codex-workflow-v2 2.0.0-beta.13.9 → 2.0.0-beta.14.1

package/src/historical-step-provenance.ts

@@ -0,0 +1,136 @@
+import type {
+  HistoricalStepProvenanceRecoveryPreflight,
+  TaskState,
+} from './contracts.js';
+import { changedFiles, currentBranch, headCommit, runGit } from './repository.js';
+
+export interface HistoricalStepProvenanceEnvironment {
+  activeLeaseCount: number;
+  staleLeaseCount: number;
+  pendingTransactionCount: number;
+  corruptTransactionCount: number;
+  coreOperationCount: number;
+  verifiedHistoricalStepBindings: Array<{
+    stepId: string;
+    commitSha: string;
+    planHash: string;
+    recordedAt: string;
+  }>;
+}
+
+export interface HistoricalStepProvenanceInspectionOptions {
+  historyBoundary?: string;
+  preservedHeadCommit?: string;
+}
+
+export function omittedStepEvidenceCommits(
+  task: TaskState,
+  nextSteps: ReadonlyArray<Pick<TaskState['steps'][number], 'evidence'>>,
+): string[] {
+  const retainedByCurrentPlan = new Set(nextSteps.flatMap((step) =>
+    step.evidence ? [step.evidence.commitSha] : []));
+  return [...new Set(task.steps.flatMap((step) =>
+    step.evidence && !retainedByCurrentPlan.has(step.evidence.commitSha)
+      ? [step.evidence.commitSha]
+      : []))];
+}
+
+export function inspectHistoricalStepProvenanceRecovery(
+  repositoryRoot: string,
+  task: TaskState,
+  environment: HistoricalStepProvenanceEnvironment,
+  options: HistoricalStepProvenanceInspectionOptions = {},
+): HistoricalStepProvenanceRecoveryPreflight {
+  const blockers: string[] = [];
+  const dirty = changedFiles(repositoryRoot);
+  const historyBoundary = options.historyBoundary ?? 'HEAD';
+  const head = options.preservedHeadCommit ?? headCommit(repositoryRoot);
+  const activeSteps = task.steps.filter((step) => step.status === 'in_progress');
+  const activeStep = activeSteps.length === 1 ? activeSteps[0]! : null;
+
+  if (task.status !== 'in_progress') blockers.push('The Task must be in progress.');
+  if (activeSteps.length !== 1) blockers.push('Exactly one Step must be in progress.');
+  if (activeStep && dirty.some((file) => !activeStep.allowedWrites.includes(file))) {
+    blockers.push('Dirty files must remain confined to the active Step allowedWrites.');
+  }
+  if (task.workspaceOwner !== 'local') blockers.push('Recovery is limited to a local Task workspace.');
+  if (!task.taskBranch || currentBranch(repositoryRoot) !== task.taskBranch) {
+    blockers.push('The current branch must be the recorded Task branch.');
+  }
+  if (!task.baseCommit) blockers.push('The Task must have a recorded base commit.');
+  if (!task.planHash) blockers.push('The Task must have a current Plan hash.');
+  if (environment.activeLeaseCount > 0) blockers.push('No active writer lease may exist.');
+  if (environment.staleLeaseCount > 0) blockers.push('No stale writer lease may exist.');
+  if (environment.pendingTransactionCount > 0) blockers.push('No pending Workflow transaction may exist.');
+  if (environment.corruptTransactionCount > 0) blockers.push('No corrupt Workflow transaction may exist.');
+  if (environment.coreOperationCount > 0) blockers.push('No Core Task operation may exist.');
+
+  let candidate: string | null = null;
+  let sourceFinalAcceptanceRecordedAt: string | null = null;
+  if (task.baseCommit) {
+    try {
+      const output = runGit(repositoryRoot, ['rev-list', '--reverse', `${task.baseCommit}..${historyBoundary}`]);
+      const actual = output ? output.split('\n') : [];
+      const expected = [...new Set([
+        ...task.steps.flatMap((step) => (step.evidence ? [step.evidence.commitSha] : [])),
+        ...task.systemCommits,
+        ...(task.invalidatedStepCommits ?? []),
+        ...(task.dependencyProvenanceRecoveries ?? []).flatMap((recovery) => recovery.retainedHistoricalCommits ?? []),
+      ])];
+      const missing = expected.filter((commit) => !actual.includes(commit));
+      const unexpected = actual.filter((commit) => !expected.includes(commit));
+      if (missing.length > 0) blockers.push('Recorded Task history contains missing commits.');
+      if (unexpected.length !== 1) blockers.push('Recovery requires exactly one unregistered historical commit.');
+      candidate = unexpected.length === 1 ? unexpected[0]! : null;
+      const verifiedBindings = candidate
+        ? environment.verifiedHistoricalStepBindings.filter((binding) => binding.commitSha === candidate)
+        : [];
+      if (verifiedBindings.length === 0) {
+        blockers.push('The historical commit lacks a complete passed strict Step Review chain.');
+      }
+      const finalAcceptance = candidate
+        ? task.authorizations.find((authorization) =>
+            authorization.kind === 'final_acceptance'
+            && ['approved', 'superseded'].includes(authorization.decision)
+            && authorization.headCommit === candidate
+            && authorization.planHash
+            && authorization.resultHash
+            && authorization.evidenceHash)
+        : null;
+      if (!finalAcceptance) {
+        blockers.push('The historical commit lacks a hash-bound prior final acceptance.');
+      } else {
+        sourceFinalAcceptanceRecordedAt = finalAcceptance.recordedAt;
+        if (!verifiedBindings.some((binding) =>
+          binding.planHash === finalAcceptance.planHash
+          && binding.recordedAt <= finalAcceptance.recordedAt)) {
+          blockers.push('The prior final acceptance does not bind the passed historical Step Review Plan.');
+        }
+      }
+      if (candidate) {
+        const subject = runGit(repositoryRoot, ['show', '-s', '--format=%s', candidate]);
+        if (!subject.startsWith(`${task.id}/STEP-`)) {
+          blockers.push('The historical commit subject is not bound to this Task and a Step.');
+        }
+      }
+    } catch {
+      blockers.push('The Task history could not be inspected.');
+    }
+  }
+
+  return {
+    eligible: blockers.length === 0,
+    action: blockers.length === 0 ? 'task historical-step-provenance-recover' : null,
+    projectId: task.projectId,
+    taskId: task.id,
+    taskRevision: task.revision,
+    briefHash: task.briefHash,
+    planHash: task.planHash,
+    headCommit: head,
+    activeStepId: activeStep?.id ?? null,
+    dirtyFiles: dirty,
+    commitSha: blockers.length === 0 ? candidate : null,
+    sourceFinalAcceptanceRecordedAt: blockers.length === 0 ? sourceFinalAcceptanceRecordedAt : null,
+    blockers,
+  };
+}

package/src/index.ts

@@ -0,0 +1,23 @@
+export * from './contracts.js';
+export * from './errors.js';
+export * from './diagnostics.js';
+export * from './delegation.js';
+export * from './graph.js';
+export * from './memory.js';
+export * from './migration.js';
+export * from './repository.js';
+export * from './reviewer.js';
+export * from './observed-routes.js';
+export * from './operational-contract.js';
+export * from './state/store.js';
+export * from './workflow.js';
+export * from './version.js';
+export * from './lifecycle/index.js';
+export * from './alpha7/autonomy.js';
+export * from './alpha6/mechanical-feasibility.js';
+export { defaultTaskWorkerActor } from './alpha6/handoff.js';
+export { defaultCorrectiveAuditorActor } from './alpha6/remediation.js';
+export type { AdoptionPreparation } from './alpha6/adoption.js';
+export type { RecordPlanRiskAuditInput } from './alpha6/plan-risk.js';
+
+export type { CheckExecutionOptions } from './checks/runner.js';

package/src/lifecycle/canonical-hash.ts

@@ -0,0 +1,28 @@
+import { createHash } from 'node:crypto';
+
+type JsonPrimitive = boolean | null | number | string;
+export type CanonicalJsonValue = JsonPrimitive | CanonicalJsonValue[] | { [key: string]: CanonicalJsonValue };
+
+const EDITORIAL_KEYS = new Set(['description']);
+
+export function hashCanonical(value: unknown): string {
+  return createHash('sha256').update(JSON.stringify(canonicalize(value))).digest('hex');
+}
+
+function canonicalize(value: unknown): CanonicalJsonValue {
+  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new TypeError('Canonical hashes do not support non-finite numbers.');
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((entry) => canonicalize(entry));
+  if (typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value)
+        .filter(([key, entry]) => entry !== undefined && !EDITORIAL_KEYS.has(key))
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, canonicalize(entry)]),
+    );
+  }
+  throw new TypeError(`Unsupported canonical hash value: ${typeof value}`);
+}

package/src/lifecycle/catalog.ts

@@ -0,0 +1,202 @@
+import {
+  catalogDefinitionManifestHash, hashCanonical, runtimeCatalogHash, runtimeSemanticFingerprint,
+  transitionDefinitionManifestHash,
+} from './fingerprint.js';
+import { transitionSemanticRegistry } from './semantic-registry.js';
+import {
+  TRANSITION_DEFINITION_FORMAT_VERSION,
+  type EffectCondition, type ExecutableTransitionDefinition, type GuardId, type RegisteredRef,
+  type SerializedTransitionDefinition, type TransitionDefinitionMetadata,
+  type TransitionEffectNode, type TransitionId, type VersionedRegistryEntry,
+} from './types.js';
+
+type AnyDefinition = ExecutableTransitionDefinition<unknown, unknown>;
+type DefinitionLike = AnyDefinition | SerializedTransitionDefinition | TransitionDefinitionMetadata;
+
+export type TransitionSemanticValidationRuleId =
+  | 'validation.atomicity.contract-invalid' | 'validation.definition.format-invalid'
+  | 'validation.definition.manifest-mismatch' | 'validation.effect.graph-invalid'
+  | 'validation.fingerprint.alias-mismatch' | 'validation.fingerprint.runtime-mismatch'
+  | 'validation.guard.evaluator-mismatch' | 'validation.guard.namespace-invalid'
+  | 'validation.namespace.transition-invalid' | 'validation.race.revalidation-invalid'
+  | 'validation.reference.unresolved' | 'validation.semantic-id.duplicate';
+
+export interface TransitionSemanticValidationIssue {
+  readonly ruleId: TransitionSemanticValidationRuleId;
+  readonly path: string;
+  readonly ref?: string;
+  readonly message: string;
+}
+
+export interface TransitionSemanticValidationReport {
+  readonly valid: boolean;
+  readonly issues: readonly TransitionSemanticValidationIssue[];
+  readonly reportHash: string;
+}
+
+export class GuardedTransitionCatalog {
+  readonly #definitions: ReadonlyMap<TransitionId, AnyDefinition>;
+  readonly catalogHash: string;
+  readonly catalogDefinitionManifestHash: string;
+
+  constructor(definitions: readonly AnyDefinition[]) {
+    const indexed = new Map<TransitionId, AnyDefinition>();
+    for (const definition of definitions) {
+      const id = definition.metadata.transitionId;
+      if (indexed.has(id)) throw new TypeError(`validation.semantic-id.duplicate ${id}`);
+      const semantic = validateTransitionDefinitionSemantics(definition);
+      if (!semantic.valid) throw new TypeError(`${semantic.issues[0]!.ruleId} ${id}: ${semantic.issues[0]!.message}`);
+      if (definition.guards.length !== definition.metadata.guards.length
+        || definition.guards.some((guard, index) => guard.metadata.guardId !== definition.metadata.guards[index]?.guardId)) {
+        throw new TypeError(`validation.guard.evaluator-mismatch ${id}`);
+      }
+      indexed.set(id, definition);
+    }
+    this.#definitions = indexed;
+    this.catalogHash = runtimeCatalogHash(this.serialize());
+    this.catalogDefinitionManifestHash = catalogDefinitionManifestHash(this.serialize());
+  }
+
+  has(id: TransitionId): boolean { return this.#definitions.has(id); }
+  get<TSnapshot, TBindings>(id: TransitionId): ExecutableTransitionDefinition<TSnapshot, TBindings> {
+    const definition = this.#definitions.get(id);
+    if (!definition) throw new TypeError(`Unknown transition definition: ${id}`);
+    return definition as ExecutableTransitionDefinition<TSnapshot, TBindings>;
+  }
+  serialize(): SerializedTransitionDefinition[] {
+    return structuredClone([...this.#definitions.values()].map((definition) => ({
+      ...definition.metadata,
+      runtimeSemanticFingerprint: definition.runtimeSemanticFingerprint,
+      semanticFingerprint: definition.semanticFingerprint,
+      definitionManifestHash: definition.definitionManifestHash,
+    })).sort((left, right) => left.transitionId.localeCompare(right.transitionId)));
+  }
+}
+
+export function validateTransitionDefinitionSemantics(definition: DefinitionLike): TransitionSemanticValidationReport {
+  const issues: TransitionSemanticValidationIssue[] = [];
+  let unpacked: ReturnType<typeof unpack>;
+  try { unpacked = unpack(definition); }
+  catch (error) { issue(issues, 'validation.reference.unresolved', '/', message(error)); return report(issues); }
+  const metadata = unpacked.metadata;
+  if (metadata.definitionFormatVersion !== TRANSITION_DEFINITION_FORMAT_VERSION) issue(issues, 'validation.definition.format-invalid', '/definitionFormatVersion', 'Definition format must be 4.');
+  const namespace = metadata.entity === 'step' ? 'task' : metadata.entity === 'project-memory' ? 'project' : metadata.entity;
+  if (!metadata.transitionId.startsWith(`${namespace}.`)) issue(issues, 'validation.namespace.transition-invalid', '/transitionId', 'Transition namespace does not match entity.', metadata.transitionId);
+  if (!metadata.guardNamespace.startsWith(`${namespace}.`)) issue(issues, 'validation.guard.namespace-invalid', '/guardNamespace', 'Guard namespace does not match entity.');
+  let runtime = '';
+  try { runtime = runtimeSemanticFingerprint(metadata); }
+  catch (error) { issue(issues, 'validation.reference.unresolved', referencePath(error, metadata), message(error), referenceKey(error)); }
+  if (unpacked.runtime && runtime && unpacked.runtime !== runtime) issue(issues, 'validation.fingerprint.runtime-mismatch', '/runtimeSemanticFingerprint', 'Runtime fingerprint is stale.');
+  if (unpacked.semantic && unpacked.semantic !== unpacked.runtime) issue(issues, 'validation.fingerprint.alias-mismatch', '/semanticFingerprint', 'Deprecated alias is stale.');
+  try {
+    const manifest = transitionDefinitionManifestHash(metadata, runtime);
+    if (unpacked.manifest && unpacked.manifest !== manifest) issue(issues, 'validation.definition.manifest-mismatch', '/definitionManifestHash', 'Definition manifest is stale.');
+  } catch (error) { issue(issues, 'validation.reference.unresolved', '/readinessManifest', message(error), referenceKey(error)); }
+  const inputRefs = new Set(metadata.inputContract.map((entry) => refKey(entry.input)));
+  unique(metadata.inputContract.map((entry) => refKey(entry.input)), '/inputContract', issues);
+  const guards = new Map<GuardId, TransitionDefinitionMetadata['guards'][number]>();
+  metadata.guards.forEach((guard, index) => {
+    if (!guard.guardId.startsWith(`${metadata.guardNamespace}.`)) issue(issues, 'validation.guard.namespace-invalid', `/guards/${index}/guardId`, 'Guard is outside namespace.');
+    if (guards.has(guard.guardId)) issue(issues, 'validation.semantic-id.duplicate', `/guards/${index}/guardId`, 'Duplicate guard.', guard.guardId);
+    guards.set(guard.guardId, guard);
+    const evaluator = exactRef(transitionSemanticRegistry.guardEvaluators, guard.evaluator);
+    if (!evaluator) issue(issues, 'validation.reference.unresolved', `/guards/${index}/evaluator`, 'Guard evaluator is unresolved.', refKey(guard.evaluator));
+    else if (evaluator.transitionId !== metadata.transitionId || evaluator.guardId !== guard.guardId) issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/evaluator`, 'Evaluator does not bind this guard.', refKey(guard.evaluator));
+    guard.requiredInputs.forEach((input) => {
+      if (!inputRefs.has(refKey(input))) issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/requiredInputs`, 'Guard input is outside contract.', refKey(input));
+    });
+  });
+  metadata.inputContract.forEach((entry, index) => {
+    if (entry.required && !metadata.guards.some((guard) => guard.requiredInputs.some((input) => refKey(input) === refKey(entry.input)))) issue(issues, 'validation.guard.evaluator-mismatch', `/inputContract/${index}`, 'Required input has no guard.', refKey(entry.input));
+  });
+  validateEffects(metadata, guards, inputRefs, issues);
+  validateRaces(metadata, guards, issues);
+  validateAtomicity(metadata, issues);
+  return report(issues);
+}
+
+function validateEffects(metadata: TransitionDefinitionMetadata, guards: ReadonlyMap<GuardId, unknown>, inputs: ReadonlySet<string>, issues: TransitionSemanticValidationIssue[]): void {
+  const nodes = metadata.effects.orderedNodes;
+  unique(nodes.map((node) => node.effectId), '/effects/orderedNodes', issues);
+  const byId = new Map(nodes.map((node) => [node.effectId, node]));
+  nodes.forEach((node, index) => {
+    if (node.ordinal !== index) issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/ordinal`, 'Effect ordinals are not contiguous.');
+    node.dependsOn.forEach((dependency) => {
+      if (!byId.has(dependency) || dependency === node.effectId || depends(byId.get(dependency), node.effectId, byId)) issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/dependsOn`, 'Effect graph is cyclic or unresolved.', dependency);
+    });
+    node.conditions.forEach((condition, conditionIndex) => validateCondition(condition, `/effects/orderedNodes/${index}/conditions/${conditionIndex}`, guards, inputs, issues));
+  });
+  unique(metadata.effects.postconditions.map((entry) => entry.postconditionId), '/effects/postconditions', issues);
+  metadata.effects.postconditions.forEach((entry, index) => {
+    if (entry.effectNodeIds.length === 0 || entry.effectNodeIds.some((id) => !byId.has(id))) issue(issues, 'validation.effect.graph-invalid', `/effects/postconditions/${index}/effectNodeIds`, 'Postcondition does not bind effects.');
+  });
+}
+
+function validateCondition(condition: EffectCondition, path: string, guards: ReadonlyMap<GuardId, unknown>, inputs: ReadonlySet<string>, issues: TransitionSemanticValidationIssue[]): void {
+  if (condition.kind === 'input-present' ? !inputs.has(refKey(condition.input)) : !guards.has(condition.guardId)) issue(issues, 'validation.effect.graph-invalid', path, 'Effect condition is unresolved.');
+}
+
+function validateRaces(metadata: TransitionDefinitionMetadata, guards: ReadonlyMap<GuardId, TransitionDefinitionMetadata['guards'][number]>, issues: TransitionSemanticValidationIssue[]): void {
+  unique(metadata.admissionBoundary.orderedRevalidations.map((entry) => entry.revalidationId), '/admissionBoundary/orderedRevalidations', issues);
+  unique(metadata.racePreconditions.map((entry) => entry.raceId), '/racePreconditions', issues);
+  metadata.admissionBoundary.orderedRevalidations.forEach((entry, index) => {
+    const race = metadata.racePreconditions.filter((candidate) => candidate.raceId === entry.raceId && candidate.revalidationId === entry.revalidationId);
+    const guard = guards.get(entry.guardId);
+    if (entry.ordinal !== index || race.length !== 1 || race[0]!.guardId !== entry.guardId || !guard || refKey(guard.evaluator) !== refKey(entry.evaluator)) issue(issues, 'validation.race.revalidation-invalid', `/admissionBoundary/orderedRevalidations/${index}`, 'Race and revalidation are not exact.', entry.raceId);
+  });
+}
+
+function validateAtomicity(metadata: TransitionDefinitionMetadata, issues: TransitionSemanticValidationIssue[]): void {
+  const atomicity = metadata.atomicity;
+  const writes = metadata.effects.orderedNodes.filter((entry) => entry.operation !== 'preserve').length;
+  if (atomicity.classification === 'single-write' && writes !== 1) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'single-write requires exactly one write.');
+  if (atomicity.classification === 'read-only' && writes !== 0) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'read-only cannot write.');
+  if (atomicity.classification.includes('multi-write') && writes < 2) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'multi-write requires multiple writes.');
+  if (atomicity.classification === 'non-transactional-multi-write' && atomicity.journal.mode !== 'none') issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/journal', 'Nontransactional write cannot claim journal.');
+  const postconditions = new Set(metadata.effects.postconditions.map((entry) => entry.postconditionId));
+  if (atomicity.readback.postconditionIds.length !== postconditions.size || atomicity.readback.postconditionIds.some((id) => !postconditions.has(id))) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/readback/postconditionIds', 'Readback does not cover postconditions.');
+}
+
+function unpack(definition: DefinitionLike) {
+  if ('metadata' in definition) return { metadata: definition.metadata, runtime: definition.runtimeSemanticFingerprint, semantic: definition.semanticFingerprint, manifest: definition.definitionManifestHash };
+  if ('runtimeSemanticFingerprint' in definition) {
+    const { runtimeSemanticFingerprint: runtime, semanticFingerprint: semantic, definitionManifestHash: manifest, ...metadata } = definition;
+    return { metadata, runtime, semantic, manifest };
+  }
+  return { metadata: definition, runtime: null, semantic: null, manifest: null };
+}
+
+function exactRef<T extends VersionedRegistryEntry<string>>(entries: readonly T[], ref: RegisteredRef<string>): T | undefined {
+  const matches = entries.filter((entry) => refKey(entry) === refKey(ref));
+  return matches.length === 1 ? matches[0] : undefined;
+}
+function referencePath(error: unknown, metadata: TransitionDefinitionMetadata): string {
+  const key = referenceKey(error); return key ? referencePaths(metadata).get(key) ?? '/' : '/';
+}
+function referencePaths(root: unknown): Map<string, string> {
+  const result = new Map<string, string>(); visit(root, ''); return result;
+  function visit(value: unknown, path: string): void {
+    if (Array.isArray(value)) return value.forEach((entry, index) => visit(entry, `${path}/${index}`));
+    if (value === null || typeof value !== 'object') return;
+    const candidate = value as Record<string, unknown>;
+    if (typeof candidate.id === 'string' && Number.isInteger(candidate.version)) result.set(`${candidate.id}@${candidate.version}`, path || '/');
+    Object.entries(candidate).forEach(([key, entry]) => visit(entry, `${path}/${key}`));
+  }
+}
+function referenceKey(error: unknown): string | undefined { return error instanceof Error ? (error as Error & { ref?: string }).ref : undefined; }
+function refKey(ref: RegisteredRef<string>): string { return `${ref.id}@${ref.version}`; }
+function message(error: unknown): string { return error instanceof Error ? error.message : String(error); }
+function unique(values: readonly string[], path: string, issues: TransitionSemanticValidationIssue[]): void {
+  if (new Set(values).size !== values.length) issue(issues, 'validation.semantic-id.duplicate', path, 'Semantic IDs must be unique.');
+}
+function depends(node: TransitionEffectNode | undefined, target: string, nodes: ReadonlyMap<string, TransitionEffectNode>, seen = new Set<string>()): boolean {
+  if (!node) return false;
+  return node.dependsOn.some((id) => id === target || (!seen.has(id) && (seen.add(id), depends(nodes.get(id), target, nodes, seen))));
+}
+function issue(issues: TransitionSemanticValidationIssue[], ruleId: TransitionSemanticValidationRuleId, path: string, message: string, ref?: string): void {
+  issues.push(ref === undefined ? { ruleId, path, message } : { ruleId, path, message, ref });
+}
+function report(issues: readonly TransitionSemanticValidationIssue[]): TransitionSemanticValidationReport {
+  const ordered = [...issues].sort((left, right) => `${left.path}\0${left.ruleId}\0${left.ref ?? ''}`.localeCompare(`${right.path}\0${right.ruleId}\0${right.ref ?? ''}`));
+  const content = { valid: ordered.length === 0, issues: ordered }; return { ...content, reportHash: hashCanonical(content) };
+}

package/src/lifecycle/compiler-inspection.ts

@@ -0,0 +1,29 @@
+import { diagnoseCoreIssuanceClosure, inspectCorePrivateIr, installedTransitionExecutableBindings } from '../transition-core.js';
+import { validateTransitionDefinitionSemantics } from './catalog.js';
+import { assessCorrectiveReplanAuthorityTuple, installedAuthoritySemanticBindings, projectAuthoritySemanticBundle } from './corrective-replan-authority.js';
+import { correctiveReplanCredentialInspection } from './corrective-replan-credentials.js';
+import { installedCoreRuleBindings } from './core-static-readiness.js';
+import { runtimeSemanticFingerprint, transitionDefinitionManifestHash } from './fingerprint.js';
+import { installedPayloadSchemaArtifacts, installedPayloadSchemaValidators } from './schema-artifact.js';
+import { transitionSemanticRegistry } from './semantic-registry.js';
+
+export const installedCoreRuleBindingsForTests = installedCoreRuleBindings;
+export const installedAuthoritySemanticBindingsForTests = installedAuthoritySemanticBindings;
+export const installedTransitionExecutableBindingsForTests = installedTransitionExecutableBindings;
+export const installedPayloadSchemaArtifactsForTests = installedPayloadSchemaArtifacts;
+export const installedPayloadSchemaValidatorsForTests = installedPayloadSchemaValidators;
+export const installedSemanticRegistryForTests = transitionSemanticRegistry;
+export const inspectCorePrivateIrForTests = inspectCorePrivateIr;
+export const diagnoseCoreIssuanceClosureForTests = diagnoseCoreIssuanceClosure;
+export const assessCorrectiveReplanAuthorityTupleForTests = assessCorrectiveReplanAuthorityTuple;
+export const projectAuthoritySemanticBundleForTests = projectAuthoritySemanticBundle;
+export const correctiveReplanCredentialInspectionForTests = correctiveReplanCredentialInspection;
+export function runtimeSemanticFingerprintForInspection(metadata: unknown) {
+  return runtimeSemanticFingerprint(metadata as Parameters<typeof runtimeSemanticFingerprint>[0]);
+}
+export function definitionManifestHashForInspection(metadata: unknown, runtime?: string) {
+  return transitionDefinitionManifestHash(metadata as Parameters<typeof transitionDefinitionManifestHash>[0], runtime);
+}
+export function validateTransitionDefinitionForInspection(raw: unknown) {
+  return validateTransitionDefinitionSemantics(raw as never);
+}

package/src/lifecycle/core-static-readiness.ts

@@ -0,0 +1,132 @@
+import { runtimeSemanticProjection } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+import { coreReleaseRuleDescriptors } from './implementation-table.js';
+import type { CoreReleaseRuleBinding, CoreReleaseRuleContext, RegisteredRef } from './types.js';
+
+type RecordValue = Readonly<Record<string, unknown>>;
+
+const ruleFunctions = [definitionIntegrity, exactAuthority, requiredInputs, admissionBoundary, reliableEffects] as const;
+
+export const installedCoreRuleBindings: readonly CoreReleaseRuleBinding[] = deepFreeze(
+  coreReleaseRuleDescriptors.map(([id, suffix], index) => ({
+    id, version: 1,
+    implementationId: `implementation.release-rule.${suffix}`,
+    implementationVersion: 1,
+    callable: ruleFunctions[index]!,
+  })),
+);
+
+export function projectReleaseRuleContextForCore(raw: unknown, ruleId: string): CoreReleaseRuleContext {
+  const source = raw as Record<string, unknown>;
+  const metadata = Object.fromEntries(Object.entries(source)
+    .filter(([key]) => !['runtimeSemanticFingerprint', 'semanticFingerprint', 'definitionManifestHash'].includes(key)));
+  const closure = runtimeSemanticProjection(metadata as never).resolvedRegistryEntries as {
+    category: string; entry: Record<string, unknown>;
+  }[];
+  const entries = (category: string) => closure.filter((entry) => entry.category === category).map(({ entry }) => entry);
+  const guards = () => rows(metadata.guards).map((guard) => ({ guardId: guard.guardId }));
+  if (ruleId === 'semantic-rule.definition-integrity') return context({ guards: guards() });
+  if (ruleId === 'semantic-rule.exact-authority') {
+    const authority = record(metadata.authority); const actor = record(authority.actor); const principal = record(authority.principal);
+    return context({ authority: { actor: { required: actor.required, identity: ref(actor.identity) }, principal: { identity: ref(principal.identity) },
+      capabilities: presence(authority.capabilities), credentials: presence(authority.credentials), separationOfDuty: presence(authority.separationOfDuty),
+      forbiddenCombinations: presence(authority.forbiddenCombinations),
+      ownership: ref(authority.ownership), eligibleRoles: presence(authority.eligibleRoles) }, guards: guards() }, {
+      capabilities: presence(entries('capabilities')), credentialPolicies: presence(entries('credentialPolicies')),
+      identityComparators: presence(entries('identityComparators')), ownershipPolicies: entries('ownershipPolicies').map((entry) => ({ id: entry.id, version: entry.version, c1Ownership: entry.c1Ownership, writerLease: entry.writerLease })),
+    });
+  }
+  if (ruleId === 'semantic-rule.required-inputs') return context({ inputContract: rows(metadata.inputContract).map((entry) => ({ required: entry.required, input: ref(entry.input) })), guards: rows(metadata.guards).map((guard) => ({ requiredInputs: rows(guard.requiredInputs).map(ref) })) });
+  if (ruleId === 'semantic-rule.admission-boundary') { const boundary = record(metadata.admissionBoundary); return context({ admissionBoundary: {
+    lock: { policy: ref(record(boundary.lock).policy) },
+    orderedRevalidations: rows(boundary.orderedRevalidations).map((entry) => ({ underLock: entry.underLock })),
+    firstEffectAfterRevalidation: boundary.firstEffectAfterRevalidation, release: boundary.release,
+  } }, { lockPolicies: entries('lockPolicies').map((entry) => ({ id: entry.id, version: entry.version, lockKind: entry.lockKind })) }); }
+  if (ruleId === 'semantic-rule.reliable-effects') { const atomicity = record(metadata.atomicity); const readback = record(atomicity.readback); return context({ atomicity: {
+    classification: atomicity.classification, nonMutatingFailureGuarantee: atomicity.nonMutatingFailureGuarantee,
+    readback: { adapter: ref(readback.adapter), wiring: readback.wiring, checkpoints: record(readback.checkpoints) },
+    journal: { mode: record(atomicity.journal).mode }, recovery: { mode: record(atomicity.recovery).mode, trigger: record(atomicity.recovery).trigger },
+  } }, { readbackAdapters: entries('readbackAdapters').map((entry) => ({ id: entry.id, version: entry.version, wiring: entry.wiring })) }); }
+  throw new TypeError(`No installed Core context projection for ${ruleId}.`);
+}
+
+export function evaluateInstalledReleaseRulesForCore(
+  bindings: readonly (CoreReleaseRuleBinding & { readonly context: CoreReleaseRuleContext })[],
+): readonly string[] {
+  return [...new Set(bindings.flatMap((binding) => binding.callable(binding.context)))].sort();
+}
+
+function definitionIntegrity({ transition }: CoreReleaseRuleContext): readonly string[] {
+  const guards = new Set(array(transition.guards).map((guard) => String(guard.guardId)));
+  const required = ['actor-role-eligible', 'no-c1-claim', 'no-writer-lease', 'plan-validation-passed', 'receipt-valid', 'risk-audit-passed']
+    .map((suffix) => `task.corrective-replan.${suffix}`);
+  return required.every((guard) => guards.has(guard)) ? [] : ['static.definition.mandatory-guard-incomplete'];
+}
+
+function exactAuthority({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const authority = transition.authority as RecordValue;
+  const actor = authority.actor as RecordValue;
+  const principal = authority.principal as RecordValue;
+  const blockers: string[] = [];
+  if (actor.required !== true || refText(actor.identity) !== 'identity.actor@1'
+    || refText(principal.identity) !== 'identity.human-principal@1') blockers.push('static.authority.actor-unbound');
+  if (array(authority.capabilities).length === 0 || array(registry.capabilities).length === 0) blockers.push('static.authority.exact-capability-missing');
+  if (array(authority.credentials).length === 0 || array(registry.credentialPolicies).length === 0) blockers.push('static.authority.exact-credential-missing');
+  if (array(authority.separationOfDuty).length !== 2 || array(authority.forbiddenCombinations).length !== 1
+    || array(registry.identityComparators).length !== 3) blockers.push('static.authority.sod-unenforced');
+  const ownership = array(registry.ownershipPolicies).find((entry) => refText(entry) === refText(authority.ownership));
+  if (!ownership || ownership.c1Ownership === 'unchecked' || ownership.writerLease === 'unchecked') blockers.push('static.authority.ownership-unchecked');
+  if (array(authority.eligibleRoles).length === 0 || !array(transition.guards)
+    .some((guard) => guard.guardId === 'task.corrective-replan.actor-role-eligible')) blockers.push('static.authority.role-eligibility-unenforced');
+  return blockers;
+}
+
+function requiredInputs({ transition }: CoreReleaseRuleContext): readonly string[] {
+  const inputs = new Set(array(transition.inputContract).filter((entry) => entry.required === true).map((entry) => refText(entry.input)));
+  const guarded = new Set(array(transition.guards).flatMap((guard) => array(guard.requiredInputs).map(refText)));
+  const exact = ['corrective-execution-receipt', 'corrective-plan-risk-audit', 'corrective-plan-validation', 'corrective-replacement-plan', 'expected-revision', 'task-id']
+    .map((id) => `input.${id}@1`);
+  return exact.every((id) => inputs.has(id) && guarded.has(id)) ? [] : ['static.input.exact-contract-incomplete'];
+}
+
+function admissionBoundary({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const boundary = transition.admissionBoundary as RecordValue;
+  const lock = (boundary.lock as RecordValue).policy;
+  const installed = array(registry.lockPolicies).find((entry) => refText(entry) === refText(lock));
+  const revalidations = array(boundary.orderedRevalidations);
+  return installed?.lockKind === 'exclusive-task'
+    && revalidations.length === 3 && revalidations.every((entry) => entry.underLock === true)
+    && boundary.firstEffectAfterRevalidation === true && boundary.release === 'finally-after-readback'
+    ? [] : ['static.admission.exclusive-lock-incomplete'];
+}
+
+function reliableEffects({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const atomicity = transition.atomicity as RecordValue;
+  const readback = atomicity.readback as RecordValue;
+  const installed = array(registry.readbackAdapters).find((entry) => refText(entry) === refText(readback.adapter));
+  const blockers: string[] = [];
+  const checkpoints = readback.checkpoints as RecordValue;
+  if (readback.wiring !== 'invoked-post-effect' || installed?.wiring !== 'invoked-post-effect'
+    || checkpoints.preCompletion !== 'domain-readback' || checkpoints.postTerminal !== 'terminal-readback') blockers.push('static.reliability.readback-unwired');
+  if (atomicity.classification !== 'journaled-multi-write' || atomicity.nonMutatingFailureGuarantee !== 'all-guards-before-effects'
+    || (atomicity.journal as RecordValue).mode !== 'required' || (atomicity.recovery as RecordValue).mode !== 'automatic-roll-forward'
+    || (atomicity.recovery as RecordValue).trigger !== 'explicit-repair') {
+    blockers.push('static.reliability.contract-incomplete');
+  }
+  return blockers;
+}
+
+function context(transition: Record<string, unknown>, registry: Record<string, readonly Record<string, unknown>[]> = {}): CoreReleaseRuleContext { return deepFreeze({ transition, registry, policy: {} }); }
+function record(value: unknown): Record<string, unknown> { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}; }
+function rows(value: unknown): Record<string, unknown>[] { return Array.isArray(value) ? value.map(record) : []; }
+function presence(value: unknown): Record<string, never>[] { return Array.isArray(value) ? value.map(() => ({})) : []; }
+function ref(value: unknown): Record<string, unknown> { const entry = record(value); return { id: entry.id, version: entry.version }; }
+
+function array(value: unknown): Record<string, unknown>[] {
+  return Array.isArray(value) ? value as Record<string, unknown>[] : [];
+}
+
+function refText(value: unknown): string {
+  const ref = value as Partial<RegisteredRef<string>> | undefined;
+  return ref && typeof ref.id === 'string' && Number.isInteger(ref.version) ? `${ref.id}@${ref.version}` : '';
+}