTINGS),
+    );
+  const policyFile = managedSettingsPath({
+    env: policyEnv,
+    managedSettingsFile:
+      raw.managedSettingsFile === undefined
+        ? undefined
+        : path.resolve(cwd, required(raw.managedSettingsFile)),
+  });
+  const options = Object.freeze({
+    cwd,
+    env,
+    managedSettingsFile: policyFile,
+    host: cliGoalExtensionHost(TYPES.map((type) => `event:${type}`)),
+  });
+  return (async () => {
+    const source = _deps.createProjectGoalConnection(connection);
+    if (!source.eventHistory || typeof source.readEventPage !== "function")
+      fail("GOAL_EVENT_HISTORY_CONNECTION_REQUIRED");
+    const goalRef = source.goalRef;
+    if (
+      goalRef.id !== id ||
+      (expectedStore !== undefined && expectedStore !== goalRef.storeId)
+    )
+      fail("CLI_GOAL_STORE_MISMATCH");
+    const selected = collectGoalExtensions(options).extensions.find(
+      (entry) =>
+        entry.name === name &&
+        entry.scope === scope &&
+        entry.declaration.events.some((type) => TYPES.includes(type)),
+    );
+    if (!selected) fail("CLI_GOAL_EVENT_PLUGIN_UNAVAILABLE");
+    const plugin = Object.freeze({
+        name: selected.name,
+        scope: selected.scope,
+        version: selected.version,
+      }),
+      declarationDigest = hash(selected.declaration);
+    function admission() {
+      if (signal?.aborted) fail("GOAL_EVENT_REPLAY_ABORTED");
+      const current = collectGoalExtensions(options).extensions.find(
+        (entry) =>
+          entry.name === name &&
+          entry.scope === scope &&
+          entry.version === plugin.version,
+      );
+      if (!current || hash(current.declaration) !== declarationDigest)
+        fail("CLI_GOAL_EVENT_ADMISSION_CHANGED");
+    }
+    admission();
+    const root = path.dirname(checkpoint),
+      realRoot = fs.realpathSync(root),
+      rootStat = fs.statSync(root);
+    const checkRoot = () => {
+      const stat = fs.statSync(root);
+      if (
+        fs.realpathSync(root) !== realRoot ||
+        !stat.isDirectory() ||
+        stat.dev !== rootStat.dev ||
+        stat.ino !== rootStat.ino
+      )
+        fail("GOAL_EVENT_CHECKPOINT_CHANGED");
+    };
+    const binding = {
+      schema: "chainlesschain.goal-event-checkpoint/v1",
+      goalRef,
+      plugin,
+      declarationDigest,
+    };
+    return withFileLockAsync(
+      checkpoint,
+      async (lock) => {
+        checkRoot();
+        admission();
+        const exists = fs.existsSync(checkpoint);
+        if (checkpointMode === "new" && exists)
+          fail("GOAL_EVENT_CHECKPOINT_EXISTS");
+        if (checkpointMode === "resume" && !exists)
+          fail("GOAL_EVENT_CHECKPOINT_MISSING");
+        if (!fs.existsSync(checkpoint)) {
+          const fd = fs.openSync(checkpoint, "wx", 0o600);
+          try {
+            fs.writeFileSync(fd, JSON.stringify({ ...binding, after: null }));
+            fs.fsyncSync(fd);
+          } finally {
+            fs.closeSync(fd);
+          }
+        }
+        const initial = readFile(checkpoint),
+          record = initial.record;
+        if (
+          !record ||
+          Object.keys(record).sort().join() !==
+            "after,declarationDigest,goalRef,plugin,schema" ||
+          hash({ ...record, after: null }) !== hash({ ...binding, after: null })
+        )
+          fail("GOAL_EVENT_CHECKPOINT_BINDING_CONFLICT");
+        if (record.after !== null) parseGoalEventCursor(record.after);
+        const after = record.after ?? undefined;
+        const page = await source.readEventPage(after, { signal });
+        admission();
+        const events = [];
+        for (const entry of page.entries) {
+          if (!selected.declaration.events.includes(entry.type)) continue;
+          const summary =
+            entry.type === "risk.review.completed"
+              ? `Historical risk check ${entry.sourceId}: ${entry.state}; risk task count ${entry.riskTaskCount ?? "unknown"}. This does not prove current risk or goal completion.`
+              : `Historical action receipt ${entry.sourceId}: ${entry.state} (${entry.actionType}). This does not prove goal completion.`;
+          const event = await _deps.projectGoalExtensionEvent(
+            plugin,
+            { type: entry.type, goalRef },
+            {
+              ...options,
+              authorize(context) {
+                admission();
+                return (
+                  context.operation === "read-event" &&
+                  context.type === entry.type &&
+                  hash(context.goalRef) === hash(goalRef)
+                );
+              },
+              readEvent() {
+                return { summary, occurredAt: entry.recordedAt };
+              },
+            },
+          );
+          events.push({
+            id: entry.id,
+            sequence: entry.sequence,
+            sourceRef: entry.sourceRef,
+            recordedAt: entry.recordedAt,
+            event,
+          });
+        }
+        async function revalidate() {
+          admission();
+          checkRoot();
+          if (readFile(checkpoint).digest !== initial.digest)
+            fail("GOAL_EVENT_CHECKPOINT_CHANGED");
+          const current = await source.readEventPage(after, { signal });
+          if (
+            hash(current.entries.slice(0, page.entries.length)) !==
+              hash(page.entries) ||
+            (page.nextCursor === null && current.nextCursor !== null) ||
+            (page.nextCursor &&
+              parseGoalEventCursor(page.nextCursor).epoch !==
+                parseGoalEventCursor(current.nextCursor).epoch)
+          )
+            fail("GOAL_EVENT_HISTORY_CHANGED");
+          admission();
+        }
+        await revalidate();
+        const result = {
+          schema: "chainlesschain.goal-extension-history/v1",
+          goalRef,
+          plugin,
+          observedAt: new Date().toISOString(),
+          delivery: "at-least-once",
+          entries: events,
+          scannedCount: page.entries.length,
+          nextCursor: page.nextCursor,
+          hasMore: page.hasMore,
+          truncated: page.truncated,
+          retainedFrom: page.retainedFrom,
+          highWatermark: page.highWatermark,
+        };
+        if ((await publish(Object.freeze(result))) !== true)
+          fail("GOAL_EVENT_OUTPUT_NOT_ACKNOWLEDGED");
+        await revalidate();
+        lock.assertOwnership();
+        const temporary = `${checkpoint}.${randomUUID()}.tmp`;
+        try {
+          const fd = fs.openSync(temporary, "wx", 0o600);
+          try {
+            fs.writeFileSync(
+              fd,
+              JSON.stringify({ ...binding, after: page.nextCursor }),
+            );
+            fs.fsyncSync(fd);
+          } finally {
+            fs.closeSync(fd);
+          }
+          checkRoot();
+          lock.assertOwnership();
+          if (readFile(checkpoint).digest !== initial.digest)
+            fail("GOAL_EVENT_CHECKPOINT_CHANGED");
+          fs.renameSync(temporary, checkpoint);
+        } finally {
+          if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
+        }
+        return { checkpoint, hasMore: page.hasMore };
+      },
+      { failIfUnavailable: true, timeoutMs: 2000 },
+    );
+  })();
+}