chainlesschain 0.166.42 → 0.166.44

package/src/gateways/ws/evolution-deployment-topic-handlers.js

@@ -0,0 +1,53 @@
+import {
+  configureEvolutionDeployment,
+  getEvolutionDeploymentStatus,
+  setEvolutionDeploymentEnabled,
+} from "../../lib/evolution/evolution-deployment-config.js";
+
+function assertSecureControl(context) {
+  const server = context?.server;
+  const loopback = new Set(["127.0.0.1", "localhost", "::1"]);
+  if (!server?.token && !loopback.has(server?.host)) {
+    throw new Error(
+      "Skill evolution configuration requires a token-protected or loopback-only cc ui",
+    );
+  }
+}
+
+function requiredPath(value, name) {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > 4096 ||
+    /[\r\n\0]/u.test(value)
+  ) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+
+export function createEvolutionDeploymentTopicHandlers(options = {}) {
+  const getStatus = options.getStatus || getEvolutionDeploymentStatus;
+  const configure = options.configure || configureEvolutionDeployment;
+  const setEnabled = options.setEnabled || setEvolutionDeploymentEnabled;
+  return {
+    "evolution.deployment.status": async (_frame, context) => {
+      assertSecureControl(context);
+      return getStatus();
+    },
+    "evolution.deployment.configure": async (frame, context) => {
+      assertSecureControl(context);
+      return configure({
+        descriptorPath: requiredPath(frame?.descriptorPath, "descriptorPath"),
+        trustRootPath: requiredPath(frame?.trustRootPath, "trustRootPath"),
+        enabled: true,
+      });
+    },
+    "evolution.deployment.set-enabled": async (frame, context) => {
+      assertSecureControl(context);
+      if (typeof frame?.enabled !== "boolean")
+        throw new Error("enabled must be a boolean");
+      return setEnabled(frame.enabled);
+    },
+  };
+}

package/src/lib/evolution/evolution-deployment-config.js

@@ -0,0 +1,81 @@
+import {
+  readEvolutionDeploymentProfile,
+  setEvolutionDeploymentProfileEnabled,
+  writeEvolutionDeploymentProfile,
+} from "./evolution-deployment-profile.js";
+import { verifyEvolutionDeployment } from "./evolution-deployment-loader.js";
+
+function environmentSelection(env) {
+  const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
+  const trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  if (!descriptorPath && !trustRootPath) return null;
+  return { descriptorPath, trustRootPath };
+}
+
+export async function getEvolutionDeploymentStatus(options = {}) {
+  const env = options.env || process.env;
+  const saved = await readEvolutionDeploymentProfile(options);
+  const fromEnvironment = environmentSelection(env);
+  const source = fromEnvironment
+    ? "environment"
+    : saved.profile?.enabled
+      ? "profile"
+      : "none";
+  const selected =
+    fromEnvironment || (saved.profile?.enabled ? saved.profile : null);
+  const base = {
+    source,
+    effectiveEnabled: source !== "none",
+    profileEnabled: saved.profile?.enabled === true,
+    profilePath: saved.filePath,
+    descriptorPath:
+      selected?.descriptorPath || saved.profile?.descriptorPath || null,
+    trustRootPath:
+      selected?.trustRootPath || saved.profile?.trustRootPath || null,
+    verified: false,
+    error: saved.error,
+    autoPromotion: "hold",
+  };
+  if (!selected || saved.error) return Object.freeze(base);
+  try {
+    const verified = await verifyEvolutionDeployment(selected, options);
+    return Object.freeze({
+      ...base,
+      verified: true,
+      error: null,
+      revision: verified.descriptor.revision,
+      modulePath: verified.modulePath,
+      moduleDigest: verified.descriptor.moduleDigest,
+      commands: verified.descriptor.commands,
+    });
+  } catch (error) {
+    return Object.freeze({
+      ...base,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export async function configureEvolutionDeployment(
+  { descriptorPath, trustRootPath, enabled = true },
+  options = {},
+) {
+  const verified = await verifyEvolutionDeployment(
+    { descriptorPath, trustRootPath },
+    options,
+  );
+  await writeEvolutionDeploymentProfile(
+    {
+      enabled: enabled === true,
+      descriptorPath: verified.descriptorPath,
+      trustRootPath: verified.trustRootPath,
+    },
+    options,
+  );
+  return getEvolutionDeploymentStatus(options);
+}
+
+export async function setEvolutionDeploymentEnabled(enabled, options = {}) {
+  await setEvolutionDeploymentProfileEnabled(enabled, options);
+  return getEvolutionDeploymentStatus(options);
+}

package/src/lib/evolution/evolution-deployment-loader.js

@@ -2,6 +2,7 @@ import { createHash, createPublicKey, verify } from "node:crypto";
 import { readFile, realpath } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import { types as utilTypes } from "node:util";
+import { readEvolutionDeploymentProfile } from "./evolution-deployment-profile.js";
 
 export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA =
   "chainlesschain.evolution-deployment-descriptor/v1";
@@ -223,7 +224,9 @@ async function loadBuiltInFactories(commandName) {
       import("./evolution-eval-process-supervisor.js"),
       import("./governed-skill-synthesis-attestor-trust-approval-client.js"),
       import("./governed-skill-synthesis-attestor-trust-operations-client.js"),
-      import("./governed-skill-synthesis-attestor-trust-operations-cli-host.js"),
+      import(
+        "./governed-skill-synthesis-attestor-trust-operations-cli-host.js"
+      ),
     ]);
     factories.createEvolutionWorkbenchCliHost = createEvolutionWorkbenchCliHost;
     factories.createEvolutionWorkbenchReviewRuntime =
@@ -350,8 +353,9 @@ async function loadBuiltInFactories(commandName) {
     commandName === "stream" ||
     commandName === "ui"
   ) {
-    const { createAgentEvolutionRuntimeComposition } =
-      await import("./agent-evolution-runtime-composition.js");
+    const { createAgentEvolutionRuntimeComposition } = await import(
+      "./agent-evolution-runtime-composition.js"
+    );
     factories.createAgentEvolutionRuntimeComposition =
       createAgentEvolutionRuntimeComposition;
   }
@@ -414,20 +418,14 @@ function bindFactoriesToModule(factories, moduleDigest) {
   return Object.freeze(result);
 }
 
-export async function loadEvolutionDeploymentCommandDependencies(
-  commandName,
+export async function verifyEvolutionDeployment(
+  { descriptorPath, trustRootPath },
   {
-    env = process.env,
     read = readFile,
     resolveRealPath = realpath,
-    importModule = (url) => import(url),
-    additionalFactories = {},
+    includeModuleBytes = false,
   } = {},
 ) {
-  if (!SUPPORTED_COMMANDS.has(commandName)) return null;
-  const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
-  const trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
-  if (!descriptorPath && !trustRootPath) return null;
   if (!descriptorPath || !trustRootPath)
     throw new Error(
       "evolution deployment requires both descriptor and trust root",
@@ -458,7 +456,6 @@ export async function loadEvolutionDeploymentCommandDependencies(
     )
   )
     throw new Error("evolution deployment descriptor signature rejected");
-  if (!descriptor.commands.includes(commandName)) return null;
 
   const modulePath = await resolveRealPath(descriptor.modulePath);
   const moduleBytes = await read(modulePath);
@@ -466,6 +463,58 @@ export async function loadEvolutionDeploymentCommandDependencies(
     throw new Error("evolution deployment module size is invalid");
   if (sha256(moduleBytes) !== descriptor.moduleDigest)
     throw new Error("evolution deployment module digest mismatch");
+  return Object.freeze({
+    descriptor,
+    descriptorPath: await resolveRealPath(descriptorPath),
+    trustRootPath: await resolveRealPath(trustRootPath),
+    modulePath,
+    ...(includeModuleBytes ? { moduleBytes } : {}),
+  });
+}
+
+export async function loadEvolutionDeploymentCommandDependencies(
+  commandName,
+  {
+    env = process.env,
+    read = readFile,
+    resolveRealPath = realpath,
+    importModule = (url) => import(url),
+    additionalFactories = {},
+  } = {},
+) {
+  if (!SUPPORTED_COMMANDS.has(commandName)) return null;
+  let descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
+  let trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  let fromSavedProfile = false;
+  if (!descriptorPath && !trustRootPath) {
+    const saved = await readEvolutionDeploymentProfile({ env });
+    if (!saved.error && saved.profile?.enabled) {
+      descriptorPath = saved.profile.descriptorPath;
+      trustRootPath = saved.profile.trustRootPath;
+      fromSavedProfile = true;
+    }
+  }
+  if (!descriptorPath && !trustRootPath) return null;
+  if (!descriptorPath || !trustRootPath)
+    throw new Error(
+      "evolution deployment requires both descriptor and trust root",
+    );
+  let verified;
+  try {
+    verified = await verifyEvolutionDeployment(
+      { descriptorPath, trustRootPath },
+      { read, resolveRealPath, includeModuleBytes: true },
+    );
+  } catch (error) {
+    // A saved profile may become stale after files are moved or rotated. Keep
+    // governed capabilities fail-closed while allowing `deployment status`,
+    // `configure`, and `disable` to start so the operator can recover. Explicit
+    // environment overrides remain strict and surface the error immediately.
+    if (fromSavedProfile) return null;
+    throw error;
+  }
+  const { descriptor, moduleBytes } = verified;
+  if (!descriptor.commands.includes(commandName)) return null;
   // Import the exact bytes that were authenticated. Importing modulePath here
   // would reopen a pathname-replacement window between hashing and execution.
   // Deployment entrypoints are therefore single-file ESM bundles; any external

package/src/lib/evolution/evolution-deployment-profile.js

@@ -0,0 +1,114 @@
+import { randomUUID } from "node:crypto";
+import { readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import { resolveConfigDataRoot } from "../paths.js";
+import {
+  PRIVATE_FILE_MODE,
+  ensurePrivateDirectory,
+  ensurePrivateFile,
+} from "../secure-fs.js";
+
+export const EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
+  "chainlesschain.evolution-deployment-profile/v1";
+
+export function getEvolutionDeploymentProfilePath({
+  env = process.env,
+  cwd = process.cwd(),
+} = {}) {
+  return join(
+    resolveConfigDataRoot({ env, cwd }).path,
+    "evolution",
+    "deployment-profile.json",
+  );
+}
+
+function normalizeProfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError("evolution deployment profile must be an object");
+  const keys = Object.keys(value).sort();
+  const expected = ["descriptorPath", "enabled", "schema", "trustRootPath"];
+  if (JSON.stringify(keys) !== JSON.stringify(expected.sort()))
+    throw new TypeError("evolution deployment profile has unexpected fields");
+  if (value.schema !== EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA)
+    throw new TypeError("evolution deployment profile schema is invalid");
+  if (typeof value.enabled !== "boolean")
+    throw new TypeError("evolution deployment profile enabled is invalid");
+  for (const [name, path] of [
+    ["descriptorPath", value.descriptorPath],
+    ["trustRootPath", value.trustRootPath],
+  ]) {
+    if (typeof path !== "string" || !isAbsolute(path))
+      throw new TypeError(
+        `evolution deployment profile ${name} must be absolute`,
+      );
+  }
+  return Object.freeze({
+    schema: value.schema,
+    enabled: value.enabled,
+    descriptorPath: value.descriptorPath,
+    trustRootPath: value.trustRootPath,
+  });
+}
+
+export async function readEvolutionDeploymentProfile(options = {}) {
+  const filePath =
+    options.filePath || getEvolutionDeploymentProfilePath(options);
+  try {
+    const profile = normalizeProfile(
+      JSON.parse(await readFile(filePath, "utf8")),
+    );
+    return Object.freeze({ filePath, profile, error: null });
+  } catch (error) {
+    if (error?.code === "ENOENT")
+      return Object.freeze({ filePath, profile: null, error: null });
+    return Object.freeze({
+      filePath,
+      profile: null,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export async function writeEvolutionDeploymentProfile(input, options = {}) {
+  const profile = normalizeProfile({
+    schema: EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
+    enabled: input?.enabled === true,
+    descriptorPath: input?.descriptorPath,
+    trustRootPath: input?.trustRootPath,
+  });
+  const filePath =
+    options.filePath || getEvolutionDeploymentProfilePath(options);
+  ensurePrivateDirectory(dirname(filePath));
+  const temporaryPath = join(
+    dirname(filePath),
+    `.deployment-profile.${randomUUID()}.tmp`,
+  );
+  try {
+    await writeFile(temporaryPath, `${JSON.stringify(profile, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: PRIVATE_FILE_MODE,
+      flag: "wx",
+    });
+    ensurePrivateFile(temporaryPath);
+    await rename(temporaryPath, filePath);
+    ensurePrivateFile(filePath);
+  } catch (error) {
+    await unlink(temporaryPath).catch(() => {});
+    throw error;
+  }
+  return Object.freeze({ filePath, profile });
+}
+
+export async function setEvolutionDeploymentProfileEnabled(
+  enabled,
+  options = {},
+) {
+  const current = await readEvolutionDeploymentProfile(options);
+  if (current.error) throw new Error(current.error);
+  if (!current.profile)
+    throw new Error("evolution deployment profile is not configured");
+  return writeEvolutionDeploymentProfile(
+    { ...current.profile, enabled: enabled === true },
+    { ...options, filePath: current.filePath },
+  );
+}

package/src/lib/evolution/evolution-file-identity.js

@@ -1,3 +1,5 @@
+import path from "node:path";
+
 import {
   isAffectedWindowsZeroDeviceStatRuntime,
   sameFileStatIdentity,
@@ -48,3 +50,43 @@ export function withEvolutionFileIdentity(
     { runtime },
   );
 }
+
+// Verify any number of children while holding one authenticated parent
+// directory identity. This keeps the affected Windows/libuv device bridge
+// exact without reopening the volume root and parent once per child.
+export function withEvolutionDirectoryFileIdentity(
+  fsImpl,
+  directoryPath,
+  operation,
+  runtime = undefined,
+) {
+  if (typeof operation !== "function") {
+    throw new TypeError("evolution directory identity operation is required");
+  }
+  const sentinel = path.join(path.resolve(directoryPath), ".identity-scope");
+  return withTrustedFileParentSync(
+    fsImpl,
+    sentinel,
+    ({ parentDevice, parentPath }) =>
+      operation(
+        isAffectedWindowsZeroDeviceStatRuntime(runtime)
+          ? (pathStat, handleStat) =>
+              samePathHandleFileIdentity(
+                pathStat,
+                handleStat,
+                parentDevice,
+                runtime,
+              )
+          : sameFileStatIdentity,
+        (pathStat, handleStat) =>
+          samePathHandleStableFileIdentity(
+            pathStat,
+            handleStat,
+            parentDevice,
+            runtime,
+          ),
+        Object.freeze({ parentPath }),
+      ),
+    { runtime },
+  );
+}

package/src/lib/evolution/evolution-ledger-file-manifest-head-store.js

@@ -0,0 +1,242 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { types as utilTypes } from "node:util";
+
+import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
+import { withFileLock } from "../with-file-lock.js";
+import { readBoundedDescriptor } from "./bounded-descriptor-read.js";
+import { EVOLUTION_LEDGER_MANIFEST_HEAD_CAS_RESULT_SCHEMA } from "./evolution-ledger-manifest-head-store.js";
+
+export const EVOLUTION_LEDGER_FILE_MANIFEST_HEAD_BACKEND_SCHEMA =
+  "chainlesschain.evolution-ledger-file-manifest-head-backend/v2";
+
+const STATE_SCHEMA =
+  "chainlesschain.evolution-ledger-file-manifest-head-state/v2";
+const STATE_KEYS = new Set(["head", "schema"]);
+const DEFAULT_MAXIMUM_BYTES = 256 * 1024;
+
+function exactRecord(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value)
+  ) {
+    throw new Error(`${label} is invalid`);
+  }
+  const fields = Object.getOwnPropertyDescriptors(value);
+  const names = Object.keys(fields);
+  if (names.length !== keys.size || names.some((name) => !keys.has(name))) {
+    throw new Error(`${label} fields are invalid`);
+  }
+  for (const name of names) {
+    if (!("value" in fields[name]))
+      throw new Error(`${label}.${name} must be own data`);
+  }
+  return fields;
+}
+
+function requiredDirectory(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError("manifest head directoryPath is required");
+  }
+  return path.resolve(value);
+}
+
+function syncDirectory(fsImpl, directory) {
+  let descriptor;
+  try {
+    descriptor = fsImpl.openSync(directory, "r");
+    fsImpl.fsyncSync(descriptor);
+  } catch (error) {
+    if (
+      process.platform !== "win32" ||
+      !["EACCES", "EINVAL", "EISDIR", "EPERM"].includes(error?.code)
+    ) {
+      throw error;
+    }
+  } finally {
+    if (descriptor !== undefined) fsImpl.closeSync(descriptor);
+  }
+}
+
+function headDigest(value) {
+  if (value === null) return null;
+  const field = Object.getOwnPropertyDescriptor(value, "headDigest");
+  if (!field || !("value" in field) || typeof field.value !== "string") {
+    throw new Error("manifest head record has no own headDigest");
+  }
+  return field.value;
+}
+
+export function createEvolutionLedgerFileManifestHeadBackend({
+  directoryPath,
+  fsImpl = fs,
+  lock = withFileLock,
+  maximumBytes = DEFAULT_MAXIMUM_BYTES,
+  random = () => crypto.randomBytes(16).toString("hex"),
+  crashHook = null,
+} = {}) {
+  const directory = requiredDirectory(directoryPath);
+  if (
+    typeof lock !== "function" ||
+    typeof random !== "function" ||
+    (crashHook !== null && typeof crashHook !== "function")
+  ) {
+    throw new TypeError(
+      "manifest head lock, random, and crashHook ports are invalid",
+    );
+  }
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 4096) {
+    throw new TypeError("manifest head maximumBytes must be at least 4096");
+  }
+  const file = path.join(directory, "manifest-head.json");
+  const secureOptions = { deps: { fs: fsImpl }, failIfUnavailable: true };
+  ensurePrivateDirectory(directory, secureOptions);
+
+  const invokeCrashHook = (phase, details) => {
+    if (crashHook !== null) crashHook(phase, Object.freeze(details));
+  };
+
+  const readBytes = () => {
+    if (!fsImpl.existsSync(file)) return null;
+    const stat = fsImpl.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+      throw new Error("manifest head file identity is invalid");
+    }
+    if (stat.size > maximumBytes)
+      throw new Error("manifest head exceeds maximumBytes");
+    let descriptor;
+    try {
+      descriptor = fsImpl.openSync(
+        file,
+        fsImpl.constants.O_RDONLY | (fsImpl.constants.O_NOFOLLOW || 0),
+      );
+      const opened = fsImpl.fstatSync(descriptor);
+      if (!opened.isFile() || opened.nlink !== 1 || opened.size !== stat.size) {
+        throw new Error("manifest head changed while opening");
+      }
+      const bytes = readBoundedDescriptor(
+        fsImpl,
+        descriptor,
+        stat.size,
+        maximumBytes,
+      );
+      const after = fsImpl.lstatSync(file);
+      if (
+        after.isSymbolicLink() ||
+        after.nlink !== 1 ||
+        after.size !== stat.size
+      ) {
+        throw new Error("manifest head changed while reading");
+      }
+      return bytes;
+    } finally {
+      if (descriptor !== undefined) fsImpl.closeSync(descriptor);
+    }
+  };
+
+  const readState = () => {
+    const bytes = readBytes();
+    if (bytes === null) return { head: null, schema: STATE_SCHEMA };
+    let parsed;
+    try {
+      parsed = JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      );
+    } catch {
+      throw new Error("manifest head is not valid UTF-8 JSON");
+    }
+    const fields = exactRecord(parsed, STATE_KEYS, "manifest head state");
+    if (fields.schema.value !== STATE_SCHEMA) {
+      throw new Error("manifest head state schema is invalid");
+    }
+    const head = fields.head.value;
+    if (
+      head !== null &&
+      (!head ||
+        typeof head !== "object" ||
+        Array.isArray(head) ||
+        utilTypes.isProxy(head))
+    ) {
+      throw new Error("manifest head state record is invalid");
+    }
+    headDigest(head);
+    return parsed;
+  };
+
+  const writeState = (state) => {
+    const bytes = Buffer.from(`${JSON.stringify(state)}\n`, "utf8");
+    if (bytes.length > maximumBytes)
+      throw new Error("manifest head exceeds maximumBytes");
+    const token = random();
+    if (typeof token !== "string" || !/^[a-zA-Z0-9_-]{8,128}$/u.test(token)) {
+      throw new Error("manifest head random token is invalid");
+    }
+    const temporary = `${file}.${token}.tmp`;
+    let descriptor;
+    try {
+      descriptor = fsImpl.openSync(temporary, "wx", 0o600);
+      fsImpl.writeFileSync(descriptor, bytes);
+      fsImpl.fsyncSync(descriptor);
+      fsImpl.closeSync(descriptor);
+      descriptor = undefined;
+      invokeCrashHook("after-stage", { file, temporary });
+      fsImpl.renameSync(temporary, file);
+      ensurePrivateFile(file, secureOptions);
+      descriptor = fsImpl.openSync(file, "r+");
+      fsImpl.fsyncSync(descriptor);
+      fsImpl.closeSync(descriptor);
+      descriptor = undefined;
+      syncDirectory(fsImpl, directory);
+      invokeCrashHook("after-rename", { file });
+      const readback = readBytes();
+      if (readback === null || !readback.equals(bytes)) {
+        throw new Error("manifest head durable readback differs");
+      }
+    } finally {
+      if (descriptor !== undefined) fsImpl.closeSync(descriptor);
+      try {
+        if (fsImpl.existsSync(temporary)) fsImpl.unlinkSync(temporary);
+      } catch {
+        // A private incomplete staging file cannot change the committed head.
+      }
+    }
+  };
+
+  return Object.freeze({
+    descriptor: Object.freeze({
+      file,
+      localOnly: true,
+      schema: EVOLUTION_LEDGER_FILE_MANIFEST_HEAD_BACKEND_SCHEMA,
+    }),
+    load() {
+      return structuredClone(readState().head);
+    },
+    compareAndSet(request) {
+      return lock(
+        file,
+        () => {
+          const state = readState();
+          const current = state.head;
+          if (headDigest(current) !== request.expectedHeadDigest) {
+            return Object.freeze({
+              committed: false,
+              head: structuredClone(current),
+              schema: EVOLUTION_LEDGER_MANIFEST_HEAD_CAS_RESULT_SCHEMA,
+            });
+          }
+          const next = structuredClone(request.nextHead);
+          writeState({ head: next, schema: STATE_SCHEMA });
+          return Object.freeze({
+            committed: true,
+            head: structuredClone(next),
+            schema: EVOLUTION_LEDGER_MANIFEST_HEAD_CAS_RESULT_SCHEMA,
+          });
+        },
+        { _fs: fsImpl, failIfUnavailable: true },
+      );
+    },
+  });
+}