dotmem 0.0.8 → 0.0.9

package/index.cjs

@@ -674,7 +674,7 @@ var init_detection_events = __esm({
 });
 
 // core/knowledge/policy.ts
-var ENFORCEMENT_TIERS, POLICY_DIR_NAME, PolicyAuthorityError, validatePolicyAuthority, TIER_ENFORCEMENT, TIER_ACTION, CONVERSATIONAL_OVERRIDE_KEYS, ConversationalOverrideRejectedError, PolicyPreconditionViolationError, assertNoConversationalOverride, findPolicyBypassKey, canonicalEvent, findFieldValue, evaluateCondition, validatePolicyAuditAuthority, authorityRelaxationPermitted, authorityRevocationPermitted, canonicalPolicyFingerprint, resolveOverrideState, resolveEffectivePolicies, evaluatePolicies, applyOverrideOverlay, stripNonAuthoritativeTierFields;
+var ENFORCEMENT_TIERS, POLICY_DIR_NAME, PolicyAuthorityError; exports.validateGovernanceAuthority = void 0; var TIER_ENFORCEMENT, TIER_ACTION, CONVERSATIONAL_OVERRIDE_KEYS, ConversationalOverrideRejectedError, PolicyPreconditionViolationError, assertNoConversationalOverride, findPolicyBypassKey, canonicalEvent, findFieldValue, evaluateCondition, validatePolicyAuditAuthority, authorityRelaxationPermitted, authorityRevocationPermitted, canonicalPolicyFingerprint, resolveOverrideState, resolveEffectivePolicies, evaluatePolicies, applyOverrideOverlay, stripNonAuthoritativeTierFields;
 var init_policy = __esm({
   "core/knowledge/policy.ts"() {
     init_canonical_hash();
@@ -690,7 +690,7 @@ var init_policy = __esm({
         this.name = "PolicyAuthorityError";
       }
     };
-    validatePolicyAuthority = /* @__PURE__ */ __name((value) => {
+    exports.validateGovernanceAuthority = /* @__PURE__ */ __name((value) => {
       if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new PolicyAuthorityError("Policy authority requires an authority object");
       }
@@ -825,17 +825,17 @@ var init_policy = __esm({
       if (candidate.kind === "system") {
         return { kind: "system", source: candidate.source.trim() };
       }
-      return validatePolicyAuthority(candidate);
+      return exports.validateGovernanceAuthority(candidate);
     }, "validatePolicyAuditAuthority");
     authorityRelaxationPermitted = /* @__PURE__ */ __name((targetAuthority, actorAuthority) => {
-      validatePolicyAuthority(targetAuthority);
-      validatePolicyAuthority(actorAuthority);
+      exports.validateGovernanceAuthority(targetAuthority);
+      exports.validateGovernanceAuthority(actorAuthority);
       if (targetAuthority.kind === "HI") return actorAuthority.kind === "HI";
       return actorAuthority.kind === "HI" || actorAuthority.kind === "operator";
     }, "authorityRelaxationPermitted");
     authorityRevocationPermitted = /* @__PURE__ */ __name((overrideAuthority, actorAuthority) => {
-      validatePolicyAuthority(overrideAuthority);
-      validatePolicyAuthority(actorAuthority);
+      exports.validateGovernanceAuthority(overrideAuthority);
+      exports.validateGovernanceAuthority(actorAuthority);
       if (actorAuthority.kind === "HI") return true;
       return overrideAuthority.kind === "operator";
     }, "authorityRevocationPermitted");
@@ -2238,7 +2238,7 @@ var init_policy_store = __esm({
     resolveUserPolicyFilePath = /* @__PURE__ */ __name((namespace2) => joinPath(resolveUserPolicyDir2(), `${namespace2}.policy.json`), "resolveUserPolicyFilePath");
     validatePolicyAuthority2 = /* @__PURE__ */ __name((value) => {
       try {
-        return validatePolicyAuthority(value);
+        return exports.validateGovernanceAuthority(value);
       } catch (error) {
         emitPolicyAuthorityDetection(value);
         throw error instanceof PolicyStoreError ? error : new PolicyStoreError(error.message);
@@ -2414,6 +2414,7 @@ var init_policy_store = __esm({
       if (entry.target !== void 0) built.target = entry.target;
       if (entry.reason !== void 0) built.reason = entry.reason;
       if (entry.detail !== void 0) built.detail = entry.detail;
+      if (entry.mandatory !== void 0) built.mandatory = entry.mandatory;
       return built;
     }, "validatePolicyAuditEntry");
     validatePolicyDocument = /* @__PURE__ */ __name((value) => {
@@ -2491,6 +2492,7 @@ var init_policy_store = __esm({
       if (entry.target !== void 0) built.target = entry.target;
       if (entry.reason !== void 0) built.reason = entry.reason;
       if (entry.detail !== void 0) built.detail = entry.detail;
+      if (entry.mandatory !== void 0) built.mandatory = entry.mandatory;
       return built;
     }, "buildAuditEntry");
     boundedAudit = /* @__PURE__ */ __name((entries2, overrides) => {
@@ -2503,9 +2505,10 @@ var init_policy_store = __esm({
       for (let index = entries2.length - 1; index >= 0; index--) {
         const entry = entries2[index];
         const activeLinked = entry.target !== void 0 && activeOverrideIds.has(entry.target) && (entry.action === "override" || entry.action === "revoke");
-        if (activeLinked || budget > 0) {
+        const mandatory = entry.mandatory === true;
+        if (activeLinked || mandatory || budget > 0) {
           kept.unshift(entry);
-          if (!activeLinked) budget--;
+          if (!activeLinked && !mandatory) budget--;
         }
       }
       return kept;
@@ -2546,6 +2549,12 @@ var init_policy_store = __esm({
         try {
           await fs.writeFile(temporary, `${JSON.stringify(document, null, 2)}
 `, "utf8");
+          const handle = await fs.open(temporary, "r+");
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
           await fs.rename(temporary, filePath);
         } catch (error) {
           await fs.rm(temporary, { force: true }).catch(() => void 0);
@@ -5040,6 +5049,109 @@ ${contentId}
   }
 });
 
+// core/storage-coordinator/index.ts
+var nodeFs4, withStorageLock, readStorageGeneration, writeStorageGeneration;
+var init_storage_coordinator = __esm({
+  "core/storage-coordinator/index.ts"() {
+    nodeFs4 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
+    withStorageLock = /* @__PURE__ */ __name(async (directoryPath, operationOrOptions, operation, _options = {}) => {
+      const opts = typeof operationOrOptions === "function" ? operation ?? {} : operationOrOptions ?? {};
+      const op = typeof operationOrOptions === "function" ? operationOrOptions : operation;
+      const timeoutMs = opts.timeoutMs ?? 3e4;
+      const staleMs = opts.staleMs ?? 6e4;
+      const lockName = opts.lockName ?? ".storage.lock";
+      const lockPath = `${directoryPath}/${lockName}`;
+      const fs = await nodeFs4();
+      const started = Date.now();
+      await fs.mkdir(directoryPath, { recursive: true });
+      while (true) {
+        try {
+          await fs.mkdir(lockPath);
+          const token2 = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+          await fs.writeFile(`${lockPath}/owner.json`, JSON.stringify({ token: token2, pid: process.pid, createdAt: Date.now() }), { flag: "wx" });
+          break;
+        } catch (error) {
+          const code = error.code;
+          if (code !== "EEXIST" && code !== "ENOENT" && code !== "EPERM" && code !== "ENOTEMPTY") throw error;
+          let stale = false;
+          let processDead = false;
+          try {
+            const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+            const parsed = JSON.parse(raw);
+            const ageStale = typeof parsed.createdAt === "number" && Date.now() - parsed.createdAt > staleMs;
+            if (typeof parsed.pid === "number") {
+              try {
+                process.kill(parsed.pid, 0);
+              } catch {
+                processDead = true;
+              }
+            } else {
+              processDead = true;
+            }
+            if (ageStale || processDead) stale = true;
+          } catch {
+            stale = true;
+          }
+          if (stale) {
+            if (processDead) {
+              try {
+                await fs.rm(lockPath, { recursive: true, force: true });
+                continue;
+              } catch {
+              }
+            }
+            try {
+              await fs.rmdir(lockPath);
+              continue;
+            } catch {
+            }
+          }
+          if (Date.now() - started > timeoutMs) {
+            throw new Error(`Storage lock timeout for ${directoryPath}`);
+          }
+          await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+      }
+      let token = "";
+      try {
+        const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+        token = JSON.parse(raw).token ?? "";
+      } catch {
+        token = "";
+      }
+      try {
+        return await op();
+      } finally {
+        try {
+          const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+          const parsed = JSON.parse(raw);
+          if (parsed.token === token && token) {
+            await fs.rm(lockPath, { recursive: true, force: true });
+          }
+        } catch {
+        }
+      }
+    }, "withStorageLock");
+    readStorageGeneration = /* @__PURE__ */ __name(async (directoryPath) => {
+      const fs = await nodeFs4();
+      try {
+        const raw = await fs.readFile(`${directoryPath}/.storage.generation`, "utf8");
+        const value = Number(raw.trim());
+        return Number.isFinite(value) && value >= 0 ? value : 0;
+      } catch {
+        return 0;
+      }
+    }, "readStorageGeneration");
+    writeStorageGeneration = /* @__PURE__ */ __name(async (directoryPath, value) => {
+      const fs = await nodeFs4();
+      await fs.mkdir(directoryPath, { recursive: true });
+      const temp = `${directoryPath}/.storage.generation.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+      await fs.writeFile(temp, String(value));
+      await fs.rename(temp, `${directoryPath}/.storage.generation`);
+    }, "writeStorageGeneration");
+  }
+});
+
 // core/knowledge/mem-repository.ts
 function resolveDuplicate(existing, existingSource, current, currentSource) {
   const existingRetracts = existing.revision?.kind === "retracts";
@@ -5080,19 +5192,20 @@ async function parseMemFile(value, sourceId) {
     throw new Error(`${message} in ${sourceId}`);
   }
 }
-var DOTMEM_DIRECTORY, DEFAULT_MEM_FILE, directoryLocks, nodeFs4, separator2, normalizePath, isAbsolutePath, resolvePath, joinPath2, parentPath, uniqueSuffix, withDirectoryLock, isMissingDirectory, sourcePriority, memFilePath, MemDirectoryKnowledgeRepository;
+var DOTMEM_DIRECTORY, DEFAULT_MEM_FILE, nodeFs5, repositoryLoadCaches, separator2, normalizePath, isAbsolutePath, resolvePath, joinPath2, parentPath, uniqueSuffix, isMissingDirectory, sourcePriority, memFilePath, MemDirectoryKnowledgeRepository;
 var init_mem_repository = __esm({
   "core/knowledge/mem-repository.ts"() {
     init_mem_codec();
     init_mem_package();
     init_state();
     init_acquisition_limits();
+    init_storage_coordinator();
     DOTMEM_DIRECTORY = ".dotmem";
     DEFAULT_MEM_FILE = "project.mem";
-    directoryLocks = /* @__PURE__ */ new Map();
-    nodeFs4 = /* @__PURE__ */ __name(async () => {
+    nodeFs5 = /* @__PURE__ */ __name(async () => {
       return import('fs/promises');
     }, "nodeFs");
+    repositoryLoadCaches = /* @__PURE__ */ new Map();
     separator2 = /* @__PURE__ */ __name(() => process.platform === "win32" ? "\\" : "/", "separator");
     normalizePath = /* @__PURE__ */ __name((value) => value.replace(/[\\/]+/g, separator2()), "normalizePath");
     isAbsolutePath = /* @__PURE__ */ __name((value) => /^(?:[A-Za-z]:[\\/]|[\\/])/.test(value), "isAbsolutePath");
@@ -5104,25 +5217,8 @@ var init_mem_repository = __esm({
       return index <= 0 ? "." : normalized.slice(0, index);
     }, "parentPath");
     uniqueSuffix = /* @__PURE__ */ __name(() => globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`, "uniqueSuffix");
-    withDirectoryLock = /* @__PURE__ */ __name(async (directoryPath, operation) => {
-      const previous = directoryLocks.get(directoryPath) ?? Promise.resolve();
-      let release = /* @__PURE__ */ __name(() => void 0, "release");
-      const gate = new Promise((resolveGate) => {
-        release = resolveGate;
-      });
-      const queued = previous.then(() => gate);
-      directoryLocks.set(directoryPath, queued);
-      await previous;
-      try {
-        return await operation();
-      } finally {
-        release();
-        if (directoryLocks.get(directoryPath) === queued) directoryLocks.delete(directoryPath);
-      }
-    }, "withDirectoryLock");
     isMissingDirectory = /* @__PURE__ */ __name((error) => error.code === "ENOENT", "isMissingDirectory");
     sourcePriority = /* @__PURE__ */ __name((sourceId, scope) => {
-      if (sourceId.endsWith(".mem") && sourceId !== "project.mem" && sourceId !== "user.mem" && sourceId !== "agent.mem") return 0;
       if (scope === "project" || sourceId === "project.mem") return 4;
       if (scope === "user" || sourceId === "user.mem") return 3;
       if (sourceId === "agent.mem" || sourceId === "agent") return 2;
@@ -5150,7 +5246,7 @@ var init_mem_repository = __esm({
         this.loadWritableOnly = loadWritableOnly;
       }
       async discover() {
-        const { readdir } = await nodeFs4();
+        const { readdir } = await nodeFs5();
         try {
           const entries2 = await readdir(this.directoryPath, { withFileTypes: true });
           return entries2.filter((entry) => entry.isFile() && entry.name.endsWith(".mem") && entry.name !== "@brain.mem").map((entry) => entry.name).sort((a, b) => a.localeCompare(b));
@@ -5165,7 +5261,7 @@ var init_mem_repository = __esm({
        * receive a clear failure instead of discovering corruption on first use.
        */
       async initialize() {
-        const { mkdir } = await nodeFs4();
+        const { mkdir } = await nodeFs5();
         await mkdir(this.directoryPath, { recursive: true });
         await this.load();
       }
@@ -5180,7 +5276,7 @@ var init_mem_repository = __esm({
        * that does not delete is not a delete.
        */
       async clearWritable() {
-        const { rm, readdir } = await nodeFs4();
+        const { rm, readdir } = await nodeFs5();
         const filePath = memFilePath(this.directoryPath, this.writableSourceId);
         await rm(filePath, { force: true });
         await rm(`${filePath}.bak`, { force: true });
@@ -5197,15 +5293,28 @@ var init_mem_repository = __esm({
         }
       }
       async load() {
-        const loaded = this.loadWritableOnly ? await this.loadSources([this.writableSourceId]) : await this.loadSources();
-        return this.combine(loaded);
+        const cacheKey = `${this.directoryPath}:${this.writableSourceId}:${this.loadWritableOnly}`;
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+          const generationBefore = await readStorageGeneration(this.directoryPath);
+          const cached = repositoryLoadCaches.get(cacheKey);
+          if (cached && cached.signature === String(generationBefore)) {
+            return structuredClone(cached.state);
+          }
+          const loaded = this.loadWritableOnly ? await this.loadSources([this.writableSourceId]) : await this.loadSources();
+          const state3 = this.combine(loaded);
+          const generationAfter = await readStorageGeneration(this.directoryPath);
+          if (generationBefore !== generationAfter && attempt < 4) continue;
+          repositoryLoadCaches.set(cacheKey, { signature: String(generationAfter), state: structuredClone(state3) });
+          return state3;
+        }
+        throw new Error("Unable to load stable repository state");
       }
-      async save(state3, expectedVersion) {
+      async save(state3, expectedVersion, locked = false) {
         const validated = validateKnowledgeState(state3);
         if (!Number.isInteger(expectedVersion) || expectedVersion < 0 || validated.version !== expectedVersion + 1) {
           throw new Error("Invalid expected persisted version");
         }
-        await withDirectoryLock(this.directoryPath, async () => {
+        const doWrite = /* @__PURE__ */ __name(async () => {
           const loaded = await this.loadSources();
           const writable = loaded.find((source) => source.id === this.writableSourceId) ?? {
             id: this.writableSourceId,
@@ -5227,10 +5336,16 @@ var init_mem_repository = __esm({
             claims: [...writable.state.claims, ...newClaims]
           };
           await this.writeSource(writable.filePath, nextWritable, writable.preserved, writable.package);
-        });
+          await writeStorageGeneration(this.directoryPath, await readStorageGeneration(this.directoryPath) + 1);
+        }, "doWrite");
+        if (locked) {
+          await doWrite();
+        } else {
+          await withStorageLock(this.directoryPath, doWrite);
+        }
       }
       async loadSources(sourceIds) {
-        const { readFile: readFile5 } = await nodeFs4();
+        const { readFile: readFile5 } = await nodeFs5();
         const ids = sourceIds ?? await this.discover();
         const sources = [];
         for (const sourceId of ids) {
@@ -5320,7 +5435,7 @@ var init_mem_repository = __esm({
        * valid package, so the backup is always a version this library can read.
        */
       async keepLastValidVersion(filePath) {
-        const { readFile: readFile5, copyFile, rename, rm } = await nodeFs4();
+        const { readFile: readFile5, copyFile, rename, rm } = await nodeFs5();
         let current;
         try {
           current = await readFile5(filePath);
@@ -5344,7 +5459,7 @@ var init_mem_repository = __esm({
       }
       /** Best-effort directory sync: the rename is durable once the directory is. */
       async syncDirectory(directoryPath) {
-        const { open } = await nodeFs4();
+        const { open } = await nodeFs5();
         try {
           const handle = await open(directoryPath, "r");
           try {
@@ -5356,7 +5471,7 @@ var init_mem_repository = __esm({
         }
       }
       async writeSource(filePath, state3, preserved, preservedPackage) {
-        const { mkdir, rename, rm, open, readFile: readFile5 } = await nodeFs4();
+        const { mkdir, rename, rm, open, readFile: readFile5 } = await nodeFs5();
         if (!Number.isInteger(state3.version) || state3.version < 0) throw new Error("Invalid writable .mem knowledge version");
         for (const claim of state3.claims) validateClaim(claim);
         await mkdir(parentPath(filePath), { recursive: true });
@@ -5884,7 +5999,7 @@ var init_project_identity = __esm({
 });
 
 // core/knowledge/staging.ts
-var DOTMEM_STAGE_FORMAT, DOTMEM_STAGE_VERSION, StageFileError, generateRequestId, nodeCwd, resolveStagingDirectory, stagePathFor, nodeFs5, normalizeClaimIds, revisionFromOptions, writeStageFile, readStageFile, validateStageFile, commitStageFile, cleanupStageFile;
+var DOTMEM_STAGE_FORMAT, DOTMEM_STAGE_VERSION, StageFileError, generateRequestId, nodeCwd, resolveStagingDirectory, stagePathFor, nodeFs6, normalizeClaimIds, revisionFromOptions, writeStageFile, readStageFile, validateStageFile, commitStageFile, cleanupStageFile;
 var init_staging = __esm({
   "core/knowledge/staging.ts"() {
     init_claim_record();
@@ -5919,7 +6034,7 @@ var init_staging = __esm({
       return `${base}/dotmem`;
     }, "resolveStagingDirectory");
     stagePathFor = /* @__PURE__ */ __name((requestId) => `${resolveStagingDirectory()}/${requestId}.stage`, "stagePathFor");
-    nodeFs5 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
+    nodeFs6 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
     normalizeClaimIds = /* @__PURE__ */ __name((value) => {
       if (!value) return [];
       return Array.isArray(value) ? value : [value];
@@ -5944,7 +6059,7 @@ var init_staging = __esm({
       };
       const requestId = generateRequestId();
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       await fs.mkdir(resolveStagingDirectory(), { recursive: true });
       const stageFile = {
         format: DOTMEM_STAGE_FORMAT,
@@ -5964,7 +6079,7 @@ var init_staging = __esm({
     }, "writeStageFile");
     readStageFile = /* @__PURE__ */ __name(async (requestId) => {
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       try {
         const content = await fs.readFile(stagePath, "utf8");
         return JSON.parse(content);
@@ -6075,7 +6190,7 @@ var init_staging = __esm({
     }, "commitStageFile");
     cleanupStageFile = /* @__PURE__ */ __name(async (requestId) => {
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       try {
         await fs.unlink(stagePath);
       } catch (error) {
@@ -8556,10 +8671,12 @@ init_project_identity();
 init_project_anchor();
 init_acquisition_boundary();
 init_claim_record();
+init_state();
 init_router();
 init_store_queue();
 init_staging();
 init_user_paths();
+init_storage_coordinator();
 init_mem_repository();
 function normalizeClaimIds3(value) {
   if (!value) return [];
@@ -8637,23 +8754,27 @@ var acquire = {
       );
     }
     const revision = revisionFromAcquire2(opts);
+    const repository = target.repository;
     await withStoreQueue(acquisitionStoreKey(kind, scope, sourceProject), async () => {
-      const state3 = await target.runtime.select([]);
-      await target.runtime.update({
-        basedOnVersion: state3.context.knowledgeVersion,
-        claims: [buildClaimRecord({
-          id: opts.id,
-          knowledge: boundary.knowledge,
-          applicability: opts.applicability,
-          evidence: opts.evidence,
-          epistemicType: opts.epistemicType,
-          provenance: opts.provenance,
-          acquiredAt: opts.acquiredAt,
-          revision,
-          scope,
-          sourceProject,
-          kind
-        })]
+      await withStorageLock(repository.directoryPath, async () => {
+        const state3 = await repository.load();
+        const next = updateKnowledge(state3, {
+          basedOnVersion: state3.version,
+          claims: [buildClaimRecord({
+            id: opts.id,
+            knowledge: boundary.knowledge,
+            applicability: opts.applicability,
+            evidence: opts.evidence,
+            epistemicType: opts.epistemicType,
+            provenance: opts.provenance,
+            acquiredAt: opts.acquiredAt,
+            revision,
+            scope,
+            sourceProject,
+            kind
+          })]
+        });
+        await repository.save(next, state3.version, true);
       });
     });
     const verification = await target.repository.load();
@@ -10194,6 +10315,442 @@ var saveContinuityDocument = /* @__PURE__ */ __name(async (path, document) => {
   }
 }, "saveContinuityDocument");
 
+// core/continuity-ledger/index.ts
+var EVENT_ID_PREFIX = "evt.";
+var LEDGER_APPLICABILITY = { area: "continuity", baseline: false };
+var EVENT_TYPES = /* @__PURE__ */ new Set([
+  "decision",
+  "discovery",
+  "correction",
+  "conversation",
+  "commitment",
+  "open-loop",
+  "project-change",
+  "activity"
+]);
+var MEMORY_DOMAINS = /* @__PURE__ */ new Set(["environmental", "professional", "conversational", "activity"]);
+var EPITEMIC_STATUSES = /* @__PURE__ */ new Set([
+  "verified-fact",
+  "user-statement",
+  "ai-inference",
+  "hypothesis",
+  "proposal",
+  "decision",
+  "verified-result"
+]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["high", "medium", "low", "unknown"]);
+var AUTHORS = /* @__PURE__ */ new Set(["human", "ai", "system"]);
+var CHANNELS = /* @__PURE__ */ new Set(["conversation", "acquisition", "tool", "migration"]);
+var SOURCE_KINDS = /* @__PURE__ */ new Set(["claim", "file", "commit", "tool-output", "conversation"]);
+var RELATIONSHIP_KEYS = [
+  "refines",
+  "supersedes",
+  "retracts",
+  "dependsOn",
+  "resolves",
+  "relatedTo"
+];
+var isRecord = /* @__PURE__ */ __name((value) => !!value && typeof value === "object" && !Array.isArray(value), "isRecord");
+var normalizeRelationships = /* @__PURE__ */ __name((value) => {
+  const result = {
+    refines: [],
+    supersedes: [],
+    retracts: [],
+    dependsOn: [],
+    resolves: [],
+    relatedTo: []
+  };
+  if (!isRecord(value)) return result;
+  for (const key of RELATIONSHIP_KEYS) {
+    const raw = value[key];
+    if (Array.isArray(raw)) {
+      result[key] = raw.filter((item) => typeof item === "string");
+    }
+  }
+  return result;
+}, "normalizeRelationships");
+var validateEvent = /* @__PURE__ */ __name((event) => {
+  if (!isRecord(event)) throw new Error("Continuity event must be an object");
+  if (event.schemaVersion !== 1) throw new Error("Unsupported continuity event schemaVersion");
+  if (typeof event.eventId !== "string" || !event.eventId.startsWith(EVENT_ID_PREFIX)) {
+    throw new Error("Continuity event requires a valid eventId");
+  }
+  if (typeof event.eventType !== "string" || !EVENT_TYPES.has(event.eventType)) {
+    throw new Error("Continuity event requires a valid eventType");
+  }
+  if (typeof event.memoryDomain !== "string" || !MEMORY_DOMAINS.has(event.memoryDomain)) {
+    throw new Error("Continuity event requires a valid memoryDomain");
+  }
+  if (typeof event.epistemicStatus !== "string" || !EPITEMIC_STATUSES.has(event.epistemicStatus)) {
+    throw new Error("Continuity event requires a valid epistemicStatus");
+  }
+  if (typeof event.confidence !== "string" || !CONFIDENCE_VALUES.has(event.confidence)) {
+    throw new Error("Continuity event requires a valid confidence");
+  }
+  if (typeof event.createdAt !== "string") throw new Error("Continuity event requires createdAt");
+  if (typeof event.sessionId !== "string") throw new Error("Continuity event requires sessionId");
+  if (event.projectId !== null && typeof event.projectId !== "string") {
+    throw new Error("Continuity event requires projectId to be string or null");
+  }
+  if (typeof event.subject !== "string") throw new Error("Continuity event requires subject");
+  if (!isRecord(event.content)) throw new Error("Continuity event requires content object");
+  if (!Array.isArray(event.sourceRefs)) throw new Error("Continuity event requires sourceRefs array");
+  for (const ref of event.sourceRefs) {
+    if (!isRecord(ref) || typeof ref.kind !== "string" || !SOURCE_KINDS.has(ref.kind) || typeof ref.id !== "string") {
+      throw new Error("Continuity event contains an invalid sourceRef");
+    }
+  }
+  if (!isRecord(event.relationships)) throw new Error("Continuity event requires relationships object");
+  if (!isRecord(event.provenance)) throw new Error("Continuity event requires provenance object");
+  const provenance = event.provenance;
+  if (typeof provenance.author !== "string" || !AUTHORS.has(provenance.author)) {
+    throw new Error("Continuity event requires a valid provenance.author");
+  }
+  if (typeof provenance.origin !== "string") throw new Error("Continuity event requires provenance.origin");
+  if (typeof provenance.channel !== "string" || !CHANNELS.has(provenance.channel)) {
+    throw new Error("Continuity event requires a valid provenance.channel");
+  }
+  if (typeof provenance.recordedAt !== "string") throw new Error("Continuity event requires provenance.recordedAt");
+  return {
+    schemaVersion: 1,
+    eventId: event.eventId,
+    eventType: event.eventType,
+    memoryDomain: event.memoryDomain,
+    epistemicStatus: event.epistemicStatus,
+    confidence: event.confidence,
+    createdAt: event.createdAt,
+    sessionId: event.sessionId,
+    projectId: event.projectId,
+    subject: event.subject,
+    content: event.content,
+    sourceRefs: event.sourceRefs,
+    relationships: normalizeRelationships(event.relationships),
+    provenance
+  };
+}, "validateEvent");
+var isLedgerEvent = /* @__PURE__ */ __name((claim) => {
+  return isRecord(claim.knowledge) && claim.knowledge.schemaVersion === 1 && typeof claim.knowledge.eventId === "string";
+}, "isLedgerEvent");
+var loadEvents = /* @__PURE__ */ __name(async () => {
+  const state3 = await loadCombinedKnowledgeState();
+  const events = [];
+  for (const claim of state3.claims) {
+    if (isLedgerEvent(claim)) {
+      try {
+        events.push(validateEvent(claim.knowledge));
+      } catch {
+      }
+    }
+  }
+  return events.sort((left, right) => left.eventId.localeCompare(right.eventId));
+}, "loadEvents");
+var findEvent = /* @__PURE__ */ __name((events, eventId) => events.find((event) => event.eventId === eventId), "findEvent");
+var epistemicTypeFor = /* @__PURE__ */ __name((status) => {
+  if (status === "verified-fact" || status === "verified-result" || status === "decision") return "verified";
+  if (status === "user-statement") return "human-stated";
+  return "inferred";
+}, "epistemicTypeFor");
+var EVENT_ID_PATTERN = /^evt\.[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var validateEventId = /* @__PURE__ */ __name((eventId) => {
+  if (!EVENT_ID_PATTERN.test(eventId)) throw new Error(`Invalid continuity event ID: ${eventId}`);
+}, "validateEventId");
+var hasRelationshipPath = /* @__PURE__ */ __name((events, startId, targetId, relationKey) => {
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [startId];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === targetId) return true;
+    if (visited.has(current)) continue;
+    visited.add(current);
+    const event = findEvent(events, current);
+    if (!event) continue;
+    for (const next of event.relationships[relationKey]) {
+      if (!visited.has(next)) stack.push(next);
+    }
+  }
+  return false;
+}, "hasRelationshipPath");
+var CYCLIC_RELATIONSHIP_KEYS = /* @__PURE__ */ new Set([
+  "refines",
+  "supersedes",
+  "retracts",
+  "dependsOn",
+  "resolves",
+  "relatedTo"
+]);
+var validateRelationshipTargets = /* @__PURE__ */ __name(async (event, existing) => {
+  validateEventId(event.eventId);
+  for (const key of RELATIONSHIP_KEYS) {
+    for (const targetId of event.relationships[key]) {
+      validateEventId(targetId);
+      if (targetId === event.eventId) throw new Error(`Continuity event cannot reference itself: ${targetId}`);
+      const target = findEvent(existing, targetId);
+      if (!target) throw new Error(`Continuity relationship references a nonexistent event: ${targetId}`);
+      if (target.projectId !== event.projectId) {
+        throw new Error(`Cross-scope continuity relationship is not allowed: ${event.eventId} -> ${targetId}`);
+      }
+      if (CYCLIC_RELATIONSHIP_KEYS.has(key) && hasRelationshipPath(existing, targetId, event.eventId, key)) {
+        throw new Error(`Continuity relationship would create a cycle: ${event.eventId} -> ${targetId}`);
+      }
+    }
+  }
+}, "validateRelationshipTargets");
+var validateResolutionRequest = /* @__PURE__ */ __name(async (resolution, existing) => {
+  validateEventId(resolution.resolutionEventId);
+  if (!Array.isArray(resolution.conflictingEventIds) || resolution.conflictingEventIds.length === 0) {
+    throw new Error("Conflict resolution requires at least one conflicting event");
+  }
+  if (typeof resolution.selectedEventId !== "string" || !resolution.selectedEventId) {
+    throw new Error("Conflict resolution requires a selected event");
+  }
+  if (typeof resolution.reason !== "string" || !resolution.reason.trim()) {
+    throw new Error("Conflict resolution requires a reason");
+  }
+  const conflicting = resolution.conflictingEventIds.map((id) => {
+    validateEventId(id);
+    const event = findEvent(existing, id);
+    if (!event) throw new Error(`Conflict resolution references a nonexistent event: ${id}`);
+    if (event.relationships.supersedes.length !== 1) {
+      throw new Error(`Conflict resolution references a non-supersession event: ${id}`);
+    }
+    return event;
+  });
+  const targets = new Set(conflicting.map((event) => event.relationships.supersedes[0]));
+  if (targets.size !== 1) {
+    throw new Error("Conflict resolution references supersession events targeting different decisions");
+  }
+  const targetId = [...targets][0];
+  const knownCompeting = supersedingEvents(existing, targetId).map((event) => event.eventId).sort();
+  const requested = [...resolution.conflictingEventIds].sort();
+  if (requested.length !== knownCompeting.length || requested.some((id, index) => id !== knownCompeting[index])) {
+    throw new Error("Conflict resolution must include every competing supersession event");
+  }
+  if (!resolution.conflictingEventIds.includes(resolution.selectedEventId)) {
+    throw new Error("Conflict resolution selectedEventId must be one of the conflicting events");
+  }
+  const existingResolutions = existing.filter(
+    (event) => event.relationships.resolves.includes(targetId) || resolution.conflictingEventIds.some((id) => event.relationships.resolves.includes(id))
+  );
+  if (existingResolutions.length > 0) {
+    const selectedOutcomes = new Set(existingResolutions.map((event) => {
+      const content = isRecord(event.content) ? event.content : {};
+      return typeof content.selectedEventId === "string" ? content.selectedEventId : null;
+    }).filter((value) => value !== null));
+    if (existingResolutions.some((event) => event.eventId === resolution.resolutionEventId)) {
+      throw new Error(`Duplicate continuity resolution event: ${resolution.resolutionEventId}`);
+    }
+    if (selectedOutcomes.size > 0 && !selectedOutcomes.has(resolution.selectedEventId)) {
+      throw new Error("Incompatible continuity conflict resolution");
+    }
+    throw new Error("Continuity conflict is already resolved");
+  }
+  const resolutionEventId = resolution.resolutionEventId;
+  for (const conflictingId of resolution.conflictingEventIds) {
+    const event = findEvent(existing, conflictingId);
+    if (event && hasRelationshipPath(existing, conflictingId, resolutionEventId, "resolves")) {
+      throw new Error(`Continuity resolution would create a cycle: ${resolutionEventId}`);
+    }
+  }
+}, "validateResolutionRequest");
+var recordEventOnce = /* @__PURE__ */ __name(async (event) => {
+  const validated = validateEvent(event);
+  const existing = await loadEvents();
+  await validateRelationshipTargets(validated, existing);
+  if (existing.some((item) => item.eventId === validated.eventId)) {
+    throw new Error(`Continuity event already exists: ${validated.eventId}`);
+  }
+  const scope = validated.projectId ? "project" : "user";
+  const evidence = validated.sourceRefs.length > 0 ? validated.sourceRefs.map((ref) => ({
+    id: ref.id,
+    source: ref.kind,
+    observedAt: validated.createdAt,
+    supports: validated.eventId
+  })) : [{ id: validated.eventId, source: "continuity-ledger", observedAt: validated.createdAt, supports: validated.eventId }];
+  await memory.acquire({
+    id: validated.eventId,
+    knowledge: validated,
+    applicability: { ...LEDGER_APPLICABILITY, topic: validated.eventType },
+    evidence,
+    epistemicType: epistemicTypeFor(validated.epistemicStatus),
+    provenance: {
+      source: validated.provenance.origin,
+      detail: validated.provenance.channel
+    },
+    scope,
+    sourceProject: validated.projectId ?? void 0,
+    kind: "experience"
+  });
+}, "recordEventOnce");
+var recordEvent = /* @__PURE__ */ __name(async (event) => {
+  let lastError;
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    try {
+      await recordEventOnce(event);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (error instanceof Error && /Stale update/i.test(error.message) && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error("Continuity event recording failed");
+}, "recordEvent");
+var getEvent = /* @__PURE__ */ __name(async (eventId) => {
+  const events = await loadEvents();
+  return findEvent(events, eventId) ?? null;
+}, "getEvent");
+var listEvents = /* @__PURE__ */ __name(async (filter = {}) => {
+  const events = await loadEvents();
+  return events.filter((event) => {
+    if (filter.eventId && event.eventId !== filter.eventId) return false;
+    if (filter.eventType && event.eventType !== filter.eventType) return false;
+    if (filter.memoryDomain && event.memoryDomain !== filter.memoryDomain) return false;
+    if (filter.sessionId && event.sessionId !== filter.sessionId) return false;
+    if (filter.projectId !== void 0 && event.projectId !== filter.projectId) return false;
+    if (filter.epistemicStatus && event.epistemicStatus !== filter.epistemicStatus) return false;
+    return true;
+  });
+}, "listEvents");
+var supersedingEvents = /* @__PURE__ */ __name((events, eventId) => events.filter((event) => event.relationships.supersedes.includes(eventId)), "supersedingEvents");
+var retractingEvents = /* @__PURE__ */ __name((events, eventId) => events.filter((event) => event.relationships.retracts.includes(eventId)), "retractingEvents");
+var resolutionEventsFor = /* @__PURE__ */ __name((events, eventId, conflictingIds) => events.filter(
+  (event) => event.relationships.resolves.includes(eventId) || conflictingIds.some((id) => event.relationships.resolves.includes(id))
+), "resolutionEventsFor");
+var deriveValidity = /* @__PURE__ */ __name(async (eventId) => {
+  let events = await loadEvents();
+  for (let stabilityAttempt = 0; stabilityAttempt < 5; stabilityAttempt += 1) {
+    const nextEvents = await loadEvents();
+    if (nextEvents.length === events.length) break;
+    events = nextEvents;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  const supersededBy = supersedingEvents(events, eventId).map((event) => event.eventId);
+  const retractedBy = retractingEvents(events, eventId).map((event) => event.eventId);
+  const contestedBy = supersededBy.length > 1 ? supersededBy : [];
+  const resolvedBy = resolutionEventsFor(events, eventId, contestedBy).map((event) => event.eventId);
+  let state3 = "current";
+  if (retractedBy.length > 0) state3 = "retracted";
+  else if (supersededBy.length > 0) state3 = supersededBy.length > 1 && resolvedBy.length === 0 ? "contested" : "superseded";
+  else if (events.some((event) => event.eventId === eventId && event.eventType === "decision") === false) state3 = "current";
+  if (supersededBy.length > 1 && resolvedBy.length === 0) state3 = "contested";
+  return {
+    eventId,
+    state: state3,
+    supersededBy,
+    retractedBy,
+    contestedBy,
+    resolvedBy
+  };
+}, "deriveValidity");
+var listContested = /* @__PURE__ */ __name(async () => {
+  const events = await loadEvents();
+  const targets = /* @__PURE__ */ new Set();
+  for (const event of events) {
+    for (const target of event.relationships.supersedes) targets.add(target);
+  }
+  const contested = [];
+  for (const target of targets) {
+    const supersededBy = supersedingEvents(events, target);
+    if (supersededBy.length <= 1) continue;
+    const conflictingIds = supersededBy.map((event) => event.eventId);
+    const resolvedBy = resolutionEventsFor(events, target, conflictingIds);
+    if (resolvedBy.length === 0) contested.push(target);
+  }
+  return contested.sort();
+}, "listContested");
+var resolveConflictOnce = /* @__PURE__ */ __name(async (resolution) => {
+  const existing = await loadEvents();
+  await validateResolutionRequest(resolution, existing);
+  const resolutionEvent = {
+    schemaVersion: 1,
+    eventId: resolution.resolutionEventId,
+    eventType: "correction",
+    memoryDomain: "professional",
+    epistemicStatus: "decision",
+    confidence: "high",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    sessionId: "resolution",
+    projectId: null,
+    subject: "Continuity conflict resolution",
+    content: {
+      selectedEventId: resolution.selectedEventId,
+      reason: resolution.reason
+    },
+    sourceRefs: resolution.conflictingEventIds.map((id) => ({ kind: "claim", id })),
+    relationships: {
+      refines: [],
+      supersedes: [],
+      retracts: [],
+      dependsOn: [],
+      resolves: [...resolution.conflictingEventIds],
+      relatedTo: [resolution.selectedEventId]
+    },
+    provenance: {
+      author: "system",
+      origin: "continuity-ledger",
+      channel: "acquisition",
+      recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  await recordEvent(resolutionEvent);
+}, "resolveConflictOnce");
+var reconstructValidity = /* @__PURE__ */ __name(async () => {
+  const events = await loadEvents();
+  const result = [];
+  const targets = new Set(events.map((event) => event.eventId));
+  for (const event of events) {
+    for (const target of event.relationships.supersedes) targets.add(target);
+    for (const target of event.relationships.retracts) targets.add(target);
+  }
+  for (const target of targets) {
+    result.push(await deriveValidity(target));
+  }
+  return result.sort((left, right) => left.eventId.localeCompare(right.eventId));
+}, "reconstructValidity");
+var resolveConflict = /* @__PURE__ */ __name(async (resolution) => {
+  let lastError;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      await resolveConflictOnce(resolution);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (error instanceof Error && /Stale update/i.test(error.message) && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error("Continuity conflict resolution failed");
+}, "resolveConflict");
+var validateRelationships = validateRelationshipTargets;
+var continuityLedger = {
+  recordEvent,
+  record: recordEvent,
+  append: recordEvent,
+  add: recordEvent,
+  getEvent,
+  get: getEvent,
+  find: getEvent,
+  listEvents,
+  list: listEvents,
+  query: listEvents,
+  deriveValidity,
+  validity: deriveValidity,
+  listContested,
+  contested: listContested,
+  resolveConflict,
+  resolve: resolveConflict,
+  reconstructValidity,
+  validateRelationships,
+  validateRelationshipTargets,
+  validateResolution: validateResolutionRequest
+};
+
 // core/continuity/index.ts
 var continuity = {
   async context(options) {
@@ -12022,6 +12579,1232 @@ var createCompactionEngine = /* @__PURE__ */ __name((options) => new CompactionE
 // index.ts
 init_user_identity();
 init_user_paths();
+
+// core/governance/index.ts
+init_user_paths();
+init_policy();
+init_policy_namespace_lock();
+init_detection_events();
+init_policy();
+var GOVERNANCE_FILE_NAME = "governance.policy.json";
+var GOVERNANCE_FORMAT = "dotmem.governance-policy";
+var GOVERNANCE_VERSION = 1;
+var GOVERNANCE_AUDIT_RETENTION = 200;
+var GovernancePolicyError = class extends Error {
+  static {
+    __name(this, "GovernancePolicyError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "GovernancePolicyError";
+  }
+};
+var requiredText3 = /* @__PURE__ */ __name((v) => typeof v === "string" && v.trim().length > 0, "requiredText");
+var nowIso2 = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString(), "nowIso");
+var joinPath7 = /* @__PURE__ */ __name((base, child) => {
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return `${base.replace(/[\\/]+/g, sep)}${sep}${child}`;
+}, "joinPath");
+var resolveGovernanceDir = /* @__PURE__ */ __name((directory) => directory ?? joinPath7(resolveUserDotMemPath(), "policy"), "resolveGovernanceDir");
+var resolveGovernanceFilePath = /* @__PURE__ */ __name((directory) => joinPath7(resolveGovernanceDir(directory), GOVERNANCE_FILE_NAME), "resolveGovernanceFilePath");
+var ROLE_CAPABILITIES = {
+  "human-owner": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.approve", "policy.reject", "policy.activate", "policy.suspend", "policy.retire", "role.bind", "governance.read", "governance.audit.read", "agent.execute", "guardrail.stop.activate", "guardrail.stop.release"]),
+  "human-approver": /* @__PURE__ */ new Set(["policy.review", "policy.approve", "policy.reject", "governance.read", "governance.audit.read", "guardrail.stop.activate", "guardrail.stop.release"]),
+  "coordinator-jo": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.activate", "governance.read", "governance.audit.read", "agent.execute"]),
+  "specialist-agent": /* @__PURE__ */ new Set(["policy.propose", "governance.read"]),
+  "policy-authority": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.activate", "governance.read", "governance.audit.read", "agent.execute"]),
+  "auditor-reviewer": /* @__PURE__ */ new Set(["governance.read", "governance.audit.read"])
+};
+var defaultRoleBindings = /* @__PURE__ */ __name(() => [
+  { principalId: "hi", role: "human-owner", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+  { principalId: "human-owner", role: "human-owner", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+  { principalId: "jo", role: "coordinator-jo", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() }
+], "defaultRoleBindings");
+var emptyDocument2 = /* @__PURE__ */ __name(() => ({
+  format: GOVERNANCE_FORMAT,
+  version: GOVERNANCE_VERSION,
+  revision: 0,
+  policies: [],
+  roleBindings: defaultRoleBindings(),
+  audit: []
+}), "emptyDocument");
+var validateAuthority = /* @__PURE__ */ __name((value) => {
+  try {
+    return exports.validateGovernanceAuthority(value);
+  } catch (err2) {
+    void detectAuthorityEscalationAttempt({ claimed: "invalid governance authority", channel: "governance" }).catch(() => void 0);
+    throw err2 instanceof GovernancePolicyError ? err2 : new GovernancePolicyError(err2.message);
+  }
+}, "validateAuthority");
+var buildAudit = /* @__PURE__ */ __name((entry) => ({
+  id: entry.id ?? `gov-audit.${entry.action}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`,
+  action: entry.action,
+  at: entry.at,
+  ...entry.actorPrincipal !== void 0 ? { actorPrincipal: entry.actorPrincipal } : {},
+  ...entry.actorRole !== void 0 ? { actorRole: entry.actorRole } : {},
+  ...entry.targetPolicyId !== void 0 ? { targetPolicyId: entry.targetPolicyId } : {},
+  ...entry.targetVersion !== void 0 ? { targetVersion: entry.targetVersion } : {},
+  ...entry.scope !== void 0 ? { scope: entry.scope } : {},
+  outcome: entry.outcome,
+  ...entry.reason !== void 0 ? { reason: entry.reason } : {},
+  ...entry.detail !== void 0 ? { detail: entry.detail } : {},
+  ...entry.correlationId !== void 0 ? { correlationId: entry.correlationId } : {},
+  ...entry.mandatory !== void 0 ? { mandatory: entry.mandatory } : {}
+}), "buildAudit");
+var boundedAudit2 = /* @__PURE__ */ __name((entries2) => {
+  if (entries2.length <= GOVERNANCE_AUDIT_RETENTION) return [...entries2];
+  const kept = [];
+  let budget = GOVERNANCE_AUDIT_RETENTION;
+  for (let i2 = entries2.length - 1; i2 >= 0; i2--) {
+    const e = entries2[i2];
+    const mandatory = e.mandatory === true;
+    if (mandatory || budget > 0) {
+      kept.unshift(e);
+      if (!mandatory) budget--;
+    }
+  }
+  return kept;
+}, "boundedAudit");
+var validatePolicy = /* @__PURE__ */ __name((p) => {
+  if (!p || typeof p !== "object" || Array.isArray(p)) throw new GovernancePolicyError("Governance policy must be an object");
+  const r = p;
+  if (!requiredText3(r.policyId)) throw new GovernancePolicyError("policyId is required");
+  if (typeof r.version !== "number" || !Number.isInteger(r.version) || r.version < 1) throw new GovernancePolicyError("version must be a positive integer");
+  if (!requiredText3(r.scope)) throw new GovernancePolicyError("scope is required");
+  if (!requiredText3(r.rationale)) throw new GovernancePolicyError("rationale is required");
+  if (!requiredText3(r.proposedBy)) throw new GovernancePolicyError("proposedBy is required");
+  if (!requiredText3(r.proposedAt)) throw new GovernancePolicyError("proposedAt is required");
+  if (typeof r.status !== "string" || !["proposed", "under_review", "approved", "active", "rejected", "suspended", "retired"].includes(r.status)) {
+    throw new GovernancePolicyError("invalid status");
+  }
+  if (typeof r.revision !== "number" || !Number.isInteger(r.revision) || r.revision < 0) throw new GovernancePolicyError("revision must be a non-negative integer");
+  if (!Array.isArray(r.applicablePrincipals)) throw new GovernancePolicyError("applicablePrincipals must be an array");
+  if (!Array.isArray(r.applicableResources)) throw new GovernancePolicyError("applicableResources must be an array");
+  const authority = validateAuthority(r.ownerAuthority);
+  return {
+    policyId: r.policyId,
+    version: r.version,
+    ...requiredText3(r.title) ? { title: r.title } : {},
+    ...requiredText3(r.description) ? { description: r.description } : {},
+    scope: r.scope,
+    applicablePrincipals: r.applicablePrincipals,
+    applicableResources: r.applicableResources,
+    ...requiredText3(r.effectiveAt) ? { effectiveAt: r.effectiveAt } : {},
+    ...requiredText3(r.expiresAt) ? { expiresAt: r.expiresAt } : {},
+    rationale: r.rationale,
+    status: r.status,
+    ownerAuthority: authority,
+    proposedBy: r.proposedBy,
+    proposedAt: r.proposedAt,
+    ...requiredText3(r.reviewedBy) ? { reviewedBy: r.reviewedBy } : {},
+    ...requiredText3(r.reviewedAt) ? { reviewedAt: r.reviewedAt } : {},
+    ...r.approval && typeof r.approval === "object" ? { approval: r.approval } : {},
+    ...requiredText3(r.activatedBy) ? { activatedBy: r.activatedBy } : {},
+    ...requiredText3(r.activatedAt) ? { activatedAt: r.activatedAt } : {},
+    ...requiredText3(r.suspendedBy) ? { suspendedBy: r.suspendedBy } : {},
+    ...requiredText3(r.suspendedAt) ? { suspendedAt: r.suspendedAt } : {},
+    ...requiredText3(r.retiredBy) ? { retiredBy: r.retiredBy } : {},
+    ...requiredText3(r.retiredAt) ? { retiredAt: r.retiredAt } : {},
+    ...requiredText3(r.supersedes) ? { supersedes: r.supersedes } : {},
+    ...requiredText3(r.supersededBy) ? { supersededBy: r.supersededBy } : {},
+    ...requiredText3(r.correlationId) ? { correlationId: r.correlationId } : {},
+    revision: r.revision,
+    ...requiredText3(r.fingerprint) ? { fingerprint: r.fingerprint } : {}
+  };
+}, "validatePolicy");
+var validateRoleBinding = /* @__PURE__ */ __name((rb) => {
+  if (!rb || typeof rb !== "object" || Array.isArray(rb)) throw new GovernancePolicyError("role binding must be an object");
+  const r = rb;
+  if (!requiredText3(r.principalId)) throw new GovernancePolicyError("principalId is required");
+  if (typeof r.role !== "string" || !["human-owner", "human-approver", "coordinator-jo", "specialist-agent", "policy-authority", "auditor-reviewer"].includes(r.role)) {
+    throw new GovernancePolicyError("invalid role");
+  }
+  if (!requiredText3(r.scope)) throw new GovernancePolicyError("scope is required");
+  return {
+    principalId: r.principalId,
+    role: r.role,
+    scope: r.scope,
+    ...requiredText3(r.grantedBy) ? { grantedBy: r.grantedBy } : {},
+    ...requiredText3(r.grantedAt) ? { grantedAt: r.grantedAt } : {}
+  };
+}, "validateRoleBinding");
+var validateDocument2 = /* @__PURE__ */ __name((value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new GovernancePolicyError("document must be an object");
+  const d = value;
+  if (d.format !== GOVERNANCE_FORMAT) throw new GovernancePolicyError("invalid format");
+  if (d.version !== GOVERNANCE_VERSION) throw new GovernancePolicyError("invalid version");
+  if (typeof d.revision !== "number" || !Number.isInteger(d.revision) || d.revision < 0) throw new GovernancePolicyError("invalid revision");
+  if (!Array.isArray(d.policies)) throw new GovernancePolicyError("policies must be an array");
+  if (!Array.isArray(d.roleBindings)) throw new GovernancePolicyError("roleBindings must be an array");
+  if (!Array.isArray(d.audit)) throw new GovernancePolicyError("audit must be an array");
+  const policies = d.policies.map(validatePolicy);
+  const roleBindings = d.roleBindings.map(validateRoleBinding);
+  const audit = d.audit.map((e) => {
+    if (!e || typeof e !== "object" || Array.isArray(e)) throw new GovernancePolicyError("audit entry must be an object");
+    const r = e;
+    if (!requiredText3(r.id)) throw new GovernancePolicyError("audit id required");
+    if (!requiredText3(r.action)) throw new GovernancePolicyError("audit action required");
+    if (!requiredText3(r.at)) throw new GovernancePolicyError("audit at required");
+    if (r.outcome !== "applied" && r.outcome !== "rejected") throw new GovernancePolicyError("audit outcome invalid");
+    return r;
+  });
+  return { format: GOVERNANCE_FORMAT, version: GOVERNANCE_VERSION, revision: d.revision, policies, roleBindings, audit };
+}, "validateDocument");
+var scopeCovers = /* @__PURE__ */ __name((bindingScope, targetScope) => {
+  if (bindingScope === "*") return true;
+  if (bindingScope === targetScope) return true;
+  return targetScope.startsWith(bindingScope.endsWith("/") ? bindingScope : bindingScope + "/");
+}, "scopeCovers");
+var GovernancePolicyStore = class {
+  constructor(directory) {
+    this.directory = directory;
+  }
+  directory;
+  static {
+    __name(this, "GovernancePolicyStore");
+  }
+  dir() {
+    return resolveGovernanceDir(this.directory);
+  }
+  filePath() {
+    return resolveGovernanceFilePath(this.directory);
+  }
+  async load() {
+    const fs = await import('fs/promises');
+    let raw;
+    try {
+      raw = await fs.readFile(this.filePath(), "utf8");
+    } catch (err2) {
+      if (err2.code === "ENOENT") return emptyDocument2();
+      throw err2;
+    }
+    return validateDocument2(JSON.parse(raw));
+  }
+  async readDoc(fs) {
+    try {
+      const raw = await fs.readFile(this.filePath(), "utf8");
+      return validateDocument2(JSON.parse(raw));
+    } catch (err2) {
+      if (err2.code === "ENOENT") return emptyDocument2();
+      throw err2;
+    }
+  }
+  async writeDoc(fs, doc) {
+    await fs.mkdir(this.dir(), { recursive: true });
+    const fp = this.filePath();
+    const tmp = `${fp}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    try {
+      await fs.writeFile(tmp, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+      const handle = await fs.open(tmp, "r+");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await fs.rename(tmp, fp);
+    } catch (err2) {
+      await fs.rm(tmp, { force: true }).catch(() => void 0);
+      throw err2;
+    }
+  }
+  async mutate(operation, options = {}) {
+    const directory = this.dir();
+    return withPolicyNamespaceLock(async (session3) => {
+      const fs = await import('fs/promises');
+      const doc = await this.readDoc(fs);
+      if (options.basedOnRevision !== void 0 && options.basedOnRevision !== doc.revision) {
+        throw new GovernancePolicyError(`Stale governance revision: expected ${options.basedOnRevision}, current ${doc.revision}`);
+      }
+      const outcome = operation(doc);
+      let next = outcome.document;
+      validateDocument2(next);
+      await session3.assertOwnership();
+      await this.writeDoc(fs, next);
+      return outcome.result;
+    }, { directory });
+  }
+  // --- role helpers ---
+  findRoleBinding(doc, principalId, scope) {
+    const candidates = doc.roleBindings.filter((rb) => rb.principalId === principalId && scopeCovers(rb.scope, scope));
+    if (candidates.length === 0) return null;
+    return candidates.sort((a, b) => b.scope.length - a.scope.length)[0];
+  }
+  resolveRole(principalId, scope = "*") {
+    return { principalId, role: null, scope, reason: "use resolveRoleAsync" };
+  }
+  async resolveRoleAsync(principalId, scope = "*") {
+    const doc = await this.load();
+    const rb = this.findRoleBinding(doc, principalId, scope);
+    if (!rb) return { principalId, role: null, scope, reason: "no role binding for principal in scope" };
+    return { principalId, role: rb.role, scope, reason: `bound role ${rb.role} (scope ${rb.scope})` };
+  }
+  async hasPermission(principalId, action, scope) {
+    const res = await this.resolveRoleAsync(principalId, scope);
+    if (!res.role) return false;
+    return ROLE_CAPABILITIES[res.role].has(action);
+  }
+  // --- role binding governed ---
+  async bindRole(input, basedOnRevision) {
+    const authority = validateAuthority(input.authority);
+    if (!requiredText3(input.principalId)) throw new GovernancePolicyError("principalId is required");
+    if (!requiredText3(input.grantedBy)) throw new GovernancePolicyError("grantedBy is required");
+    if (input.principalId === input.grantedBy && (input.role === "human-owner" || input.role === "human-approver" || input.role === "policy-authority")) {
+      void detectSelfPromoted({ claim: `self-grant ${input.role}`, channel: "governance.role.bind" }).catch(() => void 0);
+      throw new GovernancePolicyError("self-grant of elevated role denied");
+    }
+    const doc0 = await this.load();
+    const grantedByRole = this.findRoleBinding(doc0, input.grantedBy, input.scope ?? "*");
+    if (!grantedByRole || !ROLE_CAPABILITIES[grantedByRole.role].has("role.bind")) {
+      throw new GovernancePolicyError("grantedBy lacks role.bind authority");
+    }
+    if (authority.kind !== "HI" && authority.kind !== "operator") {
+      throw new GovernancePolicyError("invalid authority for role binding");
+    }
+    const binding = {
+      principalId: input.principalId,
+      role: input.role,
+      scope: input.scope || "*",
+      grantedBy: input.grantedBy,
+      grantedAt: nowIso2()
+    };
+    return this.mutate((doc) => {
+      const nextBindings = [...doc.roleBindings.filter((rb) => !(rb.principalId === binding.principalId && rb.scope === binding.scope)), binding];
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "role.bind",
+        at: binding.grantedAt,
+        actorPrincipal: input.grantedBy,
+        actorRole: grantedByRole.role,
+        scope: binding.scope,
+        outcome: "applied",
+        detail: `bound ${binding.principalId} to ${binding.role} in scope ${binding.scope}`,
+        correlationId: void 0
+      })]);
+      return { document: { ...doc, revision, roleBindings: nextBindings, audit }, result: binding };
+    }, { basedOnRevision });
+  }
+  // --- propose ---
+  async propose(input, basedOnRevision) {
+    if (!input || typeof input !== "object") throw new GovernancePolicyError("proposal input required");
+    if (!requiredText3(input.scope)) throw new GovernancePolicyError("scope is required");
+    if (!requiredText3(input.rationale)) throw new GovernancePolicyError("rationale is required");
+    if (!requiredText3(input.proposedBy)) throw new GovernancePolicyError("proposedBy is required");
+    const authority = validateAuthority(input.authority);
+    const doc0 = await this.load();
+    if (!await this.hasPermission(input.proposedBy, "policy.propose", input.scope)) {
+      void detectAuthorityEscalationAttempt({ claimed: `${input.proposedBy} propose without permission`, channel: "governance.propose" }).catch(() => void 0);
+      await this.recordDenial(doc0, "policy.propose", input.proposedBy, input.scope, "permission denied");
+      throw new GovernancePolicyError("proposer lacks policy.propose permission");
+    }
+    const policyId = requiredText3(input.policyId) ? input.policyId : `gov-policy.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const existing = doc0.policies.filter((p) => p.policyId === policyId);
+    const version = existing.length > 0 ? Math.max(...existing.map((p) => p.version)) + 1 : 1;
+    const supersedes = input.supersedes;
+    const policy2 = {
+      policyId,
+      version,
+      ...requiredText3(input.title) ? { title: input.title } : {},
+      ...requiredText3(input.description) ? { description: input.description } : {},
+      scope: input.scope,
+      applicablePrincipals: input.applicablePrincipals ?? [],
+      applicableResources: input.applicableResources ?? [],
+      ...requiredText3(input.effectiveAt) ? { effectiveAt: input.effectiveAt } : {},
+      ...requiredText3(input.expiresAt) ? { expiresAt: input.expiresAt } : {},
+      rationale: input.rationale,
+      status: "proposed",
+      ownerAuthority: authority,
+      proposedBy: input.proposedBy,
+      proposedAt: nowIso2(),
+      ...requiredText3(supersedes) ? { supersedes } : {},
+      ...requiredText3(input.correlationId) ? { correlationId: input.correlationId } : {},
+      revision: 0
+    };
+    return this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const fingerprint = `${policy2.policyId}@v${policy2.version}`;
+      const stored = { ...policy2, revision, fingerprint };
+      const policies = [...doc.policies, stored];
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.proposed",
+        at: stored.proposedAt,
+        actorPrincipal: input.proposedBy,
+        targetPolicyId: stored.policyId,
+        targetVersion: stored.version,
+        scope: stored.scope,
+        outcome: "applied",
+        detail: `policy ${stored.policyId} v${stored.version} proposed`,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: stored };
+    }, { basedOnRevision });
+  }
+  async recordDenial(doc, action, actor, scope, reason) {
+    try {
+      await this.mutate((d) => {
+        const revision = d.revision + 1;
+        const audit = boundedAudit2([...d.audit, buildAudit({
+          action: `${action}.denied`,
+          at: nowIso2(),
+          actorPrincipal: actor,
+          scope,
+          outcome: "rejected",
+          reason
+        })]);
+        return { document: { ...d, revision, audit }, result: void 0 };
+      });
+    } catch {
+    }
+  }
+  // --- review ---
+  async review(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.reviewerPrincipal)) throw new GovernancePolicyError("reviewerPrincipal is required");
+    const doc0 = await this.load();
+    if (!await this.hasPermission(input.reviewerPrincipal, "policy.review", "*")) {
+      const pol = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+      const scope = pol?.scope ?? "*";
+      if (!await this.hasPermission(input.reviewerPrincipal, "policy.review", scope)) {
+        await this.recordDenial(doc0, "policy.review", input.reviewerPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("reviewer lacks policy.review permission");
+      }
+    }
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    if (policy2.status !== "proposed") throw new GovernancePolicyError(`cannot review policy in status ${policy2.status}`);
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const updated = {
+        ...doc.policies[idx],
+        status: "under_review",
+        reviewedBy: input.reviewerPrincipal,
+        reviewedAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.reviewed",
+        at: updated.reviewedAt,
+        actorPrincipal: input.reviewerPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- decide (approve/reject) ---
+  async decide(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.approverPrincipal)) throw new GovernancePolicyError("approverPrincipal is required");
+    if (input.decision !== "approved" && input.decision !== "rejected") throw new GovernancePolicyError("decision must be approved or rejected");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    const action = input.decision === "approved" ? "policy.approve" : "policy.reject";
+    if (!await this.hasPermission(input.approverPrincipal, "policy.approve", scope) && !await this.hasPermission(input.approverPrincipal, "policy.reject", scope)) {
+      if (!await this.hasPermission(input.approverPrincipal, "policy.approve", scope)) {
+        await this.recordDenial(doc0, action, input.approverPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("approver lacks approval permission");
+      }
+    }
+    if (input.approverPrincipal === policy2.proposedBy) {
+      void detectSelfPromoted({ claim: `self-approval ${policy2.policyId}`, channel: "governance.approve" }).catch(() => void 0);
+      await this.recordDenial(doc0, action, input.approverPrincipal, scope, "self-approval denied");
+      throw new GovernancePolicyError("self-approval denied: proposer cannot be sole approver");
+    }
+    if (policy2.status !== "under_review" && policy2.status !== "proposed") {
+      throw new GovernancePolicyError(`cannot decide policy in status ${policy2.status}`);
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      const newStatus = input.decision === "approved" ? "approved" : "rejected";
+      const updated = {
+        ...current,
+        status: newStatus,
+        approval: {
+          approverPrincipal: input.approverPrincipal,
+          decision: input.decision,
+          ...requiredText3(input.reason) ? { reason: input.reason } : {},
+          at: nowIso2()
+        }
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: input.decision === "approved" ? "policy.approved" : "policy.rejected",
+        at: updated.approval.at,
+        actorPrincipal: input.approverPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- activate ---
+  async activate(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.activatorPrincipal)) throw new GovernancePolicyError("activatorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    if (policy2.status !== "approved") throw new GovernancePolicyError(`cannot activate policy in status ${policy2.status}`);
+    const scope = policy2.scope;
+    if (!await this.hasPermission(input.activatorPrincipal, "policy.activate", scope)) {
+      await this.recordDenial(doc0, "policy.activate", input.activatorPrincipal, scope, "permission denied");
+      throw new GovernancePolicyError("activator lacks policy.activate permission");
+    }
+    const now3 = /* @__PURE__ */ new Date();
+    if (policy2.effectiveAt && Date.parse(policy2.effectiveAt) > now3.getTime()) {
+      throw new GovernancePolicyError("policy not yet effective");
+    }
+    if (policy2.expiresAt && Date.parse(policy2.expiresAt) <= now3.getTime()) {
+      throw new GovernancePolicyError("policy expired");
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      if (current.status !== "approved") throw new GovernancePolicyError(`cannot activate policy in status ${current.status}`);
+      const policies = doc.policies.map((p) => {
+        if (p.policyId === current.policyId && p.version !== current.version && p.status === "active") {
+          return { ...p, status: "retired", retiredBy: input.activatorPrincipal, retiredAt: nowIso2(), supersededBy: `${current.policyId}@v${current.version}` };
+        }
+        return p;
+      });
+      const nowStr = nowIso2();
+      policies[idx] = {
+        ...current,
+        status: "active",
+        activatedBy: input.activatorPrincipal,
+        activatedAt: nowStr
+      };
+      const updated = policies[idx];
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.activated",
+        at: nowStr,
+        actorPrincipal: input.activatorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  async suspend(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.actorPrincipal)) throw new GovernancePolicyError("actorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    if (!await this.hasPermission(input.actorPrincipal, "policy.suspend", scope)) {
+      const role = await this.resolveRoleAsync(input.actorPrincipal, scope);
+      if (role.role !== "human-owner" && role.role !== "human-approver") {
+        await this.recordDenial(doc0, "policy.suspend", input.actorPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("actor lacks suspend permission");
+      }
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      if (current.status !== "active" && current.status !== "approved") throw new GovernancePolicyError(`cannot suspend policy in status ${current.status}`);
+      const updated = {
+        ...current,
+        status: "suspended",
+        suspendedBy: input.actorPrincipal,
+        suspendedAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.suspended",
+        at: updated.suspendedAt,
+        actorPrincipal: input.actorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  async retire(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.actorPrincipal)) throw new GovernancePolicyError("actorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    const role = await this.resolveRoleAsync(input.actorPrincipal, scope);
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.recordDenial(doc0, "policy.retire", input.actorPrincipal, scope, "permission denied");
+      throw new GovernancePolicyError("actor lacks retire permission");
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      const updated = {
+        ...current,
+        status: "retired",
+        retiredBy: input.actorPrincipal,
+        retiredAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.retired",
+        at: updated.retiredAt,
+        actorPrincipal: input.actorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- resolution (fail-closed) ---
+  async resolvePolicy(policyId, version, requestedScope, now3 = /* @__PURE__ */ new Date()) {
+    const doc = await this.load();
+    const policy2 = doc.policies.find((p) => p.policyId === policyId && p.version === version);
+    if (!policy2) {
+      return { outcome: "none", policy: null, reason: "no applicable policy" };
+    }
+    if (!scopeCovers(policy2.scope, requestedScope)) {
+      return { outcome: "insufficient-scope", policy: null, reason: "policy scope does not cover requested scope" };
+    }
+    if (!policy2.ownerAuthority || policy2.ownerAuthority.kind !== "HI" && policy2.ownerAuthority.kind !== "operator") {
+      return { outcome: "unresolved-authority", policy: null, reason: "unresolved or invalid authority" };
+    }
+    if (policy2.effectiveAt && Date.parse(policy2.effectiveAt) > now3.getTime()) {
+      return { outcome: "not-yet-effective", policy: null, reason: "policy not yet effective" };
+    }
+    if (policy2.expiresAt && Date.parse(policy2.expiresAt) <= now3.getTime()) {
+      return { outcome: "expired", policy: null, reason: "policy expired" };
+    }
+    if (policy2.status !== "active") {
+      return { outcome: "none", policy: null, reason: `policy status ${policy2.status} is not active` };
+    }
+    if (policy2.fingerprint && policy2.fingerprint !== `${policy2.policyId}@v${policy2.version}`) {
+      return { outcome: "invalid-provenance", policy: null, reason: "fingerprint mismatch" };
+    }
+    return { outcome: "applicable", policy: policy2, reason: "applicable and valid" };
+  }
+  async resolveActivePolicies(scope, now3 = /* @__PURE__ */ new Date()) {
+    const doc = await this.load();
+    const active = doc.policies.filter((p) => p.status === "active" && scopeCovers(p.scope, scope));
+    return active.filter((p) => {
+      if (p.effectiveAt && Date.parse(p.effectiveAt) > now3.getTime()) return false;
+      if (p.expiresAt && Date.parse(p.expiresAt) <= now3.getTime()) return false;
+      return true;
+    });
+  }
+  async checkConflicts(scope, now3 = /* @__PURE__ */ new Date()) {
+    const actives = await this.resolveActivePolicies(scope, now3);
+    const conflicting = actives.length > 1;
+    return { conflicting, policies: actives };
+  }
+  async failClosedResolve(scope, now3 = /* @__PURE__ */ new Date()) {
+    const actives = await this.resolveActivePolicies(scope, now3);
+    if (actives.length === 0) {
+      return { outcome: "none", policy: null, reason: "no applicable policy" };
+    }
+    if (actives.length > 1) {
+      return { outcome: "conflicting", policy: null, reason: "conflicting active policies" };
+    }
+    const p = actives[0];
+    if (!p.ownerAuthority || p.ownerAuthority.kind !== "HI" && p.ownerAuthority.kind !== "operator") {
+      return { outcome: "unresolved-authority", policy: null, reason: "unresolved authority" };
+    }
+    return { outcome: "applicable", policy: p, reason: "applicable and valid" };
+  }
+  // --- authorization granted/denied audit ---
+  async recordAuthorization(decision) {
+    await this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: decision.allowed ? "authorization.granted" : "authorization.denied",
+        at: nowIso2(),
+        actorPrincipal: decision.principalId,
+        scope: decision.scope ?? decision.resource,
+        outcome: decision.allowed ? "applied" : "rejected",
+        reason: decision.reason,
+        detail: `${decision.action} on ${decision.resource}`,
+        correlationId: decision.correlationId
+      })]);
+      return { document: { ...doc, revision, audit }, result: void 0 };
+    });
+  }
+  // --- list ---
+  async listPolicies() {
+    const doc = await this.load();
+    return [...doc.policies].sort((a, b) => a.policyId.localeCompare(b.policyId) || a.version - b.version);
+  }
+  async listRoleBindings() {
+    const doc = await this.load();
+    return [...doc.roleBindings];
+  }
+  async auditTrail() {
+    const doc = await this.load();
+    return [...doc.audit];
+  }
+  async recordAuditEvent(input) {
+    await this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: input.action,
+        at: input.at ?? nowIso2(),
+        ...input.actorPrincipal !== void 0 ? { actorPrincipal: input.actorPrincipal } : {},
+        ...input.actorRole !== void 0 ? { actorRole: input.actorRole } : {},
+        ...input.targetPolicyId !== void 0 ? { targetPolicyId: input.targetPolicyId } : {},
+        ...input.targetVersion !== void 0 ? { targetVersion: input.targetVersion } : {},
+        ...input.scope !== void 0 ? { scope: input.scope } : {},
+        outcome: input.outcome,
+        ...input.reason !== void 0 ? { reason: input.reason } : {},
+        ...input.detail !== void 0 ? { detail: input.detail } : {},
+        ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {},
+        ...input.mandatory !== void 0 ? { mandatory: input.mandatory } : {}
+      })]);
+      return { document: { ...doc, revision, audit }, result: void 0 };
+    });
+  }
+};
+var roleHasPermission = /* @__PURE__ */ __name((role, action) => ROLE_CAPABILITIES[role].has(action), "roleHasPermission");
+var GOVERNANCE_ROLES = [
+  "human-owner",
+  "human-approver",
+  "coordinator-jo",
+  "specialist-agent",
+  "policy-authority",
+  "auditor-reviewer"
+];
+var GOVERNANCE_POLICY_STATUSES = [
+  "proposed",
+  "under_review",
+  "approved",
+  "active",
+  "rejected",
+  "suspended",
+  "retired"
+];
+
+// core/guardrails/index.ts
+init_user_paths();
+init_policy_namespace_lock();
+var STOP_FILE_NAME = "guardrails.stop.json";
+var STOP_FORMAT = "dotmem.guardrails-stop";
+var STOP_VERSION = 1;
+var GuardrailError = class extends Error {
+  static {
+    __name(this, "GuardrailError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "GuardrailError";
+  }
+};
+var requiredText4 = /* @__PURE__ */ __name((v) => typeof v === "string" && v.trim().length > 0, "requiredText");
+var nowIso3 = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString(), "nowIso");
+var joinPath8 = /* @__PURE__ */ __name((base, child) => {
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return `${base.replace(/[\\/]+/g, sep)}${sep}${child}`;
+}, "joinPath");
+var resolveGuardrailDir = /* @__PURE__ */ __name((directory) => directory ?? joinPath8(resolveUserDotMemPath(), "policy"), "resolveGuardrailDir");
+var resolveStopFilePath = /* @__PURE__ */ __name((directory) => joinPath8(resolveGuardrailDir(directory), STOP_FILE_NAME), "resolveStopFilePath");
+var ACTIONS_REQUIRING_TRUSTED_IDENTITY = /* @__PURE__ */ new Set([
+  "agent.execute",
+  "guardrail.stop.activate",
+  "guardrail.stop.release"
+]);
+var GuardrailService = class {
+  static {
+    __name(this, "GuardrailService");
+  }
+  directory;
+  governance;
+  constructor(directory, governance) {
+    this.directory = directory;
+    this.governance = governance ?? new GovernancePolicyStore(directory);
+  }
+  dir() {
+    return resolveGuardrailDir(this.directory);
+  }
+  // --- stop controller persistence ---
+  async readStopState() {
+    const fs = await import('fs/promises');
+    let raw;
+    try {
+      raw = await fs.readFile(resolveStopFilePath(this.directory), "utf8");
+    } catch (err2) {
+      if (err2.code === "ENOENT") {
+        return { stopped: false, revision: 0 };
+      }
+      throw err2;
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed.format !== STOP_FORMAT || parsed.version !== STOP_VERSION) {
+      throw new GuardrailError("invalid stop state document");
+    }
+    return {
+      stopped: parsed.stopped === true,
+      ...requiredText4(parsed.activatedBy) ? { activatedBy: parsed.activatedBy } : {},
+      ...requiredText4(parsed.activatedAt) ? { activatedAt: parsed.activatedAt } : {},
+      ...requiredText4(parsed.reason) ? { reason: parsed.reason } : {},
+      ...requiredText4(parsed.releasedBy) ? { releasedBy: parsed.releasedBy } : {},
+      ...requiredText4(parsed.releasedAt) ? { releasedAt: parsed.releasedAt } : {},
+      revision: typeof parsed.revision === "number" ? parsed.revision : 0
+    };
+  }
+  async writeStopState(state3) {
+    const fs = await import('fs/promises');
+    const dir = this.dir();
+    await fs.mkdir(dir, { recursive: true });
+    const fp = resolveStopFilePath(this.directory);
+    const tmp = `${fp}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    const doc = { format: STOP_FORMAT, version: STOP_VERSION, ...state3 };
+    try {
+      await fs.writeFile(tmp, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+      const handle = await fs.open(tmp, "r+");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await fs.rename(tmp, fp);
+    } catch (err2) {
+      await fs.rm(tmp, { force: true }).catch(() => void 0);
+      throw err2;
+    }
+  }
+  async getStopState() {
+    return this.readStopState();
+  }
+  async isStopped() {
+    const s = await this.readStopState();
+    return s.stopped;
+  }
+  async activateStop(input) {
+    if (!requiredText4(input.actorPrincipal)) throw new GuardrailError("actorPrincipal is required");
+    const role = await this.governance.resolveRoleAsync(input.actorPrincipal, "*");
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.activate.denied",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "rejected",
+        reason: "insufficient authority to activate stop",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      throw new GuardrailError("unauthorized stop activation");
+    }
+    const current = await this.readStopState();
+    if (current.stopped) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.activate",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "applied",
+        reason: "already stopped (idempotent)",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      return current;
+    }
+    const now3 = nowIso3();
+    const next = {
+      stopped: true,
+      activatedBy: input.actorPrincipal,
+      activatedAt: now3,
+      ...requiredText4(input.reason) ? { reason: input.reason } : {},
+      revision: current.revision + 1
+    };
+    await this.governance.recordAuditEvent({
+      action: "guardrail.stop.activated",
+      actorPrincipal: input.actorPrincipal,
+      actorRole: role.role ?? void 0,
+      outcome: "applied",
+      reason: input.reason,
+      correlationId: input.correlationId
+    });
+    await withPolicyNamespaceLock(async (session3) => {
+      await this.writeStopState(next);
+      await session3.assertOwnership();
+    }, { directory: this.dir() });
+    return next;
+  }
+  async releaseStop(input) {
+    if (!requiredText4(input.actorPrincipal)) throw new GuardrailError("actorPrincipal is required");
+    const role = await this.governance.resolveRoleAsync(input.actorPrincipal, "*");
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.release.denied",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "rejected",
+        reason: "insufficient authority to release stop",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      throw new GuardrailError("unauthorized stop release");
+    }
+    const current = await this.readStopState();
+    if (!current.stopped) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.release",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "applied",
+        reason: "already running (idempotent)",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      return current;
+    }
+    const now3 = nowIso3();
+    const next = {
+      stopped: false,
+      activatedBy: current.activatedBy,
+      activatedAt: current.activatedAt,
+      reason: current.reason,
+      releasedBy: input.actorPrincipal,
+      releasedAt: now3,
+      revision: current.revision + 1
+    };
+    await this.governance.recordAuditEvent({
+      action: "guardrail.stop.released",
+      actorPrincipal: input.actorPrincipal,
+      actorRole: role.role ?? void 0,
+      outcome: "applied",
+      reason: input.reason,
+      correlationId: input.correlationId
+    });
+    await withPolicyNamespaceLock(async (session3) => {
+      await this.writeStopState(next);
+      await session3.assertOwnership();
+    }, { directory: this.dir() });
+    return next;
+  }
+  auditModes = {
+    "agent.execute": "mandatory",
+    "guardrail.stop.activate": "mandatory",
+    "guardrail.stop.release": "mandatory"
+  };
+  auditModeFor(action) {
+    return this.auditModes[action] ?? "best_effort";
+  }
+  async recordAudit(decision, auditMode) {
+    const persisted = await this.auditDecision(decision);
+    decision.auditPersisted = persisted;
+    decision.auditMode = auditMode;
+    if (!persisted && auditMode === "mandatory" && decision.allowed) {
+      decision.outcome = "audit_failure";
+      decision.allowed = false;
+      decision.reason = "mandatory audit persistence failed";
+    }
+    return persisted;
+  }
+  // --- evaluation ---
+  async evaluate(input) {
+    const evaluatedAt = nowIso3();
+    const auditMode = this.auditModeFor(input.action);
+    const principalId = input.principalContext.trusted ? input.principalContext.trustedPrincipalId : input.principalContext.assertedPrincipalId;
+    const stopState = await this.readStopState().catch(() => ({ stopped: false, revision: 0 }));
+    const base = {
+      outcome: "deny",
+      allowed: false,
+      reason: "",
+      evaluatedAt,
+      principalId,
+      action: input.action,
+      resource: input.resource,
+      scope: input.scope,
+      phase: input.phase,
+      stopState: stopState.stopped ? "stopped" : "running",
+      correlationId: input.correlationId,
+      auditMode,
+      auditPersisted: false
+    };
+    if (stopState.stopped && input.action !== "guardrail.stop.release") {
+      const decision2 = { ...base, outcome: "stop_active", reason: "global stop active" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    const requiresTrusted = ACTIONS_REQUIRING_TRUSTED_IDENTITY.has(input.action);
+    if (requiresTrusted && !input.principalContext.trusted) {
+      const decision2 = { ...base, outcome: "identity_unverified", reason: "trusted identity required but not verified" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    if (!requiredText4(input.action) || !requiredText4(input.resource) || !requiredText4(input.scope)) {
+      const decision2 = { ...base, outcome: "invalid_context", reason: "missing action/resource/scope" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    let policyId;
+    let policyVersion;
+    try {
+      const resolution = await this.governance.failClosedResolve(input.scope, input.now ?? /* @__PURE__ */ new Date());
+      if (resolution.outcome !== "applicable" || !resolution.policy) {
+        const decision2 = {
+          ...base,
+          outcome: resolution.outcome === "conflicting" ? "deny" : "policy_unavailable",
+          reason: `policy resolution: ${resolution.outcome} - ${resolution.reason}`
+        };
+        await this.recordAudit(decision2, auditMode);
+        return decision2;
+      }
+      policyId = resolution.policy.policyId;
+      policyVersion = resolution.policy.version;
+      const actorForPermission = principalId ?? "";
+      const allowed = await this.governance.hasPermission(actorForPermission, input.action, input.scope);
+      if (!allowed) {
+        const decision2 = {
+          ...base,
+          outcome: "deny",
+          reason: "permission denied by governance role binding",
+          policyId,
+          policyVersion
+        };
+        await this.recordAudit(decision2, auditMode);
+        return decision2;
+      }
+    } catch (err2) {
+      const decision2 = {
+        ...base,
+        outcome: "policy_unavailable",
+        reason: `governance unavailable: ${err2.message}`
+      };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    const decision = {
+      ...base,
+      outcome: "allow",
+      allowed: true,
+      reason: "allowed by governance policy",
+      policyId,
+      policyVersion
+    };
+    await this.recordAudit(decision, auditMode);
+    return decision;
+  }
+  async auditDecision(decision) {
+    try {
+      await this.governance.recordAuditEvent({
+        action: decision.allowed ? "guardrail.evaluation.allowed" : "guardrail.evaluation.denied",
+        actorPrincipal: decision.principalId,
+        scope: decision.scope,
+        outcome: decision.allowed ? "applied" : "rejected",
+        reason: decision.reason,
+        detail: `${decision.action} on ${decision.resource} (${decision.outcome})`,
+        correlationId: decision.correlationId,
+        mandatory: decision.auditMode === "mandatory"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async execute(input, operation) {
+    const decision = await this.evaluate(input);
+    if (!decision.allowed) {
+      return { decision, executed: false, error: decision.reason };
+    }
+    await this.governance.recordAuditEvent({
+      action: "guardrail.operation.started",
+      actorPrincipal: decision.principalId,
+      scope: decision.scope,
+      outcome: "applied",
+      detail: `${decision.action} on ${decision.resource}`,
+      correlationId: decision.correlationId
+    }).catch(() => void 0);
+    let result;
+    try {
+      result = await operation();
+    } catch (err2) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.operation.failed",
+        actorPrincipal: decision.principalId,
+        scope: decision.scope,
+        outcome: "rejected",
+        reason: err2.message,
+        detail: `${decision.action} on ${decision.resource}`,
+        correlationId: decision.correlationId
+      }).catch(() => void 0);
+      return { decision, executed: true, error: err2.message };
+    }
+    await this.governance.recordAuditEvent({
+      action: "guardrail.operation.completed",
+      actorPrincipal: decision.principalId,
+      scope: decision.scope,
+      outcome: "applied",
+      detail: `${decision.action} on ${decision.resource}`,
+      correlationId: decision.correlationId
+    }).catch(() => void 0);
+    return { decision, executed: true, result };
+  }
+};
+function createGuardrailService(directory, governance) {
+  return new GuardrailService(directory, governance);
+}
+__name(createGuardrailService, "createGuardrailService");
+
+// core/memory-anthology/index.ts
+var VALID_TRANSITIONS = {
+  unassessed: ["asserted", "corroborated", "reviewed", "disputed", "refuted", "superseded"],
+  asserted: ["corroborated", "reviewed", "disputed", "refuted", "superseded"],
+  corroborated: ["reviewed", "disputed", "refuted", "superseded"],
+  reviewed: ["disputed", "refuted", "superseded"],
+  disputed: ["corroborated", "reviewed", "refuted", "superseded"],
+  refuted: ["superseded"],
+  superseded: []
+};
+function canTransitionEpistemic(from, to) {
+  if (from === to) return true;
+  return (VALID_TRANSITIONS[from] ?? []).includes(to);
+}
+__name(canTransitionEpistemic, "canTransitionEpistemic");
+function validateEpistemicTransition(from, to, reason) {
+  if (from === to) return { allowed: true, reason: "no change" };
+  if (!canTransitionEpistemic(from, to)) {
+    return { allowed: false, reason: `invalid transition ${from} -> ${to}` };
+  }
+  if (to === "corroborated" && !reason) {
+    return { allowed: false, reason: "corroborated requires explanation of independent sources" };
+  }
+  if (to === "reviewed" && !reason) {
+    return { allowed: false, reason: "reviewed requires reviewer identity and scope" };
+  }
+  return { allowed: true, reason: reason ?? "ok" };
+}
+__name(validateEpistemicTransition, "validateEpistemicTransition");
+function validateProvenance(p) {
+  const errors = [];
+  if (!p || typeof p !== "object") {
+    errors.push("provenance must be an object");
+    return { valid: false, errors };
+  }
+  const kinds = ["user-statement", "system-observation", "imported-document", "external-source", "agent-inference", "model-summary", "human-correction", "system-event", "unknown"];
+  if (!kinds.includes(p.kind)) errors.push("invalid provenance kind");
+  if (p.observedAt !== void 0 && (typeof p.observedAt !== "string" || isNaN(Date.parse(p.observedAt)))) {
+    errors.push("observedAt must be valid ISO timestamp if provided");
+  }
+  return { valid: errors.length === 0, errors };
+}
+__name(validateProvenance, "validateProvenance");
+function validateMemoryItem(item) {
+  const errors = [];
+  if (!item || typeof item !== "object") {
+    errors.push("item must be an object");
+    return { valid: false, errors };
+  }
+  if (typeof item.itemId !== "string" || !item.itemId.trim()) errors.push("itemId is required");
+  if (typeof item.schemaVersion !== "number" || !Number.isInteger(item.schemaVersion) || item.schemaVersion < 1) errors.push("schemaVersion must be positive integer");
+  if (typeof item.scope !== "string" || !item.scope.trim()) errors.push("scope is required");
+  if (!item.temporal || typeof item.temporal !== "object") errors.push("temporal is required");
+  else if (typeof item.temporal.recordedAt !== "string" || isNaN(Date.parse(item.temporal.recordedAt))) errors.push("recordedAt must be valid ISO timestamp");
+  if (!item.provenance) errors.push("provenance is required");
+  else {
+    const pv = validateProvenance(item.provenance);
+    if (!pv.valid) errors.push(...pv.errors);
+  }
+  if (!item.revision || typeof item.revision !== "object") errors.push("revision is required");
+  else if (typeof item.revision.revision !== "number" || item.revision.revision < 0) errors.push("revision.revision must be non-negative integer");
+  if (item.category === "derived-summary") {
+    if (!item.derivedLineage) errors.push("derived summary requires lineage");
+  }
+  return { valid: errors.length === 0, errors };
+}
+__name(validateMemoryItem, "validateMemoryItem");
+function validateDerivedLineage(lineage, _sourceStatuses) {
+  const errors = [];
+  if (!lineage || typeof lineage !== "object") {
+    errors.push("lineage required");
+    return { valid: false, errors };
+  }
+  if (!Array.isArray(lineage.sourceItemIds) || lineage.sourceItemIds.length === 0) errors.push("sourceItemIds required");
+  if (!Array.isArray(lineage.sourceRevisions) || lineage.sourceRevisions.length !== lineage.sourceItemIds.length) errors.push("sourceRevisions must match sourceItemIds length");
+  if (typeof lineage.derivedAt !== "string" || isNaN(Date.parse(lineage.derivedAt))) errors.push("derivedAt invalid");
+  if (typeof lineage.producingComponent !== "string" || !lineage.producingComponent.trim()) errors.push("producingComponent required");
+  return { valid: errors.length === 0, errors };
+}
+__name(validateDerivedLineage, "validateDerivedLineage");
+function markDerivedStale(lineage) {
+  return { ...lineage, stale: true };
+}
+__name(markDerivedStale, "markDerivedStale");
+function isLegacyRecord(item) {
+  return !item || typeof item !== "object" || !item.provenance || !item.temporal || !item.revision;
+}
+__name(isLegacyRecord, "isLegacyRecord");
+function normalizeLegacyRecord(item) {
+  return {
+    itemId: item?.id ?? item?.itemId ?? `legacy-${Math.random().toString(36).slice(2, 10)}`,
+    schemaVersion: 0,
+    category: "legacy",
+    payload: item,
+    scope: item?.scope ?? "unknown",
+    provenance: { kind: "unknown" },
+    epistemicStatus: "unassessed",
+    sensitivity: "unknown",
+    temporal: { recordedAt: item?.createdAt ? new Date(item.createdAt).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString() },
+    revision: { revision: 0 }
+  };
+}
+__name(normalizeLegacyRecord, "normalizeLegacyRecord");
+var MEMORY_CATEGORIES = [
+  "observation",
+  "claim",
+  "fact-candidate",
+  "hypothesis",
+  "decision",
+  "preference",
+  "instruction",
+  "experience",
+  "goal",
+  "relationship",
+  "derived-summary",
+  "unknown-disputed",
+  "legacy"
+];
+var EPITEMIC_STATUSES2 = [
+  "unassessed",
+  "asserted",
+  "corroborated",
+  "reviewed",
+  "disputed",
+  "refuted",
+  "superseded"
+];
+
+// index.ts
 var dotmem = {
   version: "0.0.8",
   isBrowser,
@@ -12056,18 +13839,29 @@ Object.defineProperty(exports, "store", {
 exports.CompactionEngine = CompactionEngine;
 exports.ContextCompiler = ContextCompiler;
 exports.ContextLifecycleOrchestrator = ContextLifecycleOrchestrator;
+exports.EPITEMIC_STATUSES = EPITEMIC_STATUSES2;
+exports.GOVERNANCE_POLICY_STATUSES = GOVERNANCE_POLICY_STATUSES;
+exports.GOVERNANCE_ROLES = GOVERNANCE_ROLES;
+exports.GovernancePolicyError = GovernancePolicyError;
+exports.GovernancePolicyStore = GovernancePolicyStore;
+exports.GuardrailError = GuardrailError;
+exports.GuardrailService = GuardrailService;
+exports.MEMORY_CATEGORIES = MEMORY_CATEGORIES;
 exports.RecoveryService = RecoveryService;
 exports.addDecision = addDecision;
 exports.addOpenLoopRef = addOpenLoopRef;
 exports.addRejectedApproach = addRejectedApproach;
 exports.addUnresolvedQuestion = addUnresolvedQuestion;
 exports.appendReasoningStep = appendReasoningStep;
+exports.canTransitionEpistemic = canTransitionEpistemic;
 exports.clearUserIdentity = clearUserIdentity;
 exports.closeConversationalState = closeConversationalState;
 exports.compileContext = compileContext;
 exports.continuity = continuity;
+exports.continuityLedger = continuityLedger;
 exports.createCompactionEngine = createCompactionEngine;
 exports.createConversationalState = createConversationalState;
+exports.createGuardrailService = createGuardrailService;
 exports.createNoOpHost = createNoOpHost;
 exports.createRecoveryService = createRecoveryService;
 exports.default = index_default;
@@ -12082,11 +13876,14 @@ exports.isBrowser = isBrowser;
 exports.isBun = isBun;
 exports.isDeno = isDeno;
 exports.isEdge = isEdge;
+exports.isLegacyRecord = isLegacyRecord;
 exports.isNode = isNode;
 exports.listUnfinishedConversations = listUnfinishedConversations;
 exports.loadAllConversationalStates = loadAllConversationalStates;
 exports.loadConversationalStateById = loadConversationalStateById;
+exports.markDerivedStale = markDerivedStale;
 exports.memory = memory;
+exports.normalizeLegacyRecord = normalizeLegacyRecord;
 exports.recoverConversation = recoverConversation;
 exports.resolveUserAgentMemoryPath = resolveUserAgentMemoryPath;
 exports.resolveUserBrainPath = resolveUserBrainPath;
@@ -12096,8 +13893,15 @@ exports.resolveUserExperiencePath = resolveUserExperiencePath;
 exports.resolveUserIdentity = resolveUserIdentity;
 exports.resolveUserProjectMemoryPath = resolveUserProjectMemoryPath;
 exports.resolveUserReadmePath = resolveUserReadmePath;
+exports.roleHasPermission = roleHasPermission;
 exports.saveConversationalState = saveConversationalState;
 exports.security = security;
 exports.setUserIdentity = setUserIdentity;
 exports.signMemPackage = signMemPackage;
 exports.updateConversationalState = updateConversationalState;
+exports.validateDerivedLineage = validateDerivedLineage;
+exports.validateEpistemicTransition = validateEpistemicTransition;
+exports.validateMemoryItem = validateMemoryItem;
+exports.validateProvenance = validateProvenance;
+exports.validateRelationshipTargets = validateRelationshipTargets;
+exports.validateResolutionRequest = validateResolutionRequest;