chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/core/scripts/build-native.js

@@ -0,0 +1,36 @@
+// Maintainer build only. Installation never downloads or compiles native code.
+import { execFileSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, realpathSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+if (!['linux', 'darwin'].includes(process.platform)) throw new Error('native POSIX build requires Linux or macOS');
+const root = fileURLToPath(new URL('..', import.meta.url));
+const include = join(dirname(dirname(realpathSync(process.execPath))), 'include/node');
+if (!existsSync(join(include, 'node_api.h'))) throw new Error(`Node-API development headers are missing: ${include}`);
+const output = join(root, 'native/prebuilds', `${process.platform}-${process.arch}`);
+mkdirSync(output, { recursive: true });
+execFileSync('/usr/bin/cc', [
+  '-std=c11', '-Wall', '-Wextra', '-Werror', '-O2', '-fPIC', '-DNAPI_VERSION=8',
+  '-I', include, ...(process.platform === 'darwin' ? ['-bundle', '-undefined', 'dynamic_lookup'] : ['-shared']),
+  join(root, 'native/descriptor-fs.c'), '-o', join(output, 'descriptor-fs.node'),
+], { stdio: 'inherit' });
+chmodSync(join(output, 'descriptor-fs.node'), 0o755);
+process.stdout.write(`Built descriptor-relative storage: ${process.platform}/${process.arch}\n`);
+execFileSync('/usr/bin/cc', [
+  '-std=c11', '-Wall', '-Wextra', '-Werror', '-O2',
+  join(root, 'native/execution-gate.c'), '-o', join(output, 'execution-gate'),
+], { stdio: 'inherit' });
+// Compiler output follows the maintainer's umask. The shipped trusted helper
+// must never inherit group/other write permissions from that environment.
+chmodSync(join(output, 'execution-gate'), 0o755);
+process.stdout.write(`Built native execution admission gate: ${process.platform}/${process.arch}\n`);
+if (process.platform === 'darwin') {
+  execFileSync('/usr/bin/cc', [
+    '-std=c11', '-Wall', '-Wextra', '-Werror', '-O2',
+    '-framework', 'CoreFoundation', '-framework', 'Security',
+    join(root, 'native/darwin-launcher.c'), '-o', join(output, 'darwin-launcher'),
+  ], { stdio: 'inherit' });
+  chmodSync(join(output, 'darwin-launcher'), 0o755);
+  process.stdout.write(`Built Darwin suspended-image launcher: ${process.arch}\n`);
+}

package/node_modules/@chati/core/src/darwin-browser-proof.js

@@ -0,0 +1,87 @@
+/** Private fixed-frame transport for the admitted Darwin helper. This module
+ * does not attest a helper or select a PID. The caller owns sealed launch and
+ * exclusive fd9/fd10 inheritance, as well as final native completion. */
+import { createHash } from 'node:crypto';
+import { closeSync, writeSync } from 'node:fs';
+import { Socket } from 'node:net';
+import { createProcessInfoPipeSync } from './descriptor-fs.js';
+
+const REQUEST_SIZE = 104; const RESPONSE_SIZE = 116;
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+function error(code) { return Object.assign(new Error(code), { code }); }
+
+export function createDarwinBrowserProofChannels(nonce) {
+  if (typeof nonce !== 'string' || !/^[a-f0-9]{64}$/.test(nonce)) throw error('BROWSER_PROOF_NONCE_INVALID');
+  const owned = new Set();
+  function pipe() { const pair = createProcessInfoPipeSync(); for (const fd of pair) owned.add(fd); return pair; }
+  function close(fd) { if (owned.delete(fd)) closeSync(fd); }
+  let request; let reply; let reader; let pending;
+  let phase = 'prepared'; let sequence = 0n; let queued = Promise.resolve();
+  let received = Buffer.alloc(0); let chain = digest(Buffer.from(nonce)); let positives = 0;
+  function dispose(failure = error('BROWSER_PROOF_CHANNEL_CLOSED')) {
+    if (phase === 'closed') return false;
+    phase = 'closed';
+    if (pending) { clearTimeout(pending.timer); pending.reject(failure); pending = undefined; }
+    reader?.destroy();
+    for (const fd of [...owned]) close(fd);
+    return true;
+  }
+  try {
+    request = pipe(); reply = pipe();
+    reader = new Socket({ fd: reply[0], readable: true, writable: false });
+    owned.delete(reply[0]); // Socket now owns this descriptor exclusively.
+    reader.on('error', () => dispose(error('BROWSER_PROOF_CHANNEL_ERROR')));
+    reader.on('end', () => dispose(error('BROWSER_PROOF_CHANNEL_EOF')));
+    reader.on('close', () => dispose(error('BROWSER_PROOF_CHANNEL_CLOSED')));
+    reader.on('data', bytes => {
+      if (!pending || received.length + bytes.length > RESPONSE_SIZE) {
+        dispose(error('BROWSER_PROOF_FRAME_INVALID')); return;
+      }
+      received = Buffer.concat([received, bytes]);
+      if (received.length !== RESPONSE_SIZE) return;
+      if (!received.subarray(0, REQUEST_SIZE).equals(pending.frame) || received[104] > 1
+        || received.subarray(105, 108).some(byte => byte !== 0)
+        || (received[104] === 1) !== (received.readBigUInt64BE(108) > 0n)) {
+        dispose(error('BROWSER_PROOF_FRAME_INVALID')); return;
+      }
+      const current = pending; pending = undefined; clearTimeout(current.timer);
+      const proved = received[104] === 1;
+      if (proved) positives++;
+      chain = digest(Buffer.concat([Buffer.from(chain, 'hex'), received]));
+      received = Buffer.alloc(0);
+      current.resolve(proved);
+    });
+  } catch (failure) { dispose(failure); throw failure; }
+
+  function query(tuple) {
+    if (phase !== 'active') throw error('BROWSER_PROOF_CHANNEL_CLOSED');
+    if (!tuple || Object.keys(tuple).length !== 4 || tuple.local_address !== '127.0.0.1' || tuple.remote_address !== '127.0.0.1'
+      || !Number.isInteger(tuple.local_port) || tuple.local_port < 1 || tuple.local_port > 65535
+      || !Number.isInteger(tuple.remote_port) || tuple.remote_port < 1024 || tuple.remote_port > 65535) throw error('BROWSER_PROOF_TUPLE_INVALID');
+    if (++sequence >= 2n ** 128n) { dispose(); throw error('BROWSER_PROOF_SEQUENCE_EXHAUSTED'); }
+    const frame = Buffer.alloc(REQUEST_SIZE);
+    frame.write('CBP1'); frame.write(nonce, 4); frame.write(sequence.toString(16).padStart(32, '0'), 68);
+    frame.writeUInt16BE(tuple.local_port, 100); frame.writeUInt16BE(tuple.remote_port, 102);
+    return new Promise((resolve, reject) => {
+      pending = { frame, resolve, reject, timer: setTimeout(() => dispose(error('BROWSER_PROOF_TIMEOUT')), 1000) };
+      try {
+        if (writeSync(request[1], frame) !== frame.length) dispose(error('BROWSER_PROOF_WRITE_FAILED'));
+      } catch { dispose(error('BROWSER_PROOF_WRITE_FAILED')); }
+    });
+  }
+  return Object.freeze({
+    inheritedDescriptors: Object.freeze([request[0], reply[1]]),
+    afterSpawn() {
+      if (phase !== 'prepared') throw error('BROWSER_PROOF_CHANNEL_STATE_INVALID');
+      close(request[0]); close(reply[1]); phase = 'active';
+    },
+    verifyPeer(tuple) {
+      const frozen = structuredClone(tuple);
+      const result = queued.then(() => query(frozen));
+      queued = result.catch(() => {});
+      return result;
+    },
+    summary: () => Object.freeze({ nonce, positive_proofs: positives, proof_chain_sha256: chain, closed: phase === 'closed' }),
+    dispose,
+  });
+}

package/node_modules/@chati/core/src/darwin-host-boot.js

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+let binding;
+function fail(code, message, cause) { throw Object.assign(new Error(message), { code, ...(cause ? { cause } : {}) }); }
+
+export function assertDarwinHostBootIdentity(identity) {
+  if (!identity || typeof identity !== 'object' || Array.isArray(identity)
+    || Object.keys(identity).length !== 4 || identity.schema_version !== 1 || identity.platform !== 'darwin'
+    || typeof identity.host_id_sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(identity.host_id_sha256)
+    || typeof identity.boot_session_uuid !== 'string' || !UUID.test(identity.boot_session_uuid)
+    || identity.boot_session_uuid === NIL_UUID) {
+    fail('INVALID_DARWIN_HOST_BOOT_IDENTITY', 'a complete native host and boot-session identity is required');
+  }
+  return true;
+}
+
+/** Native host observation, never environment variables, hostname, wall time or
+ * provider output. The hardware UUID is hashed here and never enters receipts. */
+export function captureDarwinHostBootIdentity() {
+  if (process.platform !== 'darwin') fail('DARWIN_HOST_BOOT_UNAVAILABLE', 'Darwin host identity requires the native Darwin observer');
+  try { binding ??= require(`../native/prebuilds/darwin-${process.arch}/descriptor-fs.node`); }
+  catch (error) { fail('DARWIN_HOST_BOOT_UNAVAILABLE', 'matching packaged native host observer is required', error); }
+  if (typeof binding.darwinHostBoot !== 'function') fail('DARWIN_HOST_BOOT_UNAVAILABLE', 'packaged native observer lacks the host/boot contract');
+  const observed = binding.darwinHostBoot();
+  if (!observed || !UUID.test(observed.host_uuid ?? '') || observed.host_uuid === NIL_UUID
+    || !UUID.test(observed.boot_session_uuid ?? '') || observed.boot_session_uuid === NIL_UUID) {
+    fail('DARWIN_HOST_BOOT_UNAVAILABLE', 'kernel host or boot UUID is unavailable');
+  }
+  const identity = Object.freeze({ schema_version: 1, platform: 'darwin',
+    host_id_sha256: createHash('sha256').update(`chati-darwin-host-v1\0${observed.host_uuid}`).digest('hex'),
+    boot_session_uuid: observed.boot_session_uuid });
+  assertDarwinHostBootIdentity(identity);
+  return identity;
+}
+
+/** Pure comparison of already authenticated/observed facts, not authentication. */
+export function compareDarwinHostBootIdentity(previous, current) {
+  assertDarwinHostBootIdentity(previous);
+  assertDarwinHostBootIdentity(current);
+  if (previous.host_id_sha256 !== current.host_id_sha256) {
+    fail('DARWIN_HOST_IDENTITY_MISMATCH', 'recovery cannot prove termination on a different machine');
+  }
+  return previous.boot_session_uuid === current.boot_session_uuid ? 'same-boot' : 'previous-boot';
+}
+
+/** A new kernel boot kills all earlier processes, including detached groups.
+ * Same-boot absence/group completion never supplies that stronger proof. */
+export function observeDarwinPreviousBoot(previous) {
+  const current = captureDarwinHostBootIdentity();
+  if (compareDarwinHostBootIdentity(previous, current) !== 'previous-boot') {
+    fail('RECOVERY_DARWIN_LIFETIME_UNPROVEN', 'detached writers remain unproven in the current boot; recovery requires a new boot of the same machine');
+  }
+  return Object.freeze({ status: 'exited', reason: 'previous-boot', signal_sent: false, host_boot_identity: current });
+}

package/node_modules/@chati/core/src/darwin-process.js

@@ -0,0 +1,79 @@
+/** Strict readers for private native Darwin supervisor messages. Parsing does
+ * not authenticate a sender: callers must own the attested helper and private
+ * descriptors. No PID lookup, process signaling, receipt signing or recovery. */
+import { createHash } from 'node:crypto';
+
+const READY_KEYS = ['schema_version', 'phase', 'nonce', 'helper_pid', 'provider_pid', 'verified_cdhash', 'lifetime_kind'];
+const COMPLETION_KEYS = [...READY_KEYS, 'elapsed_ms', 'exit_code', 'signal', 'supervisor_signal',
+  'reaper_result', 'process_group_empty', 'detached_descendants'];
+function fail(message) {
+  throw Object.assign(new Error(message), { code: 'INVALID_DARWIN_PROCESS_OBSERVATION' });
+}
+function object(value) { return value && typeof value === 'object' && !Array.isArray(value); }
+function integer(value, minimum, maximum) { return Number.isSafeInteger(value) && value >= minimum && value <= maximum; }
+function hash(value, length) { return typeof value === 'string' && value.length === length && /^[a-f0-9]+$/.test(value); }
+function exactKeys(value, keys) {
+  return object(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+}
+
+function readMessage(input, phase, keys) {
+  if (typeof input !== 'string' || Buffer.byteLength(input) > 4096) fail('native message must be bounded UTF-8 text');
+  let value;
+  try { value = JSON.parse(input); } catch { fail('native message is not JSON'); }
+  // The native writer emits one compact JSON object with one final newline.
+  // Exact roundtrip rejects duplicate keys and ambiguous/trailing material.
+  if (!exactKeys(value, keys) || `${JSON.stringify(value)}\n` !== input
+    || value.schema_version !== 1 || value.phase !== phase) fail('native message schema or framing is invalid');
+  if (!hash(value.nonce, 64) || !hash(value.verified_cdhash, 40)
+    || !integer(value.helper_pid, 2, 0x7fffffff) || !integer(value.provider_pid, 2, 0x7fffffff)
+    || value.helper_pid === value.provider_pid
+    || value.lifetime_kind !== 'darwin_process_group_v1') fail('native process identity or lifetime contract is invalid');
+  return value;
+}
+
+export function darwinSupervisorNonce(context) {
+  const command = context?.authority_kind === 'verification_check';
+  const keys = ['authority_kind', 'invocation_id', 'launch_nonce', command ? 'executable_binding_digest' : 'provider_id'];
+  if (command && (!exactKeys(context, keys) || !hash(context.executable_binding_digest, 64))) {
+    fail('verification commands require their exact executable identity, not provider/model routing');
+  }
+  if (!object(context) || keys.some(key => typeof context[key] !== 'string'
+    || !context[key].trim() || context[key].includes('\0') || Buffer.byteLength(context[key]) > 4096)) {
+    fail('a complete public invocation context is required for the native nonce');
+  }
+  return createHash('sha256').update(JSON.stringify(['chati-darwin-supervisor-v1', ...keys.map(key => context[key])])).digest('hex');
+}
+
+export function parseDarwinReadyMessage(input, expected) {
+  if (!object(expected) || !hash(expected.nonce, 64) || !hash(expected.verified_cdhash, 40)
+    || !integer(expected.helper_pid, 2, 0x7fffffff)) fail('trusted native launch expectations are required');
+  const value = readMessage(input, 'ready', READY_KEYS);
+  for (const key of ['nonce', 'helper_pid', 'verified_cdhash']) {
+    if (value[key] !== expected[key]) fail(`native READY differs from its launch binding: ${key}`);
+  }
+  return Object.freeze(value);
+}
+
+export function parseDarwinCompletionMessage(input, ready, helperExitStatus) {
+  if (!exactKeys(ready, READY_KEYS)) fail('the complete bound READY observation is required');
+  // Revalidate stored input too; a caller cannot smuggle a different lifetime
+  // contract by constructing a ready-shaped object instead of reading the pipe.
+  parseDarwinReadyMessage(`${JSON.stringify(ready)}\n`, ready);
+  const value = readMessage(input, 'completed', COMPLETION_KEYS);
+  for (const key of ['nonce', 'helper_pid', 'provider_pid', 'verified_cdhash', 'lifetime_kind']) {
+    if (value[key] !== ready[key]) fail(`native completion differs from READY: ${key}`);
+  }
+  if (!integer(value.elapsed_ms, 0, Number.MAX_SAFE_INTEGER)
+    || !integer(value.signal, 0, 127) || !integer(value.supervisor_signal, 0, 127)
+    || !(value.signal === 0 ? integer(value.exit_code, 0, 255) : value.exit_code === -1)
+    || !['acknowledged', 'eperm_then_group_empty'].includes(value.reaper_result)
+    || value.process_group_empty !== true || value.detached_descendants !== 'unknown') {
+    fail('native completion must report its actual bounded child result and cleanup scope');
+  }
+  const expectedStatus = value.supervisor_signal ? 128 + value.supervisor_signal
+    : value.signal ? 128 + value.signal : value.exit_code;
+  if (!integer(helperExitStatus, 0, 255) || helperExitStatus !== expectedStatus) {
+    fail('native completion does not match the observed helper exit status');
+  }
+  return Object.freeze(value);
+}

package/node_modules/@chati/core/src/darwin-supervisor-channels.js

@@ -0,0 +1,82 @@
+/** Own the private descriptors for one native Darwin supervisor invocation.
+ * This transport never chooses a helper/policy or signs authority. Its caller
+ * must spawn the attested helper and persist dispatch before authorize(). */
+import { closeSync, writeSync } from 'node:fs';
+import { createProcessInfoPipeSync, readProcessInfoPipeSync } from './descriptor-fs.js';
+import { darwinSupervisorNonce, parseDarwinReadyMessage, parseDarwinCompletionMessage } from './darwin-process.js';
+
+export function createDarwinSupervisorChannels(context) {
+  const nonce = darwinSupervisorNonce(context);
+  const owned = new Set();
+  let phase = 'prepared';
+  let ready;
+  function close(fd) {
+    if (!owned.delete(fd)) return;
+    closeSync(fd);
+  }
+  function dispose() {
+    if (phase === 'disposed') return false;
+    phase = 'disposed';
+    const errors = [];
+    for (const fd of owned) {
+      try { close(fd); } catch (error) { errors.push(error); }
+    }
+    if (errors.length) throw new AggregateError(errors, 'private supervisor descriptor cleanup failed');
+    return true;
+  }
+  function failAndDispose(error) {
+    try { dispose(); } catch (cleanupError) { error.cleanupError = cleanupError; }
+    throw error;
+  }
+  function requirePhase(expected) {
+    if (phase !== expected) throw Object.assign(new Error(`supervisor channel phase must be ${expected}, not ${phase}`), {
+      code: 'INVALID_DARWIN_SUPERVISOR_STATE',
+    });
+  }
+  function pipe() {
+    const pair = createProcessInfoPipeSync();
+    for (const fd of pair) owned.add(fd);
+    return pair;
+  }
+  let go; let readyPipe; let completion; let owner;
+  try { go = pipe(); readyPipe = pipe(); completion = pipe(); owner = pipe(); }
+  catch (error) { failAndDispose(error); }
+  const inheritedDescriptors = Object.freeze([go[0], readyPipe[1], completion[1], owner[0]]);
+  return Object.freeze({
+    nonce,
+    // Exact fd5..fd8 mapping. The caller supplies stdio, optional prompt and cwd.
+    inheritedDescriptors,
+    readReady(helperPid, cdhash) {
+      requirePhase('prepared');
+      phase = 'starting';
+      try {
+        // Close parent copies of child ends immediately after the real spawn.
+        // Otherwise our own READY/completion writer would prevent EOF forever.
+        for (const fd of inheritedDescriptors) close(fd);
+        ready = parseDarwinReadyMessage(readProcessInfoPipeSync(readyPipe[0], 10000), {
+          nonce, helper_pid: helperPid, verified_cdhash: cdhash,
+        });
+        close(readyPipe[0]);
+        phase = 'ready';
+        return ready;
+      } catch (error) { return failAndDispose(error); }
+    },
+    authorize() {
+      requirePhase('ready');
+      try {
+        // The caller's synchronous durable-dispatch callback precedes this.
+        // Owner lifetime stays open when this one-shot GO writer closes.
+        writeSync(go[1], 'G'); close(go[1]); phase = 'authorized';
+      } catch (error) { failAndDispose(error); }
+    },
+    readCompletion(helperExitStatus) {
+      requirePhase('authorized');
+      try {
+        const value = parseDarwinCompletionMessage(readProcessInfoPipeSync(completion[0], 5000), ready, helperExitStatus);
+        close(completion[0]); dispose();
+        return value;
+      } catch (error) { return failAndDispose(error); }
+    },
+    dispose,
+  });
+}

package/node_modules/@chati/core/src/darwin-terminal-receipt.js

@@ -0,0 +1,111 @@
+/** Typed Darwin terminal facts, not authentication or proof of all descendants'
+ * death. The authority must authenticate receipts before a consumer uses them. */
+import { posix } from 'node:path';
+import { canonicalize, sha256 } from './index.js';
+import { darwinSupervisorNonce, parseDarwinReadyMessage, parseDarwinCompletionMessage } from './darwin-process.js';
+import { assertDarwinHostBootIdentity } from './darwin-host-boot.js';
+
+const BINDING_KEYS = ['schema_version', 'helper_sha256', 'policy_digest', 'ready', 'write_scope', 'detached_descendants', 'host_boot_identity'];
+const IDENTITIES = ['authority_kind', 'invocation_id', 'launch_nonce', 'terminal_id', 'provider_id', 'harness_id',
+  'model_id', 'reasoning_configuration', 'provider_executable_path', 'provider_executable_sha256'];
+export const PROVIDER_CONTROL_PLANE_DIRECTORIES = Object.freeze(['.chati', '.chati.dev', '.claude', '.codex', '.grok', '.agents']);
+const ADMISSION_FIELDS = ['execution_admission_protocol', 'execution_admission_helper_sha256', 'execution_admission_receipt_digest'];
+function fail(message) { throw Object.assign(new Error(message), { code: 'INVALID_DARWIN_TERMINAL_RECEIPT' }); }
+function object(value) { return value && typeof value === 'object' && !Array.isArray(value); }
+function exact(value, keys) { return object(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key)); }
+function text(value) {
+  return typeof value === 'string' && value.trim() && Buffer.byteLength(value) <= 4096
+    && !Array.from(value).some(character => character.codePointAt(0) < 32 || character.codePointAt(0) === 127);
+}
+function digest(value) { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
+function path(value) { return text(value) && posix.isAbsolute(value) && posix.resolve(value) === value && value !== '/'; }
+function within(root, target) { const rel = posix.relative(root, target); return !rel || (rel !== '..' && !rel.startsWith('../') && !posix.isAbsolute(rel)); }
+function nativeRead(callback) {
+  try { return callback(); } catch (error) { fail(`invalid private native observation: ${error.message}`); }
+}
+function assertBinding(binding) {
+  if (!exact(binding, BINDING_KEYS) || binding.schema_version !== 1
+    || !digest(binding.helper_sha256) || !digest(binding.policy_digest)
+    || binding.detached_descendants !== 'unknown') fail('Darwin launch requires the complete closed native binding');
+  nativeRead(() => parseDarwinReadyMessage(`${JSON.stringify(binding.ready)}\n`, binding.ready));
+  nativeRead(() => assertDarwinHostBootIdentity(binding.host_boot_identity));
+  const scope = binding.write_scope;
+  if (!exact(scope, ['full_project', 'entries']) || typeof scope.full_project !== 'boolean'
+    || !Array.isArray(scope.entries) || scope.entries.length > 1024
+    || (scope.full_project && scope.entries.length)) fail('Darwin write scope must be explicit and unmixed');
+  const targets = new Set();
+  for (const entry of scope.entries) {
+    if (!exact(entry, ['target', 'kind']) || !path(entry.target) || !['file', 'directory'].includes(entry.kind)
+      || targets.has(entry.target)) fail('Darwin partial write scopes require distinct canonical targets');
+    targets.add(entry.target);
+  }
+}
+
+/** Shared by the actual spawner and contract tests. It cannot sign a receipt or
+ * turn caller-supplied values into an authenticated native observation. */
+export function createDarwinTerminalLaunchBinding({ helperSha256, policyDigest, ready, writeScopes, hostBootIdentity }) {
+  if (!writeScopes || !Array.isArray(writeScopes.entries)) fail('prepared native write scopes are required');
+  const binding = {
+    schema_version: 1, helper_sha256: helperSha256, policy_digest: policyDigest, ready, host_boot_identity: hostBootIdentity,
+    write_scope: { full_project: writeScopes.fullProject,
+      entries: writeScopes.entries.map(({ target, kind }) => ({ target, kind })) },
+    detached_descendants: 'unknown',
+  };
+  assertBinding(binding);
+  return Object.freeze(canonicalize(binding));
+}
+
+export function assertDarwinTerminalLaunch(receipt) {
+  if (!object(receipt) || receipt.schema_version !== 1 || receipt.purpose !== 'terminal_launch'
+    || receipt.process_containment_kind !== 'darwin_scoped_process_group_v1'
+    || !['rail_execution', 'rail_review', 'rail_adjudication', 'planning_execution', 'council_gate'].includes(receipt.authority_kind)
+    || IDENTITIES.some(key => !text(receipt[key]))
+    || !Number.isInteger(receipt.process_pid) || receipt.process_pid < 2 || receipt.process_pid > 0x7fffffff
+    || receipt.process_group_id !== receipt.process_pid || !text(receipt.process_hostname)
+    || receipt.process_containment_id !== `darwin:${receipt.terminal_id}`
+    || !path(receipt.working_dir) || !path(receipt.provider_executable_path)
+    || ['provider_executable_sha256', 'process_containment_digest', 'project_identity_digest', 'command_digest'].some(key => !digest(receipt[key]))
+    || Object.hasOwn(receipt, 'process_namespace_identity')) fail('Darwin launch identity or containment variant is incomplete');
+  const binding = receipt.darwin_launch_binding;
+  assertBinding(binding);
+  nativeRead(() => parseDarwinReadyMessage(`${JSON.stringify(binding.ready)}\n`, {
+    nonce: darwinSupervisorNonce(receipt), helper_pid: receipt.process_pid, verified_cdhash: binding.ready.verified_cdhash,
+  }));
+  for (const entry of binding.write_scope.entries) {
+    if (entry.target === receipt.working_dir || !within(receipt.working_dir, entry.target)
+      || PROVIDER_CONTROL_PLANE_DIRECTORIES.some(name => {
+        const control = posix.join(receipt.working_dir, name);
+        return within(control, entry.target) || within(entry.target, control);
+      })) fail('Darwin write scope escapes the product or overlaps the control plane');
+  }
+  if (receipt.authority_kind === 'rail_execution') {
+    if (receipt.execution_admission_protocol !== 'native-positive-go-v1'
+      || receipt.execution_admission_helper_sha256 !== binding.helper_sha256
+      || !digest(receipt.execution_admission_receipt_digest)) fail('Darwin execution must bind its exact positive-GO admission helper');
+  } else {
+    if (ADMISSION_FIELDS.some(key => Object.hasOwn(receipt, key))) fail('Only RAIL execution may carry execution admission');
+    if (binding.write_scope.full_project
+      || (receipt.authority_kind !== 'planning_execution' && binding.write_scope.entries.length)) {
+      fail('Darwin Planning requires partial product scope; review, adjudication and council require readonly scope');
+    }
+  }
+  return true;
+}
+
+export function assertDarwinTerminalCompletion(receipt, launch) {
+  assertDarwinTerminalLaunch(launch);
+  if (!object(receipt) || receipt.schema_version !== 1 || receipt.purpose !== 'terminal_completion'
+    || IDENTITIES.some(key => receipt[key] !== launch[key])
+    || receipt.launch_receipt_digest !== sha256(launch)
+    || receipt.darwin_launch_binding_digest !== sha256(launch.darwin_launch_binding)
+    || Object.hasOwn(receipt, 'process_namespace_identity_digest') || Object.hasOwn(receipt, 'process_namespace_identity')
+    || !digest(receipt.stdout_digest) || !digest(receipt.stderr_digest)
+    || receipt.process_time_kind !== 'provider-invocation-wall-time'
+    || !Number.isFinite(receipt.process_elapsed_ms) || receipt.process_elapsed_ms < 0
+    || typeof receipt.completed_at !== 'string'
+    || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(receipt.completed_at)
+    || !Number.isFinite(Date.parse(receipt.completed_at))) fail('Darwin completion must bind its canonical launch and observed output/time');
+  nativeRead(() => parseDarwinCompletionMessage(`${JSON.stringify(receipt.darwin_completion_observation)}\n`,
+    launch.darwin_launch_binding.ready, receipt.exit_status));
+  return true;
+}