chainlesschain 0.166.21 → 0.166.24

package/src/lib/evolution/governed-knowledge-sync-merge-publisher.js

@@ -8,6 +8,7 @@ import {
 } from "./governed-knowledge-merge-publisher-authority.js";
 import { isGovernedKnowledgeSync } from "./governed-knowledge-sync.js";
 import { isGovernedKnowledgePublicationReader } from "./governed-knowledge-sync-ledger-adapter.js";
+import { isEvolvableArtifactTransitionReader } from "./evolvable-artifact-ledger-adapter.js";
 
 export const GOVERNED_KNOWLEDGE_SYNC_MERGE_VERIFICATION_SCHEMA =
   "chainlesschain.governed-knowledge-sync-merge-verification/v1";
@@ -121,6 +122,7 @@ function verifyStoredPublication(record, request, envelope = null) {
 
 export function createGovernedKnowledgeSyncMergePublisherAuthority({
   sync,
+  verifierArtifactTransitionReader,
   providerPublicationReader,
   verifierPublicationReader,
   providerDescriptor,
@@ -142,9 +144,22 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
   }
   const tenantId = sync.tenantId;
   const deviceId = sync.deviceId;
+  if (
+    !isEvolvableArtifactTransitionReader(verifierArtifactTransitionReader) ||
+    verifierArtifactTransitionReader.tenantId !== tenantId
+  ) {
+    throw new TypeError(
+      "an independent tenant-bound artifact transition reader is required",
+    );
+  }
+  const readArtifactTransition = capture(
+    verifierArtifactTransitionReader,
+    "readTransition",
+    "verifierArtifactTransitionReader",
+  );
   const providerIdentity = descriptor(providerDescriptor, "provider");
   const verifierIdentity = descriptor(verifierDescriptor, "verifier");
-  const publish = capture(sync, "publish", "sync");
+  const publish = capture(sync, "publishWithArtifactEvidence", "sync");
   const readProviderPublication = bindReader(
     providerPublicationReader,
     tenantId,
@@ -158,10 +173,14 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
     "verifierPublicationReader",
   );
   const provider = Object.freeze({
-    async publish(request) {
-      const envelope = await publish(request.mergedKnowledge, {
+    async publish(request, plan) {
+      const published = await publish(request.mergedKnowledge, {
         operationId: request.operationId,
+        artifactOperation: "merge",
+        artifactEvidenceDigest: plan.humanReceiptDigest,
+        artifactHumanReviewed: true,
       });
+      const { envelope, artifact } = published;
       const stored = verifyStoredPublication(
         await readProviderPublication({ operationId: request.operationId }),
         request,
@@ -184,6 +203,12 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
         knowledgeId: request.knowledgeId,
         mergedContentDigest: request.mergedContentDigest,
         envelopeDigest: stored.envelopeDigest,
+        artifactCandidateDigest: artifact.artifactCandidateDigest,
+        artifactDigest: artifact.artifactDigest,
+        artifactReleaseId: artifact.artifactReleaseId,
+        artifactTransitionOperationId: artifact.artifactTransitionOperationId,
+        artifactTransitionReceiptDigest:
+          artifact.artifactTransitionReceiptDigest,
         providerAuthorityId: providerIdentity.authorityId,
         providerRevision: providerIdentity.revision,
         providerHandlerArtifactDigest: providerIdentity.handlerArtifactDigest,
@@ -204,13 +229,30 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
         await readVerifierPublication({ operationId: request.operationId }),
         request,
       );
+      const transition = await readArtifactTransition({
+        operationId: result.artifactTransitionOperationId,
+      });
       if (
         result.envelopeDigest !== stored.envelopeDigest ||
         Date.parse(result.publishedAt) < Date.parse(stored.committedAt) ||
         canonical(result.attestation) !==
           canonical(stored.envelope.signature) ||
         result.resultDigest !==
-          digestGovernedKnowledgeMergePublishResult(result)
+          digestGovernedKnowledgeMergePublishResult(result) ||
+        transition?.request?.previousArtifactDigest !==
+          result.artifactCandidateDigest ||
+        transition.request.nextArtifactDigest !== result.artifactDigest ||
+        transition.artifact.artifactDigest !== result.artifactDigest ||
+        transition.artifact.activeReleaseId !== result.artifactReleaseId ||
+        transition.artifact.contentDigest !== request.mergedContentDigest ||
+        transition.artifact.runtimeManifest.operation !== "merge" ||
+        transition.artifact.runtimeManifest.operationId !==
+          request.operationId ||
+        transition.receipt.operationId !==
+          result.artifactTransitionOperationId ||
+        transition.receipt.receiptDigest !==
+          result.artifactTransitionReceiptDigest ||
+        transition.receipt.durable !== true
       ) {
         throw new Error("merge publication result differs from durable state");
       }
@@ -224,6 +266,12 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
           resultDigest: result.resultDigest,
           envelopeDigest: stored.envelopeDigest,
           publicationRecordDigest: stored.recordDigest,
+          artifactCandidateDigest: result.artifactCandidateDigest,
+          artifactDigest: result.artifactDigest,
+          artifactReleaseId: result.artifactReleaseId,
+          artifactTransitionOperationId: result.artifactTransitionOperationId,
+          artifactTransitionReceiptDigest:
+            result.artifactTransitionReceiptDigest,
           verifierAuthorityId: verifierIdentity.authorityId,
           verifierRevision: verifierIdentity.revision,
           verifierHandlerArtifactDigest: verifierIdentity.handlerArtifactDigest,
@@ -239,6 +287,11 @@ export function createGovernedKnowledgeSyncMergePublisherAuthority({
         planDigest: request.planDigest,
         resultDigest: result.resultDigest,
         envelopeDigest: stored.envelopeDigest,
+        artifactCandidateDigest: result.artifactCandidateDigest,
+        artifactDigest: result.artifactDigest,
+        artifactReleaseId: result.artifactReleaseId,
+        artifactTransitionOperationId: result.artifactTransitionOperationId,
+        artifactTransitionReceiptDigest: result.artifactTransitionReceiptDigest,
         providerAuthorityId: providerIdentity.authorityId,
         providerRevision: providerIdentity.revision,
         verifierAuthorityId: verifierIdentity.authorityId,

package/src/lib/evolution/governed-knowledge-sync.js

@@ -2,18 +2,25 @@ import { createHash } from "node:crypto";
 import { types as utilTypes } from "node:util";
 
 import { isGovernedKnowledgeDependencyExecutor } from "./governed-knowledge-dependency-ledger-executor.js";
+import { isGovernedKnowledgeArtifactLifecycle } from "./governed-knowledge-artifact-lifecycle.js";
+
+import {
+  GOVERNED_KNOWLEDGE_SCOPE,
+  verifyGovernedKnowledgeRecord,
+  normalizeGovernedKnowledgeVectorClock as vectorClock,
+} from "./governed-knowledge-record.js";
+export {
+  GOVERNED_KNOWLEDGE_SYNC_SCHEMA,
+  GOVERNED_KNOWLEDGE_SCOPE,
+  verifyGovernedKnowledgeRecord,
+} from "./governed-knowledge-record.js";
 
-export const GOVERNED_KNOWLEDGE_SYNC_SCHEMA =
-  "chainlesschain.governed-evolution-knowledge-sync/v1";
 export const GOVERNED_KNOWLEDGE_ENVELOPE_SCHEMA =
   "chainlesschain.governed-evolution-knowledge-envelope/v1";
-export const GOVERNED_KNOWLEDGE_SCOPE = Object.freeze({
-  PERSONAL: "personal",
-  PROJECT: "project",
-  TEAM: "team",
-  ORG: "org",
-});
-
+export const GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_SCHEMA =
+  "chainlesschain.governed-knowledge-artifact-binding/v2";
+export const GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_LEGACY_SCHEMA =
+  "chainlesschain.governed-knowledge-artifact-binding/v1";
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
 const SCOPES = new Set(Object.values(GOVERNED_KNOWLEDGE_SCOPE));
@@ -37,6 +44,20 @@ const ENVELOPE_KEYS = new Set([
   "tenantId",
   "vectorClock",
 ]);
+const ARTIFACT_BINDING_KEYS = new Set([
+  "activate",
+  "authorizationReceiptDigest",
+  "baseline",
+  "evidenceDigest",
+  "humanReviewed",
+  "issuedAt",
+  "operationId",
+  "operation",
+  "schema",
+]);
+const LEGACY_ARTIFACT_BINDING_KEYS = new Set(
+  [...ARTIFACT_BINDING_KEYS].filter((key) => key !== "activate"),
+);
 
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -78,6 +99,11 @@ function record(value, label) {
     ![Object.prototype, null].includes(Object.getPrototypeOf(value))
   )
     throw new TypeError(`${label} must be a plain object`);
+  for (const key of Reflect.ownKeys(value)) {
+    const property = Object.getOwnPropertyDescriptor(value, key);
+    if (typeof key !== "string" || !Object.hasOwn(property, "value"))
+      throw new TypeError(`${label} must contain only data properties`);
+  }
   return value;
 }
 
@@ -87,12 +113,6 @@ function id(value, label) {
   return value;
 }
 
-function digest(value, label) {
-  if (typeof value !== "string" || !DIGEST.test(value))
-    throw new TypeError(`${label} must be sha256-bound`);
-  return value;
-}
-
 function capture(owner, method) {
   if (
     !owner ||
@@ -104,23 +124,6 @@ function capture(owner, method) {
   return (...args) => Reflect.apply(owner[method], owner, args);
 }
 
-function vectorClock(value) {
-  record(value, "vectorClock");
-  const entries = Object.entries(value);
-  if (entries.length < 1 || entries.length > 64)
-    throw new TypeError("vectorClock is empty or unbounded");
-  const result = {};
-  for (const [deviceId, revision] of entries.sort(([a], [b]) =>
-    a.localeCompare(b),
-  )) {
-    id(deviceId, "vectorClock device");
-    if (!Number.isSafeInteger(revision) || revision < 0)
-      throw new TypeError("vectorClock revision is invalid");
-    result[deviceId] = revision;
-  }
-  return result;
-}
-
 function relation(left, right) {
   const devices = new Set([...Object.keys(left), ...Object.keys(right)]);
   let before = false;
@@ -137,73 +140,59 @@ function relation(left, right) {
   return "equal";
 }
 
-function normalizeDependencies(value, action) {
-  if (!Array.isArray(value) || value.length > 256)
-    throw new TypeError("dependency dispositions are unbounded");
-  const seen = new Set();
-  return value.map((entry) => {
-    record(entry, "dependency disposition");
-    const normalized = {
-      kind: id(entry.kind, "dependency kind"),
-      digest: digest(entry.digest, "dependency digest"),
-      disposition: id(entry.disposition, "dependency disposition"),
-    };
-    const key = `${normalized.kind}:${normalized.digest}`;
-    if (seen.has(key)) throw new TypeError("duplicate dependency disposition");
-    seen.add(key);
-    if (
-      ["tombstone", "revoke"].includes(action) &&
-      ![
-        "tombstone",
-        "quarantine",
-        "reject-candidate",
-        "rollback-active",
-      ].includes(normalized.disposition)
-    )
-      throw new TypeError("revocation dependency disposition is unsafe");
-    return normalized;
-  });
-}
-
 function normalizeRecord(input, descriptor, { executionRecord = false } = {}) {
-  record(input, "knowledge record");
-  const action = ACTIONS.has(input.action) ? input.action : null;
-  const scope = SCOPES.has(input.scope) ? input.scope : null;
-  if (!action || !scope || input.tenantId !== descriptor.tenantId)
-    throw new TypeError("knowledge record boundary is invalid");
-  const dependencies = normalizeDependencies(input.dependencies || [], action);
-  if (
-    ["team", "org"].includes(scope) &&
-    !DIGEST.test(input.approvalReceiptDigest || "")
-  )
-    throw new TypeError("shared knowledge requires approval");
-  if (
-    ["tombstone", "revoke"].includes(action) &&
-    (!DIGEST.test(input.revocationReceiptDigest || "") ||
-      dependencies.length < 1)
-  )
-    throw new TypeError(
-      "revocation must bind its receipt and dependency graph",
-    );
-  const normalized = freeze({
-    schema: GOVERNED_KNOWLEDGE_SYNC_SCHEMA,
+  const normalized = verifyGovernedKnowledgeRecord(input, {
     tenantId: descriptor.tenantId,
-    knowledgeId: id(input.knowledgeId, "knowledgeId"),
-    scope,
-    scopeId: id(input.scopeId, "scopeId"),
-    action,
-    contentDigest: digest(input.contentDigest, "contentDigest"),
-    vectorClock: vectorClock(input.vectorClock),
-    approvalReceiptDigest: input.approvalReceiptDigest || null,
-    revocationReceiptDigest: input.revocationReceiptDigest || null,
-    dependencies,
   });
   if (executionRecord) EXECUTION_RECORDS.add(normalized);
   return normalized;
 }
 
-export function verifyGovernedKnowledgeRecord(input, { tenantId } = {}) {
-  return normalizeRecord(input, { tenantId: id(tenantId, "tenantId") });
+export function verifyGovernedKnowledgeArtifactBinding(
+  input,
+  { tenantId, knowledge, authorizationReceiptDigest } = {},
+) {
+  record(input, "knowledge artifact binding");
+  const expectedTenantId = id(tenantId, "tenantId");
+  const normalizedKnowledge = verifyGovernedKnowledgeRecord(knowledge, {
+    tenantId: expectedTenantId,
+  });
+  const keys = Reflect.ownKeys(input);
+  const current = input.schema === GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_SCHEMA;
+  const legacy =
+    input.schema === GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_LEGACY_SCHEMA;
+  const expectedKeys = current
+    ? ARTIFACT_BINDING_KEYS
+    : LEGACY_ARTIFACT_BINDING_KEYS;
+  const baseline =
+    input.baseline === null
+      ? null
+      : verifyGovernedKnowledgeRecord(input.baseline, {
+          tenantId: expectedTenantId,
+        });
+  if (
+    (!current && !legacy) ||
+    keys.length !== expectedKeys.size ||
+    keys.some((key) => typeof key !== "string" || !expectedKeys.has(key)) ||
+    !ID.test(input.operationId ?? "") ||
+    !(
+      current ? ["publish", "merge", "receive"] : ["publish", "merge"]
+    ).includes(input.operation) ||
+    (current && typeof input.activate !== "boolean") ||
+    !Number.isFinite(Date.parse(input.issuedAt)) ||
+    input.authorizationReceiptDigest !== authorizationReceiptDigest ||
+    !DIGEST.test(input.authorizationReceiptDigest ?? "") ||
+    !DIGEST.test(input.evidenceDigest ?? "") ||
+    typeof input.humanReviewed !== "boolean" ||
+    (baseline !== null &&
+      (baseline.knowledgeId !== normalizedKnowledge.knowledgeId ||
+        baseline.scope !== normalizedKnowledge.scope ||
+        baseline.scopeId !== normalizedKnowledge.scopeId)) ||
+    canonical(baseline) !== canonical(input.baseline)
+  ) {
+    throw new Error("knowledge artifact binding is invalid");
+  }
+  return freeze(clone(input));
 }
 
 export function isGovernedKnowledgeExecutionRecord(value) {
@@ -250,7 +239,14 @@ export function verifyGovernedKnowledgeEnvelopeIntegrity(
 }
 
 export class GovernedKnowledgeSync {
-  constructor({ tenantId, deviceId, ports, dependencyExecutor = null } = {}) {
+  constructor({
+    tenantId,
+    deviceId,
+    ports,
+    dependencyExecutor = null,
+    artifactLifecycle,
+    clock = () => Date.now(),
+  } = {}) {
     this.tenantId = id(tenantId, "tenantId");
     this.deviceId = id(deviceId, "deviceId");
     this._authorize = capture(ports, "authorize");
@@ -265,6 +261,16 @@ export class GovernedKnowledgeSync {
       ports?.loadPublication === undefined
         ? null
         : capture(ports, "loadPublication");
+    this._loadReception = capture(ports, "loadReception");
+    if (!isGovernedKnowledgeArtifactLifecycle(artifactLifecycle)) {
+      throw new TypeError(
+        "a branded governed Knowledge artifact lifecycle is required",
+      );
+    }
+    this._prepareArtifact = capture(artifactLifecycle, "prepare");
+    this._commitArtifact = capture(artifactLifecycle, "commit");
+    if (typeof clock !== "function") throw new TypeError("clock is required");
+    this._clock = clock;
     if (
       dependencyExecutor !== null &&
       !isGovernedKnowledgeDependencyExecutor(dependencyExecutor)
@@ -279,7 +285,20 @@ export class GovernedKnowledgeSync {
     SYNCHRONIZERS.add(this);
   }
 
-  async publish(input, { operationId = null } = {}) {
+  async publish(input, options = {}) {
+    const result = await this.publishWithArtifactEvidence(input, options);
+    return result.envelope;
+  }
+
+  async publishWithArtifactEvidence(
+    input,
+    {
+      operationId = null,
+      artifactOperation = "publish",
+      artifactEvidenceDigest = null,
+      artifactHumanReviewed = false,
+    } = {},
+  ) {
     const knowledge = normalizeRecord(input, this, { executionRecord: true });
     if (knowledge.scope === "personal")
       throw new Error("personal knowledge cannot enter a shared sync channel");
@@ -301,6 +320,32 @@ export class GovernedKnowledgeSync {
           throw new Error("publish operationId resolved different knowledge");
         }
         verifyGovernedKnowledgeEnvelopeIntegrity(existing.envelope, this);
+        const binding = verifyGovernedKnowledgeArtifactBinding(
+          existing.artifactBinding,
+          {
+            tenantId: this.tenantId,
+            knowledge,
+            authorizationReceiptDigest: existing.authorizationReceiptDigest,
+          },
+        );
+        if (
+          artifactOperation !== binding.operation ||
+          (artifactEvidenceDigest !== null &&
+            artifactEvidenceDigest !== binding.evidenceDigest) ||
+          artifactHumanReviewed !== binding.humanReviewed
+        ) {
+          throw new Error("publish artifact recovery binding differs");
+        }
+        const prepared = await this._prepareArtifact({
+          knowledge,
+          currentKnowledge: binding.baseline,
+          operation: binding.operation,
+          operationId: binding.operationId,
+          authorizationReceiptDigest: binding.authorizationReceiptDigest,
+          evidenceDigest: binding.evidenceDigest,
+          issuedAt: binding.issuedAt,
+          humanReviewed: binding.humanReviewed,
+        });
         const sent = await this._send({ envelope: existing.envelope });
         if (
           sent?.durable !== true ||
@@ -308,10 +353,51 @@ export class GovernedKnowledgeSync {
         ) {
           throw new Error("sync transport did not durably accept the envelope");
         }
-        return freeze(clone(existing.envelope));
+        const artifact = await this._commitArtifact(prepared);
+        return freeze({
+          envelope: clone(existing.envelope),
+          artifact: clone(artifact),
+          recovered: true,
+        });
       }
     }
     const admission = await this._admit("publish", knowledge);
+    const current = await this._load({ knowledgeId: knowledge.knowledgeId });
+    const effectiveOperationId =
+      operationId ??
+      `knowledge-publish:${hash(
+        "chainlesschain.governed-knowledge-publish-operation/v1",
+        { tenantId: this.tenantId, deviceId: this.deviceId, knowledge },
+      ).slice(7)}`;
+    const milliseconds = Number(this._clock());
+    if (!Number.isFinite(milliseconds))
+      throw new TypeError("knowledge sync clock is invalid");
+    const binding = freeze({
+      schema: GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_SCHEMA,
+      activate: true,
+      operationId: effectiveOperationId,
+      operation: artifactOperation,
+      issuedAt: new Date(milliseconds).toISOString(),
+      authorizationReceiptDigest: admission.receiptDigest,
+      evidenceDigest: artifactEvidenceDigest ?? admission.receiptDigest,
+      humanReviewed: artifactHumanReviewed,
+      baseline: current === null ? null : clone(current),
+    });
+    verifyGovernedKnowledgeArtifactBinding(binding, {
+      tenantId: this.tenantId,
+      knowledge,
+      authorizationReceiptDigest: admission.receiptDigest,
+    });
+    const prepared = await this._prepareArtifact({
+      knowledge,
+      currentKnowledge: binding.baseline,
+      operation: binding.operation,
+      operationId: binding.operationId,
+      authorizationReceiptDigest: binding.authorizationReceiptDigest,
+      evidenceDigest: binding.evidenceDigest,
+      issuedAt: binding.issuedAt,
+      humanReviewed: binding.humanReviewed,
+    });
     await this._applyRevocationDependencies(knowledge);
     const plaintext = Buffer.from(canonical(knowledge), "utf8");
     const encrypted = await this._encrypt({ knowledge, plaintext });
@@ -344,11 +430,19 @@ export class GovernedKnowledgeSync {
       envelopeDigest,
       signature: clone(signature),
     });
-    await this._persist(knowledge, envelope, "local", admission, operationId);
+    await this._persist(
+      knowledge,
+      envelope,
+      "local",
+      admission,
+      operationId,
+      binding,
+    );
     const sent = await this._send({ envelope });
     if (sent?.durable !== true || sent.envelopeDigest !== envelopeDigest)
       throw new Error("sync transport did not durably accept the envelope");
-    return envelope;
+    const artifact = await this._commitArtifact(prepared);
+    return freeze({ envelope, artifact: clone(artifact), recovered: false });
   }
 
   async receive(envelope) {
@@ -390,6 +484,60 @@ export class GovernedKnowledgeSync {
     )
       throw new Error("knowledge envelope substituted its governed record");
     const admission = await this._admit("receive", knowledge);
+    const existing = await this._loadReception({
+      envelopeDigest: envelope.envelopeDigest,
+    });
+    if (existing) {
+      const comparable = { ...existing.knowledge };
+      delete comparable.conflictWithDigest;
+      if (
+        !["remote", "conflict"].includes(existing.disposition) ||
+        existing.envelopeDigest !== envelope.envelopeDigest ||
+        canonical(comparable) !== canonical(knowledge)
+      ) {
+        throw new Error("receive envelope resolved different knowledge");
+      }
+      const binding = verifyGovernedKnowledgeArtifactBinding(
+        existing.artifactBinding,
+        {
+          tenantId: this.tenantId,
+          knowledge,
+          authorizationReceiptDigest: existing.authorizationReceiptDigest,
+        },
+      );
+      if (
+        binding.operation !== "receive" ||
+        binding.activate !== (existing.disposition === "remote")
+      ) {
+        throw new Error("receive artifact recovery binding differs");
+      }
+      const prepared = await this._prepareArtifact({
+        knowledge,
+        currentKnowledge: binding.baseline,
+        operation: binding.operation,
+        operationId: binding.operationId,
+        authorizationReceiptDigest: binding.authorizationReceiptDigest,
+        evidenceDigest: binding.evidenceDigest,
+        issuedAt: binding.issuedAt,
+        activate: binding.activate,
+        humanReviewed: binding.humanReviewed,
+      });
+      const artifact = await this._commitArtifact(prepared);
+      return existing.disposition === "conflict"
+        ? freeze({
+            applied: false,
+            reason: "conflict",
+            requiresHumanMerge: true,
+            recovered: true,
+            artifact: clone(artifact),
+          })
+        : freeze({
+            applied: true,
+            action: knowledge.action,
+            recovered: true,
+            artifact: clone(artifact),
+          });
+    }
     const current = await this._load({ knowledgeId: knowledge.knowledgeId });
     if (current) {
       const order = relation(current.vectorClock, knowledge.vectorClock);
@@ -400,22 +548,105 @@ export class GovernedKnowledgeSync {
         return freeze({ applied: false, reason: "replay" });
       }
       if (order === "concurrent") {
+        const binding = this._receiveArtifactBinding({
+          knowledge,
+          current,
+          admission,
+          envelope,
+          activate: false,
+        });
+        const prepared = await this._prepareArtifact({
+          knowledge,
+          currentKnowledge: binding.baseline,
+          operation: binding.operation,
+          operationId: binding.operationId,
+          authorizationReceiptDigest: binding.authorizationReceiptDigest,
+          evidenceDigest: binding.evidenceDigest,
+          issuedAt: binding.issuedAt,
+          activate: binding.activate,
+          humanReviewed: binding.humanReviewed,
+        });
         await this._persist(
           { ...knowledge, conflictWithDigest: current.contentDigest },
           envelope,
           "conflict",
           admission,
+          null,
+          binding,
         );
+        const artifact = await this._commitArtifact(prepared);
         return freeze({
           applied: false,
           reason: "conflict",
           requiresHumanMerge: true,
+          recovered: false,
+          artifact: clone(artifact),
         });
       }
     }
+    const binding = this._receiveArtifactBinding({
+      knowledge,
+      current,
+      admission,
+      envelope,
+      activate: true,
+    });
+    const prepared = await this._prepareArtifact({
+      knowledge,
+      currentKnowledge: binding.baseline,
+      operation: binding.operation,
+      operationId: binding.operationId,
+      authorizationReceiptDigest: binding.authorizationReceiptDigest,
+      evidenceDigest: binding.evidenceDigest,
+      issuedAt: binding.issuedAt,
+      activate: binding.activate,
+      humanReviewed: binding.humanReviewed,
+    });
     await this._applyRevocationDependencies(knowledge);
-    await this._persist(knowledge, envelope, "remote", admission);
-    return freeze({ applied: true, action: knowledge.action });
+    await this._persist(
+      knowledge,
+      envelope,
+      "remote",
+      admission,
+      null,
+      binding,
+    );
+    const artifact = await this._commitArtifact(prepared);
+    return freeze({
+      applied: true,
+      action: knowledge.action,
+      recovered: false,
+      artifact: clone(artifact),
+    });
+  }
+
+  _receiveArtifactBinding({
+    knowledge,
+    current,
+    admission,
+    envelope,
+    activate,
+  }) {
+    const milliseconds = Number(this._clock());
+    if (!Number.isFinite(milliseconds))
+      throw new TypeError("knowledge sync clock is invalid");
+    const binding = freeze({
+      schema: GOVERNED_KNOWLEDGE_ARTIFACT_BINDING_SCHEMA,
+      activate,
+      operationId: `knowledge-receive:${envelope.envelopeDigest.slice(7)}`,
+      operation: "receive",
+      issuedAt: new Date(milliseconds).toISOString(),
+      authorizationReceiptDigest: admission.receiptDigest,
+      evidenceDigest: envelope.envelopeDigest,
+      humanReviewed: false,
+      baseline: current === null ? null : clone(current),
+    });
+    verifyGovernedKnowledgeArtifactBinding(binding, {
+      tenantId: this.tenantId,
+      knowledge,
+      authorizationReceiptDigest: admission.receiptDigest,
+    });
+    return binding;
   }
 
   async _admit(operation, knowledge) {
@@ -439,6 +670,7 @@ export class GovernedKnowledgeSync {
     disposition,
     admission,
     operationId = null,
+    artifactBinding = null,
   ) {
     const result = await this._commit({
       knowledge,
@@ -447,6 +679,7 @@ export class GovernedKnowledgeSync {
       disposition,
       authorizationReceiptDigest: admission.receiptDigest,
       operationId,
+      artifactBinding,
     });
     if (
       result?.authenticated !== true ||