create-agdf 0.14.5 → 0.20.0

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/runtime/plugin-provenance.js

@@ -0,0 +1,496 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync, statSync, lstatSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+export const INSTALLATION_PROVENANCE_FILE = ".agdf-installation.json";
+export const LEGACY_LOCAL_INSTALL_FILE = ".agdf-local-install.json";
+export const COPILOT_PAYLOAD_INVENTORY_FILE = ".agdf-payload-inventory.json";
+// Host-owned liveness markers written into the installed plugin root while a session holds it
+// (Claude Code: `.in_use/<pid>`). They are not plugin payload and must not affect provenance.
+export const HOST_RUNTIME_MARKER_DIRECTORIES = Object.freeze([".in_use"]);
+
+// Private, owner-recorded qualification metadata, never a tool argument or a
+// gesture credential. Native observations must precede recording this tuple.
+export const DECISION_APP_OBSERVATIONS = Object.freeze(['initialize', 'app_only_visibility', 'model_call_denied',
+  'deliberate_approve', 'deliberate_change', 'deliberate_reject', 'permission_denial', 'document_return', 'teardown']);
+// The boolean and read-only diagnosis deliberately share one validator. Host/candidate
+// values are owner supplied, never caller credentials or qualification writes.
+export function inspectDecisionAppQualification(root, record, expected = {}) {
+  const fail = (reason, detail = {}) => Object.freeze({ qualified: false, reason, ...detail, authorizes: false });
+  const exact = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+  const hex = value => typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+  try {
+    if (record == null) return fail('qualification_record_missing');
+    if (!exact(record, ['schema_version', 'result', 'surface', 'host', 'candidate', 'observations', 'evidence', 'assurance', 'authorizes'])
+      || record.schema_version !== 1 || record.result !== 'qualified' || record.surface !== 'codex'
+      || record.assurance !== 'cooperative_local' || record.authorizes !== false) return fail('qualification_record_invalid');
+    if (!expected.client) return fail('host_context_unavailable');
+    if (!exact(record.host, ['name', 'version', 'os', 'arch'])
+      || typeof record.host.name !== 'string' || !record.host.name || typeof record.host.version !== 'string' || !record.host.version)
+      return fail('qualification_host_invalid');
+    if (record.host.name !== expected.client.name || record.host.version !== expected.client.version
+      || record.host.os !== process.platform || record.host.arch !== process.arch) return fail('qualification_host_mismatch');
+    if (!exact(record.candidate, ['server_digest', 'dispatcher_digest', 'sdk_digest', 'resource_digest'])) return fail('qualification_candidate_invalid');
+    const mismatches = Object.keys(record.candidate).filter(key => !hex(record.candidate[key]) || record.candidate[key] !== expected[key]);
+    if (mismatches.length) return fail('qualification_candidate_mismatch', { fields: mismatches });
+    if (!Array.isArray(record.observations) || record.observations.length !== DECISION_APP_OBSERVATIONS.length
+      || new Set(record.observations).size !== record.observations.length || !DECISION_APP_OBSERVATIONS.every(key => record.observations.includes(key)))
+      return fail('qualification_observations_incomplete', { missing_observations: DECISION_APP_OBSERVATIONS.filter(key => !Array.isArray(record.observations) || !record.observations.includes(key)) });
+    if (!Array.isArray(record.evidence) || !record.evidence.length || record.evidence.length > 16) return fail('qualification_evidence_missing_or_invalid');
+    const paths = new Set();
+    for (const item of record.evidence) {
+      if (!exact(item, ['path', 'digest']) || !hex(item.digest) || typeof item.path !== 'string'
+        || !/^qualification\/(?:[a-zA-Z0-9_-]+\/)*[a-zA-Z0-9_-]+\.(?:json|log|md)$/u.test(item.path) || paths.has(item.path)) return fail('qualification_evidence_reference_invalid');
+      paths.add(item.path); let path = root;
+      for (const component of item.path.split('/')) { path = join(path, component); if (lstatSync(path).isSymbolicLink()) return fail('qualification_evidence_symlink'); }
+      const stats = lstatSync(path);
+      if (!stats.isFile() || stats.size > 1048576) return fail('qualification_evidence_file_invalid');
+      const bytes = readFileSync(path);
+      if (bytes.length > 1048576 || createHash('sha256').update(bytes).digest('hex') !== item.digest) return fail('qualification_evidence_digest_mismatch');
+    }
+    return Object.freeze({ qualified: true, reason: null, authorizes: false });
+  } catch { return fail('qualification_evidence_unavailable'); }
+}
+export function evaluateDecisionAppQualification(root, record, expected) {
+  return inspectDecisionAppQualification(root, record, expected).qualified;
+}
+
+// Codex starts plugin MCP servers only from absolute paths and passes no plugin root or data directory
+// (native probe, Codex 0.145/0.157). The runtime plugin therefore ships a template that the installer
+// fills with the absolute marketplace plugin root and data directory; provenance digests the template.
+export const CODEX_PLUGIN_MCP_FILE = "mcp.json";
+const CODEX_ROOT_TOKEN = "{{AGDF_PLUGIN_ROOT}}";
+const CODEX_DATA_TOKEN = "{{AGDF_MCP_DATA}}";
+
+export function renderCodexPluginMcpConfig({ pluginRoot = CODEX_ROOT_TOKEN, dataRoot = CODEX_DATA_TOKEN, portable = true, cockpit = false } = {}) {
+  const root = pluginRoot.replaceAll("\\", "/");
+  return `${JSON.stringify({
+    ...(portable ? { $schema: "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json" } : {}),
+    mcpServers: {
+      agdf: {
+        ...(portable ? { type: "stdio" } : {}),
+        command: "node",
+        args: [`${root}/mcp/agdf-mcp-launch.js`, "--surface", "codex", "--data", dataRoot.replaceAll("\\", "/")],
+      },
+      ...(cockpit ? { 'agdf-cockpit': {
+        ...(portable ? { type: 'stdio' } : {}), command: 'node',
+        args: [`${root}/mcp/agdf-mcp-launch.js`, '--surface', 'codex', '--data', dataRoot.replaceAll('\\', '/'), '--cockpit'],
+      } } : {}),
+    },
+  }, null, 2)}\n`;
+}
+
+export function renderCopilotPluginMcpConfig() {
+  return `${JSON.stringify({
+    $schema: "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+    mcpServers: {
+      agdf: {
+        type: "stdio",
+        command: "node",
+        args: ["${PLUGIN_ROOT}/mcp/agdf-mcp-launch.js", "--surface", "copilot", "--data", "${PLUGIN_DATA}"],
+      },
+    },
+  }, null, 2)}\n`;
+}
+
+// Returns the template for any config of the owned shape, so an installed file with absolute paths
+// digests exactly like the generated one; any other content is returned unchanged and therefore
+// changes the digest.
+export function normalizeCodexPluginMcpConfig(content) {
+  try {
+    const config = JSON.parse(String(content));
+    const args = config.mcpServers?.agdf?.args;
+    if (Array.isArray(args) && args.length === 5 && typeof args[0] === "string"
+        && args[0].endsWith("/mcp/agdf-mcp-launch.js") && typeof args[4] === "string" && args[4]) {
+      const portable = Object.hasOwn(config, "$schema");
+      const cockpit = Object.hasOwn(config.mcpServers, 'agdf-cockpit');
+      const expected = renderCodexPluginMcpConfig({ pluginRoot: args[0].slice(0, -"/mcp/agdf-mcp-launch.js".length), dataRoot: args[4], portable, cockpit });
+      if (JSON.stringify(config) === JSON.stringify(JSON.parse(expected))) return renderCodexPluginMcpConfig({ portable, cockpit });
+    }
+  } catch {}
+  return content;
+}
+
+function isHostRuntimeMarker(root, directory, name) {
+  return directory === root && HOST_RUNTIME_MARKER_DIRECTORIES.includes(name);
+}
+
+const EXPECTED_PROFILES = Object.freeze({
+  "source-development": Object.freeze({ runtime: "absent", installable: false, machineValidation: "unavailable" }),
+  "runtime-plugin": Object.freeze({ runtime: "required", installable: true, machineValidation: "local_exact_version_digest" }),
+  "copilot-runtime-plugin": Object.freeze({ runtime: "required", installable: true, machineValidation: "local_exact_version_digest_inventory" }),
+  "opencode-config-local": Object.freeze({ runtime: "config_local_package", installable: true, machineValidation: "local_exact_version" }),
+  "portable-skills": Object.freeze({ runtime: "absent", installable: true, machineValidation: "unavailable_or_external_required" }),
+});
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function digestDirectory(root) {
+  const files = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) visit(path);
+      else if (stats.isFile()) files.push(path);
+    }
+  }
+  visit(root);
+  const hash = createHash("sha256");
+  for (const path of files) {
+    hash.update(relative(root, path).replaceAll("\\", "/"));
+    hash.update("\0");
+    hash.update(readFileSync(path));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+const LEGACY_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([
+  "package.json",
+  "lib/mcp-dispatch-runtime.js",
+  "lib/control-read-boundary.js",
+  "lib/control-inspect",
+  "lib/skill-dispatch",
+  "lib/control-evaluation",
+  "lib/control-state",
+  "lib/cli/runtime-context.js",
+  "lib/runtime/control-context.js",
+  "lib/cli/contract-command.js",
+  "lib/runtime/plugin-provenance.js",
+  "lib/task-target-resolution.js",
+  "lib/repository-context-reader.js",
+  "lib/interaction-presentation.js",
+  "lib/interaction-catalog.js",
+  "generated/plugins/agdf/meta/agdf-plugin.definition.json",
+  "generated/plugins/agdf/meta/agdf-interaction-locales.json",
+  "generated/plugins/agdf/meta/contracts",
+]);
+
+const CORE_MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([
+  "package.json", "lib/mcp-dispatch-runtime.js", "lib/cli/runtime-context.js", "lib/runtime/control-context.js", "lib/cli/contract-command.js", "lib/runtime/plugin-provenance.js", "runtime/core",
+  "generated/plugins/agdf/meta/agdf-plugin.definition.json", "generated/plugins/agdf/meta/agdf-interaction-locales.json", "generated/plugins/agdf/meta/contracts",
+]);
+export const MCP_DISPATCHER_RUNTIME_ENTRIES = Object.freeze([...CORE_MCP_DISPATCHER_RUNTIME_ENTRIES,
+  'lib/mcp-lifecycle/package.js', 'lib/mcp-lifecycle/facade-entry.js', 'lib/npm-invocation.js', 'lib/host-command.js']);
+const dispatcherEntries = root => existsSync(join(root, "runtime", "core"))
+  ? existsSync(join(root, 'lib/mcp-lifecycle/facade-entry.js')) ? MCP_DISPATCHER_RUNTIME_ENTRIES : CORE_MCP_DISPATCHER_RUNTIME_ENTRIES
+  : LEGACY_MCP_DISPATCHER_RUNTIME_ENTRIES;
+
+export const MCP_SDK_RUNTIME_ENTRIES = Object.freeze([
+  "node_modules/@modelcontextprotocol/server",
+  "node_modules/@modelcontextprotocol/core",
+  "node_modules/zod",
+]);
+
+function digestSelectedEntries(root, entries, syntheticEntries = []) {
+  const files = [];
+  function visit(path) {
+    const stats = statSync(path);
+    if (stats.isDirectory()) {
+      for (const name of readdirSync(path).sort()) visit(join(path, name));
+    } else if (stats.isFile()) files.push({ path, content: readFileSync(path) });
+  }
+  for (const entry of entries) visit(join(root, entry));
+  for (const entry of syntheticEntries) files.push({ path: join(root, entry.path), content: Buffer.from(entry.content) });
+  const hash = createHash("sha256");
+  for (const file of files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)) {
+    hash.update(relative(root, file.path).replaceAll("\\", "/"));
+    hash.update("\0");
+    hash.update(file.content);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+export function digestMcpDispatcherPackage(root) {
+  return digestSelectedEntries(root, dispatcherEntries(root));
+}
+
+export function digestPluginMcpDispatcherSource(root, version) {
+  const packageJson = `${JSON.stringify({
+    name: "create-agdf",
+    version,
+    private: true,
+    type: "module",
+    exports: { "./mcp-dispatch-runtime": "./lib/mcp-dispatch-runtime.js" },
+    ...(existsSync(join(root, "runtime", "core")) ? { imports: { "#agdf-core": "./runtime/core/lib/index.js", "#agdf-core/*": "./runtime/core/lib/*" } } : {}),
+  }, null, 2)}\n`;
+  return digestSelectedEntries(
+    root,
+    dispatcherEntries(root).filter((entry) => entry !== "package.json"),
+    [{ path: "package.json", content: packageJson }],
+  );
+}
+
+export function digestMcpSdkRuntime(root) {
+  return digestSelectedEntries(root, MCP_SDK_RUNTIME_ENTRIES);
+}
+
+export function digestFile(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+export function inspectCopilotPayloadInventory(pluginRoot, expectedVersion) {
+  const inventoryPath = join(pluginRoot, COPILOT_PAYLOAD_INVENTORY_FILE);
+  const inventory = readJson(inventoryPath);
+  if (!inventory || inventory.schema_version !== 1 || inventory.profile_id !== "copilot-runtime-plugin"
+      || inventory.version !== expectedVersion || !Array.isArray(inventory.entries)) {
+    return { status: "invalid", reason: "copilot_payload_inventory_invalid" };
+  }
+  const destinations = inventory.entries.map((entry) => entry.destination);
+  if (new Set(destinations).size !== destinations.length) {
+    return { status: "invalid", reason: "copilot_payload_inventory_duplicate" };
+  }
+  const actual = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) {
+        if (!isHostRuntimeMarker(pluginRoot, directory, name)) visit(path);
+      } else if (stats.isFile()) {
+        const normalized = relative(pluginRoot, path).replaceAll("\\", "/");
+        if (![COPILOT_PAYLOAD_INVENTORY_FILE, INSTALLATION_PROVENANCE_FILE, LEGACY_LOCAL_INSTALL_FILE].includes(normalized)) actual.push(normalized);
+      }
+    }
+  }
+  try { visit(pluginRoot); } catch { return { status: "invalid", reason: "copilot_payload_incomplete" }; }
+  if (JSON.stringify(actual.sort()) !== JSON.stringify([...destinations].sort())) {
+    return { status: "invalid", reason: "copilot_payload_inventory_mismatch" };
+  }
+  for (const entry of inventory.entries) {
+    const path = join(pluginRoot, entry.destination);
+    if (!existsSync(path) || digestFile(path) !== entry.digest || statSync(path).size !== entry.bytes) {
+      return { status: "invalid", reason: "copilot_payload_digest_mismatch", entry: entry.destination };
+    }
+  }
+  const excluded = actual.some((path) => path.startsWith("copilot-skills/") || path.startsWith(".codex-plugin/")
+    || path.startsWith(".claude-plugin/") || path.startsWith("submission/")
+    || path === "hooks/hooks.json" || path === "hooks/session-start.sh");
+  if (excluded) return { status: "invalid", reason: "copilot_payload_excluded_surface" };
+  return { status: "matched", inventory, inventoryDigest: digestFile(inventoryPath) };
+}
+
+export function digestNormalizedPluginSource(root, canonicalVersion) {
+  const files = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) {
+        if (!isHostRuntimeMarker(root, directory, name)) visit(path);
+      } else if (stats.isFile()) files.push(path);
+    }
+  }
+  visit(root);
+  const hash = createHash("sha256");
+  for (const path of files) {
+    const normalizedPath = relative(root, path).replaceAll("\\", "/");
+    if ([INSTALLATION_PROVENANCE_FILE, LEGACY_LOCAL_INSTALL_FILE].includes(normalizedPath)) continue;
+    let content = readFileSync(path);
+    if (normalizedPath === ".codex-plugin/plugin.json"
+        || (normalizedPath === "plugin.json" && readJson(path)?.$schema === "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json")) {
+      const manifest = readJson(path);
+      if (!manifest) throw new Error(`Invalid Codex plugin manifest: ${path}`);
+      content = `${JSON.stringify({ ...manifest, version: canonicalVersion }, null, 2)}\n`;
+    } else if ([CODEX_PLUGIN_MCP_FILE, "mcp/codex.mcp.json"].includes(normalizedPath)) {
+      content = normalizeCodexPluginMcpConfig(content);
+    }
+    hash.update(normalizedPath);
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+export function validateDistributionProfiles(definition) {
+  const contract = definition?.distributionProfiles;
+  if (contract?.schemaVersion !== 1) return { status: "invalid", reason: "profile_invalid" };
+  if (contract.marketplaceIdentities?.durable !== "agdf"
+      || contract.marketplaceIdentities?.generatedRepository !== "agdf-repo") {
+    return { status: "invalid", reason: "profile_invalid" };
+  }
+  for (const [profileId, expected] of Object.entries(EXPECTED_PROFILES)) {
+    const observed = contract.profiles?.[profileId];
+    if (!observed
+        || Object.keys(observed).length !== Object.keys(expected).length
+        || Object.keys(expected).some((key) => observed[key] !== expected[key])) {
+      return { status: "invalid", reason: "profile_invalid" };
+    }
+  }
+  if (Object.keys(contract.profiles ?? {}).length !== Object.keys(EXPECTED_PROFILES).length) {
+    return { status: "invalid", reason: "profile_invalid" };
+  }
+  return { status: "matched", contract };
+}
+
+function classifyInstalledHistoricalProfile(catalogue, definition, classifyHistoricalProfile) {
+  if (typeof classifyHistoricalProfile !== "function") {
+    return { status: "invalid", reason: "profile_history_invalid" };
+  }
+  const result = classifyHistoricalProfile({
+    catalogue,
+    version: definition?.version,
+    distributionProfiles: definition?.distributionProfiles,
+  });
+  if (result.status !== "matched") return result;
+  return {
+    ...result,
+    contract: catalogue.contracts[result.contract_id].distribution_profiles,
+  };
+}
+
+export function inspectGeneratedRepositoryMarketplace(targetDir) {
+  const marketplacePath = join(targetDir, ".agents", "plugins", "marketplace.json");
+  if (!existsSync(marketplacePath)) return { status: "absent", marketplacePath };
+  const marketplace = readJson(marketplacePath);
+  const plugin = marketplace?.plugins?.length === 1 ? marketplace.plugins[0] : null;
+  const pluginPath = plugin?.source?.source === "local" ? plugin.source.path : null;
+  if (marketplace?.name !== "agdf-repo" || plugin?.name !== "agdf" || pluginPath !== "./plugins/agdf") {
+    return { status: "invalid", reason: "repository_marketplace_invalid", marketplacePath };
+  }
+  const pluginRoot = resolve(targetDir, pluginPath);
+  const rel = relative(resolve(targetDir), pluginRoot);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return { status: "invalid", reason: "repository_marketplace_path_escape", marketplacePath };
+  }
+  const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
+  const runtimeManifest = readJson(join(pluginRoot, "runtime", "runtime-manifest.json"));
+  const codexManifest = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"));
+  const claudeManifest = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"));
+  const runtimeRoot = join(pluginRoot, "runtime");
+  const runtimePackageRoot = join(pluginRoot, "runtime", "create-agdf");
+  const runtimeEntrypoint = resolve(runtimeRoot, runtimeManifest?.entrypoint ?? "");
+  const runtimeEntrypointRel = relative(runtimeRoot, runtimeEntrypoint);
+  if (validateDistributionProfiles(definition).status !== "matched"
+      || definition?.version !== runtimeManifest?.version
+      || codexManifest?.version !== definition?.version
+      || claudeManifest?.version !== definition?.version
+      || !/^[a-f0-9]{64}$/.test(runtimeManifest?.digest ?? "")
+      || !existsSync(join(runtimeRoot, "agdf-local.js"))
+      || !runtimeManifest?.entrypoint
+      || runtimeEntrypointRel === ".."
+      || runtimeEntrypointRel.startsWith(`..${sep}`)
+      || isAbsolute(runtimeEntrypointRel)
+      || !existsSync(runtimeEntrypoint)
+      || !existsSync(runtimePackageRoot)) {
+    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
+  }
+  let runtimeDigest;
+  try { runtimeDigest = digestDirectory(runtimePackageRoot); } catch {
+    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
+  }
+  if (runtimeDigest !== runtimeManifest.digest) {
+    return { status: "invalid", reason: "runtime_digest_mismatch", marketplacePath, pluginRoot };
+  }
+  return {
+    status: "matched",
+    marketplacePath,
+    pluginRoot,
+    selector: `${plugin.name}@${marketplace.name}`,
+    runtimeDigest,
+  };
+}
+
+export function inspectInstallationProvenance(pluginRoot, {
+  definition,
+  runtimeManifest,
+  pluginVersion,
+  allowLegacy = false,
+  profileId = "runtime-plugin",
+  inventoryDigest = null,
+  allowHistoricalProfilesForMigration = false,
+  distributionProfileHistory = null,
+  classifyHistoricalProfile = null,
+} = {}) {
+  const markerPath = join(pluginRoot, INSTALLATION_PROVENANCE_FILE);
+  const legacyPath = join(pluginRoot, LEGACY_LOCAL_INSTALL_FILE);
+  if (!existsSync(markerPath)) {
+    if (allowLegacy && existsSync(legacyPath)) {
+      const currentProfile = validateDistributionProfiles(definition);
+      if (Object.hasOwn(definition ?? {}, "distributionProfiles")
+          && currentProfile.status !== "matched") {
+        return allowHistoricalProfilesForMigration
+          ? classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile).status === "matched"
+            ? { status: "invalid", reason: "installation_provenance_invalid" }
+            : classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile)
+          : currentProfile;
+      }
+      const marker = readJson(legacyPath);
+      if (!marker
+          || marker.schema_version !== 1
+          || marker.owner !== "create-agdf"
+          || marker.kind !== "codex_local_development_projection"
+          || marker.canonical_version !== definition.version
+          || marker.codex_install_version !== pluginVersion
+          || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
+        return { status: "invalid", reason: "installation_provenance_invalid", marker };
+      }
+      let observedSourceDigest;
+      try { observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version); } catch {
+        return { status: "invalid", reason: "source_digest_mismatch", marker };
+      }
+      return observedSourceDigest === marker.source_digest
+        ? { status: "legacy", marker, observedSourceDigest, reason: "legacy_installation_provenance" }
+        : { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
+    }
+    const profile = validateDistributionProfiles(definition);
+    if (profile.status !== "matched") return profile;
+    return { status: "missing", reason: "installation_provenance_missing" };
+  }
+  const currentProfile = validateDistributionProfiles(definition);
+  const historicalProfile = currentProfile.status !== "matched" && allowHistoricalProfilesForMigration
+    ? classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile)
+    : null;
+  if (currentProfile.status !== "matched" && historicalProfile?.status !== "matched") {
+    return historicalProfile ?? currentProfile;
+  }
+  const profile = currentProfile.status === "matched" ? currentProfile : historicalProfile;
+  const marker = readJson(markerPath);
+  const portable = readJson(join(pluginRoot, "plugin.json"));
+  if (!marker
+      || marker.schema_version !== 1
+      || marker.owner !== "create-agdf"
+      || marker.profile_id !== profileId
+      || marker.marketplace_id !== profile.contract.marketplaceIdentities.durable
+      || marker.canonical_version !== definition.version
+      || marker.codex_install_version !== pluginVersion
+      || (portable?.$schema === "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json" && portable.version !== pluginVersion)
+      || marker.runtime_digest !== runtimeManifest?.digest
+      || (profileId === "copilot-runtime-plugin" && marker.inventory_digest !== inventoryDigest)
+      || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
+    return { status: "invalid", reason: "installation_provenance_invalid", marker };
+  }
+  let observedSourceDigest;
+  try {
+    observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version);
+  } catch {
+    return { status: "invalid", reason: "source_digest_mismatch", marker };
+  }
+  if (observedSourceDigest !== marker.source_digest) {
+    return { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
+  }
+  return {
+    status: "matched",
+    marker,
+    observedSourceDigest,
+    profileClassification: historicalProfile ? "supported_historical" : "current",
+    historicalReleaseVersion: historicalProfile?.release_version ?? null,
+    historicalContractId: historicalProfile?.contract_id ?? null,
+    historicalContractDigest: historicalProfile?.contract_digest ?? null,
+    historicalEntryDigest: historicalProfile?.entry_digest ?? null,
+  };
+}
+
+export const distributionProfileContract = Object.freeze({
+  expectedProfiles: EXPECTED_PROFILES,
+});

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/skill-dispatch/binding.js

@@ -0,0 +1,66 @@
+import { statSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+import { SKILL_DISPATCH_SURFACES, skillDispatchArgumentGrammar } from "./contract.js";
+
+const SURFACES = new Set(SKILL_DISPATCH_SURFACES);
+const text = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && !/[\r\n\0]/u.test(value);
+const absolute = (value) => text(value) && isAbsolute(value);
+
+function fileIdentity(path, stat) {
+  if (!absolute(path)) throw new Error("runtime_unavailable");
+  try {
+    const s = stat(path);
+    if (!s.isFile()) throw new Error();
+    return [s.dev, s.ino, s.size, s.mtimeMs, s.ctimeMs];
+  } catch { throw new Error("runtime_unavailable"); }
+}
+
+export function validateDispatchBinding(binding) {
+  const invalid = () => { throw new Error("invalid_dispatch_binding"); };
+  if (!binding || binding.schema_version !== "2" || binding.authorizes !== false
+      || !absolute(binding.executable) || !text(binding.expected_version)
+      || binding.arguments !== skillDispatchArgumentGrammar()) invalid();
+  const keys = ["schema_version", "executable", "argv_prefix", "environment", "arguments", "expected_version", "request_activation", "authorizes"];
+  if (binding.route_source_after_activation !== undefined) keys.push("route_source_after_activation");
+  if (Object.keys(binding).sort().join() !== keys.sort().join()) invalid();
+  const args = binding.argv_prefix;
+  if (!Array.isArray(args) || args.length !== 5 || !absolute(args[0])
+      || args.slice(1, 4).join() !== "skill-dispatch,--json,--surface" || !SURFACES.has(args[4])) invalid();
+  const env = binding.environment;
+  if (!env || typeof env !== "object" || Array.isArray(env)
+      || Object.keys(env).some((key) => key !== "ELECTRON_RUN_AS_NODE")
+      || (Object.hasOwn(env, "ELECTRON_RUN_AS_NODE") && env.ELECTRON_RUN_AS_NODE !== "1")) invalid();
+  const a = binding.request_activation;
+  if (!a || Object.keys(a).sort().join() !== "guard_fingerprint,owner,policy_version"
+      || a.owner !== "request_activation_contract" || a.policy_version !== 1
+      || !/^sha256:[a-f0-9]{64}$/u.test(a.guard_fingerprint)) invalid();
+  const route = binding.route_source_after_activation;
+  if (binding.route_source_after_activation !== undefined && (!route || Object.keys(route).sort().join() !== "path,relative_to"
+      || route.relative_to !== "validator_directory"
+      || !["../meta/contracts/request-activation.md", "../skills/contracts/request-activation.md"].includes(route.path))) invalid();
+  return binding;
+}
+
+export function createDispatchBinding({ validator, surface, expectedVersion, requestActivation, routeSource,
+  executable, versions }, { probe, stat = statSync } = {}) {
+  if (typeof probe !== "function") throw new Error("runtime_unavailable");
+  fileIdentity(validator, stat);
+  const launch = probe({ executable, versions });
+  const binding = {
+    schema_version: "2",
+    executable: launch.executable,
+    argv_prefix: Object.freeze([validator, "skill-dispatch", "--json", "--surface", surface]),
+    environment: launch.environment,
+    arguments: skillDispatchArgumentGrammar(),
+    expected_version: expectedVersion,
+    request_activation: Object.freeze({ ...requestActivation }),
+    ...(routeSource ? { route_source_after_activation: Object.freeze({ ...routeSource }) } : {}),
+    authorizes: false,
+  };
+  validateDispatchBinding(binding);
+  return Object.freeze(binding);
+}
+
+export function unavailableDispatchContext() {
+  return 'AGDF dispatch: {"outcome":"dispatcher_unavailable","authorizes":false,"recovery":"Repair the installed runtime and restart; do not infer an executable or environment."}';
+}

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/skill-dispatch/compact-continuation.js

@@ -0,0 +1,76 @@
+import { readFileSync } from '../control-read/fs.js';
+import { containedRegularFile, hasSymlinkComponent } from '../control-state/contained-file.js';
+import { artefactFileDigest } from '../control-state/run-seal-compute.js';
+import { REVISION_ID_PATTERN } from '../control-state/run-identity.js';
+import { extractField, parseVerifiedChangePathList } from '../control-evaluation/verified-change.js';
+
+// Translate only the final evaluated operation; policy and writers retain authority.
+export function compactContinuation(root, report, input) {
+  const state = report.status_card?.runState;
+  const mode = report.status_card?.mode_slice_decision ?? report.delivery_map?.mode_slice_decision?.decision;
+  const operation = report.next_operation;
+  const implementation = operation?.type === 'implement_compact_scope'
+    && operation.skill_id === 'gate-check' && operation.operation_key === 'implementation.execute'
+    && operation.actor === 'agent' && operation.effect === 'implementation';
+  const closeout = operation?.type === 'record_closeout'
+    && operation.skill_id === 'release-or' && operation.operation_key === 'closeout.record'
+    && operation.actor === 'agent' && operation.effect === 'closeout';
+  const expectedGate = mode === 'quick_task' ? 'Quick Task Execution'
+    : mode === 'verified_change' ? (implementation ? 'Verified Change Execution' : 'OR') : null;
+  if (!input.continue_delivery || !input.run_id || !state || !expectedGate
+      || (!implementation && !closeout) || report.status !== 'open'
+      || report.current_gate !== expectedGate || operation.gate !== expectedGate
+      || report.blocking_reason !== 'none' || report.missing_approval !== 'none'
+      || extractField(state.content, 'lifecycle') !== 'active') return null;
+  const runId = extractField(state.content, 'run_id');
+  const revision = extractField(state.content, 'revision_id');
+  if (runId !== input.run_id || runId !== report.status_card.run_id || !REVISION_ID_PATTERN.test(revision)) throw Error('compact_binding_invalid');
+  const sources = [];
+  const read = type => {
+    const path = state.artefacts.get(type)?.path;
+    const file = containedRegularFile(root, path);
+    if (hasSymlinkComponent(root, path) || file.status !== 'valid') throw Error('compact_source_unavailable');
+    const content = readFileSync(file.path, 'utf8');
+    const digest = artefactFileDigest(root, path);
+    if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw Error('compact_source_unavailable');
+    sources.push({ type, path, digest });
+    return { path, content };
+  };
+  read('UR'); read('Brownfield Review');
+  let record;
+  if (mode === 'verified_change') {
+    const evaluated = report.verified_change;
+    const current = read('Verified Change');
+    if (evaluated?.status !== (implementation ? 'eligible' : 'executed')
+        || evaluated.findings?.length || current.path !== evaluated.record?.path
+        || current.content !== evaluated.record?.content) throw Error('compact_record_changed');
+    record = {
+      path: current.path, canonical_owner: extractField(current.content, 'canonical_owner'),
+      allowed_source_paths: parseVerifiedChangePathList(extractField(current.content, 'allowed_source_paths')),
+      allowed_derived_paths: parseVerifiedChangePathList(extractField(current.content, 'allowed_derived_paths')),
+      baseline_commit: extractField(current.content, 'baseline_commit'),
+      baseline_tracked_paths: parseVerifiedChangePathList(extractField(current.content, 'baseline_tracked_paths')),
+      baseline_untracked_paths: parseVerifiedChangePathList(extractField(current.content, 'baseline_untracked_paths')),
+      propagation_command: extractField(current.content, 'propagation_command'),
+      validation_commands: extractField(current.content, 'validation_commands'),
+      escalation_target: evaluated.escalation_target,
+    };
+  } else if (closeout && state.artefacts.get('CR')?.path) {
+    // The CLI review step records a done Code Review without a file; bind CR only when one is registered.
+    read('CR');
+  }
+  return {
+    phase: implementation ? 'compact_implementation' : 'compact_closeout',
+    skill_id: implementation ? 'gate-check' : 'release-or',
+    governance_target: root, run_id: runId, revision_id: revision,
+    presentation_language: input.presentation_language, mode,
+    source_artifacts: sources, ...(record ? { verified_change: record } : {}),
+    instruction: implementation
+      ? `Inspect current execution and review evidence first; perform only unfinished work within the approved UR and Brownfield scope. ${mode === 'verified_change'
+        ? 'Use only the evaluated record paths; run its declared propagation and validation commands, record exact changed paths and passing evidence through the existing record/run-update owner. Escalate through the existing declared structured path if eligibility is lost.'
+        : 'Run relevant checks, record actual evidence and mandatory Code Review through the existing run-step owners before OR-lite.'} After recorded changes redispatch gate-check for this same target/run with continue_delivery and its fresh revision. Stop at any decision or concrete blocker. Never infer QA, UAT, VCS or release authority.`
+      : `Close only this already reviewed/executed compact scope through release-or. ${mode === 'verified_change'
+        ? 'Complete the linked Verified Change Mini-Closeout and publish lifecycle-consistent role links through the existing run-update owner; closeout.record does not support this mode. Revalidate with Git-aware CLI evaluation.'
+        : 'Persist OR-lite with Result, Evidence, Risk and Next Step through the existing run-step closeout owner.'} Do not repeat implementation or perform VCS/release actions. Redispatch gate-check for this same target/run after recording; completed state stops.`,
+  };
+}