ctxr-cli 0.8.0 → 0.10.0

package/dist/commands/source-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-check.d.ts","sourceRoot":"","sources":["../../src/commands/source-check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAI7C,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnE;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAoC1C"}
+{"version":3,"file":"source-check.d.ts","sourceRoot":"","sources":["../../src/commands/source-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAK7C,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE3G,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAqDnE;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAkC1C"}

package/dist/commands/source-check.js

@@ -1,15 +1,60 @@
-import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { contentHash } from '../core/content/canonicalize.js';
+import { hashOfCapture } from '../core/ingest/capture-hash.js';
 import { NoteNotFoundError } from '../core/errors.js';
 import { ExitCode } from '../core/exit-codes.js';
+import { hasAssignedIdentity } from '../core/ingest/identity.js';
 import { evaluateSourceCheck } from '../core/ingest/model.js';
-import { listNotes } from '../core/notes/list.js';
+import { listCaptures, listNotes } from '../core/notes/list.js';
 export const requires = { store: 'required' };
 function toStoreRelativePath(env, store, givenPath) {
     const absolute = path.isAbsolute(givenPath) ? givenPath : path.resolve(env.cwd, givenPath);
     return path.relative(store.root, absolute).split(path.sep).join('/');
 }
+/**
+ * retain-captures-as-provenance: the index is the union of the capture tier
+ * and the notes still carrying identity from before it existed. `listNotes`
+ * alone would return nothing at all, since the capture root is a declared
+ * retrieval exclusion. This includes the candidate itself — see
+ * `excludeUnassignedCandidate`, applied by the caller, for whether and when
+ * that self-record is removed before evaluation.
+ */
+async function identityRecords(store) {
+    const [captures, notes] = await Promise.all([
+        listCaptures(store.root, store.config),
+        listNotes(store.root, store.config),
+    ]);
+    // One file is one record. A store that has not (yet) excluded its capture
+    // root would otherwise have every capture enumerated twice, and two records
+    // sharing a source-id is exactly the `multiple_matches` refusal — a config
+    // gap must not read as an ambiguity in the material.
+    const byPath = new Map();
+    for (const record of [...captures, ...notes])
+        byPath.set(record.path, record);
+    return [...byPath.values()];
+}
+/**
+ * exclude-candidate-from-source-check: the candidate is always present in
+ * `identityRecords()`'s result (it is itself a capture or a note), so
+ * without this it is always a candidate for matching itself. Whether that
+ * self-match is a bug depends on whether the candidate has been assigned
+ * identity by ingest (`source_hash` or `ingested` present):
+ *
+ * - Not assigned: a capture pipeline is permitted to pre-know its own
+ *   `source_type`/`source_id` at capture time, before it has ever been
+ *   ingested. Matching it against itself would report `already_ingested`
+ *   for material that has never been ingested — the candidate is excluded.
+ * - Already assigned: the candidate genuinely has been ingested (or
+ *   stamped). Re-checking it against its own identity is a legitimate
+ *   question — "has this been ingested?" — and the honest answer is yes,
+ *   naming itself. It stays in the comparison set.
+ */
+function excludeUnassignedCandidate(records, candidatePath) {
+    const candidate = records.find((record) => record.path === candidatePath);
+    if (candidate && !hasAssignedIdentity(candidate)) {
+        return records.filter((record) => record.path !== candidatePath);
+    }
+    return [...records];
+}
 /**
  * context-ingest spec: evaluate, in order, source-id match then content-
  * hash match, never proceeding past a stage with more than one match. Only
@@ -19,19 +64,17 @@ function toStoreRelativePath(env, store, givenPath) {
  */
 export async function execute(env, store, flags) {
     const relativePath = toStoreRelativePath(env, store, flags.path);
-    const absolutePath = path.join(store.root, relativePath);
-    let raw;
+    let hash;
     try {
-        raw = await readFile(absolutePath, 'utf8');
+        ({ hash } = await hashOfCapture(store.root, relativePath));
     }
     catch (err) {
         if (err.code === 'ENOENT')
             throw new NoteNotFoundError(relativePath);
         throw err;
     }
-    const hash = contentHash(raw, relativePath);
-    const notes = await listNotes(store.root, store.config);
-    const result = evaluateSourceCheck(notes, hash, flags.sourceId, store.config.ingest.tracking_params);
+    const records = excludeUnassignedCandidate(await identityRecords(store), relativePath);
+    const result = evaluateSourceCheck(records, hash, flags.sourceId, store.config.ingest.tracking_params);
     const findings = result.verdict === 'multiple_matches'
         ? [
             {

package/dist/commands/source-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-check.js","sourceRoot":"","sources":["../../src/commands/source-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAS/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,KAAY,EACZ,KAAuB;IAEvB,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAEzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAErG,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,KAAK,kBAAkB;QACnC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,8CAA8C,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC1G,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aAC1D;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACpF,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE;QACvC,QAAQ;QACR,YAAY,EAAE,GAAG,YAAY,KAAK,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvH,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"source-check.js","sourceRoot":"","sources":["../../src/commands/source-check.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAA+C,MAAM,yBAAyB,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAS/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,KAAY;IACzC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACtC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,0BAA0B,CAAC,OAAkC,EAAE,aAAqB;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC1E,IAAI,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,KAAY,EACZ,KAAuB;IAEvB,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAEvG,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,KAAK,kBAAkB;QACnC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,8CAA8C,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC1G,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aAC1D;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACpF,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE;QACvC,QAAQ;QACR,YAAY,EAAE,GAAG,YAAY,KAAK,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvH,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/commands/source-stamp.d.ts

@@ -14,11 +14,12 @@ export interface SourceStampData {
 }
 /**
  * context-ingest spec (store-primitives-from-migration-audit D2): records
- * source identity on a note directly — the opportunistic-backfill path for
- * a legacy note that predates identity fields, or any note an operator
- * wants dedupe to recognize without re-running full ingest. `--hash`
- * defaults to the note's CURRENT content hash, matching what `ingest`
- * itself computes.
+ * source identity on a record directly — the opportunistic-backfill path for
+ * a legacy note that predates identity fields, a capture an operator filed by
+ * hand, or anything else dedupe should recognize without re-running full
+ * ingest. `--hash` defaults to the record's CURRENT content hash, computed by
+ * the same sidecar-aware primitive `ingest` uses, so stamping a sidecar
+ * records its subject's bytes rather than its own prose.
  */
 export declare function execute(env: RunEnv, store: Store, flags: SourceStampFlags): Promise<CommandOutcome<SourceStampData>>;
 //# sourceMappingURL=source-stamp.d.ts.map

package/dist/commands/source-stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-stamp.d.ts","sourceRoot":"","sources":["../../src/commands/source-stamp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAO7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAOD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAwB1H"}
+{"version":3,"file":"source-stamp.d.ts","sourceRoot":"","sources":["../../src/commands/source-stamp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAO7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAOD;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAwB1H"}

package/dist/commands/source-stamp.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { contentHashOfBody } from '../core/content/canonicalize.js';
+import { hashOfCapture } from '../core/ingest/capture-hash.js';
 import { NoteNotFoundError } from '../core/errors.js';
 import { ExitCode } from '../core/exit-codes.js';
 import { writeFileAtomic } from '../core/fs/atomic.js';
@@ -13,11 +13,12 @@ function toStoreRelativePath(env, store, givenPath) {
 }
 /**
  * context-ingest spec (store-primitives-from-migration-audit D2): records
- * source identity on a note directly — the opportunistic-backfill path for
- * a legacy note that predates identity fields, or any note an operator
- * wants dedupe to recognize without re-running full ingest. `--hash`
- * defaults to the note's CURRENT content hash, matching what `ingest`
- * itself computes.
+ * source identity on a record directly — the opportunistic-backfill path for
+ * a legacy note that predates identity fields, a capture an operator filed by
+ * hand, or anything else dedupe should recognize without re-running full
+ * ingest. `--hash` defaults to the record's CURRENT content hash, computed by
+ * the same sidecar-aware primitive `ingest` uses, so stamping a sidecar
+ * records its subject's bytes rather than its own prose.
  */
 export async function execute(env, store, flags) {
     const relativePath = toStoreRelativePath(env, store, flags.path);
@@ -31,7 +32,7 @@ export async function execute(env, store, flags) {
             throw new NoteNotFoundError(relativePath);
         throw err;
     }
-    const sourceHash = flags.hash ?? contentHashOfBody(note.body);
+    const sourceHash = flags.hash ?? (await hashOfCapture(store.root, relativePath)).hash;
     const frontmatter = { ...note.frontmatter, [SOURCE_ID_FIELD]: flags.id, [SOURCE_HASH_FIELD]: sourceHash };
     await writeFileAtomic(absolutePath, renderNoteText(frontmatter, note.body));
     return {

package/dist/commands/source-stamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-stamp.js","sourceRoot":"","sources":["../../src/commands/source-stamp.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAc/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY,EAAE,KAAuB;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC;IAC1G,MAAM,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE;QAC5D,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,YAAY,YAAY,kBAAkB,KAAK,CAAC,EAAE,IAAI;QACpE,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"source-stamp.js","sourceRoot":"","sources":["../../src/commands/source-stamp.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAc/D,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAY,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY,EAAE,KAAuB;IAC9E,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC;IAC1G,MAAM,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE;QAC5D,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,YAAY,YAAY,kBAAkB,KAAK,CAAC,EAAE,IAAI;QACpE,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/commands/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAa5F"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAI9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAmB5F"}

package/dist/commands/update.js

@@ -1,5 +1,6 @@
 import { ExitCode } from '../core/exit-codes.js';
 import { reconcileStore } from '../core/reconcile.js';
+import { updateAdvisory } from '../core/version-check.js';
 import { generateAdapterOutputs } from './adapters-generate.js';
 export const requires = { store: 'required' };
 /**
@@ -13,10 +14,15 @@ export async function execute(env, store) {
     const { changed, findings } = await reconcileStore(env, store.root, store.config);
     const adapterFiles = await generateAdapterOutputs(env.git, store);
     const all = [...new Set([...changed, ...adapterFiles.filter((f) => f.changed).map((f) => f.path)])];
+    // cli-contract: the human path for the release advisory. This is the command
+    // someone runs right AFTER upgrading, so "you have not upgraded" is at its
+    // most actionable here. It never changes this command's exit code.
+    const advisory = await updateAdvisory(env, store);
     return {
         exitCode: ExitCode.Ok,
         data: { changed: all },
-        findings,
+        findings: [...findings, ...advisory.findings],
+        notices: advisory.notice ? [advisory.notice] : undefined,
         humanSummary: all.length === 0 ? 'Store is already up to date.' : `Updated ${all.length} contexture-owned file(s).`,
         storeRoot: store.root,
         schemaVersion: store.config.schema_version,

package/dist/commands/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAO/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;QACtB,QAAQ;QACR,YAAY,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAM,4BAA4B;QACnH,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAO/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAElD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;QACtB,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,YAAY,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAM,4BAA4B;QACnH,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/commands/verify.d.ts

@@ -1,4 +1,5 @@
 import type { CommandOutcome, CommandRequires } from '../core/command.js';
+import type { RunEnv } from '../core/env.js';
 import type { Store } from '../core/store.js';
 export declare const requires: CommandRequires;
 export interface VerifyFlags {
@@ -6,11 +7,19 @@ export interface VerifyFlags {
 }
 export interface VerifyStepResult {
     operation: string;
-    status: 'pass' | 'fail';
+    /**
+     * isolate-the-portability-test: `skip` is reported when an operation has
+     * nothing to exercise in this store — a conditional artifact that is not
+     * configured. Only `fail` decides the exit code, so a skipped step is
+     * visible in the envelope without ever changing the verdict.
+     */
+    status: 'pass' | 'fail' | 'skip';
     detail?: string;
 }
 export interface VerifyData {
     steps: VerifyStepResult[];
+    /** Present only in portable mode: the commit the disposable checkout was made from. */
+    commit?: string;
 }
 /**
  * harness-portability spec: exercises core store operations "from an
@@ -26,5 +35,5 @@ export interface VerifyData {
  * drift `ctxr doctor` checks — see `integrity-checks.ts`), and that a skill
  * is reachable by path at the configured skills path.
  */
-export declare function execute(store: Store, _flags?: VerifyFlags): Promise<CommandOutcome<VerifyData>>;
+export declare function execute(env: RunEnv, store: Store, flags?: VerifyFlags): Promise<CommandOutcome<VerifyData>>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/commands/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAoB1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CA8FzG"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAsB1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAI7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAS/D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CA6HrH"}

package/dist/commands/verify.js

@@ -8,8 +8,19 @@ import { readFencedRegionFromFile } from '../core/fs/fenced-region.js';
 import { buildGraphFromNotes, graphBuildOptions } from '../core/graph/model.js';
 import { writeGraph } from '../core/graph/persist.js';
 import { listNotes } from '../core/notes/list.js';
+import { resolveOnPath } from '../core/environment/probe.js';
 import { scanSkills } from '../core/skills.js';
+import { sanctionedPath } from '../core/write-lifecycle/path-gate.js';
+import { NoCommitToVerifyError } from '../core/errors.js';
+import { runIsolatedVerify } from '../core/harness/isolated-run.js';
+import { resolveHead } from '../core/git/worktree.js';
 export const requires = { store: 'required' };
+/**
+ * The tool `templates/skills/ctxr-submit.md` and `ctxr-land.md` drive. Hardcoded
+ * on purpose: accepting a tool name from configuration would let a store point
+ * the check at something it knows is present (D4).
+ */
+const WRITE_PATH_TOOL = 'gh';
 /** Every section that renders unconditionally — Mission is checked separately since it's optional. */
 const ALWAYS_PRESENT_SECTIONS = [
     { label: 'store fundamentals', fence: AGENTS_MD_CANONICAL_FENCE },
@@ -32,7 +43,9 @@ const ALWAYS_PRESENT_SECTIONS = [
  * drift `ctxr doctor` checks — see `integrity-checks.ts`), and that a skill
  * is reachable by path at the configured skills path.
  */
-export async function execute(store, _flags = {}) {
+export async function execute(env, store, flags = {}) {
+    if (flags.portable)
+        return executePortable(env, store);
     const steps = [];
     // 1. A retrieval query — reading a catalog section works even before any
     // build has ever run (an empty, valid section), so this genuinely proves
@@ -121,9 +134,38 @@ export async function execute(store, _flags = {}) {
             detail: err instanceof Error ? err.message : String(err),
         });
     }
+    // 7. The write-path gate — the store's surviving refusal mechanism. Every
+    // other operation here is a happy path; this one asks whether the gate still
+    // says no. The path escapes the store, which `sanctionedPath` refuses
+    // unconditionally: its sanctioned-location rule is inert until
+    // `write_lifecycle.writable_paths` is declared, so a step built on that half
+    // would pass vacuously on a default store (D3).
+    const gated = await sanctionedPath(store.config, store.root, path.join('..', 'outside.md'));
+    if (gated.ok || gated.reason === undefined) {
+        steps.push({
+            operation: 'write-path gate refuses an escaping path',
+            status: 'fail',
+            detail: 'the gate produced no refusal for a path resolving outside the store',
+        });
+        return finish(store, steps);
+    }
+    steps.push({ operation: 'write-path gate refuses an escaping path', status: 'pass' });
+    // 8. The external tooling the shipped write-path skills invoke. Presence
+    // only — nothing is executed, and no tool name comes from configuration.
+    const resolved = await resolveOnPath(WRITE_PATH_TOOL, env.env);
+    if (resolved === null) {
+        steps.push({
+            operation: `write-path prerequisite "${WRITE_PATH_TOOL}" on PATH`,
+            status: 'fail',
+            detail: `"${WRITE_PATH_TOOL}" is not on PATH; the shipped submit and land skills invoke it.`,
+        });
+        return finish(store, steps);
+    }
+    steps.push({ operation: `write-path prerequisite "${WRITE_PATH_TOOL}" on PATH`, status: 'pass' });
     return finish(store, steps);
 }
-function finish(store, steps) {
+function finish(store, steps, commit) {
+    // Only `fail` is failing — a skipped operation never changes the exit code.
     const failed = steps.find((s) => s.status === 'fail');
     const findings = failed
         ? [
@@ -135,15 +177,54 @@ function finish(store, steps) {
             },
         ]
         : [];
+    // D2: a portable pass is a statement about the recorded commit, never about
+    // the working tree, so the summary always names which commit it was.
+    const at = commit === undefined ? '' : ` at commit ${commit.slice(0, 12)}`;
+    const mode = commit === undefined ? 'verify' : 'verify --portable';
     return {
         exitCode: failed ? ExitCode.CheckFailed : ExitCode.Ok,
-        data: { steps },
+        data: commit === undefined ? { steps } : { steps, commit },
         findings,
         humanSummary: failed
-            ? `verify --portable failed at: ${failed.operation}`
-            : `verify --portable: all ${steps.length} operation(s) succeeded.`,
+            ? `${mode} failed${at} at: ${failed.operation}`
+            : `${mode}${at}: all ${steps.length} operation(s) succeeded.`,
         storeRoot: store.root,
         schemaVersion: store.config.schema_version,
     };
 }
+/**
+ * D1/D2: verifies the store's RECORDED COMMIT in a disposable checkout, in a
+ * child process with no harness state reachable. The refusal below is a value
+ * check on `resolveHead` rather than a caught git error, and it runs before
+ * anything is created — an unborn HEAD leaves no checkout behind.
+ */
+async function executePortable(env, store) {
+    const commit = await resolveHead(env.git, store.root);
+    if (commit === null)
+        throw new NoCommitToVerifyError();
+    const isolated = await runIsolatedVerify(env.git, store.root, env.env, commit);
+    const steps = isolated.steps.map((step) => ({
+        operation: step.operation,
+        status: step.status === 'fail' ? 'fail' : step.status === 'skip' ? 'skip' : 'pass',
+        ...(step.detail === undefined ? {} : { detail: step.detail }),
+    }));
+    // The requirement's "no harness state" clause, enforced: if the child wrote
+    // into the scrubbed home, the run was not isolated from what it claimed.
+    if (!isolated.homeWasEmpty) {
+        steps.push({
+            operation: 'isolated run leaves no harness state',
+            status: 'fail',
+            detail: 'the child wrote into the scrubbed home directory, so the run was not isolated from harness state',
+        });
+        return finish(store, steps, isolated.commit);
+    }
+    if (steps.length === 0) {
+        steps.push({
+            operation: 'isolated run',
+            status: 'fail',
+            detail: `the isolated child produced no verifiable output (exit ${isolated.exitCode})`,
+        });
+    }
+    return finish(store, steps, isolated.commit);
+}
 //# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAgB/D,sGAAsG;AACtG,MAAM,uBAAuB,GAA+C;IAC1E,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACjE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAClE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACpD,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACxD,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;CACnE,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAY,EAAE,MAAM,GAAgB,EAAE;IAClE,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,yEAAyE;IACzE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,kBAAkB,CAAC,KAAK,EAAE,YAAa,CAAC,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,gCAAgC;YAC3C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,UAAU,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,sCAAsC;YACjD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,sBAAsB,KAAK,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ,KAAK,4DAA4D;aAClF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAExE,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,kCAAkC;YAC7C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8DAA8D,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;SACnI,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kCAAkC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,gCAAgC;gBAC3C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oDAAoD,KAAK,CAAC,cAAc,0BAA0B;aAC3G,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,6DAA6D;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4BAA4B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI;SACzE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,iBAAiB,KAAK,CAAC,KAAK,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,iBAAiB,KAAK,CAAC,KAAK,WAAW;YAClD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,KAAY,EAAE,KAAyB;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAc,MAAM;QAChC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,aAAa,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE;gBAC1E,OAAO,EAAE,MAAM,CAAC,SAAS;aAC1B;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACrD,IAAI,EAAE,EAAE,KAAK,EAAE;QACf,QAAQ;QACR,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,gCAAgC,MAAM,CAAC,SAAS,EAAE;YACpD,CAAC,CAAC,0BAA0B,KAAK,CAAC,MAAM,0BAA0B;QACpE,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGtD,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAE/D;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,CAAC;AAwB7B,sGAAsG;AACtG,MAAM,uBAAuB,GAA+C;IAC1E,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACjE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAClE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACpD,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACxD,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;CACnE,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAY,EAAE,KAAK,GAAgB,EAAE;IAC9E,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,yEAAyE;IACzE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,kBAAkB,CAAC,KAAK,EAAE,YAAa,CAAC,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,gCAAgC;YAC3C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,UAAU,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,sCAAsC;YACjD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,sBAAsB,KAAK,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ,KAAK,4DAA4D;aAClF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAExE,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,kCAAkC;YAC7C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8DAA8D,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;SACnI,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kCAAkC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,gCAAgC;gBAC3C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oDAAoD,KAAK,CAAC,cAAc,0BAA0B;aAC3G,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,6DAA6D;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4BAA4B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI;SACzE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,iBAAiB,KAAK,CAAC,KAAK,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,iBAAiB,KAAK,CAAC,KAAK,WAAW;YAClD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,sEAAsE;IACtE,+DAA+D;IAC/D,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,0CAA0C;YACrD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,0CAA0C,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtF,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,4BAA4B,eAAe,WAAW;YACjE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,IAAI,eAAe,iEAAiE;SAC7F,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,4BAA4B,eAAe,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,KAAY,EAAE,KAAyB,EAAE,MAAe;IACtE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAc,MAAM;QAChC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,aAAa,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE;gBAC1E,OAAO,EAAE,MAAM,CAAC,SAAS;aAC1B;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACnE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACrD,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;QAC1D,QAAQ;QACR,YAAY,EAAE,MAAM;YAClB,CAAC,CAAC,GAAG,IAAI,UAAU,EAAE,QAAQ,MAAM,CAAC,SAAS,EAAE;YAC/C,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,KAAK,CAAC,MAAM,0BAA0B;QAC/D,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAY;IACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAuB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAClF,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;KAC9D,CAAC,CAAC,CAAC;IACJ,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,sCAAsC;YACjD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kGAAkG;SAC3G,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;YACT,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0DAA0D,QAAQ,CAAC,QAAQ,GAAG;SACvF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC"}

package/dist/commands/version.d.ts

@@ -0,0 +1,31 @@
+import type { CommandOutcome, CommandRequires } from '../core/command.js';
+import type { RunEnv } from '../core/env.js';
+import type { InstallKind } from '../core/install-kind.js';
+/**
+ * cli-contract: the CLI reports its own version and how it was installed.
+ * `store: 'absent'` — the version of the running executable is a fact about
+ * the installation, not about any store, so this must answer from a directory
+ * that resolves to no store root at all.
+ */
+export declare const requires: CommandRequires;
+export type ReleaseStatus = 'current' | 'newer-available' | 'undetermined';
+export interface VersionData {
+    version: string;
+    install_path: string;
+    install_kind: InstallKind;
+    /** Only present with --check. Null when the published version could not be resolved. */
+    latest?: string | null;
+    release_status?: ReleaseStatus;
+}
+export interface VersionFlags {
+    check?: boolean;
+}
+/**
+ * Unlike the session-start/update advisory, this check IS the command's whole
+ * purpose, so it fails loud: an answer that could not be determined exits with
+ * the usage code naming what was missing, rather than degrading to "current".
+ * It also reads the registry directly, never the cache — an operator who asks
+ * explicitly is asking about now.
+ */
+export declare function execute(env: RunEnv, flags?: VersionFlags): Promise<CommandOutcome<VersionData>>;
+//# sourceMappingURL=version.d.ts.map

package/dist/commands/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/commands/version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAM3D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,eAAqC,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,WAAW,CAAC;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAuDzG"}

package/dist/commands/version.js

@@ -0,0 +1,87 @@
+import { ExitCode } from '../core/exit-codes.js';
+import { resolveInstallLocation } from '../core/install-kind.js';
+import { ownPackageName } from '../core/registry.js';
+import { compareRelease } from '../core/version-check.js';
+import { CLI_VERSION } from '../version.js';
+/**
+ * cli-contract: the CLI reports its own version and how it was installed.
+ * `store: 'absent'` — the version of the running executable is a fact about
+ * the installation, not about any store, so this must answer from a directory
+ * that resolves to no store root at all.
+ */
+export const requires = { store: 'absent' };
+/**
+ * Unlike the session-start/update advisory, this check IS the command's whole
+ * purpose, so it fails loud: an answer that could not be determined exits with
+ * the usage code naming what was missing, rather than degrading to "current".
+ * It also reads the registry directly, never the cache — an operator who asks
+ * explicitly is asking about now.
+ */
+export async function execute(env, flags = {}) {
+    const install = resolveInstallLocation(env.execPath);
+    const base = {
+        version: CLI_VERSION,
+        install_path: install.path,
+        install_kind: install.kind,
+    };
+    if (!flags.check) {
+        return {
+            exitCode: ExitCode.Ok,
+            data: base,
+            findings: [],
+            humanSummary: CLI_VERSION,
+            storeRoot: null,
+            schemaVersion: null,
+        };
+    }
+    const lookup = await env.registry.latestVersion(ownPackageName());
+    if (lookup.kind === 'undetermined') {
+        return undetermined(base, `the latest published version could not be determined: ${lookup.reason}`);
+    }
+    const comparison = compareRelease(CLI_VERSION, lookup.version);
+    if (comparison.kind === 'undetermined') {
+        return undetermined({ ...base, latest: lookup.version }, comparison.reason);
+    }
+    if (comparison.kind === 'newer-available') {
+        const finding = {
+            code: 'cli.update_available',
+            severity: 'info',
+            message: `ctxr ${comparison.installed} is installed; ${comparison.latest} is available.`,
+            subject: ownPackageName(),
+            details: { installed: comparison.installed, latest: comparison.latest },
+        };
+        return {
+            exitCode: ExitCode.CheckFailed,
+            data: { ...base, latest: lookup.version, release_status: 'newer-available' },
+            findings: [finding],
+            humanSummary: `ctxr ${comparison.installed} is installed; ${comparison.latest} is available.`,
+            storeRoot: null,
+            schemaVersion: null,
+        };
+    }
+    return {
+        exitCode: ExitCode.Ok,
+        data: { ...base, latest: lookup.version, release_status: 'current' },
+        findings: [],
+        humanSummary: `ctxr ${CLI_VERSION} is the latest published version.`,
+        storeRoot: null,
+        schemaVersion: null,
+    };
+}
+function undetermined(data, reason) {
+    const finding = {
+        code: 'cli.update_check_failed',
+        severity: 'info',
+        message: reason,
+        subject: ownPackageName(),
+    };
+    return {
+        exitCode: ExitCode.Usage,
+        data: { ...data, latest: data.latest ?? null, release_status: 'undetermined' },
+        findings: [finding],
+        humanSummary: `error: ${reason}`,
+        storeRoot: null,
+        schemaVersion: null,
+    };
+}
+//# sourceMappingURL=version.js.map

package/dist/commands/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/commands/version.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAiB7D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAK,GAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI;KAC3B,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,yDAAyD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAY;YACvB,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,QAAQ,UAAU,CAAC,SAAS,kBAAkB,UAAU,CAAC,MAAM,gBAAgB;YACxF,OAAO,EAAE,cAAc,EAAE;YACzB,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SACxE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,WAAW;YAC9B,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC5E,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,YAAY,EAAE,QAAQ,UAAU,CAAC,SAAS,kBAAkB,UAAU,CAAC,MAAM,gBAAgB;YAC7F,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE;QACpE,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,QAAQ,WAAW,mCAAmC;QACpE,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAc;IACrD,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE;QAC9E,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,YAAY,EAAE,UAAU,MAAM,EAAE;QAChC,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC"}