create-agdf 0.13.5 → 0.13.7

package/lib/installers/plugin-installers.js

@@ -1,25 +1,35 @@
 import { execFileSync } from "node:child_process";
 import { pluginDefinition } from "../cli/runtime-context.js";
-import { classifyMarketplaceList, prepareLocalMarketplace } from "./local-marketplace.js";
+import { CODEX_REGISTRATION_REVISION, classifyMarketplaceList, inspectLocalMarketplaceProjection, isCodexLocalInstallVersion, prepareLocalMarketplace } from "./local-marketplace.js";
 
 export function installCodexGlobalPlugin({ exec = execFileSync, prepare = prepareLocalMarketplace, dataRoot } = {}) {
   const expectedVersion = pluginDefinition.version;
   const nativeOutput = [];
-  const transaction = prepare({ expectedVersion, ...(dataRoot ? { dataRoot } : {}) });
-  const migration = { state: "unknown", source: "", addedLocal: false, removedLegacy: false };
+  const transaction = prepare({ expectedVersion, codexRegistrationRevision: CODEX_REGISTRATION_REVISION, ...(dataRoot ? { dataRoot } : {}) });
+  const expectedInstallVersion = transaction.codexInstallVersion ?? expectedVersion;
+  const migration = { state: "unknown", source: "", addedLocal: false, removedLegacy: false, refreshOwnedLocal: false, removedOwnedLocal: false };
   try {
     const marketplaceOutput = runPluginPhase(exec, "codex", ["plugin", "marketplace", "list", "--json"], "marketplace", captureOptions());
-    migrateMarketplace({ surface: "codex", exec, output: marketplaceOutput, root: transaction.root, nativeOutput, migration });
-    nativeOutput.push(runPluginPhase(exec, "codex", ["plugin", "add", "agdf", "--marketplace", "agdf"], "plugin_operation", captureOptions()));
+    migrateMarketplace({ surface: "codex", exec, output: marketplaceOutput, root: transaction.root, nativeOutput, migration, refreshOwnedLocal: transaction.changed === true });
+    nativeOutput.push(runPluginPhase(exec, "codex", ["plugin", "add", "agdf@agdf", "--json"], "plugin_operation", captureOptions()));
     const listOutput = runPluginPhase(exec, "codex", ["plugin", "list"], "verification", captureOptions());
     const installedVersion = pluginVersionFromList(listOutput, "agdf@agdf");
-    if (installedVersion !== expectedVersion) {
-      throw lifecycleAdapterError("version", versionMismatchMessage("Codex", "agdf@agdf", expectedVersion, installedVersion, "npx --yes @agdf/cli@latest codex"));
+    if (installedVersion !== expectedInstallVersion) {
+      throw lifecycleAdapterError("version", versionMismatchMessage("Codex", "agdf@agdf", expectedInstallVersion, installedVersion, "npx --yes @agdf/cli@latest codex"));
     }
     transaction.commit();
     return {
-      surface: "codex", operation: migration.state === "owned_local_current" ? "update" : "install", expectedVersion, installedVersion, verificationStatus: "healthy",
-      evidence: ["durable_local_marketplace", `marketplace:${migration.state}`, "codex plugin list"],
+      surface: "codex", operation: migration.state === "owned_local_current" ? "update" : "install", expectedVersion: expectedInstallVersion, canonicalVersion: expectedVersion, installedVersion, verificationStatus: "healthy",
+      evidence: [
+        "durable_local_marketplace",
+        `marketplace:${migration.state}`,
+        "codex plugin list",
+        ...(transaction.pluginRoot ? [`staged_plugin_root:${transaction.pluginRoot}`, "staged_installation_provenance:matched"] : []),
+        ...(transaction.sourceDigest ? [`source_digest:${transaction.sourceDigest}`] : []),
+        ...(transaction.digest ? [`plugin_digest:${transaction.digest}`] : []),
+        ...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
+        ...(expectedInstallVersion === expectedVersion ? [] : [`canonical_version:${expectedVersion}`, `local_install_version:${expectedInstallVersion}`]),
+      ],
       nativeOutput: nativeOutput.filter(Boolean).map(String),
     };
   } catch (error) {
@@ -39,7 +49,12 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
     nativeOutput.push(runPluginPhase(exec, "claude", ["plugin", "marketplace", "update", "agdf"], "marketplace", captureOptions()));
     const beforeList = runPluginPhase(exec, "claude", ["plugin", "list"], "verification", captureOptions());
     const alreadyInstalled = pluginListHasPlugin(beforeList, "agdf@agdf");
-    nativeOutput.push(runPluginPhase(exec, "claude", ["plugin", alreadyInstalled ? "update" : "install", "agdf@agdf"], "plugin_operation", captureOptions()));
+    // `claude plugin update` keeps the cached copy when the version is unchanged, so a
+    // same-version local source change never reaches the host; reinstall replaces the content.
+    if (alreadyInstalled) {
+      nativeOutput.push(runPluginPhase(exec, "claude", ["plugin", "uninstall", "agdf@agdf"], "plugin_operation", captureOptions()));
+    }
+    nativeOutput.push(runPluginPhase(exec, "claude", ["plugin", "install", "agdf@agdf"], "plugin_operation", captureOptions()));
     const afterList = runPluginPhase(exec, "claude", ["plugin", "list"], "verification", captureOptions());
     const installedVersion = pluginVersionFromList(afterList, "agdf@agdf");
     if (installedVersion && installedVersion !== expectedVersion) {
@@ -52,7 +67,16 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
       expectedVersion,
       installedVersion,
       verificationStatus: installedVersion ? "healthy" : "degraded",
-      evidence: ["durable_local_marketplace", `marketplace:${migration.state}`, "claude plugin list", ...(installedVersion ? [] : ["host_did_not_expose_version"])],
+      evidence: [
+        "durable_local_marketplace",
+        `marketplace:${migration.state}`,
+        "claude plugin list",
+        ...(transaction.pluginRoot ? [`staged_plugin_root:${transaction.pluginRoot}`, "staged_installation_provenance:matched"] : []),
+        ...(transaction.sourceDigest ? [`source_digest:${transaction.sourceDigest}`] : []),
+        ...(transaction.digest ? [`plugin_digest:${transaction.digest}`] : []),
+        ...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
+        ...(installedVersion ? [] : ["host_did_not_expose_version"]),
+      ],
       nativeOutput: nativeOutput.filter(Boolean).map(String),
     };
   } catch (error) {
@@ -61,13 +85,21 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
   }
 }
 
-function migrateMarketplace({ surface, exec, output, root, nativeOutput, migration }) {
+function migrateMarketplace({ surface, exec, output, root, nativeOutput, migration, refreshOwnedLocal = false }) {
   const classification = classifyMarketplaceList(surface, output, root);
   Object.assign(migration, classification);
   if (["conflict", "unknown"].includes(classification.state)) {
     throw lifecycleAdapterError("marketplace", `Refusing to replace non-AGDF marketplace registration agdf (${classification.reason || classification.state}).`, classification);
   }
   const executable = surface === "claude" ? "claude" : "codex";
+  if (surface === "codex" && classification.state === "owned_local_current" && refreshOwnedLocal) {
+    migration.refreshOwnedLocal = true;
+    nativeOutput.push(runPluginPhase(exec, executable, ["plugin", "marketplace", "remove", "agdf", "--json"], "marketplace", captureOptions()));
+    migration.removedOwnedLocal = true;
+    nativeOutput.push(runPluginPhase(exec, executable, ["plugin", "marketplace", "add", root, "--json"], "marketplace", captureOptions()));
+    migration.addedLocal = true;
+    return;
+  }
   if (classification.state === "legacy_github") {
     const args = surface === "claude"
       ? ["plugin", "marketplace", "remove", "agdf", "--scope", "user"]
@@ -91,10 +123,23 @@ function recoverMarketplace({ surface, exec, migration, transaction, error }) {
     try {
       exec(executable, args, captureOptions());
       recovery.push({ args, status: "restored" });
+      return true;
     } catch (rollbackError) {
       recovery.push({ args, status: "failed", message: commandErrorText(rollbackError) });
+      return false;
     }
   };
+  if (migration?.refreshOwnedLocal) {
+    const refreshedRegistrationRemoved = migration.addedLocal
+      ? attempt(["plugin", "marketplace", "remove", "agdf", "--json"])
+      : true;
+    rollbackMarketplaceFilesystem(transaction, recovery);
+    if (migration.removedOwnedLocal && refreshedRegistrationRemoved) {
+      attempt(["plugin", "marketplace", "add", migration.source || transaction.root, "--json"]);
+    }
+    error.evidence = { ...(error.evidence ?? {}), rollback: recovery };
+    return;
+  }
   if (migration?.addedLocal) {
     attempt(surface === "claude"
       ? ["plugin", "marketplace", "remove", "agdf", "--scope", "user"]
@@ -105,32 +150,44 @@ function recoverMarketplace({ surface, exec, migration, transaction, error }) {
       ? ["plugin", "marketplace", "add", migration.source, "--scope", "user"]
       : ["plugin", "marketplace", "add", migration.source, "--json"]);
   }
+  rollbackMarketplaceFilesystem(transaction, recovery);
+  error.evidence = { ...(error.evidence ?? {}), rollback: recovery };
+}
+
+function rollbackMarketplaceFilesystem(transaction, recovery) {
   try {
     transaction.rollback();
     recovery.push({ filesystem: transaction.root, status: "restored" });
   } catch (rollbackError) {
     recovery.push({ filesystem: transaction.root, status: "failed", message: rollbackError.message });
   }
-  error.evidence = { ...(error.evidence ?? {}), rollback: recovery };
 }
 
 function captureOptions() {
   return { encoding: "utf8", stdio: "pipe" };
 }
 
-export function inspectPluginSurface(surface, exec = execFileSync) {
+export function inspectPluginSurface(surface, exec = execFileSync, options = {}) {
   const executable = surface === "claude" ? "claude" : "codex";
   const pluginId = "agdf@agdf";
   try {
     const output = exec(executable, ["plugin", "list"], { encoding: "utf8", stdio: "pipe" });
     const installed = pluginListHasPlugin(output, pluginId);
     const version = installed ? pluginVersionFromList(output, pluginId) : "";
+    let localDevelopmentVersion = false;
+    if (surface === "codex" && isCodexLocalInstallVersion(pluginDefinition.version, version)) {
+      try {
+        localDevelopmentVersion = inspectLocalMarketplaceProjection(options)?.codexInstallVersion === version;
+      } catch {
+        localDevelopmentVersion = false;
+      }
+    }
     return {
-      status: !installed ? "not_installed" : version === pluginDefinition.version ? "healthy" : "degraded",
+      status: !installed ? "not_installed" : version === pluginDefinition.version || localDevelopmentVersion ? "healthy" : "degraded",
       surface,
       version: version || null,
       expected_version: pluginDefinition.version,
-      evidence: [`${executable} plugin list`, ...(installed && !version ? ["host_did_not_expose_version"] : [])],
+      evidence: [`${executable} plugin list`, ...(localDevelopmentVersion ? [`canonical_version:${pluginDefinition.version}`, `local_install_version:${version}`] : []), ...(installed && !version ? ["host_did_not_expose_version"] : [])],
     };
   } catch (error) {
     return { status: "unknown", surface, version: null, expected_version: pluginDefinition.version, evidence: [commandErrorText(error)] };
@@ -167,14 +224,23 @@ export function pluginListHasPlugin(output, pluginId) {
     .some((line) => line.includes(pluginId));
 }
 
+const VERSION_PATTERN = "(\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?)";
+
 export function pluginVersionFromList(output, pluginId) {
   const escapedPluginId = pluginId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const line = output
-    .split(/\r?\n/)
-    .find((entry) => new RegExp(`(^|\\s)${escapedPluginId}(\\s|$)`).test(entry));
-  if (!line) return "";
-  const versionMatch = line.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
-  return versionMatch?.[1] ?? "";
+  const lines = output.split(/\r?\n/);
+  const entryIndex = lines.findIndex((entry) => new RegExp(`(^|\\s)${escapedPluginId}(\\s|$)`).test(entry));
+  if (entryIndex < 0) return "";
+  const sameLine = lines[entryIndex].match(new RegExp(`\\b${VERSION_PATTERN}\\b`));
+  if (sameLine) return sameLine[1];
+  // Current `claude plugin list` prints the plugin id and its `Version:` on separate
+  // lines; scan the entry's block until the next plugin id line.
+  for (let index = entryIndex + 1; index < lines.length; index += 1) {
+    if (/\S+@\S+/.test(lines[index])) break;
+    const blockMatch = lines[index].match(new RegExp(`\\bVersion:?\\s*${VERSION_PATTERN}\\b`, "i"));
+    if (blockMatch) return blockMatch[1];
+  }
+  return "";
 }
 
 function versionMismatchMessage(surface, pluginId, expectedVersion, installedVersion, correctiveCommand) {

package/lib/lifecycle/operations.js

@@ -4,6 +4,7 @@ import { dirname, join } from "node:path";
 import { pluginDefinition } from "../cli/runtime-context.js";
 import { evaluateOpenCodeStatus, openCodeNpmInvocation } from "../installers/opencode.js";
 import { inspectPluginSurface } from "../installers/plugin-installers.js";
+import { inspectGeneratedRepositoryMarketplace } from "../runtime/plugin-provenance.js";
 
 const CODEX_DISABLE_MARKER = "# AGDF-OWNED-REPOSITORY-PLUGIN-STATE";
 
@@ -12,8 +13,10 @@ function pluginSection(content, selector) {
   return content.match(new RegExp(`\\[plugins\\.${escaped}\\][\\s\\S]*?(?=\\n\\[|$)`))?.[0] ?? "";
 }
 
-function repositorySelector(targetDir) {
-  return existsSync(join(targetDir, ".agents", "plugins", "marketplace.json")) ? "agdf@agdf-repo" : "agdf@agdf";
+function repositorySelector(targetDir, config = "") {
+  const repository = inspectGeneratedRepositoryMarketplace(targetDir);
+  if (repository.status === "matched") return repository.selector;
+  return pluginSection(config, "agdf@agdf-repo") ? "agdf@agdf-repo" : "agdf@agdf";
 }
 
 export function planRepositoryDisable(targetDir, surface) {
@@ -22,7 +25,7 @@ export function planRepositoryDisable(targetDir, surface) {
   }
   const path = join(targetDir, ".codex", "config.toml");
   const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
-  const selector = repositorySelector(targetDir);
+  const selector = repositorySelector(targetDir, existing);
   const escaped = JSON.stringify(selector).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const sectionPattern = new RegExp(`\\[plugins\\.${escaped}\\][\\s\\S]*?(?=\\n\\[|$)`);
   const currentSection = pluginSection(existing, selector);
@@ -49,8 +52,9 @@ export function planRepositoryDisable(targetDir, surface) {
 export function verifyRepositoryDisabled(targetDir) {
   const path = join(targetDir, ".codex", "config.toml");
   if (!existsSync(path)) return { status: "failed", evidence: [`missing:${path}`] };
-  const selector = repositorySelector(targetDir);
-  const section = pluginSection(readFileSync(path, "utf8"), selector);
+  const config = readFileSync(path, "utf8");
+  const selector = repositorySelector(targetDir, config);
+  const section = pluginSection(config, selector);
   const matches = [...section.matchAll(/^enabled\s*=\s*(true|false)\s*$/gm)];
   return matches.length === 1 && matches[0][1] === "false"
     ? { status: "healthy", evidence: [`${path}:${selector}:enabled=false`] }

package/lib/lifecycle/status.js

@@ -5,6 +5,7 @@ import { evaluateDoctor } from "../control-evaluation/doctor.js";
 import { evaluateGateCheck } from "../control-evaluation/gate-check.js";
 import { evaluateOpenCodeStatus } from "../installers/opencode.js";
 import { inspectPluginSurface } from "../installers/plugin-installers.js";
+import { inspectGeneratedRepositoryMarketplace } from "../runtime/plugin-provenance.js";
 
 function deliveryStatus(targetDir, selection, dependencies) {
   const controlDir = join(targetDir, ".agdf", "control");
@@ -29,7 +30,8 @@ function deliveryStatus(targetDir, selection, dependencies) {
 
 function repositoryStatus(targetDir, surface) {
   if (surface === "codex") {
-    const marketplace = join(targetDir, ".agents", "plugins", "marketplace.json");
+    const repository = inspectGeneratedRepositoryMarketplace(targetDir);
+    const marketplace = repository.marketplacePath;
     const disabled = join(targetDir, ".codex", "config.toml");
     const config = existsSync(disabled) ? readFileSync(disabled, "utf8") : "";
     const isDisabled = ["agdf@agdf-repo", "agdf@agdf"].some((selector) => {
@@ -37,7 +39,11 @@ function repositoryStatus(targetDir, surface) {
       const section = config.match(new RegExp(`\\[plugins\\.${escaped}\\][\\s\\S]*?(?=\\n\\[|$)`))?.[0] ?? "";
       return /^enabled\s*=\s*false\s*$/m.test(section);
     });
-    return { status: isDisabled ? "disabled" : existsSync(marketplace) ? "active" : "not_configured", scope: "repository", evidence: [marketplace] };
+    return {
+      status: isDisabled ? "disabled" : repository.status === "matched" ? "active" : repository.status === "invalid" ? "degraded" : "not_configured",
+      scope: "repository",
+      evidence: [marketplace, ...(repository.reason ? [repository.reason] : [])],
+    };
   }
   if (surface === "opencode") {
     const instructions = join(targetDir, ".opencode", pluginDefinition.opencode.instructionsFileName);
@@ -97,6 +103,8 @@ export function evaluateGeneralStatus(targetDir, options = {}, dependencies = {}
     ? `Run npx --yes @agdf/cli@latest ${surface} to install or repair AGDF.`
     : repository.status === "disabled"
     ? "Restart the host to apply the repository-local disable; the healthy global AGDF installation remains available."
+    : repository.status === "degraded"
+    ? "The repository marketplace is incomplete or invalid; use the supported repository scaffold or the healthy durable global AGDF installation."
     : repository.status === "not_configured"
     ? `Run npx --yes @agdf/cli@latest ${surface === "codex" ? "codex-repo" : `${surface}-repo`} in this repository.`
     : delivery.status === "blocked"

package/lib/public-plugin/builder.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { renameSyncWithRetry } from "../fs-swap.js";
 import { assertPublicPluginContract, loadJson } from "./contract.js";
 import { renderCodexPluginManifest } from "./manifest.js";
 import { createReadinessReport, renderReadinessReport } from "./report.js";
@@ -66,11 +67,11 @@ export function buildPublicPluginCandidate({ repoRoot, outputRoot }) {
     const backupRoot = `${outputRoot}.previous`;
     if (existsSync(backupRoot)) throw new Error(`Refusing candidate swap while recovery backup exists: ${backupRoot}`);
     const hadPrevious = existsSync(outputRoot);
-    if (hadPrevious) renameSync(outputRoot, backupRoot);
+    if (hadPrevious) renameSyncWithRetry(outputRoot, backupRoot);
     try {
-      renameSync(temporaryRoot, outputRoot);
+      renameSyncWithRetry(temporaryRoot, outputRoot);
     } catch (error) {
-      if (hadPrevious && existsSync(backupRoot) && !existsSync(outputRoot)) renameSync(backupRoot, outputRoot);
+      if (hadPrevious && existsSync(backupRoot) && !existsSync(outputRoot)) renameSyncWithRetry(backupRoot, outputRoot);
       throw error;
     }
     if (hadPrevious) rmSync(backupRoot, { recursive: true, force: true });

package/lib/runtime/local-validator.js

@@ -1,8 +1,14 @@
-import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
+import {
+  INSTALLATION_PROVENANCE_FILE,
+  digestDirectory,
+  inspectGeneratedRepositoryMarketplace,
+  inspectInstallationProvenance,
+  validateDistributionProfiles,
+} from "./plugin-provenance.js";
 
 function readJson(path) {
   try {
@@ -12,27 +18,12 @@ function readJson(path) {
   }
 }
 
-export function digestDirectory(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  const hash = createHash("sha256");
-  for (const path of files) {
-    hash.update(relative(root, path).replaceAll("\\", "/"));
-    hash.update("\0");
-    hash.update(readFileSync(path));
-    hash.update("\0");
-  }
-  return hash.digest("hex");
+function canonicalPath(path) {
+  try { return realpathSync(path); } catch { return resolve(path); }
 }
 
+export { digestDirectory };
+
 function envelope(machineValidation, options, evidence = {}) {
   return {
     schema_version: "1",
@@ -42,6 +33,14 @@ function envelope(machineValidation, options, evidence = {}) {
     observed_version: evidence.observedVersion ?? null,
     source: evidence.source ?? null,
     registry_access: false,
+    distribution_profile: evidence.distributionProfile ?? null,
+    evidence_plane: evidence.evidencePlane ?? null,
+    canonical_version: evidence.canonicalVersion ?? options.expectedVersion ?? null,
+    plugin_version: evidence.pluginVersion ?? null,
+    runtime_digest: evidence.runtimeDigest ?? null,
+    source_digest: evidence.sourceDigest ?? null,
+    plugin_root: evidence.pluginRoot ?? null,
+    provenance_status: evidence.provenanceStatus ?? null,
     ...(evidence.reason ? { reason: evidence.reason } : {}),
   };
 }
@@ -51,17 +50,17 @@ export function resolveLocalValidator(options) {
     const packageManifest = readJson(join(options.ownedPackageRoot, "package.json"));
     const observedVersion = packageManifest?.version ?? null;
     if (!packageManifest) {
-      return { envelope: envelope("unavailable", options, { source: "config_local_package", reason: "package_missing" }) };
+      return { envelope: envelope("unavailable", options, { source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", reason: "package_missing" }) };
     }
     if (observedVersion !== options.expectedVersion) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "config_local_package" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local" }) };
     }
     const entrypoint = join(options.ownedPackageRoot, "bin", "create-agdf.js");
     if (!existsSync(entrypoint)) {
-      return { envelope: envelope("unavailable", options, { observedVersion, source: "config_local_package", reason: "entrypoint_missing" }) };
+      return { envelope: envelope("unavailable", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", reason: "entrypoint_missing" }) };
     }
     return {
-      envelope: envelope("owned_version_matched", options, { observedVersion, source: "config_local_package" }),
+      envelope: envelope("owned_version_matched", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", provenanceStatus: "matched" }),
       executable: process.execPath,
       prefixArgs: [entrypoint],
     };
@@ -73,30 +72,116 @@ export function resolveLocalValidator(options) {
     return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", reason: "manifest_invalid" }) };
   }
   if (manifest) {
+    const pluginRoot = canonicalPath(options.pluginRoot ?? join(options.runtimeRoot, ".."));
+    if (options.expectedPluginRoot && canonicalPath(options.expectedPluginRoot) !== pluginRoot) {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, evidencePlane: "loaded_session", distributionProfile: "runtime-plugin", provenanceStatus: "mismatch", reason: "plugin_root_mismatch" }) };
+    }
+    const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
+    const profile = validateDistributionProfiles(definition);
+    if (profile.status !== "matched") {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, distributionProfile: "runtime-plugin", provenanceStatus: "invalid", reason: "profile_invalid" }) };
+    }
+    const codexManifest = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"));
+    const claudeManifest = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"));
+    const pluginVersion = codexManifest?.version ?? null;
+    if (!codexManifest || !claudeManifest || claudeManifest.version !== definition.version) {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, distributionProfile: "runtime-plugin", provenanceStatus: "invalid", reason: "manifest_invalid" }) };
+    }
     const packageRoot = join(options.runtimeRoot, "create-agdf");
     if (!existsSync(packageRoot)) {
-      return { envelope: envelope("unavailable", options, { source: "plugin_bundle", reason: "package_missing" }) };
+      return { envelope: envelope("unavailable", options, { source: "plugin_bundle", pluginRoot, pluginVersion, distributionProfile: "runtime-plugin", reason: "runtime_missing" }) };
     }
     const packageManifest = readJson(join(packageRoot, "package.json"));
     const observedVersion = packageManifest?.version ?? manifest.version ?? null;
     if (observedVersion !== options.expectedVersion || manifest.version !== options.expectedVersion) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, distributionProfile: "runtime-plugin" }) };
     }
     let observedDigest = null;
     try { observedDigest = digestDirectory(packageRoot); } catch {}
     if (!observedDigest || manifest.digest !== observedDigest) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", reason: "digest_mismatch" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "runtime_digest_mismatch" }) };
     }
     const entrypoint = resolve(options.runtimeRoot, manifest.entrypoint ?? "");
     const entrypointRelative = relative(options.runtimeRoot, entrypoint);
     if (!manifest.entrypoint || entrypointRelative === ".." || entrypointRelative.startsWith(`..${sep}`) || isAbsolute(entrypointRelative)) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", reason: "invalid_entrypoint" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "invalid_entrypoint" }) };
     }
     if (!existsSync(entrypoint)) {
-      return { envelope: envelope("unavailable", options, { observedVersion, source: "plugin_bundle", reason: "entrypoint_missing" }) };
+      return { envelope: envelope("unavailable", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "entrypoint_missing" }) };
+    }
+    const installed = existsSync(join(pluginRoot, INSTALLATION_PROVENANCE_FILE));
+    let provenanceStatus = "not_applicable";
+    let sourceDigest = null;
+    let evidencePlane = "loaded_session";
+    if (installed) {
+      const provenance = inspectInstallationProvenance(pluginRoot, {
+        definition,
+        runtimeManifest: manifest,
+        pluginVersion,
+      });
+      provenanceStatus = provenance.status;
+      sourceDigest = provenance.marker?.source_digest ?? null;
+      if (provenance.status !== "matched") {
+        return { envelope: envelope("version_mismatch", options, {
+          observedVersion,
+          source: "plugin_bundle",
+          pluginRoot,
+          pluginVersion,
+          canonicalVersion: definition.version,
+          runtimeDigest: observedDigest,
+          sourceDigest,
+          distributionProfile: "runtime-plugin",
+          evidencePlane: "loaded_session",
+          provenanceStatus,
+          reason: provenance.reason,
+        }) };
+      }
+    } else if (existsSync(join(pluginRoot, ".agdf-local-install.json"))) {
+      return { envelope: envelope("unavailable", options, {
+        observedVersion,
+        source: "plugin_bundle",
+        pluginRoot,
+        pluginVersion,
+        canonicalVersion: definition.version,
+        runtimeDigest: observedDigest,
+        distributionProfile: "runtime-plugin",
+        evidencePlane: "loaded_session",
+        provenanceStatus: "missing",
+        reason: "installation_provenance_missing",
+      }) };
+    } else {
+      const generatedRepository = inspectGeneratedRepositoryMarketplace(resolve(pluginRoot, "..", ".."));
+      if (pluginVersion !== definition.version
+          || generatedRepository.status !== "matched"
+          || canonicalPath(generatedRepository.pluginRoot) !== pluginRoot) {
+        return { envelope: envelope("unavailable", options, {
+          observedVersion,
+          source: "plugin_bundle",
+          pluginRoot,
+          pluginVersion,
+          canonicalVersion: definition.version,
+          runtimeDigest: observedDigest,
+          distributionProfile: "runtime-plugin",
+          evidencePlane: "installed_plugin_root",
+          provenanceStatus: "missing",
+          reason: "installation_provenance_missing",
+        }) };
+      }
+      evidencePlane = "generated_bundle";
     }
     return {
-      envelope: envelope("owned_version_matched", options, { observedVersion, source: "plugin_bundle" }),
+      envelope: envelope("owned_version_matched", options, {
+        observedVersion,
+        source: "plugin_bundle",
+        pluginRoot,
+        pluginVersion,
+        canonicalVersion: definition.version,
+        runtimeDigest: observedDigest,
+        sourceDigest,
+        distributionProfile: "runtime-plugin",
+        evidencePlane,
+        provenanceStatus,
+      }),
       executable: process.execPath,
       prefixArgs: [entrypoint],
     };