chainlesschain 0.166.24 → 0.166.26

package/src/lib/evolution/governed-knowledge-revocation-host.js

@@ -0,0 +1,59 @@
+import { isGovernedKnowledgeSync } from "./governed-knowledge-sync.js";
+
+const HOSTS = new WeakSet();
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+
+function freeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) freeze(child);
+  }
+  return value;
+}
+
+function clone(value) {
+  return structuredClone(value);
+}
+
+export function createGovernedKnowledgeRevocationHost({ sync } = {}) {
+  if (!isGovernedKnowledgeSync(sync)) {
+    throw new TypeError("a branded governed Knowledge sync is required");
+  }
+  const host = Object.freeze({
+    async prepare(record) {
+      const planned = await sync.planRevocation(record);
+      return freeze({
+        authenticated: true,
+        durable: true,
+        operationDigest: planned.operationDigest,
+        inventoryDigest: planned.inventory.inventoryDigest,
+        knowledge: clone(planned.knowledge),
+      });
+    },
+    async publish({ operationDigest } = {}) {
+      if (!DIGEST.test(operationDigest ?? "")) {
+        throw new TypeError("revocation operationDigest is invalid");
+      }
+      const planned = await sync.recoverPlannedRevocation({ operationDigest });
+      const result = await sync.publishPlanned(planned, {
+        operationId: `knowledge-revocation:${operationDigest.slice(7)}`,
+      });
+      return freeze({
+        authenticated: true,
+        durable: true,
+        recoveredPlan: true,
+        operationDigest,
+        envelopeDigest: result.envelope.envelopeDigest,
+        knowledgeId: planned.knowledge.knowledgeId,
+        contentDigest: planned.knowledge.contentDigest,
+        dependencyCount: planned.knowledge.dependencies.length,
+      });
+    },
+  });
+  HOSTS.add(host);
+  return host;
+}
+
+export function isGovernedKnowledgeRevocationHost(value) {
+  return HOSTS.has(value);
+}

package/src/lib/evolution/governed-knowledge-skill-rollback.js

@@ -22,6 +22,16 @@ import {
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
 const VERIFICATION_SCHEMA =
   "chainlesschain.knowledge-skill-rollback-verification/v1";
+const QUARANTINE_VERIFICATION_SCHEMA =
+  "chainlesschain.knowledge-skill-quarantine-verification/v1";
+const ROLLBACK = Object.freeze({
+  disposition: "rollback-active",
+  verificationSchema: VERIFICATION_SCHEMA,
+});
+const QUARANTINE = Object.freeze({
+  disposition: "quarantine",
+  verificationSchema: QUARANTINE_VERIFICATION_SCHEMA,
+});
 
 function fail(message) {
   throw new Error(`knowledge Skill rollback: ${message}`);
@@ -117,12 +127,14 @@ function sameLedger(provider, verifier) {
     fail("independent readers do not authenticate the same ledger");
 }
 
-function releasesFor(reader, request) {
+function releasesFor(reader, request, configuration) {
   if (
     request.dependency.kind !== "active-skill" ||
-    request.dependency.disposition !== "rollback-active"
+    request.dependency.disposition !== configuration.disposition
   )
-    fail("this provider requires an active-skill / rollback-active dependency");
+    fail(
+      `this provider requires an active-skill / ${configuration.disposition} dependency`,
+    );
   // This effect accepts an immutable release identity, never an ambiguous content
   // digest or a caller-supplied Skill name. Other dependency kinds need their own effect.
   const from = reader.registry.readRelease(request.dependency.digest);
@@ -175,8 +187,8 @@ function resolve(reader, request, from) {
   }).result;
 }
 
-function committedProof(reader, request) {
-  const { from, sourceRef, wiki } = releasesFor(reader, request);
+function committedProof(reader, request, configuration) {
+  const { from, sourceRef, wiki } = releasesFor(reader, request, configuration);
   const result = resolve(reader, request, from);
   if (!result) return null;
   const { intent, previous, projection, finalizationEvidence } = result;
@@ -247,20 +259,21 @@ function authorizationData(value) {
 
 // Real active-release effect with direct or historically authenticated Wiki
 // provenance. Candidate rejection and quarantine require separate effects.
-export function createGovernedKnowledgeSkillRollbackAuthority({
-  tenantId,
-  deviceId,
-  releaseRegistry,
-  transactionLedger,
-  rollbackProvider,
-  authorizationProvider,
-  verifierReleaseRegistry,
-  verifierTransactionLedger,
-  wikiLedgerAdapter = null,
-  verifierWikiLedgerAdapter = null,
-  providerDescriptor,
-  verifierDescriptor,
-} = {}) {
+function createSkillDispositionAuthority(options = {}, configuration) {
+  const {
+    tenantId,
+    deviceId,
+    releaseRegistry,
+    transactionLedger,
+    rollbackProvider,
+    authorizationProvider,
+    verifierReleaseRegistry,
+    verifierTransactionLedger,
+    wikiLedgerAdapter = null,
+    verifierWikiLedgerAdapter = null,
+    providerDescriptor,
+    verifierDescriptor,
+  } = options;
   if (
     releaseRegistry === verifierReleaseRegistry ||
     transactionLedger === verifierTransactionLedger
@@ -316,9 +329,13 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
 
   async function apply(request) {
     sameLedger(providerReader, verifierReader);
-    let proof = committedProof(providerReader, request);
+    let proof = committedProof(providerReader, request, configuration);
     if (!proof) {
-      const { from, sourceRef, wiki } = releasesFor(providerReader, request);
+      const { from, sourceRef, wiki } = releasesFor(
+        providerReader,
+        request,
+        configuration,
+      );
       const active = providerReader.registry.readActive(from.skillName);
       if (!active || active.release.releaseDigest !== from.releaseDigest)
         fail("dependent release is not currently active");
@@ -336,7 +353,11 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
       const independent = verifierReader.registry.readActive(from.skillName);
       if (canonical(independent) !== canonical(active))
         fail("independent active state differs");
-      const independentSource = releasesFor(verifierReader, request);
+      const independentSource = releasesFor(
+        verifierReader,
+        request,
+        configuration,
+      );
       const independentTargetWiki = validateTarget(
         verifierReader,
         request,
@@ -388,7 +409,7 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
           fail("authority authorized a different transition");
       sameLedger(providerReader, verifierReader);
       if (
-        committedProof(providerReader, request) !== null ||
+        committedProof(providerReader, request, configuration) !== null ||
         canonical(providerReader.registry.readActive(from.skillName)) !==
           canonical(active)
       )
@@ -397,7 +418,7 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
         authorization,
         targetReleaseDigest: target.releaseDigest,
       });
-      proof = committedProof(providerReader, request);
+      proof = committedProof(providerReader, request, configuration);
       if (!proof) fail("rollback was not durably read back");
     }
     const core = {
@@ -436,8 +457,12 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
     verifier: Object.freeze({
       async verify({ request, result }) {
         sameLedger(providerReader, verifierReader);
-        const proof = committedProof(verifierReader, request);
-        const providerProof = committedProof(providerReader, request);
+        const proof = committedProof(verifierReader, request, configuration);
+        const providerProof = committedProof(
+          providerReader,
+          request,
+          configuration,
+        );
         if (!proof || canonical(proof) !== canonical(providerProof))
           fail("independent durable rollback proof differs");
         const { algorithm, keyId, value } =
@@ -460,7 +485,7 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
           providerRevision: providerIdentity.revision,
           verifierAuthorityId: verifierIdentity.authorityId,
           verifierRevision: verifierIdentity.revision,
-          verificationReceiptDigest: digest(VERIFICATION_SCHEMA, {
+          verificationReceiptDigest: digest(configuration.verificationSchema, {
             tenantId,
             deviceId,
             requestDigest: request.requestDigest,
@@ -473,3 +498,13 @@ export function createGovernedKnowledgeSkillRollbackAuthority({
     }),
   });
 }
+
+export function createGovernedKnowledgeSkillRollbackAuthority(options = {}) {
+  return createSkillDispositionAuthority(options, ROLLBACK);
+}
+
+// Active quarantine performs the same safety rollback, while the separately
+// typed durable dependency fence prevents this exact release from reactivation.
+export function createGovernedKnowledgeSkillQuarantineAuthority(options = {}) {
+  return createSkillDispositionAuthority(options, QUARANTINE);
+}

package/src/lib/evolution/governed-knowledge-sync.js

@@ -3,6 +3,10 @@ import { types as utilTypes } from "node:util";
 
 import { isGovernedKnowledgeDependencyExecutor } from "./governed-knowledge-dependency-ledger-executor.js";
 import { isGovernedKnowledgeArtifactLifecycle } from "./governed-knowledge-artifact-lifecycle.js";
+import {
+  captureGovernedKnowledgeDependencyInventoryPlan,
+  isGovernedKnowledgeDependencyInventoryPlanner,
+} from "./governed-knowledge-dependency-inventory.js";
 
 import {
   GOVERNED_KNOWLEDGE_SCOPE,
@@ -28,6 +32,7 @@ const ACTIONS = new Set(["upsert", "tombstone", "revoke"]);
 const MAX_CIPHERTEXT_BYTES = 12 * 1024 * 1024;
 const EXECUTION_RECORDS = new WeakSet();
 const SYNCHRONIZERS = new WeakSet();
+const PLANNED_REVOCATIONS = new WeakMap();
 const ENVELOPE_KEYS = new Set([
   "action",
   "ciphertext",
@@ -244,6 +249,7 @@ export class GovernedKnowledgeSync {
     deviceId,
     ports,
     dependencyExecutor = null,
+    dependencyPlanner = null,
     artifactLifecycle,
     clock = () => Date.now(),
   } = {}) {
@@ -282,9 +288,106 @@ export class GovernedKnowledgeSync {
     this._executeDependencies = dependencyExecutor
       ? capture(dependencyExecutor, "execute")
       : null;
+    if (
+      dependencyPlanner !== null &&
+      (!isGovernedKnowledgeDependencyInventoryPlanner(dependencyPlanner) ||
+        dependencyExecutor === null)
+    ) {
+      throw new TypeError(
+        "dependencyPlanner requires a branded inventory planner and executor",
+      );
+    }
+    this._dependencyPlanner = dependencyPlanner;
+    this._planDependencies = dependencyPlanner
+      ? capture(dependencyPlanner, "plan")
+      : null;
+    this._prepareDependencies = dependencyPlanner
+      ? capture(dependencyExecutor, "prepare")
+      : null;
+    this._readPreparedDependencies = dependencyPlanner
+      ? capture(dependencyExecutor, "readPrepared")
+      : null;
+    this._readPreparedDependenciesForKnowledge = dependencyPlanner
+      ? capture(dependencyExecutor, "readPreparedForKnowledge")
+      : null;
     SYNCHRONIZERS.add(this);
   }
 
+  async planRevocation(input) {
+    if (!this._planDependencies) {
+      throw new Error("knowledge dependency inventory planner is unavailable");
+    }
+    const planned = this._planDependencies(input);
+    captureGovernedKnowledgeDependencyInventoryPlan(
+      this._dependencyPlanner,
+      planned,
+    );
+    const knowledge = normalizeRecord(planned.knowledge, this, {
+      executionRecord: true,
+    });
+    if (knowledge.scope === "personal") {
+      throw new Error("personal knowledge cannot enter a shared sync channel");
+    }
+    await this._admit("publish", knowledge);
+    const prepared = await this._prepareDependencies(knowledge);
+    if (
+      prepared?.authenticated !== true ||
+      prepared.durable !== true ||
+      !DIGEST.test(prepared.operationDigest ?? "") ||
+      canonical(prepared.knowledge) !== canonical(knowledge)
+    ) {
+      throw new Error("knowledge dependency plan was not durably prepared");
+    }
+    const result = freeze({
+      inventory: planned.inventory,
+      knowledge,
+      operationDigest: prepared.operationDigest,
+      recovered: false,
+    });
+    PLANNED_REVOCATIONS.set(result, this);
+    return result;
+  }
+
+  async recoverPlannedRevocation({ operationDigest } = {}) {
+    if (
+      !this._readPreparedDependencies ||
+      !DIGEST.test(operationDigest ?? "")
+    ) {
+      throw new TypeError(
+        "planned revocation recovery is unavailable or invalid",
+      );
+    }
+    const prepared = this._readPreparedDependencies({ operationDigest });
+    if (
+      prepared?.authenticated !== true ||
+      prepared.durable !== true ||
+      prepared.operationDigest !== operationDigest
+    ) {
+      throw new Error("prepared knowledge revocation was not found");
+    }
+    const knowledge = normalizeRecord(prepared.knowledge, this, {
+      executionRecord: true,
+    });
+    await this._admit("publish", knowledge);
+    const result = freeze({
+      inventory: null,
+      knowledge,
+      operationDigest,
+      recovered: true,
+    });
+    PLANNED_REVOCATIONS.set(result, this);
+    return result;
+  }
+
+  async publishPlanned(plan, options = {}) {
+    if (PLANNED_REVOCATIONS.get(plan) !== this) {
+      throw new TypeError(
+        "a revocation plan prepared by this sync is required",
+      );
+    }
+    return this.publishWithArtifactEvidence(plan.knowledge, options);
+  }
+
   async publish(input, options = {}) {
     const result = await this.publishWithArtifactEvidence(input, options);
     return result.envelope;
@@ -602,7 +705,8 @@ export class GovernedKnowledgeSync {
       activate: binding.activate,
       humanReviewed: binding.humanReviewed,
     });
-    await this._applyRevocationDependencies(knowledge);
+    const dependencyKnowledge = await this._receivedDependencyPlan(knowledge);
+    await this._applyRevocationDependencies(dependencyKnowledge);
     await this._persist(
       knowledge,
       envelope,
@@ -711,6 +815,65 @@ export class GovernedKnowledgeSync {
       throw new Error("revocation dependencies were not durably applied");
     }
   }
+
+  async _receivedDependencyPlan(remoteKnowledge) {
+    if (
+      !["tombstone", "revoke"].includes(remoteKnowledge.action) ||
+      !this._planDependencies
+    ) {
+      return remoteKnowledge;
+    }
+    const portable = (value) => {
+      const copy = clone(value);
+      delete copy.dependencies;
+      return copy;
+    };
+    const recovered =
+      this._readPreparedDependenciesForKnowledge(remoteKnowledge);
+    let localKnowledge;
+    if (recovered) {
+      if (
+        recovered.authenticated !== true ||
+        recovered.durable !== true ||
+        !DIGEST.test(recovered.operationDigest ?? "")
+      ) {
+        throw new Error("received revocation local plan is unauthenticated");
+      }
+      localKnowledge = normalizeRecord(recovered.knowledge, this, {
+        executionRecord: true,
+      });
+    } else {
+      const draft = portable(remoteKnowledge);
+      delete draft.schema;
+      const planned = this._planDependencies(draft);
+      captureGovernedKnowledgeDependencyInventoryPlan(
+        this._dependencyPlanner,
+        planned,
+      );
+      localKnowledge = normalizeRecord(planned.knowledge, this, {
+        executionRecord: true,
+      });
+    }
+    if (
+      canonical(portable(localKnowledge)) !==
+      canonical(portable(remoteKnowledge))
+    ) {
+      throw new Error(
+        "received revocation local plan changed signed knowledge",
+      );
+    }
+    const prepared = await this._prepareDependencies(localKnowledge);
+    if (
+      prepared?.authenticated !== true ||
+      prepared.durable !== true ||
+      canonical(prepared.knowledge) !== canonical(localKnowledge)
+    ) {
+      throw new Error(
+        "received revocation local plan was not durably prepared",
+      );
+    }
+    return localKnowledge;
+  }
 }
 
 export function isGovernedKnowledgeSync(value) {

package/src/lib/evolution/governed-knowledge-wiki-tombstone.js

@@ -2,7 +2,7 @@ import { types } from "node:util";
 import { captureWikiRevisionReader } from "./wiki-maintainer-ledger-adapter.js";
 import { captureSkillReleaseOperationReader } from "./evolution-ledger-ports.js";
 import { governedKnowledgeSourceRef } from "./governed-knowledge-skill-rollback.js";
-import { deriveWikiTargetTombstoneRevision } from "./wiki-target-tombstone-revision.js";
+import { deriveWikiTargetDispositionRevision } from "./wiki-target-tombstone-revision.js";
 import {
   createGovernedKnowledgeDependencyAuthority,
   GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
@@ -39,6 +39,36 @@ const MULTIHOP_RULES_DIGEST = digest(MULTIHOP_SCHEMA, {
   schema: MULTIHOP_SCHEMA,
   source: "authenticated-pinned-Wiki-exact-Knowledge-ancestry",
 });
+const QUARANTINE_SCHEMA = "chainlesschain.knowledge-wiki-quarantine/v1";
+const QUARANTINE_RULES = Object.freeze({
+  ...RULES,
+  schema: QUARANTINE_SCHEMA,
+  effect: "target-only-quarantine",
+});
+const QUARANTINE_RULES_DIGEST = digest(QUARANTINE_SCHEMA, QUARANTINE_RULES);
+const QUARANTINE_MULTIHOP_SCHEMA =
+  "chainlesschain.knowledge-wiki-quarantine/v2";
+const QUARANTINE_MULTIHOP_RULES_DIGEST = digest(QUARANTINE_MULTIHOP_SCHEMA, {
+  ...QUARANTINE_RULES,
+  schema: QUARANTINE_MULTIHOP_SCHEMA,
+  source: "authenticated-pinned-Wiki-exact-Knowledge-ancestry",
+});
+const TOMBSTONE = Object.freeze({
+  disposition: "tombstone",
+  schema: SCHEMA,
+  rulesDigest: RULES_DIGEST,
+  multihopSchema: MULTIHOP_SCHEMA,
+  multihopRulesDigest: MULTIHOP_RULES_DIGEST,
+  model: "deterministic:knowledge-wiki-tombstone",
+});
+const QUARANTINE = Object.freeze({
+  disposition: "quarantine",
+  schema: QUARANTINE_SCHEMA,
+  rulesDigest: QUARANTINE_RULES_DIGEST,
+  multihopSchema: QUARANTINE_MULTIHOP_SCHEMA,
+  multihopRulesDigest: QUARANTINE_MULTIHOP_RULES_DIGEST,
+  model: "deterministic:knowledge-wiki-quarantine",
+});
 function fail(message) {
   throw new Error(`Knowledge Wiki tombstone: ${message}`);
 }
@@ -57,7 +87,7 @@ function bind(wikiAdapter, transactionLedger, tenantId) {
     );
   return Object.freeze({ wiki, operations });
 }
-function partsFor(source, request, provenance) {
+function partsFor(source, request, provenance, configuration) {
   const sourceRef = governedKnowledgeSourceRef(request);
   const refs = new Set(
     Object.values(source.state.evidence)
@@ -82,7 +112,7 @@ function partsFor(source, request, provenance) {
     .sort();
   const targetIds = provenance.affectedPatternIds;
   const operations = targetIds.map((patternId) => ({
-    type: "tombstone",
+    type: configuration.disposition,
     patternId,
     reason: "governed-knowledge-revocation",
   }));
@@ -93,7 +123,7 @@ function partsFor(source, request, provenance) {
   // v2 contract, pinned to the original revision rather than today's head.
   const sourceProofDigest = same(directIds, targetIds)
     ? null
-    : digest(`${MULTIHOP_SCHEMA}/source`, {
+    : digest(`${configuration.multihopSchema}/source`, {
         revisionId: provenance.revisionId,
         stateDigest: provenance.stateDigest,
         checkpoint: provenance.checkpoint,
@@ -111,7 +141,7 @@ function partsFor(source, request, provenance) {
       operations: batch,
       ...(sourceProofDigest ? { sourceProofDigest } : {}),
       requestDigest: digest(
-        `${sourceProofDigest ? MULTIHOP_SCHEMA : SCHEMA}/batch`,
+        `${sourceProofDigest ? configuration.multihopSchema : configuration.schema}/batch`,
         {
           requestDigest: request.requestDigest,
           index,
@@ -123,8 +153,8 @@ function partsFor(source, request, provenance) {
     };
   });
 }
-function derive(reader, source, part, fence) {
-  return deriveWikiTargetTombstoneRevision({
+function derive(reader, source, part, fence, configuration) {
+  return deriveWikiTargetDispositionRevision({
     source,
     operations: part.operations,
     requestDigest: part.requestDigest,
@@ -132,24 +162,24 @@ function derive(reader, source, part, fence) {
     descriptor: {
       tenantId: reader.wiki.descriptor.tenantId,
       evolutionRunId: reader.wiki.descriptor.evolutionRunId,
-      maintainerModel: part.sourceProofDigest
-        ? "deterministic:knowledge-wiki-tombstone/v2"
-        : "deterministic:knowledge-wiki-tombstone/v1",
+      maintainerModel: `${configuration.model}/${part.sourceProofDigest ? "v2" : "v1"}`,
       rulesDigest: part.sourceProofDigest
-        ? MULTIHOP_RULES_DIGEST
-        : RULES_DIGEST,
+        ? configuration.multihopRulesDigest
+        : configuration.rulesDigest,
       minCorroboratingSources: RULES.minCorroboratingSources,
       decayHalfLifeDays: RULES.decayHalfLifeDays,
       staleConfidenceFloor: RULES.staleConfidenceFloor,
     },
   });
 }
-async function prove(reader, request, context, original) {
+async function prove(reader, request, context, original, configuration) {
   if (
     request.dependency.kind !== "wiki" ||
-    request.dependency.disposition !== "tombstone"
+    request.dependency.disposition !== configuration.disposition
   )
-    fail("only an exact wiki / tombstone dependency is supported");
+    fail(
+      `only an exact wiki / ${configuration.disposition} dependency is supported`,
+    );
   const admission = reader.operations.resolveKnowledgeRevocation({
     tenantId: request.tenantId,
     operationDigest: request.operationDigest,
@@ -189,7 +219,7 @@ async function prove(reader, request, context, original) {
     !matchHead(context.checkpoint, provenance.ledgerHead)
   )
     fail("Wiki ancestry does not bind the original state and current ledger");
-  const parts = partsFor(original, request, provenance);
+  const parts = partsFor(original, request, provenance, configuration);
   const history = reader.wiki.resolveHistory({
     tenantId: request.tenantId,
     stateDigest: request.dependency.digest,
@@ -204,7 +234,13 @@ async function prove(reader, request, context, original) {
   for (const [index, entry] of history.successors.entries()) {
     if (entry.predecessorHead.sequence < fence.sequence)
       fail("Wiki effect predates its prepared Knowledge authorization");
-    const expected = await derive(reader, source, parts[index], fence);
+    const expected = await derive(
+      reader,
+      source,
+      parts[index],
+      fence,
+      configuration,
+    );
     if (!same(expected, entry.revision))
       fail("Wiki successor does not match the exact target-only tombstones");
     source = {
@@ -228,17 +264,18 @@ async function prove(reader, request, context, original) {
   });
 }
 
-export function createGovernedKnowledgeWikiTombstoneAuthority({
-  tenantId,
-  deviceId,
-  wikiLedgerAdapter,
-  transactionLedger,
-  verifierWikiLedgerAdapter,
-  verifierTransactionLedger,
-  providerDescriptor,
-  verifierDescriptor,
-  additionalWikiTargets = [],
-} = {}) {
+function createWikiDispositionAuthority(options = {}, configuration) {
+  const {
+    tenantId,
+    deviceId,
+    wikiLedgerAdapter,
+    transactionLedger,
+    verifierWikiLedgerAdapter,
+    verifierTransactionLedger,
+    providerDescriptor,
+    verifierDescriptor,
+    additionalWikiTargets = [],
+  } = options;
   if (
     wikiLedgerAdapter === verifierWikiLedgerAdapter ||
     transactionLedger === verifierTransactionLedger
@@ -354,12 +391,14 @@ export function createGovernedKnowledgeWikiTombstoneAuthority({
       request,
       context,
       selected.original,
+      configuration,
     );
     const independent = await prove(
       selected.binding.verifier,
       request,
       context,
       selected.independentOriginal,
+      configuration,
     );
     if (!same(primary, independent))
       fail("independent Wiki effect proof differs");
@@ -407,6 +446,7 @@ export function createGovernedKnowledgeWikiTombstoneAuthority({
             proof.current,
             proof.parts[done],
             proof.fence,
+            configuration,
           );
           let commitError = null;
           try {
@@ -449,14 +489,28 @@ export function createGovernedKnowledgeWikiTombstoneAuthority({
           providerRevision: providerIdentity.revision,
           verifierAuthorityId: verifierIdentity.authorityId,
           verifierRevision: verifierIdentity.revision,
-          verificationReceiptDigest: digest(`${SCHEMA}/verification`, {
-            requestDigest: request.requestDigest,
-            resultDigest: result.resultDigest,
-            proof,
-            verifierIdentity,
-          }),
+          verificationReceiptDigest: digest(
+            `${configuration.schema}/verification`,
+            {
+              requestDigest: request.requestDigest,
+              resultDigest: result.resultDigest,
+              proof,
+              verifierIdentity,
+            },
+          ),
         });
       },
     }),
   });
 }
+
+export function createGovernedKnowledgeWikiTombstoneAuthority(options = {}) {
+  return createWikiDispositionAuthority(options, TOMBSTONE);
+}
+
+// Quarantine is a distinct non-deletion state. The generic Wiki maintainer
+// refuses to rewrite quarantined patterns, so only a future separately governed
+// release authority can make them actionable again.
+export function createGovernedKnowledgeWikiQuarantineAuthority(options = {}) {
+  return createWikiDispositionAuthority(options, QUARANTINE);
+}