chainlesschain 0.166.21 → 0.166.24

package/src/lib/evolution/governed-skill-marketplace.js

@@ -1,5 +1,12 @@
 import { createHash } from "node:crypto";
 import { types as utilTypes } from "node:util";
+import { verifyGovernedSkillMarketplaceCandidateBinding } from "./governed-skill-marketplace-candidate.js";
+
+import {
+  SKILL_REVOCATION_DEPENDENCY_REQUEST_SCHEMA,
+  SKILL_REVOCATION_DEPENDENCY_RESULT_SCHEMA,
+  digestSkillRevocationDependencyRequest,
+} from "./skill-revocation-propagation.js";
 
 export const GOVERNED_SKILL_MARKETPLACE_MANIFEST_SCHEMA =
   "chainlesschain.governed-skill-marketplace-manifest/v1";
@@ -15,6 +22,61 @@ const STAGES = new Map([
   ["shadow", "canary"],
   ["canary", "active"],
 ]);
+const MARKETPLACE_STATE_KEYS = new Set([
+  "candidateBinding",
+  "schema",
+  "tenantId",
+  "skillName",
+  "version",
+  "manifestDigest",
+  "packageDigest",
+  "adaptedOutputDigest",
+  "target",
+  "stage",
+  "previousStateDigest",
+  "revoked",
+  "transitionRequestDigest",
+  "transitionReceiptDigest",
+  "revocationReceiptDigest",
+  "revocationPropagationRequestDigest",
+  "revocationBaselineStateDigest",
+  "stateDigest",
+]);
+const MARKETPLACE_STATE_REQUIRED_KEYS = new Set([
+  "schema",
+  "tenantId",
+  "skillName",
+  "version",
+  "manifestDigest",
+  "packageDigest",
+  "adaptedOutputDigest",
+  "target",
+  "stage",
+  "previousStateDigest",
+  "revoked",
+  "stateDigest",
+]);
+const MARKETPLACE_TARGET_KEYS = new Set(["model", "os", "tool", "runtime"]);
+const REVOCATION_DEPENDENCY_REQUEST_KEYS = new Set([
+  "schema",
+  "tenantId",
+  "streamId",
+  "operationId",
+  "transitionDigest",
+  "candidateId",
+  "skillName",
+  "occurredAt",
+  "sourceReceiptDigest",
+  "resolutionDigest",
+  "dependency",
+  "requestDigest",
+]);
+const REVOCATION_DEPENDENCY_KEYS = new Set([
+  "kind",
+  "ref",
+  "digest",
+  "disposition",
+]);
 
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -55,6 +117,24 @@ function record(value, label) {
   return value;
 }
 
+function exact(value, keys, label) {
+  record(value, label);
+  const own = Reflect.ownKeys(value);
+  if (
+    own.length !== keys.size ||
+    own.some((key) => typeof key !== "string" || !keys.has(key))
+  ) {
+    throw new TypeError(`${label} has an invalid shape`);
+  }
+  for (const key of own) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(`${label}.${String(key)} is not a data field`);
+    }
+  }
+  return value;
+}
+
 function id(value, label) {
   if (typeof value !== "string" || !ID.test(value))
     throw new TypeError(`${label} is invalid`);
@@ -160,6 +240,76 @@ export function buildGovernedSkillMarketplaceManifest(input, signature) {
   return freeze({ ...core, manifestDigest, signature });
 }
 
+export function digestGovernedSkillMarketplaceState(core) {
+  return hash(GOVERNED_SKILL_MARKETPLACE_STATE_SCHEMA, core);
+}
+
+export function verifyGovernedSkillMarketplaceState(
+  input,
+  tenantId,
+  skillName,
+) {
+  record(input, "marketplace state");
+  for (const key of Reflect.ownKeys(input)) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new Error("marketplace state contains an unsafe field");
+    }
+  }
+  const ownKeys = Reflect.ownKeys(input);
+  if (
+    ownKeys.some(
+      (key) => typeof key !== "string" || !MARKETPLACE_STATE_KEYS.has(key),
+    ) ||
+    [...MARKETPLACE_STATE_REQUIRED_KEYS].some(
+      (key) => !Object.hasOwn(input, key),
+    )
+  ) {
+    throw new Error("marketplace state has an invalid shape");
+  }
+  exact(input.target, MARKETPLACE_TARGET_KEYS, "marketplace state target");
+  if (Object.hasOwn(input, "candidateBinding"))
+    verifyGovernedSkillMarketplaceCandidateBinding(
+      input.candidateBinding,
+      input,
+    );
+  const state = clone(input);
+  const core = clone(state);
+  delete core.stateDigest;
+  if (
+    state.schema !== GOVERNED_SKILL_MARKETPLACE_STATE_SCHEMA ||
+    state.tenantId !== tenantId ||
+    state.skillName !== skillName ||
+    !ID.test(state.version ?? "") ||
+    !["candidate", "shadow", "canary", "active", "rolled-back"].includes(
+      state.stage,
+    ) ||
+    typeof state.revoked !== "boolean" ||
+    (state.previousStateDigest !== null &&
+      !DIGEST.test(state.previousStateDigest ?? "")) ||
+    !["model", "os", "tool", "runtime"].every((field) =>
+      ID.test(state.target[field] ?? ""),
+    ) ||
+    [
+      "manifestDigest",
+      "packageDigest",
+      "adaptedOutputDigest",
+      "stateDigest",
+      ...[
+        "transitionRequestDigest",
+        "transitionReceiptDigest",
+        "revocationReceiptDigest",
+        "revocationPropagationRequestDigest",
+        "revocationBaselineStateDigest",
+      ].filter((field) => Object.hasOwn(state, field)),
+    ].some((field) => !DIGEST.test(state[field] ?? "")) ||
+    state.stateDigest !== digestGovernedSkillMarketplaceState(core)
+  ) {
+    throw new Error("marketplace state is unauthenticated or corrupt");
+  }
+  return freeze(state);
+}
+
 export class GovernedSkillMarketplace {
   constructor({ tenantId, ports } = {}) {
     this.tenantId = id(tenantId, "tenantId");
@@ -172,13 +322,18 @@ export class GovernedSkillMarketplace {
     this._verifyRevocation = capture(ports, "verifyRevocation");
   }
 
-  async inspect(input, target) {
+  async verifyListing(input, target) {
     const manifest = normalizeManifest(input, this.tenantId);
     if ((await this._verifySignature({ manifest })) !== true)
       throw new Error("marketplace manifest signature is invalid");
     const cell = targetCell(manifest, target);
     if (cell.safetyPassed !== true)
       throw new Error("marketplace target safety gate failed");
+    return freeze({ manifest, target: clone(target), cell });
+  }
+
+  async inspect(input, target) {
+    const { manifest, cell } = await this.verifyListing(input, target);
     const adapted = await this._adapt({
       manifest,
       target: clone(target),
@@ -202,7 +357,12 @@ export class GovernedSkillMarketplace {
     });
   }
 
-  async stage({ manifest: input, target, expectedStateDigest = null } = {}) {
+  async stage({
+    manifest: input,
+    target,
+    expectedStateDigest = null,
+    candidateBinding = null,
+  } = {}) {
     const inspected = await this.inspect(input, target);
     const current = await this._load({
       skillName: inspected.manifest.skillName,
@@ -222,6 +382,24 @@ export class GovernedSkillMarketplace {
       previousStateDigest: expectedStateDigest,
       revoked: false,
     };
+    if (candidateBinding !== null) {
+      const binding = verifyGovernedSkillMarketplaceCandidateBinding(
+        candidateBinding,
+        state,
+      );
+      if (
+        binding.dependencyLockDigest !==
+          inspected.manifest.dependencyLockDigest ||
+        binding.targetMatrixRoot !== inspected.manifest.targetMatrixDigest ||
+        binding.sbomDigest !== inspected.manifest.sbomDigest ||
+        binding.permissionManifestDigest !==
+          inspected.manifest.permissionManifestDigest
+      )
+        throw new Error(
+          "marketplace candidate binding differs from the signed manifest",
+        );
+      state.candidateBinding = binding;
+    }
     return this._persist(state, expectedStateDigest, "marketplace.staged");
   }
 
@@ -350,7 +528,15 @@ export class GovernedSkillMarketplace {
     );
   }
 
-  async revoke({ skillName, expectedStateDigest, revocationReceipt } = {}) {
+  async revoke({
+    skillName,
+    expectedStateDigest,
+    revocationReceipt,
+    propagationRequestDigest = null,
+  } = {}) {
+    if (propagationRequestDigest !== null) {
+      digest(propagationRequestDigest, "propagationRequestDigest");
+    }
     const current = await this._exact(skillName, expectedStateDigest);
     const verified = await this._verifyRevocation({
       state: current,
@@ -393,6 +579,12 @@ export class GovernedSkillMarketplace {
         stage: "rolled-back",
         revoked: true,
         revocationReceiptDigest: verified.receiptDigest,
+        ...(propagationRequestDigest === null
+          ? {}
+          : {
+              revocationPropagationRequestDigest: propagationRequestDigest,
+              revocationBaselineStateDigest: current.stateDigest,
+            }),
         transitionRequestDigest: requestDigest,
         transitionReceiptDigest: transition.receiptDigest,
       },
@@ -401,10 +593,101 @@ export class GovernedSkillMarketplace {
     );
   }
 
+  async revokeMarketplaceBadge(request) {
+    exact(
+      request,
+      REVOCATION_DEPENDENCY_REQUEST_KEYS,
+      "marketplace revocation dependency request",
+    );
+    exact(
+      request.dependency,
+      REVOCATION_DEPENDENCY_KEYS,
+      "marketplace revocation dependency",
+    );
+    const expectedRef = `marketplace-state:${this.tenantId}:${request.skillName}`;
+    if (
+      request.schema !== SKILL_REVOCATION_DEPENDENCY_REQUEST_SCHEMA ||
+      request.tenantId !== this.tenantId ||
+      request.dependency.kind !== "marketplace-badge" ||
+      request.dependency.disposition !== "revoke" ||
+      request.dependency.ref !== expectedRef ||
+      request.requestDigest !==
+        digestSkillRevocationDependencyRequest(request) ||
+      !DIGEST.test(request.dependency.digest ?? "") ||
+      !DIGEST.test(request.transitionDigest ?? "") ||
+      !DIGEST.test(request.candidateId ?? "") ||
+      !DIGEST.test(request.sourceReceiptDigest ?? "") ||
+      !DIGEST.test(request.resolutionDigest ?? "")
+    ) {
+      throw new Error("marketplace revocation dependency is not exactly bound");
+    }
+    id(request.skillName, "skillName");
+    id(request.streamId, "streamId");
+    id(request.operationId, "operationId");
+    if (new Date(request.occurredAt).toISOString() !== request.occurredAt) {
+      throw new Error("marketplace revocation timestamp is invalid");
+    }
+    let current = await this._verifiedState(request.skillName);
+    const expectedStateDigest = request.dependency.digest;
+    if (!(
+      current.revoked === true &&
+      current.stage === "rolled-back" &&
+      current.revocationBaselineStateDigest === expectedStateDigest &&
+      current.revocationPropagationRequestDigest === request.requestDigest
+    )) {
+      if (current.stateDigest !== expectedStateDigest) {
+        throw new Error("marketplace revocation dependency baseline changed");
+      }
+      try {
+        current = await this.revoke({
+          skillName: request.skillName,
+          expectedStateDigest,
+          revocationReceipt: request,
+          propagationRequestDigest: request.requestDigest,
+        });
+      } catch (cause) {
+        const recovered = await this._verifiedState(request.skillName);
+        if (
+          recovered.revoked !== true ||
+          recovered.stage !== "rolled-back" ||
+          recovered.revocationBaselineStateDigest !== expectedStateDigest ||
+          recovered.revocationPropagationRequestDigest !== request.requestDigest
+        ) {
+          throw cause;
+        }
+        current = recovered;
+      }
+    }
+    return freeze({
+      schema: SKILL_REVOCATION_DEPENDENCY_RESULT_SCHEMA,
+      authenticated: true,
+      durable: true,
+      applied: true,
+      idempotent: true,
+      tenantId: this.tenantId,
+      operationId: request.operationId,
+      requestDigest: request.requestDigest,
+      dependencyKind: request.dependency.kind,
+      dependencyRef: request.dependency.ref,
+      dependencyDigest: request.dependency.digest,
+      disposition: request.dependency.disposition,
+      receiptDigest: current.stateDigest,
+    });
+  }
+
+  async _verifiedState(skillName) {
+    const current = await this._load({ skillName });
+    return verifyGovernedSkillMarketplaceState(
+      current,
+      this.tenantId,
+      skillName,
+    );
+  }
+
   async _exact(skillName, expectedStateDigest) {
     id(skillName, "skillName");
     digest(expectedStateDigest, "expectedStateDigest");
-    const current = await this._load({ skillName });
+    const current = await this._verifiedState(skillName);
     if (!current || current.stateDigest !== expectedStateDigest)
       throw new Error("marketplace state changed or is missing");
     return current;
@@ -415,7 +698,7 @@ export class GovernedSkillMarketplace {
     delete core.stateDigest;
     const state = freeze({
       ...core,
-      stateDigest: hash(GOVERNED_SKILL_MARKETPLACE_STATE_SCHEMA, core),
+      stateDigest: digestGovernedSkillMarketplaceState(core),
     });
     const result = await this._commit({ state, expectedStateDigest, event });
     if (

package/src/lib/evolution/governed-wiki-pruning-journal.js

@@ -0,0 +1,302 @@
+import { createHash } from "node:crypto";
+import { types } from "node:util";
+export const GOVERNED_WIKI_PRUNING_PLAN_SCHEMA =
+  "chainlesschain.governed-wiki-pruning-plan/v2";
+export const GOVERNED_WIKI_PRUNING_POLICY_SCHEMA =
+  "chainlesschain.governed-wiki-pruning-policy/v1";
+
+export const WIKI_PRUNING_JOURNAL_SCHEMA =
+  "chainlesschain.governed-wiki-pruning-journal/v1";
+export const WIKI_PRUNING_JOURNAL_MAX_BYTES = 1024 * 1024;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const PLAN_KEYS = [
+  "schema",
+  "tenantId",
+  "wikiStateDigest",
+  "policyDigest",
+  "effectiveAt",
+  "patternActions",
+  "retrievalRemovals",
+  "dependencyDispositions",
+  "deletions",
+  "auditPolicy",
+  "planDigest",
+];
+const JOURNAL_KEYS = [
+  "schema",
+  "tenantId",
+  "revision",
+  "previousJournalDigest",
+  "plan",
+  "phase",
+  "operationReceipts",
+  "journalDigest",
+];
+
+export function pruningCanonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(pruningCanonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${pruningCanonical(value[key])}`)
+    .join(",")}}`;
+}
+
+export function pruningDigest(domain, value) {
+  return `sha256:${createHash("sha256").update(domain).update("\0").update(pruningCanonical(value)).digest("hex")}`;
+}
+
+function exact(value, keys, label) {
+  if (
+    !value ||
+    Array.isArray(value) ||
+    typeof value !== "object" ||
+    Object.keys(value).length !== keys.length ||
+    keys.some((key) => !Object.hasOwn(value, key))
+  )
+    throw new TypeError(`${label} fields are invalid`);
+}
+
+// Capture before any await. Never invoke accessors, proxy traps or toJSON;
+// bound traversal as well as the resulting canonical bytes.
+function snapshot(input) {
+  let nodes = 0;
+  let textBytes = 0;
+  const seen = new WeakSet();
+  const copy = (value, depth = 0) => {
+    if (++nodes > 40_000 || depth > 24)
+      throw new TypeError("pruning journal graph exceeds its budget");
+    if (typeof value === "string") {
+      textBytes += Buffer.byteLength(value, "utf8");
+      if (textBytes > WIKI_PRUNING_JOURNAL_MAX_BYTES)
+        throw new TypeError("pruning journal text exceeds its budget");
+      return value;
+    }
+    if (
+      value === null ||
+      typeof value === "boolean" ||
+      (typeof value === "number" && Number.isFinite(value))
+    )
+      return value;
+    if (typeof value !== "object" || types.isProxy(value) || seen.has(value))
+      throw new TypeError("pruning journal requires acyclic plain data");
+    const array = Array.isArray(value);
+    if (
+      ![array ? Array.prototype : Object.prototype, null].includes(
+        Object.getPrototypeOf(value),
+      )
+    )
+      throw new TypeError("pruning journal prototype is invalid");
+    seen.add(value);
+    const properties = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(properties);
+    const length = array ? properties.length?.value : 0;
+    if (
+      array &&
+      (!Number.isSafeInteger(length) ||
+        length < 0 ||
+        length > 8192 ||
+        keys.length !== length + 1)
+    )
+      throw new TypeError("pruning journal array is invalid");
+    const result = array ? [] : {};
+    for (const key of keys) {
+      if (array && key === "length") continue;
+      const property = properties[key];
+      if (
+        typeof key !== "string" ||
+        !("value" in property) ||
+        !property.enumerable ||
+        (array && (!/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length))
+      )
+        throw new TypeError("pruning journal properties are unsafe");
+      textBytes += Buffer.byteLength(key, "utf8");
+      Object.defineProperty(result, key, {
+        value: copy(property.value, depth + 1),
+        enumerable: true,
+      });
+    }
+    seen.delete(value);
+    return Object.freeze(result);
+  };
+  const result = copy(input);
+  if (
+    Buffer.byteLength(pruningCanonical(result), "utf8") >
+    WIKI_PRUNING_JOURNAL_MAX_BYTES
+  )
+    throw new TypeError("pruning journal exceeds its byte budget");
+  return result;
+}
+
+export function verifyPruningJournalPlan(input, tenantId) {
+  const plan = snapshot(input);
+  exact(plan, PLAN_KEYS, "pruning plan");
+  if (typeof tenantId !== "string" || !tenantId.trim())
+    throw new TypeError("pruning plan tenant is invalid");
+  const { planDigest, ...core } = plan;
+  if (
+    plan.schema !== GOVERNED_WIKI_PRUNING_PLAN_SCHEMA ||
+    plan.tenantId !== tenantId ||
+    !DIGEST.test(plan.wikiStateDigest) ||
+    !DIGEST.test(plan.policyDigest) ||
+    !DIGEST.test(planDigest) ||
+    typeof plan.effectiveAt !== "string" ||
+    !Number.isFinite(Date.parse(plan.effectiveAt)) ||
+    pruningDigest(GOVERNED_WIKI_PRUNING_PLAN_SCHEMA, core) !== planDigest
+  )
+    throw new TypeError("pruning plan binding is invalid");
+  for (const key of [
+    "patternActions",
+    "retrievalRemovals",
+    "dependencyDispositions",
+    "deletions",
+  ])
+    if (!Array.isArray(plan[key]) || plan[key].length > 4096)
+      throw new TypeError("pruning plan actions are invalid");
+  return plan;
+}
+
+export function capturePruningData(input) {
+  return snapshot(input);
+}
+
+export function pruningOperationCalls(plan) {
+  const steps = [
+    ["dependency-dispositions", plan.dependencyDispositions],
+    ["wiki-revision", plan.patternActions],
+    ...plan.deletions.map((deletion) => ["crypto-shred", deletion]),
+    ["retrieval-projection", { removals: plan.retrievalRemovals }],
+  ];
+  return steps.map(([operation, payload]) => {
+    const request = snapshot({
+      tenantId: plan.tenantId,
+      planDigest: plan.planDigest,
+      wikiStateDigest: plan.wikiStateDigest,
+      operation,
+      payload,
+    });
+    return Object.freeze({
+      request,
+      requestDigest: pruningDigest(
+        "chainlesschain.governed-wiki-pruning-operation/v1",
+        request,
+      ),
+    });
+  });
+}
+
+export function verifyWikiPruningJournal(input, tenantId) {
+  const state = snapshot(input);
+  exact(state, JOURNAL_KEYS, "pruning journal");
+  const { journalDigest, ...core } = state;
+  if (
+    state.schema !== WIKI_PRUNING_JOURNAL_SCHEMA ||
+    state.tenantId !== tenantId ||
+    !Number.isSafeInteger(state.revision) ||
+    state.revision < 1 ||
+    (state.previousJournalDigest !== null &&
+      !DIGEST.test(state.previousJournalDigest)) ||
+    !DIGEST.test(journalDigest) ||
+    pruningDigest(WIKI_PRUNING_JOURNAL_SCHEMA, core) !== journalDigest
+  )
+    throw new TypeError("pruning journal binding is invalid");
+  const plan = verifyPruningJournalPlan(state.plan, tenantId);
+  const calls = pruningOperationCalls(plan);
+  if (
+    !Array.isArray(state.operationReceipts) ||
+    state.operationReceipts.length > calls.length ||
+    !["prepared", "running", "finalized"].includes(state.phase) ||
+    (state.phase === "prepared" && state.operationReceipts.length !== 0) ||
+    (state.phase === "running" && state.operationReceipts.length === 0) ||
+    (state.phase === "finalized" &&
+      state.operationReceipts.length !== calls.length)
+  )
+    throw new TypeError("pruning journal progress is invalid");
+  state.operationReceipts.forEach((receipt, index) => {
+    if (
+      receipt?.authenticated !== true ||
+      receipt.durable !== true ||
+      receipt.requestDigest !== calls[index].requestDigest ||
+      !DIGEST.test(receipt.receiptDigest)
+    )
+      throw new TypeError("pruning operation receipt is not exactly bound");
+  });
+  return state;
+}
+
+export function assertPruningJournalTransition(previous, next) {
+  if (
+    next.revision !== (previous?.revision ?? 0) + 1 ||
+    next.previousJournalDigest !== (previous?.journalDigest ?? null)
+  )
+    throw new Error("pruning journal does not extend its exact predecessor");
+  if (!previous || previous.plan.planDigest !== next.plan.planDigest) {
+    if (
+      (previous && previous.phase !== "finalized") ||
+      next.phase !== "prepared"
+    )
+      throw new Error("pruning journal cannot replace an unfinished plan");
+    return;
+  }
+  if (
+    previous.phase === "finalized" ||
+    pruningCanonical(previous.plan) !== pruningCanonical(next.plan)
+  )
+    throw new Error("pruning journal plan cannot be rewritten or restarted");
+  const count = previous.operationReceipts.length;
+  if (
+    pruningCanonical(next.operationReceipts.slice(0, count)) !==
+      pruningCanonical(previous.operationReceipts) ||
+    (next.phase === "running" && next.operationReceipts.length !== count + 1) ||
+    (next.phase === "finalized" && next.operationReceipts.length !== count) ||
+    next.phase === "prepared"
+  )
+    throw new Error(
+      "pruning journal must retain receipts and advance one step at a time",
+    );
+}
+
+export function buildWikiPruningJournal({
+  plan: input,
+  previous = null,
+  receipt = null,
+  finalize = false,
+}) {
+  if (typeof finalize !== "boolean")
+    throw new TypeError("pruning journal finalize flag is invalid");
+  const capturedPlan = snapshot(input);
+  const plan = verifyPruningJournalPlan(capturedPlan, capturedPlan.tenantId);
+  const capturedReceipt = receipt === null ? null : snapshot(receipt);
+  const prior =
+    previous === null
+      ? null
+      : verifyWikiPruningJournal(previous, plan.tenantId);
+  const samePlan = prior?.plan.planDigest === plan.planDigest;
+  if (
+    (!samePlan && (receipt !== null || finalize)) ||
+    (receipt !== null && finalize)
+  )
+    throw new Error("pruning journal must prepare before progress");
+  const core = {
+    schema: WIKI_PRUNING_JOURNAL_SCHEMA,
+    tenantId: plan.tenantId,
+    revision: (prior?.revision ?? 0) + 1,
+    previousJournalDigest: prior?.journalDigest ?? null,
+    plan,
+    phase: !samePlan ? "prepared" : finalize ? "finalized" : "running",
+    operationReceipts: !samePlan
+      ? []
+      : receipt === null
+        ? prior.operationReceipts
+        : [...prior.operationReceipts, capturedReceipt],
+  };
+  const next = verifyWikiPruningJournal(
+    {
+      ...core,
+      journalDigest: pruningDigest(WIKI_PRUNING_JOURNAL_SCHEMA, core),
+    },
+    plan.tenantId,
+  );
+  assertPruningJournalTransition(prior, next);
+  return next;
+}