chainlesschain 0.166.21 → 0.166.24

package/src/lib/evolution/evolution-workbench-file-resources.js

@@ -0,0 +1,403 @@
+import fs from "node:fs";
+import path from "node:path";
+import { types } from "node:util";
+import { ArtifactStore } from "../artifact-store.js";
+import { ensurePrivateDirectory } from "../secure-fs.js";
+import { EvolutionArtifactPorts } from "./evolution-artifact-ports.js";
+import { createEvolutionLedgerFileBackend } from "./evolution-ledger-file-backend.js";
+import { createEvolutionLedgerPorts } from "./evolution-ledger-ports.js";
+import { SkillReleaseRegistry } from "./skill-release-registry.js";
+import { capturePruningData as capture } from "./governed-wiki-pruning-journal.js";
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const STORAGE_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/u;
+const FILE_RESOURCES = new WeakSet();
+
+export function captureWorkbenchFileResources(value) {
+  if (!FILE_RESOURCES.has(value))
+    throw new TypeError("genuine Workbench file resources are required");
+  return value;
+}
+const DESCRIPTOR_KEYS = [
+  "tenantId",
+  "artifactTenantId",
+  "streamId",
+  "runId",
+  "skillName",
+  "audience",
+  "purpose",
+  "authorityId",
+  "revision",
+  "handlerArtifactDigest",
+];
+const STORAGE_KEYS = [
+  "artifactDir",
+  "ledgerRootDir",
+  "ledgerAuthorityRootDir",
+  "witnessFilePath",
+  "witnessId",
+  "releaseRootDir",
+];
+
+function record(
+  value,
+  required,
+  optional = [],
+  label = "Workbench file resources",
+) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    types.isProxy(value)
+  )
+    throw new TypeError(`${label} must be an explicit data record`);
+  const properties = Object.getOwnPropertyDescriptors(value);
+  const allowed = new Set([...required, ...optional]);
+  if (
+    required.some((key) => !Object.hasOwn(properties, key)) ||
+    Reflect.ownKeys(properties).some((key) => !allowed.has(key))
+  )
+    throw new TypeError(`${label} has missing or unsupported fields`);
+  const result = {};
+  for (const [key, property] of Object.entries(properties)) {
+    if (!Object.hasOwn(property, "value") || !property.enumerable)
+      throw new TypeError(`${label}.${key} must be an own data field`);
+    result[key] = property.value;
+  }
+  return result;
+}
+
+function fixed(owner, name, label) {
+  if (!owner || typeof owner !== "object" || types.isProxy(owner))
+    throw new TypeError(`${label}.${name} port is required`);
+  const fn = Object.getOwnPropertyDescriptor(owner, name)?.value;
+  if (typeof fn !== "function" || types.isProxy(fn))
+    throw new TypeError(`${label}.${name} must be a fixed own method`);
+  return Object.freeze(fn.bind(owner));
+}
+
+function signingAuthority(input, label) {
+  const value = record(input, ["trust", "signer", "verifier"], [], label);
+  const trust = capture(
+    record(
+      value.trust,
+      ["algorithm", "keyId", "trustPolicyDigest"],
+      [],
+      `${label}.trust`,
+    ),
+  );
+  if (
+    typeof trust.algorithm !== "string" ||
+    !/^[a-z0-9][a-z0-9._+-]{0,63}$/u.test(trust.algorithm) ||
+    typeof trust.keyId !== "string" ||
+    trust.keyId.length > 256 ||
+    !/^[a-z][a-z0-9+.-]{1,31}:[^\s\\]+$/u.test(trust.keyId) ||
+    !DIGEST.test(trust.trustPolicyDigest)
+  )
+    throw new TypeError(`${label} trust is invalid`);
+  return Object.freeze({
+    trust,
+    signer: Object.freeze({ sign: fixed(value.signer, "sign", label) }),
+    verifier: Object.freeze({ verify: fixed(value.verifier, "verify", label) }),
+  });
+}
+
+function normalizedPath(value, label) {
+  if (
+    typeof value !== "string" ||
+    !path.isAbsolute(value) ||
+    value.includes("\0")
+  )
+    throw new TypeError(`${label} must be an absolute path`);
+  const result = path.resolve(value);
+  if (result === path.parse(result).root)
+    throw new TypeError(`${label} must be a dedicated storage path`);
+  return result;
+}
+
+function contained(parent, child) {
+  const relative = path.relative(parent, child);
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative))
+  );
+}
+
+function assertNoAliases(io, target, directory = true) {
+  for (let current = target; ; current = path.dirname(current)) {
+    let stat;
+    try {
+      stat = io.lstatSync(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (stat) {
+      const actual = io.realpathSync(current);
+      if (stat.isSymbolicLink() || path.relative(actual, current) !== "")
+        throw new Error("Workbench storage aliases/symlinks are not allowed");
+      if (
+        current === target &&
+        (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1)
+      )
+        throw new Error(
+          "Workbench storage path has an invalid file type or link count",
+        );
+      if (current !== target && !stat.isDirectory())
+        throw new Error("Workbench storage ancestor is not a directory");
+    }
+    if (path.dirname(current) === current) break;
+  }
+}
+
+/**
+ * Opens real persistence, not a fixture or a permission authority. The caller
+ * still provides identity, human approval and mutation authority to the host.
+ * Returned writers are for the authenticated deployment module only, never RPC.
+ */
+export function openEvolutionWorkbenchFileResources(input) {
+  const options = record(
+    input,
+    ["descriptor", "storage", "authorities"],
+    ["secure", "fsImpl", "now"],
+  );
+  const descriptor = capture(
+    record(options.descriptor, DESCRIPTOR_KEYS, [], "Workbench descriptor"),
+  );
+  for (const key of [
+    "tenantId",
+    "artifactTenantId",
+    "streamId",
+    "runId",
+    "skillName",
+    "audience",
+    "authorityId",
+  ])
+    if (typeof descriptor[key] !== "string" || !ID.test(descriptor[key]))
+      throw new TypeError(`Workbench ${key} is invalid`);
+  for (const key of ["artifactTenantId", "audience"])
+    if (!STORAGE_ID.test(descriptor[key]))
+      throw new TypeError(`Workbench storage ${key} is invalid`);
+  if (
+    descriptor.purpose !== "evolution-ledger" ||
+    !Number.isSafeInteger(descriptor.revision) ||
+    descriptor.revision < 1 ||
+    !DIGEST.test(descriptor.handlerArtifactDigest)
+  )
+    throw new TypeError(
+      "Workbench descriptor purpose/revision/handler digest is invalid",
+    );
+  const storage = record(
+    options.storage,
+    STORAGE_KEYS,
+    [],
+    "Workbench storage",
+  );
+  if (
+    typeof storage.witnessId !== "string" ||
+    !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/u.test(storage.witnessId)
+  )
+    throw new TypeError("Workbench witnessId is invalid");
+  for (const key of STORAGE_KEYS.filter((key) => key !== "witnessId"))
+    storage[key] = normalizedPath(storage[key], key);
+  const directories = [
+    storage.artifactDir,
+    storage.ledgerRootDir,
+    storage.ledgerAuthorityRootDir,
+    storage.releaseRootDir,
+    path.dirname(storage.witnessFilePath),
+  ];
+  for (let i = 0; i < directories.length; i++)
+    for (let j = i + 1; j < directories.length; j++)
+      if (
+        contained(directories[i], directories[j]) ||
+        contained(directories[j], directories[i])
+      )
+        throw new Error(
+          "Workbench artifact, Ledger, authority, witness and Registry storage must be non-overlapping",
+        );
+
+  const secure = options.secure === undefined ? true : options.secure;
+  if (typeof secure !== "boolean")
+    throw new TypeError("Workbench secure must be boolean");
+  const io = options.fsImpl ?? fs;
+  if (!io || typeof io !== "object" || types.isProxy(io))
+    throw new TypeError("Workbench filesystem is invalid");
+  const clock = options.now ?? Date.now;
+  if (typeof clock !== "function" || types.isProxy(clock))
+    throw new TypeError("Workbench clock must be a fixed function");
+  const now = Object.freeze(() => {
+    const value = Number(clock());
+    if (!Number.isFinite(value) || Math.abs(value) > 8_640_000_000_000_000)
+      throw new TypeError("Workbench clock is invalid");
+    return value;
+  });
+  now();
+  const authorities = record(
+    options.authorities,
+    ["artifact", "ledger", "witness", "releaseDurability"],
+    [],
+    "Workbench authorities",
+  );
+  const artifact = record(
+    authorities.artifact,
+    ["envelopeSigner", "envelopeVerifier", "currentAuthorityResolver"],
+    [],
+    "Workbench artifact authority",
+  );
+  const artifactAuthority = {
+    envelopeSigner: Object.freeze({
+      sign: fixed(artifact.envelopeSigner, "sign", "artifact"),
+    }),
+    envelopeVerifier: Object.freeze({
+      verify: fixed(artifact.envelopeVerifier, "verify", "artifact"),
+    }),
+    currentAuthorityResolver: Object.freeze({
+      resolve: fixed(artifact.currentAuthorityResolver, "resolve", "artifact"),
+    }),
+  };
+  const ledgerAuthority = signingAuthority(authorities.ledger, "ledger");
+  const witnessAuthority = signingAuthority(authorities.witness, "witness");
+  // Check original identities before capturing wrappers, which must not disguise
+  // use of the same authority for the event log and its independent witness.
+  if (
+    authorities.ledger === authorities.witness ||
+    authorities.ledger.signer === authorities.witness.signer ||
+    authorities.ledger.verifier === authorities.witness.verifier ||
+    ledgerAuthority.trust.keyId === witnessAuthority.trust.keyId ||
+    ledgerAuthority.trust.trustPolicyDigest ===
+      witnessAuthority.trust.trustPolicyDigest
+  )
+    throw new TypeError(
+      "Workbench Ledger and witness authorities must be independent",
+    );
+  const durability = record(
+    authorities.releaseDurability,
+    ["id", "retain", "resolve"],
+    [],
+    "release durability authority",
+  );
+  if (typeof durability.id !== "string" || !STORAGE_ID.test(durability.id))
+    throw new TypeError("release durability authority id is invalid");
+  const artifactDurabilityAuthority = Object.freeze({
+    id: durability.id,
+    retain: fixed(
+      authorities.releaseDurability,
+      "retain",
+      "release durability",
+    ),
+    resolve: fixed(
+      authorities.releaseDurability,
+      "resolve",
+      "release durability",
+    ),
+  });
+  // All configuration and authority ports are captured before any storage opens.
+  for (const target of directories) assertNoAliases(io, target);
+  assertNoAliases(io, storage.witnessFilePath, false);
+  if (secure) {
+    for (const target of [
+      storage.artifactDir,
+      path.dirname(storage.witnessFilePath),
+    ])
+      ensurePrivateDirectory(target, {
+        applyWindowsAcl: true,
+        failIfUnavailable: true,
+        deps: { fs: io },
+      });
+  } else {
+    io.mkdirSync(path.dirname(storage.witnessFilePath), {
+      recursive: true,
+      mode: 0o700,
+    });
+  }
+  function open() {
+    for (const target of directories) assertNoAliases(io, target);
+    const artifactPorts = new EvolutionArtifactPorts({
+      artifactStore: new ArtifactStore({ dir: storage.artifactDir, now }),
+      tenantId: descriptor.artifactTenantId,
+      audience: descriptor.audience,
+      ...artifactAuthority,
+      now,
+    });
+    const ledgerArtifactResolver =
+      artifactPorts.createEvolutionLedgerArtifactResolver({
+        purpose: descriptor.purpose,
+      });
+    const { ledger } = createEvolutionLedgerFileBackend({
+      rootDir: storage.ledgerRootDir,
+      authorityRootDir: storage.ledgerAuthorityRootDir,
+      witnessFilePath: storage.witnessFilePath,
+      witnessId: storage.witnessId,
+      ledgerAuthority,
+      witnessAuthority,
+      artifactResolver: ledgerArtifactResolver,
+      secure,
+      fsImpl: io,
+      clock: now,
+    });
+    const ports = createEvolutionLedgerPorts({
+      artifactPorts,
+      ledger,
+      artifactTenantId: descriptor.artifactTenantId,
+      audience: descriptor.audience,
+      purpose: descriptor.purpose,
+      artifactDurabilityAuthority,
+    });
+    // Constructor authenticates and recovers the actual Registry journal.
+    const releaseRegistry = new SkillReleaseRegistry({
+      tenantId: descriptor.tenantId,
+      rootDir: storage.releaseRootDir,
+      transactionLedger: ports.transactionLedger,
+      secure,
+      fsImpl: io,
+    });
+    return {
+      artifactPorts,
+      ledger,
+      ledgerArtifactResolver,
+      releaseRegistry,
+      ...ports,
+    };
+  }
+  const primary = open();
+  const verifier = open();
+  for (const target of directories) assertNoAliases(io, target);
+  assertNoAliases(io, storage.witnessFilePath, false);
+  // Authenticate both complete stores now, not just their constructor shapes.
+  const left = primary.ledger.verify();
+  const right = verifier.ledger.verify();
+  for (const key of [
+    "epoch",
+    "ledgerId",
+    "identityDigest",
+    "sequence",
+    "headDigest",
+  ])
+    if (left[key] !== right[key])
+      throw new Error("Workbench file readers disagree at startup");
+  const result = Object.freeze({
+    runtimeResources: Object.freeze({
+      descriptor,
+      artifactPorts: primary.artifactPorts,
+      ledger: primary.ledger,
+      ledgerArtifactResolver: primary.ledgerArtifactResolver,
+      releaseRegistry: primary.releaseRegistry,
+      transactionLedger: primary.transactionLedger,
+      verifierLedger: verifier.ledger,
+      verifierLedgerArtifactResolver: verifier.ledgerArtifactResolver,
+      verifierReleaseRegistry: verifier.releaseRegistry,
+      verifierTransactionLedger: verifier.transactionLedger,
+      now,
+    }),
+    mutationPorts: Object.freeze({
+      auditSink: primary.auditSink,
+      nonceStore: primary.nonceStore,
+    }),
+  });
+  FILE_RESOURCES.add(result);
+  return result;
+}

package/src/lib/evolution/evolution-workbench-projection.js

@@ -8,12 +8,18 @@ import {
   verifySkillPromotionReviewDecision,
   verifySkillPromotionReviewPacketArtifact,
 } from "./skill-promotion-review.js";
+import {
+  captureWorkbenchRegistrySource,
+  verifyWorkbenchRegistryState,
+} from "./evolution-workbench-registry-source.js";
 
 const { projectEvolutionRun } = evolutionRun;
 const { verifySkillInvocationReceipt } = skillInvocationReceipt;
 
 export const EVOLUTION_WORKBENCH_PROJECTION_SCHEMA =
   "chainlesschain.evolution-workbench-projection/v1";
+export const EVOLUTION_WORKBENCH_REGISTRY_PROJECTION_SCHEMA =
+  "chainlesschain.evolution-workbench-projection/v2";
 export const EVOLUTION_WORKBENCH_BATCH_PLAN_SCHEMA =
   "chainlesschain.evolution-workbench-batch-plan/v1";
 export const EVOLUTION_WORKBENCH_MAX_ITEMS = 10_000;
@@ -211,8 +217,11 @@ function normalizePilot(value, descriptor) {
     ) ||
     !Number.isSafeInteger(value.revision) ||
     value.revision < 0 ||
+    typeof value.killSwitch !== "boolean" ||
     typeof value.reconciliationRequired !== "boolean" ||
-    value.cohort?.id == null
+    typeof value.cohort?.id !== "string" ||
+    value.cohort.id.length < 1 ||
+    value.cohort.id.length > 256
   ) {
     throw new Error("pilot source result is invalid");
   }
@@ -229,7 +238,8 @@ export function createEvolutionWorkbenchDataSource({
   skillName: skillNameInput,
   runAdapter,
   reviewAdapter,
-  transitionAdapter,
+  transitionAdapter = null,
+  registrySource = null,
   invocationReceiptSource = null,
   pilotSource = null,
 } = {}) {
@@ -238,11 +248,23 @@ export function createEvolutionWorkbenchDataSource({
   const skillName = identifier(skillNameInput, "skillName");
   const loadRun = capture(runAdapter, "load", "runAdapter");
   const listReviews = capture(reviewAdapter, "listReviews", "reviewAdapter");
-  const listTransitions = capture(
-    transitionAdapter,
-    "list",
-    "transitionAdapter",
-  );
+  const registryReader =
+    registrySource === null
+      ? null
+      : captureWorkbenchRegistrySource(registrySource);
+  if (
+    registryReader &&
+    (transitionAdapter !== null ||
+      registryReader.descriptor.tenantId !== tenantId ||
+      registryReader.descriptor.skillName !== skillName ||
+      registryReader.descriptor.runId !== runId)
+  )
+    throw new TypeError(
+      "Workbench Registry source scope differs or has a second transition authority",
+    );
+  const listTransitions = registryReader
+    ? null
+    : capture(transitionAdapter, "list", "transitionAdapter");
   const listInvocations =
     invocationReceiptSource === null
       ? () => []
@@ -256,6 +278,7 @@ export function createEvolutionWorkbenchDataSource({
     runId,
     skillName,
     async load() {
+      const context = registryReader?.currentContext();
       const run = normalizeRun(await loadRun(), { tenantId, runId });
       const reviews = normalizeReviews(await listReviews(), {
         tenantId,
@@ -275,10 +298,14 @@ export function createEvolutionWorkbenchDataSource({
       const reviewPacketDigests = new Set(
         reviews.map(({ packet }) => packet.packetDigest),
       );
-      const transitions = normalizeTransitions(await listTransitions(), {
-        tenantId,
-        skillName,
-      });
+      const registryData = registryReader?.load();
+      const transitions = normalizeTransitions(
+        registryData ? registryData.transitions : await listTransitions(),
+        {
+          tenantId,
+          skillName,
+        },
+      );
       for (const { request } of transitions) {
         if (!run.projection.registry.candidates[request.candidateId]) {
           throw new Error(
@@ -286,13 +313,16 @@ export function createEvolutionWorkbenchDataSource({
           );
         }
       }
-      return deepFreeze({
+      const result = deepFreeze({
         run,
         reviews,
         transitions,
+        registry: registryData?.registry ?? null,
         invocations: normalizeInvocations(await listInvocations(), { runId }),
         pilot: normalizePilot(await readPilot(), { reviewPacketDigests }),
       });
+      if (registryReader) registryReader.assertCurrent(context);
+      return result;
     },
   });
   DATA_SOURCES.add(source);
@@ -560,15 +590,17 @@ export async function buildEvolutionWorkbenchProjection(
   normalizeTime(observedAt, "observedAt");
   const data = await source.load();
   const activeReleaseId = data.run.projection.registry.activeReleaseId;
-  const activeCandidateIds = new Set(
-    data.transitions
-      .filter(
-        ({ status, settlement }) =>
-          status === "committed" &&
-          settlement?.activeReleaseDigest === activeReleaseId,
-      )
-      .map(({ settlement }) => settlement.candidateId),
-  );
+  const activeCandidateIds = data.registry
+    ? new Set(data.registry.active ? [data.registry.active.candidateId] : [])
+    : new Set(
+        data.transitions
+          .filter(
+            ({ status, settlement }) =>
+              status === "committed" &&
+              settlement?.activeReleaseDigest === activeReleaseId,
+          )
+          .map(({ settlement }) => settlement.candidateId),
+      );
   const candidates = data.reviews.map((review) =>
     candidateView(review, data.invocations, activeCandidateIds),
   );
@@ -576,14 +608,61 @@ export async function buildEvolutionWorkbenchProjection(
     ...runTimeline(data.run.events),
     ...reviewTimeline(data.reviews),
     ...transitionTimeline(data.transitions),
+    ...(data.registry?.operations ?? []).map((operation) => ({
+      id: `release:${operation.transactionId}`,
+      sequence: operation.sequence ?? operation.preparationSequence,
+      phase:
+        operation.status === "prepared"
+          ? `release-${operation.operation}-prepared`
+          : operation.operation === "rollback"
+            ? "release-rolled-back"
+            : "release-promoted",
+      status: operation.status,
+      subjectId: operation.candidateId,
+      digest: operation.receiptDigest,
+      artifactRef: null,
+      occurredAt: operation.occurredAt,
+      source: "release-registry",
+      detail: {
+        operationId: operation.operationId,
+        requestDigest: operation.requestDigest,
+        releaseDigest: operation.releaseDigest,
+        fromReleaseDigest: operation.fromReleaseDigest,
+        stateDigest: operation.stateDigest,
+        transactionId: operation.transactionId,
+      },
+    })),
   ].sort(timelineOrder);
   const conflicts = conflictsFor(candidates, data.transitions, data.pilot);
+  for (const operation of data.registry?.operations ?? [])
+    if (operation.status === "prepared")
+      conflicts.push({
+        type: "pending-registry-effect",
+        candidateId: operation.candidateId,
+        packetDigest: null,
+        reason: "actual Registry transaction has not finalized",
+      });
+  if (
+    data.registry?.active &&
+    !candidates.some((candidate) => candidate.actualUsage.active)
+  )
+    conflicts.push({
+      type: "active-outside-run",
+      candidateId: data.registry.active.candidateId,
+      packetDigest: null,
+      reason:
+        "current Registry release is outside this run's review candidates",
+    });
+  const schema = data.registry
+    ? EVOLUTION_WORKBENCH_REGISTRY_PROJECTION_SCHEMA
+    : EVOLUTION_WORKBENCH_PROJECTION_SCHEMA;
   const core = {
-    schema: EVOLUTION_WORKBENCH_PROJECTION_SCHEMA,
+    schema,
     tenantId: source.tenantId,
     runId: source.runId,
     skillName: source.skillName,
     observedAt,
+    ...(data.registry ? { registry: data.registry } : {}),
     run: {
       status: data.run.projection.status,
       projectionDigest: data.run.projection.projectionDigest,
@@ -605,6 +684,9 @@ export async function buildEvolutionWorkbenchProjection(
       rejectedCount: candidates.filter(({ status }) => status === "rejected")
         .length,
       transitionCount: data.transitions.length,
+      ...(data.registry
+        ? { registryOperationCount: data.registry.operations.length }
+        : {}),
       invocationCount: data.invocations.length,
       conflictCount: conflicts.length,
     },
@@ -615,7 +697,7 @@ export async function buildEvolutionWorkbenchProjection(
   };
   return deepFreeze({
     ...core,
-    projectionDigest: hash(EVOLUTION_WORKBENCH_PROJECTION_SCHEMA, core),
+    projectionDigest: hash(schema, core),
   });
 }
 
@@ -624,10 +706,13 @@ export function filterEvolutionWorkbenchProjection(
   { query = "", status = null, offset = 0, limit = 100 } = {},
 ) {
   if (
-    projection?.schema !== EVOLUTION_WORKBENCH_PROJECTION_SCHEMA ||
+    ![
+      EVOLUTION_WORKBENCH_PROJECTION_SCHEMA,
+      EVOLUTION_WORKBENCH_REGISTRY_PROJECTION_SCHEMA,
+    ].includes(projection?.schema) ||
     projection.projectionDigest !==
       hash(
-        EVOLUTION_WORKBENCH_PROJECTION_SCHEMA,
+        projection.schema,
         Object.fromEntries(
           Object.entries(projection).filter(
             ([key]) => key !== "projectionDigest",
@@ -639,6 +724,28 @@ export function filterEvolutionWorkbenchProjection(
       "a verified Evolution Workbench projection is required",
     );
   }
+  const registry =
+    projection.schema === EVOLUTION_WORKBENCH_REGISTRY_PROJECTION_SCHEMA
+      ? verifyWorkbenchRegistryState(
+          projection.registry,
+          projection.tenantId,
+          projection.skillName,
+        )
+      : null;
+  if (
+    registry &&
+    (projection.summary.registryOperationCount !== registry.operations.length ||
+      projection.candidates.some(
+        (candidate) =>
+          candidate.actualUsage.active !==
+          (candidate.candidateId === registry.active?.candidateId &&
+            candidate.candidateContentDigest ===
+              registry.active?.contentDigest),
+      ))
+  )
+    throw new Error(
+      "Workbench candidate activity differs from current Registry state",
+    );
   if (
     !Number.isSafeInteger(offset) ||
     offset < 0 ||
@@ -674,8 +781,28 @@ export function filterEvolutionWorkbenchProjection(
       .toLowerCase();
     return searchable.includes(needle);
   });
+  const governance = {
+    runStatus: projection.run.status,
+    activeReleaseId: registry
+      ? (registry.active?.releaseDigest ?? null)
+      : projection.run.activeReleaseId,
+    lastKnownGoodReleaseId: registry
+      ? (registry.active?.lastKnownGoodReleaseDigest ?? null)
+      : projection.run.lastKnownGoodReleaseId,
+    conflictCount: projection.summary.conflictCount,
+    pilot:
+      projection.pilot === null
+        ? null
+        : {
+            stage: projection.pilot.stage,
+            revision: projection.pilot.revision,
+            killSwitch: projection.pilot.killSwitch,
+            reconciliationRequired: projection.pilot.reconciliationRequired,
+          },
+  };
   return deepFreeze({
     projectionDigest: projection.projectionDigest,
+    governance: clone(governance),
     total: matches.length,
     offset,
     limit,