dsh-completion-guard 0.3.1 → 0.4.0

package/dist/{index-GvKLkTqV.d.ts → index-AtjJOrK8.d.ts}

@@ -78,12 +78,6 @@ interface PackageRow {
   version?: string;
   integrity?: string;
 }
-interface HostLockManifest {
-  manifestVersion: number;
-  supportedGoalVersions: string[];
-  capabilities?: CapabilityRow[];
-  packages?: PackageRow[];
-}
 //#endregion
 //#region src/domain/types.d.ts
 type GuardItemKind = "requirement" | "acceptance" | "prohibition";
@@ -259,6 +253,8 @@ interface GuardProjection {
   hostLockDigest: string;
   hostStatus: HostStatus;
   hostReasonCode?: string;
+  /** Readback of the audited cohort bound into `hostLockDigest`. */
+  hostCohortId?: string;
   currentGoalRef?: GoalRef;
   currentGoalPhase?: "active" | "paused" | "blocked" | "complete";
   currentGoalActivation?: "armed" | "disarmed";
@@ -461,11 +457,52 @@ declare function currentContractDigest(projection: GuardProjection): string;
 type HostLockStatus = "supported" | "unsupported" | "unavailable";
 type HostPlatform = "posix" | "windows";
 type HostProfileKind = "headless" | "web";
-declare const SUPPORTED_HOST_MANIFEST: HostLockManifest;
+interface HostCohort {
+  /** Stable cohort identity; bound into every hostLockDigest via `host_cohort`. */
+  id: string;
+  manifestVersion: number;
+  supportedGoalVersions: string[];
+  /**
+  * Platforms where this cohort's exact package graph was extracted from a
+  * native host and audited. Other platforms fail closed; integrity must not
+  * be inferred across platforms.
+  */
+  auditedPlatforms: readonly HostPlatform[];
+  packages: PackageRow[];
+  capabilities: CapabilityRow[];
+}
+/**
+* alpha.2 audited package identities (second registry cohort), hoisted so the
+* alpha.2 + dshmarket 1.39.0 cohort can reuse the exact natively audited rows
+* with only the dshmarket identity substituted.
+*/
+declare const ALPHA2_HOST_PACKAGES: PackageRow[];
+/**
+* The exact graph the Windows daily runtime realized when it upgraded
+* dshmarket to 1.39.0 on an otherwise alpha.2 install — the combination whose
+* rejection was Guard 0.3.2's real web_control failure. It is one audited
+* whole-graph cohort: alpha.2 rows keep their native macOS/Windows audit
+* identities and the dshmarket 1.39.0 identity is the authoritative row from
+* the 2026-09-01 alpha.3 annex audit. Guard 0.4.0 supports this combination.
+*/
+declare const ALPHA2_DSHMARKET_139_HOST_PACKAGES: PackageRow[];
 /**
-* Audited package identities. This is a catalogue, not one indivisible lock:
-* evaluateHostLock requires only BASE_HOST_PACKAGES globally and evaluates the
-* remaining action/platform groups independently.
+* Audited host cohort registry. The rc.2 cohort keeps the exact identities
+* audited for 0.3.0/0.3.1 on macOS and Windows. The alpha.2 cohort carries the
+* exact package graph extracted from native macOS and Windows DSH
+* `0.1.2-alpha.2` / dshmarket `1.38.1` runtimes. The alpha.2+dshmarket-1.39.0
+* cohort carries the exact upgraded-Windows graph. The alpha.3 cohort carries
+* the graph audited in the 2026-09-01 annex. Graphs that mix cohorts, lack
+* rows, duplicate rows, or use identities outside every registered cohort
+* fail closed.
+*/
+declare const HOST_COHORTS: readonly HostCohort[];
+/**
+* rc.2 audited package identities (first registry cohort). The audited
+* cohort is an atomic whole-graph contract (CG-DSH-001): any drifted,
+* duplicated, unknown-version, unbound, OR MISSING row fails the whole lock
+* closed (`host_lock_missing`); no capability inherits independence from a
+* partially present graph.
 */
 declare const EXPECTED_HOST_PACKAGES: PackageRow[];
 declare const BASE_HOST_PACKAGES: ReadonlySet<string>;
@@ -484,18 +521,50 @@ interface HostLockEvaluation {
   status: HostLockStatus;
   digest: string;
   goalAvailable: boolean;
-  reasonCode?: "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch";
+  reasonCode?: "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
   packages: PackageRow[];
   capabilities: Record<HostCapabilityId, HostCapabilityEvaluation>;
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   liveGoalAvailable?: boolean;
+  /** Readback of the audited cohort the supplied graph was evaluated against. */
+  cohortId?: string;
+  /** Audited cohort rows absent from the supplied graph (diagnostic). */
+  missingPackages?: string[];
 }
 interface HostLockContext {
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   capabilityId?: string;
 }
+type HostCohortSelectionReason = "host_cohort_unknown_package" | "host_cohort_version_mismatch" | "host_cohort_integrity_mismatch" | "host_cohort_mixed_graph" | "host_cohort_incomplete_graph" | "host_cohort_unbound_identity" | "host_cohort_platform_not_audited";
+interface HostCohortSelection {
+  /**
+  * Cohort used for expected-row lookups and digest identity. When the graph
+  * does not consistently match one cohort this is the deterministic
+  * closest-cohort fallback (most exact row matches, then registry order) and
+  * `consistent` is false, so evaluation fails closed downstream.
+  */
+  cohort: HostCohort;
+  /**
+  * True only when every supplied row exactly matches the selected cohort
+  * AND every audited cohort row is present: the audited cohort is an atomic
+  * whole-graph contract, so a graph missing audited rows (missing packages)
+  * never selects consistently.
+  */
+  consistent: boolean;
+  reasonCode?: HostCohortSelectionReason;
+}
+/**
+* Atomically select the audited cohort for one supplied package graph. A
+* graph matches a cohort only when every row carries version and integrity,
+* each exactly equals that cohort's audited row, and the graph covers the
+* complete audited cohort (missing packages fail closed); graphs that mix
+* rows from different cohorts, use versions unknown to the registry, or
+* target a platform the cohort was never audited on never select
+* consistently.
+*/
+declare function selectHostCohort(rows: readonly PackageRow[], platform?: HostPlatform): HostCohortSelection;
 declare function evaluateHostLock(rows: readonly PackageRow[], context?: HostLockContext): HostLockEvaluation;
 interface HostCapabilityRequest {
   action: SemanticAction;
@@ -894,6 +963,59 @@ declare function evidenceMatchesItem(item: GuardItem, evidence: GuardEvidence):
 */
 declare function bindingSatisfies(projection: GuardProjection, item: GuardItem, evidenceIds: string[]): boolean;
 //#endregion
+//#region src/domain/proof.d.ts
+declare const PROOF_PROTOCOL_VERSION = "0.4.0";
+declare const PROOF_KINDS: readonly ["subject_readback", "scope_coverage", "state_verification"];
+type ProofKind = (typeof PROOF_KINDS)[number];
+type ProofSurface = "artifact" | "ui" | "visual" | "scope";
+interface ProofObligation {
+  obligationId: string;
+  kind: ProofKind;
+  surface: ProofSurface;
+  subjectIds: string[];
+  evidenceIds: string[];
+  expectedScopeDigest?: string;
+  observedScopeDigest?: string;
+}
+interface ProofManifest {
+  proofProtocolVersion: typeof PROOF_PROTOCOL_VERSION;
+  obligations: ProofObligation[];
+  proofSha256: string;
+  assetSetSha256?: string;
+}
+interface SessionQuery {
+  sessionRefDigest: string;
+  epoch: number;
+  contractRevision: number;
+  state: "valid" | "unknown" | "corrupt";
+  proof?: ProofManifest;
+  cohortId?: string;
+  /** Set only when a presented proof made the query unverifiable. */
+  reasonCode?: "proof_invalid" | "proof_unbound";
+}
+/**
+* The manifest digest root includes every integrity-bearing field, so a
+* tampered asset-set digest is exactly as detectable as a tampered obligation.
+*/
+declare function proofDigest(obligations: readonly ProofObligation[], assetSetSha256?: string): string;
+declare function validateProofManifest(manifest: unknown): string[];
+declare function createProofManifest(obligations: readonly ProofObligation[], assetSetSha256?: string): ProofManifest;
+/**
+* Bind a structurally valid proof to the actual replayed projection: every
+* obligation must name a pending item, every evidence id must exist in the
+* projection, and every bound evidence must satisfy the obligation's kind,
+* surface, subject, and outcome constraints. An empty projection therefore
+* rejects any proof, and cross-item or foreign evidence can never bind.
+*/
+declare function bindProofToProjection(projection: GuardProjection, proof: ProofManifest): string[];
+declare function canonicalProjection(projection: GuardProjection): Record<string, unknown>;
+declare function sessionQuery(projection: GuardProjection, proof?: ProofManifest): SessionQuery;
+declare function proofEvidenceConstraints(evidence: GuardEvidence, obligation: ProofObligation): boolean;
+//#endregion
+//#region src/domain/alpha3-host.d.ts
+/** Exact 34-row alpha.3 runtime/web graph from the 2026-09-01 annex audit. */
+declare const ALPHA3_HOST_PACKAGES: PackageRow[];
+//#endregion
 //#region src/domain/recovery.d.ts
 interface RecoveryOptions {
   rejectedBindings?: Array<{
@@ -954,4 +1076,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { gitCommandMatchesTarget as $, VerificationContract as $n, UserInteractionKind as $t, hostLockRowsFromComposedDump as A, DerivedEnvelope as An, HOST_CAPABILITY_PACKAGE_GROUPS as At, GitCommandManifest as B, GuardEvidence as Bn, SUPPORTED_HOST_MANIFEST as Bt, CommandSurfaceManifest as C, qualifyBoundary as Cn, digestStrings as Cr, AuditedExecutable as Ct, ActiveProfileHostLock as D, DeriveConfig as Dn, sha256 as Dr, ExecutableIdentity as Dt, validateManifest as E, DeferAuthorization as En, sanitizeUrl as Er, EXPECTED_HOST_PACKAGES as Et, resolveInstalledHostLock as F, ExpectedTransition as Fn, HostLockEvaluation as Ft, GitPrestateCheck as G, GuardOperation as Gn, evaluateHostLock as Gt, GitCommandRejected as H, GuardItem as Hn, bindLiveGoalCapability as Ht, verifyComposedHostLockDump as I, ExternalOperation as In, HostLockStatus as It, LinearCommitReadback as J, PersistenceAuthorization as Jn, AuthorityBlock as Jt, GitPrestateEnvelope as K, GuardProjection as Kn, evaluateToolSurfaceCapability as Kt, GIT_COMMAND_MANIFEST_IDS as L, GoalRef as Ln, HostPlatform as Lt, packageRowsFromActiveGraph as M, EvidenceOutcome as Mn, HostCapabilityId as Mt, packageRowsFromPnpmLock as N, EvidenceParseStatus as Nn, HostCapabilityRequest as Nt, HostProfileError as O, DeriveResult as On, ExecutableIdentityBinding as Ot, resolveActiveProfileHostLock as P, EvidenceRole as Pn, HostLockContext as Pt, executeRevalidatedGitEffect as Q, TargetValue as Qn, segmentAuthorityBlocks as Qt, GitAdapterAction as R, GuardBoundary as Rn, HostProfileKind as Rt, COMMAND_SURFACE_MANIFEST as S, isCurrentAcceptedBoundary as Sn, canonicalizePath as Sr, deriveProjection as St, OperationVerbEntry as T, BoundaryQualificationKind as Tn, sanitizeClauseText as Tr, DEFAULT_HOST_LOCK as Tt, GitEffectExecution as U, GuardItemKind as Un, evaluateExternalWaitCapability as Ut, GitCommandParseResult as V, GuardIntegrity as Vn, bindExecutableIdentity as Vt, GitEffectRunner as W, GuardItemStatus as Wn, evaluateHostCapability as Wt, commitTreeSnapshotDigest as X, TargetCaptureStatus as Xn, AuthorityKind as Xt, commitIndexSnapshotDigest as Y, TargetCaptureReasonCode as Yn, AuthorityBlockKind as Yt, createGitPrestateEnvelope as Z, TargetTuple as Zn, authorityCaptureCounts as Zt, EvidenceFacetCoverage as _, BoundaryRequest as _n, requestedTargetMatchesResolved as _r, extractTextContent as _t, classifyCompletionClaim as a, ClassifiedClause as an, ActionManifest as ar, ParsedShell as at, evidenceMatchesItem as b, availableBoundaryQualifications as bn, validateActionManifest as br, withDurability as bt, isWholeTaskCompletionClaim as c, captureItem as cn, SEMANTIC_ACTIONS as cr, isRunExecutable as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, extractMethod as dn, SUPPORTED_EVIDENCE_ADAPTERS as dr, goalCompletionDenial as dt, classifyUserInteraction as en, WaitAuthorization as er, parseGitCommandManifest as et, RecoveryOptions as f, extractOperation as fn, SemanticAction as fr, hasCurrentCertificate as ft, renderRecoveryPacket as g, BoundaryQualification as gn, requestedTargetAuthorizesMutation as gr, evidenceFromPersistedToolResult as gt, recoveryDigest as h, BoundaryEffectuation as hn, isStatefulAction as hr, ToolSubject as ht, TurnStoppingDecision as i, CaptureScope as in, ACTION_MANIFEST_VERSION as ir, CanonicalCommandSurface as it, injectActiveProfileHostLock as j, EvidenceBinding as jn, HostCapabilityEvaluation as jt, hostLockContextFromComposedDump as k, DeriveScope as kn, GOAL_HOST_PACKAGES as kt, latestAssistantText as l, classifyClause as ln, STATEFUL_ACTIONS as lr, parsePwshCommand as lt, openItems as m, segmentClauses as mn, actionCompatible as mr, ToolResultInput as mt, AssistantOutcomeObservation as n, RejectedBinding as nn, PackageRow as nr, verifiedLinearCommitReadback as nt, decideTurnBoundary as o, ClauseSegment as on, ActionSpec as or, ShellParseStatus as ot, closingHint as p, isInformationalMessage as pn, StatefulAction as pr, ToolCallInput as pt, GitTargetIdentity as q, HostStatus as qn, currentContractDigest as qt, CompletionDisposition as r, certifyCheckpoint as rn, ACTION_MANIFEST as rr, CanonicalArgv as rt, decideTurnStopping as s, captureClause as sn, CERTIFICATE_VERSION as sr, canonicalArgvFromCommand as st, supersedeItem as t, CheckpointResult as tn, createProjection as tr, revalidateGitPrestate as tt, observeAssistantOutcome as u, extractArtifactPaths as un, STOP_PROTOCOL_VERSION as ur, parseShellCommand as ut, bindingSatisfies as v, GoalActivationState as vn, semanticActionFromCommand as vr, extractToolSubject as vt, ManifestIssue as w, BoundaryDisposition as wn, normalizeClause as wr, BASE_HOST_PACKAGES as wt, isVerifyingCapability as x, effectuateBoundary as xn, validateActionTarget as xr, PROTOCOL_V3_NOTICE as xt, evidenceCoverage as y, GoalBoundaryAccess as yn, semanticActionFromText as yr, isDeterministicCheck as yt, GitCommandAccepted as z, GuardCheckpoint as zn, HostToolSurface as zt };
+export { GitAdapterAction as $, EvidenceOutcome as $n, HostCohortSelection as $t, sessionQuery as A, classifyClause as An, STATEFUL_ACTIONS as Ar, ToolSubject as At, OperationVerbEntry as B, GoalBoundaryAccess as Bn, semanticActionFromText as Br, AuditedExecutable as Bt, ProofSurface as C, RejectedBinding as Cn, PackageRow as Cr, isRunExecutable as Ct, createProofManifest as D, ClauseSegment as Dn, ActionSpec as Dr, hasCurrentCertificate as Dt, canonicalProjection as E, ClassifiedClause as En, ActionManifest as Er, goalCompletionDenial as Et, evidenceMatchesItem as F, segmentClauses as Fn, actionCompatible as Fr, withDurability as Ft, hostLockRowsFromComposedDump as G, BoundaryDisposition as Gn, normalizeClause as Gr, ExecutableIdentityBinding as Gt, ActiveProfileHostLock as H, effectuateBoundary as Hn, validateActionTarget as Hr, DEFAULT_HOST_LOCK as Ht, isVerifyingCapability as I, BoundaryEffectuation as In, isStatefulAction as Ir, PROTOCOL_V3_NOTICE as It, packageRowsFromPnpmLock as J, DeriveConfig as Jn, sha256 as Jr, HOST_COHORTS as Jt, injectActiveProfileHostLock as K, BoundaryQualificationKind as Kn, sanitizeClauseText as Kr, GOAL_HOST_PACKAGES as Kt, COMMAND_SURFACE_MANIFEST as L, BoundaryQualification as Ln, requestedTargetAuthorizesMutation as Lr, deriveProjection as Lt, EvidenceFacetCoverage as M, extractMethod as Mn, SUPPORTED_EVIDENCE_ADAPTERS as Mr, extractTextContent as Mt, bindingSatisfies as N, extractOperation as Nn, SemanticAction as Nr, extractToolSubject as Nt, proofDigest as O, captureClause as On, CERTIFICATE_VERSION as Or, ToolCallInput as Ot, evidenceCoverage as P, isInformationalMessage as Pn, StatefulAction as Pr, isDeterministicCheck as Pt, GIT_COMMAND_MANIFEST_IDS as Q, EvidenceBinding as Qn, HostCohort as Qt, CommandSurfaceManifest as R, BoundaryRequest as Rn, requestedTargetMatchesResolved as Rr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Rt, ProofObligation as S, CheckpointResult as Sn, createProjection as Sr, canonicalArgvFromCommand as St, bindProofToProjection as T, CaptureScope as Tn, ACTION_MANIFEST_VERSION as Tr, parseShellCommand as Tt, HostProfileError as U, isCurrentAcceptedBoundary as Un, canonicalizePath as Ur, EXPECTED_HOST_PACKAGES as Ut, validateManifest as V, availableBoundaryQualifications as Vn, validateActionManifest as Vr, BASE_HOST_PACKAGES as Vt, hostLockContextFromComposedDump as W, qualifyBoundary as Wn, digestStrings as Wr, ExecutableIdentity as Wt, resolveInstalledHostLock as X, DeriveScope as Xn, HostCapabilityId as Xt, resolveActiveProfileHostLock as Y, DeriveResult as Yn, HostCapabilityEvaluation as Yt, verifyComposedHostLockDump as Z, DerivedEnvelope as Zn, HostCapabilityRequest as Zt, ALPHA3_HOST_PACKAGES as _, AuthorityKind as _n, TargetCaptureStatus as _r, verifiedLinearCommitReadback as _t, classifyCompletionClaim as a, HostProfileKind as an, GuardBoundary as ar, GitEffectRunner as at, ProofKind as b, UserInteractionKind as bn, VerificationContract as br, ParsedShell as bt, isWholeTaskCompletionClaim as c, bindLiveGoalCapability as cn, GuardIntegrity as cr, GitTargetIdentity as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, evaluateHostLock as dn, GuardItemStatus as dr, commitTreeSnapshotDigest as dt, HostCohortSelectionReason as en, EvidenceParseStatus as er, GitCommandAccepted as et, RecoveryOptions as f, evaluateToolSurfaceCapability as fn, GuardOperation as fr, createGitPrestateEnvelope as ft, renderRecoveryPacket as g, AuthorityBlockKind as gn, TargetCaptureReasonCode as gr, revalidateGitPrestate as gt, recoveryDigest as h, AuthorityBlock as hn, PersistenceAuthorization as hr, parseGitCommandManifest as ht, TurnStoppingDecision as i, HostPlatform as in, GoalRef as ir, GitEffectExecution as it, validateProofManifest as j, extractArtifactPaths as jn, STOP_PROTOCOL_VERSION as jr, evidenceFromPersistedToolResult as jt, proofEvidenceConstraints as k, captureItem as kn, SEMANTIC_ACTIONS as kr, ToolResultInput as kt, latestAssistantText as l, evaluateExternalWaitCapability as ln, GuardItem as lr, LinearCommitReadback as lt, openItems as m, currentContractDigest as mn, HostStatus as mr, gitCommandMatchesTarget as mt, AssistantOutcomeObservation as n, HostLockEvaluation as nn, ExpectedTransition as nr, GitCommandParseResult as nt, decideTurnBoundary as o, HostToolSurface as on, GuardCheckpoint as or, GitPrestateCheck as ot, closingHint as p, selectHostCohort as pn, GuardProjection as pr, executeRevalidatedGitEffect as pt, packageRowsFromActiveGraph as q, DeferAuthorization as qn, sanitizeUrl as qr, HOST_CAPABILITY_PACKAGE_GROUPS as qt, CompletionDisposition as r, HostLockStatus as rn, ExternalOperation as rr, GitCommandRejected as rt, decideTurnStopping as s, bindExecutableIdentity as sn, GuardEvidence as sr, GitPrestateEnvelope as st, supersedeItem as t, HostLockContext as tn, EvidenceRole as tr, GitCommandManifest as tt, observeAssistantOutcome as u, evaluateHostCapability as un, GuardItemKind as ur, commitIndexSnapshotDigest as ut, PROOF_KINDS as v, authorityCaptureCounts as vn, TargetTuple as vr, CanonicalArgv as vt, SessionQuery as w, certifyCheckpoint as wn, ACTION_MANIFEST as wr, parsePwshCommand as wt, ProofManifest as x, classifyUserInteraction as xn, WaitAuthorization as xr, ShellParseStatus as xt, PROOF_PROTOCOL_VERSION as y, segmentAuthorityBlocks as yn, TargetValue as yr, CanonicalCommandSurface as yt, ManifestIssue as z, GoalActivationState as zn, semanticActionFromCommand as zr, ALPHA2_HOST_PACKAGES as zt };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as gitCommandMatchesTarget, $n as VerificationContract, $t as UserInteractionKind, A as hostLockRowsFromComposedDump, An as DerivedEnvelope, At as HOST_CAPABILITY_PACKAGE_GROUPS, B as GitCommandManifest, Bn as GuardEvidence, Bt as SUPPORTED_HOST_MANIFEST, C as CommandSurfaceManifest, Cn as qualifyBoundary, Cr as digestStrings, Ct as AuditedExecutable, D as ActiveProfileHostLock, Dn as DeriveConfig, Dr as sha256, Dt as ExecutableIdentity, E as validateManifest, En as DeferAuthorization, Er as sanitizeUrl, Et as EXPECTED_HOST_PACKAGES, F as resolveInstalledHostLock, Fn as ExpectedTransition, Ft as HostLockEvaluation, G as GitPrestateCheck, Gn as GuardOperation, Gt as evaluateHostLock, H as GitCommandRejected, Hn as GuardItem, Ht as bindLiveGoalCapability, I as verifyComposedHostLockDump, In as ExternalOperation, It as HostLockStatus, J as LinearCommitReadback, Jn as PersistenceAuthorization, Jt as AuthorityBlock, K as GitPrestateEnvelope, Kn as GuardProjection, Kt as evaluateToolSurfaceCapability, L as GIT_COMMAND_MANIFEST_IDS, Ln as GoalRef, Lt as HostPlatform, M as packageRowsFromActiveGraph, Mn as EvidenceOutcome, Mt as HostCapabilityId, N as packageRowsFromPnpmLock, Nn as EvidenceParseStatus, Nt as HostCapabilityRequest, O as HostProfileError, On as DeriveResult, Ot as ExecutableIdentityBinding, P as resolveActiveProfileHostLock, Pn as EvidenceRole, Pt as HostLockContext, Q as executeRevalidatedGitEffect, Qn as TargetValue, Qt as segmentAuthorityBlocks, R as GitAdapterAction, Rn as GuardBoundary, Rt as HostProfileKind, S as COMMAND_SURFACE_MANIFEST, Sn as isCurrentAcceptedBoundary, Sr as canonicalizePath, St as deriveProjection, T as OperationVerbEntry, Tn as BoundaryQualificationKind, Tr as sanitizeClauseText, Tt as DEFAULT_HOST_LOCK, U as GitEffectExecution, Un as GuardItemKind, Ut as evaluateExternalWaitCapability, V as GitCommandParseResult, Vn as GuardIntegrity, Vt as bindExecutableIdentity, W as GitEffectRunner, Wn as GuardItemStatus, Wt as evaluateHostCapability, X as commitTreeSnapshotDigest, Xn as TargetCaptureStatus, Xt as AuthorityKind, Y as commitIndexSnapshotDigest, Yn as TargetCaptureReasonCode, Yt as AuthorityBlockKind, Z as createGitPrestateEnvelope, Zn as TargetTuple, Zt as authorityCaptureCounts, _ as EvidenceFacetCoverage, _n as BoundaryRequest, _r as requestedTargetMatchesResolved, _t as extractTextContent, a as classifyCompletionClaim, an as ClassifiedClause, ar as ActionManifest, at as ParsedShell, b as evidenceMatchesItem, bn as availableBoundaryQualifications, br as validateActionManifest, bt as withDurability, c as isWholeTaskCompletionClaim, cn as captureItem, cr as SEMANTIC_ACTIONS, ct as isRunExecutable, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as extractMethod, dr as SUPPORTED_EVIDENCE_ADAPTERS, dt as goalCompletionDenial, en as classifyUserInteraction, er as WaitAuthorization, et as parseGitCommandManifest, f as RecoveryOptions, fn as extractOperation, fr as SemanticAction, ft as hasCurrentCertificate, g as renderRecoveryPacket, gn as BoundaryQualification, gr as requestedTargetAuthorizesMutation, gt as evidenceFromPersistedToolResult, h as recoveryDigest, hn as BoundaryEffectuation, hr as isStatefulAction, ht as ToolSubject, i as TurnStoppingDecision, in as CaptureScope, ir as ACTION_MANIFEST_VERSION, it as CanonicalCommandSurface, j as injectActiveProfileHostLock, jn as EvidenceBinding, jt as HostCapabilityEvaluation, k as hostLockContextFromComposedDump, kn as DeriveScope, kt as GOAL_HOST_PACKAGES, l as latestAssistantText, ln as classifyClause, lr as STATEFUL_ACTIONS, lt as parsePwshCommand, m as openItems, mn as segmentClauses, mr as actionCompatible, mt as ToolResultInput, n as AssistantOutcomeObservation, nn as RejectedBinding, nr as PackageRow, nt as verifiedLinearCommitReadback, o as decideTurnBoundary, on as ClauseSegment, or as ActionSpec, ot as ShellParseStatus, p as closingHint, pn as isInformationalMessage, pr as StatefulAction, pt as ToolCallInput, q as GitTargetIdentity, qn as HostStatus, qt as currentContractDigest, r as CompletionDisposition, rn as certifyCheckpoint, rr as ACTION_MANIFEST, rt as CanonicalArgv, s as decideTurnStopping, sn as captureClause, sr as CERTIFICATE_VERSION, st as canonicalArgvFromCommand, t as supersedeItem, tn as CheckpointResult, tr as createProjection, tt as revalidateGitPrestate, u as observeAssistantOutcome, un as extractArtifactPaths, ur as STOP_PROTOCOL_VERSION, ut as parseShellCommand, v as bindingSatisfies, vn as GoalActivationState, vr as semanticActionFromCommand, vt as extractToolSubject, w as ManifestIssue, wn as BoundaryDisposition, wr as normalizeClause, wt as BASE_HOST_PACKAGES, x as isVerifyingCapability, xn as effectuateBoundary, xr as validateActionTarget, xt as PROTOCOL_V3_NOTICE, y as evidenceCoverage, yn as GoalBoundaryAccess, yr as semanticActionFromText, yt as isDeterministicCheck, z as GitCommandAccepted, zn as GuardCheckpoint, zt as HostToolSurface } from "./index-GvKLkTqV.js";
+import { $ as GitAdapterAction, $n as EvidenceOutcome, $t as HostCohortSelection, A as sessionQuery, An as classifyClause, Ar as STATEFUL_ACTIONS, At as ToolSubject, B as OperationVerbEntry, Bn as GoalBoundaryAccess, Br as semanticActionFromText, Bt as AuditedExecutable, C as ProofSurface, Cn as RejectedBinding, Cr as PackageRow, Ct as isRunExecutable, D as createProofManifest, Dn as ClauseSegment, Dr as ActionSpec, Dt as hasCurrentCertificate, E as canonicalProjection, En as ClassifiedClause, Er as ActionManifest, Et as goalCompletionDenial, F as evidenceMatchesItem, Fn as segmentClauses, Fr as actionCompatible, Ft as withDurability, G as hostLockRowsFromComposedDump, Gn as BoundaryDisposition, Gr as normalizeClause, Gt as ExecutableIdentityBinding, H as ActiveProfileHostLock, Hn as effectuateBoundary, Hr as validateActionTarget, Ht as DEFAULT_HOST_LOCK, I as isVerifyingCapability, In as BoundaryEffectuation, Ir as isStatefulAction, It as PROTOCOL_V3_NOTICE, J as packageRowsFromPnpmLock, Jn as DeriveConfig, Jr as sha256, Jt as HOST_COHORTS, K as injectActiveProfileHostLock, Kn as BoundaryQualificationKind, Kr as sanitizeClauseText, Kt as GOAL_HOST_PACKAGES, L as COMMAND_SURFACE_MANIFEST, Ln as BoundaryQualification, Lr as requestedTargetAuthorizesMutation, Lt as deriveProjection, M as EvidenceFacetCoverage, Mn as extractMethod, Mr as SUPPORTED_EVIDENCE_ADAPTERS, Mt as extractTextContent, N as bindingSatisfies, Nn as extractOperation, Nr as SemanticAction, Nt as extractToolSubject, O as proofDigest, On as captureClause, Or as CERTIFICATE_VERSION, Ot as ToolCallInput, P as evidenceCoverage, Pn as isInformationalMessage, Pr as StatefulAction, Pt as isDeterministicCheck, Q as GIT_COMMAND_MANIFEST_IDS, Qn as EvidenceBinding, Qt as HostCohort, R as CommandSurfaceManifest, Rn as BoundaryRequest, Rr as requestedTargetMatchesResolved, Rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, S as ProofObligation, Sn as CheckpointResult, Sr as createProjection, St as canonicalArgvFromCommand, T as bindProofToProjection, Tn as CaptureScope, Tr as ACTION_MANIFEST_VERSION, Tt as parseShellCommand, U as HostProfileError, Un as isCurrentAcceptedBoundary, Ur as canonicalizePath, Ut as EXPECTED_HOST_PACKAGES, V as validateManifest, Vn as availableBoundaryQualifications, Vr as validateActionManifest, Vt as BASE_HOST_PACKAGES, W as hostLockContextFromComposedDump, Wn as qualifyBoundary, Wr as digestStrings, Wt as ExecutableIdentity, X as resolveInstalledHostLock, Xn as DeriveScope, Xt as HostCapabilityId, Y as resolveActiveProfileHostLock, Yn as DeriveResult, Yt as HostCapabilityEvaluation, Z as verifyComposedHostLockDump, Zn as DerivedEnvelope, Zt as HostCapabilityRequest, _ as ALPHA3_HOST_PACKAGES, _n as AuthorityKind, _r as TargetCaptureStatus, _t as verifiedLinearCommitReadback, a as classifyCompletionClaim, an as HostProfileKind, ar as GuardBoundary, at as GitEffectRunner, b as ProofKind, bn as UserInteractionKind, br as VerificationContract, bt as ParsedShell, c as isWholeTaskCompletionClaim, cn as bindLiveGoalCapability, cr as GuardIntegrity, ct as GitTargetIdentity, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as evaluateHostLock, dr as GuardItemStatus, dt as commitTreeSnapshotDigest, en as HostCohortSelectionReason, er as EvidenceParseStatus, et as GitCommandAccepted, f as RecoveryOptions, fn as evaluateToolSurfaceCapability, fr as GuardOperation, ft as createGitPrestateEnvelope, g as renderRecoveryPacket, gn as AuthorityBlockKind, gr as TargetCaptureReasonCode, gt as revalidateGitPrestate, h as recoveryDigest, hn as AuthorityBlock, hr as PersistenceAuthorization, ht as parseGitCommandManifest, i as TurnStoppingDecision, in as HostPlatform, ir as GoalRef, it as GitEffectExecution, j as validateProofManifest, jn as extractArtifactPaths, jr as STOP_PROTOCOL_VERSION, jt as evidenceFromPersistedToolResult, k as proofEvidenceConstraints, kn as captureItem, kr as SEMANTIC_ACTIONS, kt as ToolResultInput, l as latestAssistantText, ln as evaluateExternalWaitCapability, lr as GuardItem, lt as LinearCommitReadback, m as openItems, mn as currentContractDigest, mr as HostStatus, mt as gitCommandMatchesTarget, n as AssistantOutcomeObservation, nn as HostLockEvaluation, nr as ExpectedTransition, nt as GitCommandParseResult, o as decideTurnBoundary, on as HostToolSurface, or as GuardCheckpoint, ot as GitPrestateCheck, p as closingHint, pn as selectHostCohort, pr as GuardProjection, pt as executeRevalidatedGitEffect, q as packageRowsFromActiveGraph, qn as DeferAuthorization, qr as sanitizeUrl, qt as HOST_CAPABILITY_PACKAGE_GROUPS, r as CompletionDisposition, rn as HostLockStatus, rr as ExternalOperation, rt as GitCommandRejected, s as decideTurnStopping, sn as bindExecutableIdentity, sr as GuardEvidence, st as GitPrestateEnvelope, t as supersedeItem, tn as HostLockContext, tr as EvidenceRole, tt as GitCommandManifest, u as observeAssistantOutcome, un as evaluateHostCapability, ur as GuardItemKind, ut as commitIndexSnapshotDigest, v as PROOF_KINDS, vn as authorityCaptureCounts, vr as TargetTuple, vt as CanonicalArgv, w as SessionQuery, wn as certifyCheckpoint, wr as ACTION_MANIFEST, wt as parsePwshCommand, x as ProofManifest, xn as classifyUserInteraction, xr as WaitAuthorization, xt as ShellParseStatus, y as PROOF_PROTOCOL_VERSION, yn as segmentAuthorityBlocks, yr as TargetValue, yt as CanonicalCommandSurface, z as ManifestIssue, zn as GoalActivationState, zr as semanticActionFromCommand, zt as ALPHA2_HOST_PACKAGES } from "./index-AtjJOrK8.js";
 import "@deepseek-ai/dsh-tools";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
@@ -21,4 +21,4 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockProfile?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_MANIFEST, SemanticAction, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as classifyUserInteraction, A as extractToolSubject, At as STOP_PROTOCOL_VERSION, B as DEFAULT_HOST_LOCK, Bt as COMMAND_SURFACE_MANIFEST, C as latestAssistantText, Ct as canonicalRegistryBase, D as supersedeItem, Dt as CERTIFICATE_VERSION, E as deriveProjection, Et as ACTION_MANIFEST_VERSION, F as parsePwshCommand, Ft as requestedTargetMatchesResolved, G as bindExecutableIdentity, Gt as sanitizeClauseText, H as GOAL_HOST_PACKAGES, Ht as canonicalizePath, I as parseShellCommand, It as semanticActionFromCommand, J as evaluateHostCapability, Jt as createProjection, K as bindLiveGoalCapability, Kt as sanitizeUrl, L as goalCompletionDenial, Lt as semanticActionFromText, M as withDurability, Mt as actionCompatible, N as canonicalArgvFromCommand, Nt as isStatefulAction, O as evidenceFromPersistedToolResult, Ot as SEMANTIC_ACTIONS, P as isRunExecutable, Pt as requestedTargetAuthorizesMutation, Q as segmentAuthorityBlocks, R as hasCurrentCertificate, Rt as validateActionManifest, S as isWholeTaskCompletionClaim, St as segmentClauses, T as PROTOCOL_V3_NOTICE, Tt as ACTION_MANIFEST, U as HOST_CAPABILITY_PACKAGE_GROUPS, Ut as digestStrings, V as EXPECTED_HOST_PACKAGES, Vt as validateManifest, W as SUPPORTED_HOST_MANIFEST, Wt as normalizeClause, X as evaluateToolSurfaceCapability, Y as evaluateHostLock, Z as authorityCaptureCounts, _ as revalidateGitPrestate, _t as classifyClause, a as packageRowsFromActiveGraph, at as DEFAULT_RECOVERY_CHAR_BUDGET, b as decideTurnBoundary, bt as extractOperation, c as resolveInstalledHostLock, ct as recoveryDigest, d as commitIndexSnapshotDigest, dt as evidenceCoverage, et as availableBoundaryQualifications, f as commitTreeSnapshotDigest, ft as evidenceMatchesItem, g as parseGitCommandManifest, gt as captureItem, h as gitCommandMatchesTarget, ht as captureClause, i as injectActiveProfileHostLock, it as certifyCheckpoint, j as isDeterministicCheck, jt as SUPPORTED_EVIDENCE_ADAPTERS, k as extractTextContent, kt as STATEFUL_ACTIONS, l as verifyComposedHostLockDump, lt as renderRecoveryPacket, m as executeRevalidatedGitEffect, mt as currentContractDigest, n as hostLockContextFromComposedDump, nt as isCurrentAcceptedBoundary, o as packageRowsFromPnpmLock, ot as closingHint, p as createGitPrestateEnvelope, pt as isVerifyingCapability, q as evaluateExternalWaitCapability, qt as sha256, r as hostLockRowsFromComposedDump, rt as qualifyBoundary, s as resolveActiveProfileHostLock, st as openItems, t as HostProfileError, tt as effectuateBoundary, u as GIT_COMMAND_MANIFEST_IDS, ut as bindingSatisfies, v as verifiedLinearCommitReadback, vt as extractArtifactPaths, w as observeAssistantOutcome, wt as npmEscapedPackageName, x as decideTurnStopping, xt as isInformationalMessage, y as classifyCompletionClaim, yt as extractMethod, z as BASE_HOST_PACKAGES, zt as validateActionTarget } from "./domain-CBvBQHTL.js";
+import { $ as GOAL_HOST_PACKAGES, $t as COMMAND_SURFACE_MANIFEST, A as decideTurnStopping, At as classifyClause, B as isDeterministicCheck, Bt as CERTIFICATE_VERSION, C as executeRevalidatedGitEffect, Ct as bindingSatisfies, D as verifiedLinearCommitReadback, Dt as currentContractDigest, E as revalidateGitPrestate, Et as isVerifyingCapability, F as deriveProjection, Ft as segmentClauses, G as parseShellCommand, Gt as actionCompatible, H as canonicalArgvFromCommand, Ht as STATEFUL_ACTIONS, I as supersedeItem, It as canonicalRegistryBase, J as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Jt as requestedTargetMatchesResolved, K as goalCompletionDenial, Kt as isStatefulAction, L as evidenceFromPersistedToolResult, Lt as npmEscapedPackageName, M as latestAssistantText, Mt as extractMethod, N as observeAssistantOutcome, Nt as extractOperation, O as classifyCompletionClaim, Ot as captureClause, P as PROTOCOL_V3_NOTICE, Pt as isInformationalMessage, Q as EXPECTED_HOST_PACKAGES, Qt as validateActionTarget, R as extractTextContent, Rt as ACTION_MANIFEST, S as createGitPrestateEnvelope, St as renderRecoveryPacket, T as parseGitCommandManifest, Tt as evidenceMatchesItem, U as isRunExecutable, Ut as STOP_PROTOCOL_VERSION, V as withDurability, Vt as SEMANTIC_ACTIONS, W as parsePwshCommand, Wt as SUPPORTED_EVIDENCE_ADAPTERS, X as BASE_HOST_PACKAGES, Xt as semanticActionFromText, Y as ALPHA2_HOST_PACKAGES, Yt as semanticActionFromCommand, Z as DEFAULT_HOST_LOCK, Zt as validateActionManifest, _ as resolveInstalledHostLock, _t as certifyCheckpoint, a as createProofManifest, an as sanitizeUrl, at as evaluateHostCapability, b as commitIndexSnapshotDigest, bt as openItems, c as sessionQuery, ct as selectHostCohort, d as hostLockContextFromComposedDump, dt as segmentAuthorityBlocks, en as validateManifest, et as HOST_CAPABILITY_PACKAGE_GROUPS, f as hostLockRowsFromComposedDump, ft as classifyUserInteraction, g as resolveActiveProfileHostLock, gt as qualifyBoundary, h as packageRowsFromPnpmLock, ht as isCurrentAcceptedBoundary, i as canonicalProjection, in as sanitizeClauseText, it as evaluateExternalWaitCapability, j as isWholeTaskCompletionClaim, jt as extractArtifactPaths, k as decideTurnBoundary, kt as captureItem, l as validateProofManifest, lt as ALPHA3_HOST_PACKAGES, m as packageRowsFromActiveGraph, mt as effectuateBoundary, n as PROOF_PROTOCOL_VERSION, nn as digestStrings, nt as bindExecutableIdentity, o as proofDigest, on as sha256, ot as evaluateHostLock, p as injectActiveProfileHostLock, pt as availableBoundaryQualifications, q as hasCurrentCertificate, qt as requestedTargetAuthorizesMutation, r as bindProofToProjection, rn as normalizeClause, rt as bindLiveGoalCapability, s as proofEvidenceConstraints, sn as createProjection, st as evaluateToolSurfaceCapability, t as PROOF_KINDS, tn as canonicalizePath, tt as HOST_COHORTS, u as HostProfileError, ut as authorityCaptureCounts, v as verifyComposedHostLockDump, vt as DEFAULT_RECOVERY_CHAR_BUDGET, w as gitCommandMatchesTarget, wt as evidenceCoverage, x as commitTreeSnapshotDigest, xt as recoveryDigest, y as GIT_COMMAND_MANIFEST_IDS, yt as closingHint, z as extractToolSubject, zt as ACTION_MANIFEST_VERSION } from "./domain-CHTQFIT8.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -3466,4 +3466,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HostProfileError, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_MANIFEST, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/ARCHITECTURE.md

@@ -28,7 +28,7 @@ The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` appli
 
 The runtime rebuilds the projection from the log before each step. Before evidence is produced, the runtime awaits `ctx.sessions.flush(session)`; if no durability listener participated, evidence is marked `durability-unknown`, which fails closed.
 
-The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values and action/platform capability groups live in `manifests/supported-host.v1.json`. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
+The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values live in `manifests/supported-host.v1.json` as an exact host cohort registry: the whole graph must atomically match one audited cohort, mixed or unknown rows fail closed, and the selected cohort identity is part of every host lock digest, so switching cohorts invalidates certificate authority. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
 
 Evidence is produced only from persisted `tool/call` + `tool/result` pairs. Guard never inserts context between a Code Mode sub-call and its durable result.
 

package/docs/COMPATIBILITY.md

@@ -1,15 +1,49 @@
 # Compatibility
 
-The current development target is pinned, not a floating claim.
+Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
-## Target
+## Current 0.4.0 release baseline
 
-- DeepSeek Harness: `0.1.1-rc.2`
-- Cordis: `4.0.1`
+- Plugin: `dsh-completion-guard` `0.4.0`
+- DeepSeek Harness: `0.1.2-alpha.3`
+- dshmarket: `1.39.0`
+- Cordis: `4.0.2`
 - Node: `>= 22`
 - pnpm: `>= 11`
 
-The DSH host is a developer preview that declares breaking changes. A source build does not establish native acceptance; each profile and platform is verified separately.
+DSH is still a developer preview and may make breaking changes. Version 0.4.0 therefore makes no floating alpha compatibility claim.
+
+## Upstream adaptation policy
+
+Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumes with the first DeepSeek Harness RC published after alpha.3; follow the upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) for that milestone.
+
+## Platform and release evidence
+
+- **Source and CI:** the release commit must pass the repository matrix and the Ubuntu, macOS, and Windows Node.js 22/24 CI jobs.
+- **Exact package:** the repository packer emits one deterministic 26-file tgz with its full source commit in `gitHead`. That same SHA-256 must be used on both native platforms and published to npm without repacking.
+- **Native scope:** macOS and Windows acceptance separately cover isolated Web and Headless installation, complete host-lock readback, repeated injection, Web restart and recovery, intentional Headless credential failure, daily-profile preservation, and scoped cleanup.
+- **Public identity:** the annotated tag, npm manifest and downloaded tgz, GitHub Release target, checksum, and platform annexes must all resolve to the same release commit and package bytes.
+- **Daily profiles:** upgrading a user's daily DSH profile is a separate action and is not implied by release acceptance.
+
+## Historical compatibility cohorts
+
+- DSH `0.1.1-rc.2` + dshmarket `1.36.0` + Cordis `4.0.1` is a retained, published-line cohort.
+- DSH `0.1.2-alpha.2` + dshmarket `1.38.1` + Cordis `4.0.2` is the published 0.3.2 cohort checked natively on macOS and Windows.
+- DSH `0.1.2-alpha.2` + dshmarket `1.39.0` + Cordis `4.0.2` remains a deterministic compatibility cohort. It is no longer a native 0.4.0 release blocker.
+
+## Rejection rules
+
+The four exact host sets are recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). Each set is a complete list of required packages and versions. Every row must match one set.
+
+Missing, mixed, duplicate, unidentified, unknown, or integrity-drifted rows leave the Guard unavailable. Unregistered substitutions such as alpha.3 with dshmarket `1.38.1` are rejected as mixed graphs. dshmarket is an authoritative lock input; skin-center is not.
+
+The selected set is part of the host-lock digest. Changing sets invalidates earlier certificates, and a platform is marked supported only after its complete set passes native checks there.
+
+## Evidence links
+
+- Candidate and historical-artifact evidence: [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md)
+- Shared Codex/DSH semantic scope: [`SEMANTIC_COMPATIBILITY.md`](SEMANTIC_COMPATIBILITY.md)
+- Exact host identities: [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json)
 
 ## Loader contract
 
@@ -17,11 +51,43 @@ The package exposes a named `apply(ctx)` function and a named `inject` array (`[
 
 The plugin accepts an `activation` configuration value of `opt-in` or `always`. The default is `opt-in`; `always` initializes the projection as enabled before the persisted session log is replayed. Invalid values fail during plugin configuration instead of silently falling back. A DSH profile can select `always` with an ID-targeted `config` override in its `cordis.patch.yml`; see the README quick start for the complete example and the replay implications for existing sessions.
 
-Version 0.3 additionally accepts `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile`, generated from the active DSH runtime and profile graphs. Each critical row carries the exact resolved version and registry tarball integrity. Missing, duplicate, multi-version, or drifted identity is not inferred from a nearby lockfile and fails closed. Capabilities are evaluated separately for base/Goal, agent loop, POSIX or Windows terminal, filesystem tools, DSH CLI, plugin inventory, Web control, and jobs; a missing platform- or action-specific group disables only the dependent path. The filesystem group freezes pinned `read`/`write`/`edit` registration, closed result and presentation shapes, the `ctx.fs` local/sandbox implementation, read-before-mutation observation policy, sandbox policy, and approval provider. Consequently a missing or drifted filesystem row disables only `create`/`modify` and ordinary filesystem facts, while a valid terminal or jobs capability remains usable. The audited identity is [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). The packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README is the supported generation and readback path; the default patch has no `hostLockPackages` and therefore fails closed until that flow succeeds.
+### Host-lock setup
+
+Before the Guard can certify work, generate and verify the host lock from the active DSH runtime and profile. Use the packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README. The default patch has no `hostLockPackages`, so the Guard fails closed until this flow succeeds.
+
+Version 0.3 accepts the generated `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` values. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate, multi-version, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
+
+### Capability groups
+
+The host lock evaluates these groups independently:
+
+- base and Goal;
+- agent loop;
+- POSIX or Windows terminal;
+- filesystem tools;
+- DSH CLI;
+- plugin inventory;
+- Web control; and
+- jobs.
+
+A missing platform- or action-specific group disables only the path that depends on it. For example, a valid terminal or jobs group remains usable when the filesystem group is unavailable.
+
+The filesystem group has a narrower contract of its own. It freezes the registered `read`, `write`, and `edit` tools; their closed result and presentation shapes; the local or sandbox `ctx.fs` implementation; the read-before-mutation observation policy; the sandbox policy; and the approval provider. A missing or drifted filesystem row disables `create`, `modify`, and ordinary filesystem facts without disabling unrelated capability groups.
 
 ## Peer dependencies
 
-Runtime packages are host-provided and declared as peer dependencies: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-agent`, `@deepseek-ai/dsh-commands`, `@deepseek-ai/dsh-llm`, `@deepseek-ai/dsh-session`, `@deepseek-ai/dsh-tools`. Goal uses two exact optional peers as one capability: `@deepseek-ai/dsh-goal@0.1.1-rc.2` owns state, and `@deepseek-ai/dsh-tool-goal@0.1.1-rc.2` owns the audited `update_goal` name/schema/arguments. Both graph rows and the live Goal service/tool must agree. Profiles without this complete capability still load, but Goal-dependent integration is inactive. The other peer ranges remain compatible package declarations, while runtime acceptance is constrained by the exact injected host lock.
+The ordinary runtime packages are host-provided peers:
+
+- `@deepseek-ai/cordis`;
+- `@deepseek-ai/dsh-agent`;
+- `@deepseek-ai/dsh-commands`;
+- `@deepseek-ai/dsh-llm`;
+- `@deepseek-ai/dsh-session`; and
+- `@deepseek-ai/dsh-tools`.
+
+Goal support uses two exact optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
+
+Peer ranges accept only the registered DSH version lines: `0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3`, with Cordis `4.0.1 || 4.0.2`. These are not floating support claims. Runtime acceptance still requires an exact injected host lock and atomic selection of one complete cohort.
 
 ## Terminal outcome contract
 
@@ -51,10 +117,25 @@ certifying capability, and has unknown outcome.
 
 ## Verified surfaces
 
+### Current visible behavior
+
 - `dsh --profile web --dump-config` and `--profile headless --dump-config` both include `context-guard`.
-- A real headless boot loads the plugin (apply, `ctx.sessions` access, and listener registration succeed) and only stops at missing provider credentials.
+- A real Headless boot loads the plugin: `apply`, `ctx.sessions` access, and listener registration succeed before the run reaches the intentional missing-provider-credentials boundary.
+- The slash command appears in the Web command directory. Its `on`, `off`, `clear`, `status`, and `diagnose` subcommands produce the expected `command/run` and `command/done` events.
+
+`inspect` reports whether the active package graph matches a supported cohort, so it can correctly return `supported` before injection. Pre-injection failure is established by reading the composed configuration and by `verify-dump`, which rejects missing or mismatched injected host-lock data.
+
+Evidence and certificates are session-scoped. A later DSH session cannot import or certify evidence IDs from an earlier session. Any workflow that needs a certificate must therefore produce its evidence and checkpoint in the same session.
+
+### Historical 0.3.x evidence
 
-The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. The v0.3 runtime baseline exercises 352 deterministic tests in 19 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 351 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. Version 0.3.1 preserves those runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. The final 0.3.1 tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
+- **0.3.0 runtime baseline:** 20 files exercise 360 deterministic tests, including all 37 mirrored portable semantic cases and all 29 digest vectors. macOS passed 359 tests with one Windows-only shim test capability-skipped; native Windows passed all 352 tests in the earlier 19-file baseline with no skips.
+- **0.3.0 native and CI evidence:** the same canonical pre-release tgz passed isolated Web and Headless installation, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on native macOS and Windows. Headless reached the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24.
+- **0.3.0 model-session evidence:** a credentialed session verified one accepted evidence binding and persisted typed-boundary/disarm path. A deliberately over-broad prompt remained incomplete and received no false certificate.
+- **0.3.1 provenance repair:** 0.3.1 preserves the 0.3.0 runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. Its final tgz is separately bound to native-platform and public-registry readback.
+- **0.3.2 completed release:** the frozen package from commit `22cde610` passed the same-byte isolated lifecycle on native macOS and Windows. Its tag, npm publication, GitHub Release, and public downloads resolve to the same commit and bytes.
+
+Exact commands, artifact identities, and platform limits for these releases are recorded in [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md). The published 0.1.x and 0.2.x lines retain their own historical evidence there. The fail-closed invariants below remain covered as regressions.
 
 ## Session-layer capture filter and goal completion (v0.2.1)
 
@@ -88,9 +169,61 @@ new evidence, or a new contract revision always re-remind.
 
 The full `STATEFUL_ACTIONS` set is `install | apply | create | modify | restart | commit | push | publish | pull | fetch`. Each requires distinct resolution/effect/state evidence IDs, exact same-target closure, independent state readback, and a versioned expected-transition payload. An effect-only success is incomplete. Old v0.2 scope-run certificates are retained as `legacy_generic_run` audit facts and do not become current v0.3 authority; unprovable legacy authority is also non-certifiable.
 
-`context_guard_evidence` is a read-only producer for resolution, persisted-effect validation, and state readback. `context_guard_action` is the explicitly mutating surface for exact-tgz install/apply/publish, two-phase dshmarket restart, and exact Git commit/push/pull/fetch. It first flushes and replays the resolution/contract chain, then requires the exact target digest and id/revision of one current pending `root_instruction` or `root_adoption` requirement whose action and complete requested identity match this resolution; a matching pending root prohibition denies the mutation regardless of message order, while prohibitions and acceptance clauses never grant authority. Install/apply require exact package id, version, and profile; publish requires exact artifact id, version, and canonical registry (v0.3 does not authorize `latest` or ranges); push/pull/fetch require repository, remote, and canonical explicit full ref/refspec; restart requires the exact service id. Disabled, integrity-unknown, stale-host, missing, passed, superseded, clarification-required, incomplete-target, action-swapped, target-swapped, and unrebound legacy paths are rejected before executable inspection, command execution, HTTP, or intent persistence. Unknown selector, command-manifest, or Git argument keys are rejected. `install` requires package absence, while `apply` requires an existing package and a changed version/integrity. Publish executes the exact resolved tgz with `--ignore-scripts`; its registry is a canonical HTTPS base shared by capture, argv, and standard packument readback, with credentials, query, fragment, encoded separators, control characters, and ambiguous path segments rejected. Resolution and effect bind the same canonical executable realpath and version. Windows `.cmd`/`.bat` shims additionally bind the canonical `SystemRoot\\System32\\cmd.exe` realpath and version; arguments containing shell-control, expansion, quote, NUL, or newline characters are unsupported, and execution never performs a second `PATH` search or trusts a changed `ComSpec`. Modify re-hashes the source bytes against the frozen pre-digest before deriving the unique UTF-8 replacement post-digest. Restart persists an intent before POST and closes only after a restored process observes a changed boot ID. Git operations reject aliases, implicit/delete/wildcard/force refs, target substitution, and prestate drift. Commit certification additionally rejects root, merge, or substituted-parent commits; fetch certification requires its resolved pre-HEAD, post-HEAD readback, and predicate parameter to be equal. Pre-execute revalidation is a correctness gate rather than isolation from same-user concurrent tampering; any divergent post-action readback is not certified.
+### Read-only resolution and explicit mutation
+
+`context_guard_evidence` is read-only. It resolves the current target, checks a persisted effect, and reads the resulting state. `context_guard_action` is the explicitly mutating surface for exact-tgz install, apply, and publish; two-phase dshmarket restart; and exact Git commit, push, pull, and fetch.
+
+The normal flow is: resolve the current target, match that resolution to one authorized pending requirement, perform the exact action, and independently read the state back. A successful effect without matching state evidence remains incomplete.
+
+### Authorization and early rejection
+
+Before mutation, `context_guard_action` flushes and replays the resolution and contract chain. It then requires the exact target digest plus the id and revision of one current pending `root_instruction` or `root_adoption` requirement. The requirement's action and complete requested identity must match the resolution.
+
+A matching pending root prohibition denies the mutation regardless of message order. Prohibitions and acceptance clauses never grant authority.
+
+The action is rejected before executable inspection, command execution, HTTP, or intent persistence when the requirement is disabled, integrity-unknown, stale-host, missing, already passed, superseded, clarification-required, incomplete-target, action-swapped, target-swapped, or an unrebound legacy item. Unknown selector, command-manifest, or Git argument keys are also rejected.
+
+### Package operations
+
+- `install` requires the exact package id, version, and profile, and the package must be absent.
+- `apply` requires the exact package id, version, and profile, plus an existing package with a changed version or integrity.
+- `publish` requires the exact artifact id, version, and canonical registry. Version 0.3 does not authorize `latest` or a version range.
+
+Publish executes the exact resolved tgz with `--ignore-scripts`. Capture, argv, and standard packument readback use the same canonical HTTPS registry base. Registries containing credentials, a query, fragment, encoded separator, control character, or ambiguous path segment are rejected.
+
+The resolution and effect bind the same canonical executable realpath and version.
+
+### Git operations
+
+Push, pull, and fetch require the exact repository, remote, and canonical explicit full ref or refspec. Git aliases, implicit refs, deletion refs, wildcards, force refs, target substitution, and prestate drift are rejected.
+
+Commit certification additionally rejects root commits, merge commits, and substituted parents. Fetch certification requires its resolved pre-HEAD, post-HEAD readback, and predicate parameter to be equal.
+
+### File creation and modification
+
+Create and modify bind to the frozen target and expected transition described below. For modify, the Guard re-hashes the source bytes against the frozen pre-digest before deriving the unique UTF-8 replacement post-digest.
+
+### Restart
+
+Restart requires the exact service id. It persists an intent before POST and closes only after the restored process reports a changed boot ID.
+
+### Windows command shims
+
+Windows `.cmd` and `.bat` actions also bind the canonical `SystemRoot\\System32\\cmd.exe` realpath and version. Arguments containing shell control, expansion, quotes, NUL, or newline characters are unsupported. Execution never performs a second `PATH` search or trusts a changed `ComSpec`.
+
+### Concurrency limit
+
+Pre-execute revalidation is a correctness check, not isolation from another process running as the same user. Any divergent post-action readback is not certified.
+
+### Expected transitions and readback
+
+Every stateful resolution freezes its expected transition before the effect and binds a stable digest of that payload. Checkpoint diagnostics copy the immutable payload from the resolution fact. Callers cannot construct create or modify predicates from post-effect state.
+
+- **Create:** hash the exact UTF-8 content from the closed write manifest.
+- **Modify:** read the original bytes, require valid UTF-8 and exactly one `old_string` match, apply the pinned single replacement in memory, and hash the resulting bytes.
+- **Restart:** freeze `health=healthy` as a manifest constant.
 
-Every stateful resolution freezes its expected transition before effect and binds a stable digest of that payload. Checkpoint diagnostics copy this immutable payload from the resolution fact; callers cannot construct create/modify predicates from post-effect state. Create hashes the exact UTF-8 content from the closed write manifest. Modify first reads the original bytes, requires valid UTF-8 and exactly one `old_string` match, applies the pinned single replacement in memory, and hashes the resulting bytes. Restart freezes `health=healthy` as a manifest constant. A later successful effect whose independent state differs from these values remains incomplete.
+After the action, independent state readback must match the frozen transition. A successful effect with different state remains incomplete.
 
 ## Legacy v0.2 command parsing subset