dsh-completion-guard 0.5.2 → 0.6.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as parseShellCommand, $n as isStatefulAction, $t as isWholeTaskCompletionClaim, A as createGitPrestateEnvelope, An as extractMethod, At as RC1_HOST_PACKAGES, B as CAPTURE_V042_NOTICE, Bn as namedActions, Bt as renderRecoveryPacket, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as evidenceAvailabilityReason, Ct as SUPPORTED_HOST_VERSIONS, D as GIT_COMMAND_TEMPLATES, Dn as captureItem, Dt as satisfiesSupportedHostRange, E as GIT_COMMAND_MANIFEST_IDS, En as captureClause, Et as parseHostVersion, F as verifiedLinearCommitReadback, Fn as interpretMessage, Ft as DEFAULT_RECOVERY_CHAR_BUDGET, G as evidenceFromPersistedToolResult, Gn as ACTION_MANIFEST, Gt as CONTROL_RECORD_PREFIX, H as PROTOCOL_V4_NOTICE, Hn as statefulActionsOfScope, Ht as evidenceCoverage, I as FIRST_STEP_GUIDANCE, In as isExecutableItem, It as MIN_RECOVERY_CHAR_BUDGET, J as isDeterministicCheck, Jn as SEMANTIC_ACTIONS, Jt as classifyCompletionClaim, K as extractTextContent, Kn as ACTION_MANIFEST_VERSION, Kt as NO_PROGRESS_RECORD_PREFIX, L as claimedBatchHasRealRootInput, Ln as isOpenObligation, Lt as closingHint, M as gitCommandMatchesTarget, Mn as isInformationalMessage, Mt as authorityCaptureCounts, N as parseGitCommandManifest, Nn as segmentClauses, Nt as segmentAuthorityBlocks, O as commitIndexSnapshotDigest, On as classifyClause, Ot as RC015_RC2_HOST_PACKAGES, P as revalidateGitPrestate, Pn as interpretClause, Pt as certifyCheckpoint, Q as parsePwshCommand, Qn as actionCompatible, Qt as isRootPauseRequest, R as lifecyclePhase, Rn as kindOfScope, Rt as openItems, S as SESSION_API_UNSUPPORTED, Sn as deriveItemDiagnosis, St as SUPPORTED_HOST_RANGE, T as snapshotSessionEvents, Tn as relevantEvidence, Tt as evaluateMinimumHostVersion, U as deriveProjection, Un as canonicalRegistryBase, Ut as evidenceMatchesItem, V as PROTOCOL_V3_NOTICE, Vn as semanticActionOfScope, Vt as bindingSatisfies, W as supersedeItem, Wn as npmEscapedPackageName, Wt as isVerifyingCapability, X as canonicalArgvFromCommand, Xn as STOP_PROTOCOL_VERSION, Xt as decideTurnStopping, Y as withDurability, Yn as STATEFUL_ACTIONS, Yt as decideTurnBoundary, Z as isRunExecutable, Zn as SUPPORTED_EVIDENCE_ADAPTERS, Zt as decisionBoundaryKey, _ as packageRowsFromPnpmLock, _n as rebindResponse, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as hasCurrentCertificate, ar as validateActionTarget, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as isFrozenV042RebindResponse, bt as LATEST_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as isCurrentAcceptedBoundary, cr as classifyTaskIntent, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as createProjection, dr as digestStrings, dt as LEGACY_HOST_COHORTS, en as latestAssistantText, er as requestedTargetAuthorizesMutation, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as confirmRebind, fr as normalizeClause, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as rebindAttemptKey, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as proposeRebindV042, hr as sha256, ht as evaluateHostCapability, i as canonicalProjection, in as goalCompletionDenial, ir as validateActionManifest, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as extractOperation, jt as ALPHA3_HOST_PACKAGES, k as commitTreeSnapshotDigest, kn as extractArtifactPaths, kt as RC015_HOST_PACKAGES, l as validateProofManifest, ln as qualifyBoundary, lr as classifyUserInteraction, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as proposeRebindOutcome, mr as sanitizeUrl, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as observeAssistantOutcome, nr as semanticActionFromCommand, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as availableBoundaryQualifications, or as COMMAND_SURFACE_MANIFEST, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebind, pr as sanitizeClauseText, pt as bindLiveGoalCapability, q as extractToolSubject, qn as CERTIFICATE_VERSION, qt as NO_PROGRESS_TURNS_BEFORE_STOP, r as bindProofToProjection, rn as progressFingerprint, rr as semanticActionFromText, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as effectuateBoundary, sr as validateManifest, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as latestRootInstruction, tr as requestedTargetMatchesResolved, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as currentContractDigest, ur as canonicalizePath, ut as HOST_COHORTS, v as readActiveHostGraph, vn as replayRebindResult, vt as hostVersionFromPackages, w as SessionApiError, wn as itemDiagnosis, wt as compareHostVersions, x as verifyComposedHostLockDump, xn as parseConfirmationMessage, xt as MIN_SUPPORTED_HOST_VERSION, y as resolveActiveProfileHostLock, yn as CONFIRM_LINE_PATTERN, yt as selectHostCohort, z as previewFirstStepInjection, zn as maskCodeSpans, zt as recoveryDigest } from "./domain-RuX9l07o.js";
+import { $ as isDeterministicCheck, $n as deriveItemDiagnosis, $t as proofDigestV2, A as previewFirstStepInjection, An as isWholeTaskCompletionClaim, Ar as STOP_PROTOCOL_VERSION_V2, At as evaluateMinimumHostVersion, B as RELEASE_SETTLEMENT_PREFIX, Bn as qualifyBoundary, Br as validateActionManifest, Bt as PROOF_CAPABILITY_MATRIX, C as gitCommandMatchesTarget, Cn as NO_PROGRESS_RECORD_PREFIX, Cr as ACTION_MANIFEST_VERSION, Ct as hostVersionFromPackages, D as FIRST_STEP_GUIDANCE, Dn as decideTurnStopping, Dr as SEMANTIC_ACTIONS, Dt as SUPPORTED_HOST_RANGE, E as verifiedLinearCommitReadback, En as decideTurnBoundary, Er as CERTIFICATE_VERSION_V2, Et as MIN_SUPPORTED_HOST_VERSION, F as PROTOCOL_V5_NOTICE, Fn as goalCompletionDenial, Fr as requestedIdentityKey, Ft as RC1_HOST_PACKAGES, G as releaseContractFor, Gn as proposeRebindOutcome, Gr as classifyUserInteraction, Gt as PROOF_PROTOCOL_VERSION_V2, H as inFlightReservation, Hn as createProjection, Hr as COMMAND_SURFACE_MANIFEST, Ht as PROOF_KINDS_V2, I as deriveProjection, In as hasCurrentCertificate, Ir as requestedTargetAuthorizesMutation, It as ALPHA3_HOST_PACKAGES, J as reservationFor, Jn as rebindResponse, Jr as normalizeClause, Jt as canonicalProjection, K as releaseCoverage, Kn as proposeRebindV042, Kr as canonicalizePath, Kt as bindProofToProjection, L as RELEASE_OPERATIONS, Ln as availableBoundaryQualifications, Lr as requestedTargetMatchesResolved, Lt as authorityCaptureCounts, M as DEFAULT_DELEGATION_TOOL_NAMES, Mn as latestRootInstruction, Mr as actionCompatible, Mt as satisfiesSupportedHostRange, N as PROTOCOL_V3_NOTICE, Nn as observeAssistantOutcome, Nr as boundedArtifactChoiceMatches, Nt as RC015_RC2_HOST_PACKAGES, O as claimedBatchHasRealRootInput, On as decisionBoundaryKey, Or as STATEFUL_ACTIONS, Ot as SUPPORTED_HOST_VERSIONS, P as PROTOCOL_V4_NOTICE, Pn as progressFingerprint, Pr as isStatefulAction, Pt as RC015_HOST_PACKAGES, Q as extractToolSubject, Qn as parseConfirmationMessage, Qt as proofDigest, R as RELEASE_OPERATION_SURFACES, Rn as effectuateBoundary, Rr as semanticActionFromCommand, Rt as segmentAuthorityBlocks, S as executeRevalidatedGitEffect, Sn as CONTROL_RECORD_PREFIX, Sr as ACTION_MANIFEST, St as evaluateToolSurfaceCapability, T as revalidateGitPrestate, Tn as classifyCompletionClaim, Tr as CERTIFICATE_VERSION, Tt as LATEST_SUPPORTED_HOST_VERSION, U as normalizeReleaseContract, Un as confirmRebind, Ur as validateManifest, Ut as PROOF_MANIFEST_DOMAIN_V2, V as contractById, Vn as currentContractDigest, Vr as validateActionTarget, Vt as PROOF_KINDS, W as readbackSettlesContract, Wn as proposeRebind, Wr as classifyTaskIntent, Wt as PROOF_PROTOCOL_VERSION, X as evidenceFromPersistedToolResult, Xn as CONFIRM_LINE_PATTERN, Xr as sanitizeUrl, Xt as createProofManifestV2, Y as supersedeItem, Yn as replayRebindResult, Yr as sanitizeClauseText, Yt as createProofManifest, Z as extractTextContent, Zn as isFrozenV042RebindResponse, Zr as sha256, Zt as proofCapabilityReport, _ as GIT_COMMAND_MANIFEST_IDS, _n as renderRecoveryPacket, _r as namedActions, _t as bindExecutableIdentity, a as injectActiveProfileHostLock, an as scopeCoverageDigest, ar as classifyClause, at as ACTIVE_HOST_COHORT_ID, b as commitTreeSnapshotDigest, bn as evidenceMatchesItem, br as canonicalRegistryBase, bt as evaluateHostCapability, c as packageRowsFromPnpmLock, cn as validateProofManifest, cr as extractOperation, ct as ALPHA2_DSHMARKET_139_HOST_PACKAGES, d as resolveInstalledHostLock, dn as certificateClosure, dr as interpretClause, dt as DEFAULT_HOST_LOCK, en as proofEvidenceConstraints, er as evidenceAvailabilityReason, et as withDurability, f as verifyComposedHostLockDump, fn as DEFAULT_RECOVERY_CHAR_BUDGET, fr as interpretMessage, ft as EXPECTED_HOST_PACKAGES, g as snapshotSessionEvents, gn as recoveryDigest, gr as maskCodeSpans, gt as LEGACY_HOST_COHORTS, h as SessionApiError, hn as openItems, hr as kindOfScope, ht as HOST_COHORTS, i as hostLockRowsFromComposedDump, in as requiredSubjectsOf, ir as captureItem, it as parseShellCommand, j as CAPTURE_V042_NOTICE, jn as latestAssistantText, jr as SUPPORTED_EVIDENCE_ADAPTERS, jt as parseHostVersion, k as lifecyclePhase, kn as isRootPauseRequest, kr as STOP_PROTOCOL_VERSION, kt as compareHostVersions, l as readActiveHostGraph, ln as validateProofManifestV2, lr as isInformationalMessage, lt as ALPHA2_HOST_PACKAGES, m as SESSION_EVENT_ENVELOPE_INVALID, mn as closingHint, mr as isOpenObligation, mt as HOST_CAPABILITY_PACKAGE_GROUPS, n as combineHostPolicy, nn as proofOperationMatches, nr as relevantEvidence, nt as isRunExecutable, o as inspectTargetHostGraph, on as sessionQuery, or as extractArtifactPaths, ot as ACTIVE_HOST_COHORT_IDS, p as SESSION_API_UNSUPPORTED, pn as MIN_RECOVERY_CHAR_BUDGET, pr as isExecutableItem, pt as GOAL_HOST_PACKAGES, q as releasePreEffectDecision, qn as rebindAttemptKey, qr as digestStrings, qt as bindProofV2ToProjection, r as hostLockContextFromComposedDump, rn as proofV2Rejection, rr as captureClause, rt as parsePwshCommand, s as packageRowsFromActiveGraph, sn as sessionQueryV2, sr as extractMethod, st as ACTIVE_HOST_LAUNCHER_VERSION, t as HostProfileError, tn as proofHostSurfacesOf, tr as itemDiagnosis, tt as canonicalArgvFromCommand, u as resolveActiveProfileHostLock, un as certifiableOpenItems, ur as segmentClauses, ut as BASE_HOST_PACKAGES, v as GIT_COMMAND_TEMPLATES, vn as bindingSatisfies, vr as semanticActionOfScope, vt as bindLiveGoalCapability, w as parseGitCommandManifest, wn as NO_PROGRESS_TURNS_BEFORE_STOP, wr as BOUNDED_ARTIFACT_TYPES, wt as selectHostCohort, x as createGitPrestateEnvelope, xn as isVerifyingCapability, xr as npmEscapedPackageName, xt as evaluateHostLock, y as commitIndexSnapshotDigest, yn as evidenceCoverage, yr as statefulActionsOfScope, yt as evaluateExternalWaitCapability, z as RELEASE_RESERVATION_PREFIX, zn as isCurrentAcceptedBoundary, zr as semanticActionFromText, zt as certifyCheckpoint } from "./domain-COehX7MB.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -166,6 +166,7 @@ function checkpointPage(p, query, full) {
 		available_qualifications: []
 	};
 	if (full.certificate) output.certificate = full.certificate;
+	if (full.proof_state) output.proof_state = full.proof_state;
 	const pagination = {
 		snapshot: identity,
 		scope: evidence_scope,
@@ -357,6 +358,10 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 			detail_id: { type: "string" },
 			detail_offset: { type: "integer" },
 			detail_snapshot: { type: "string" },
+			proof: {
+				type: "object",
+				additionalProperties: true
+			},
 			bindings: {
 				type: "array",
 				required: true,
@@ -460,6 +465,25 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 						type: "object",
 						additionalProperties: true
 					},
+					proof_state: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							status: {
+								type: "string",
+								enum: [
+									"absent",
+									"bound",
+									"rejected",
+									"invalid"
+								]
+							},
+							reason_codes: {
+								type: "array",
+								items: { type: "string" }
+							}
+						}
+					},
 					reason_code: { type: "string" },
 					next_step: { type: "string" },
 					detail_id: { type: "string" },
@@ -599,6 +623,8 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 							evidence_sha256: { type: "string" },
 							binding_digest: { type: "string" },
 							certification_digest: { type: "string" },
+							unit_id: { type: "string" },
+							unit_closure_digest: { type: "string" },
 							goal_ref: { oneOf: [{
 								type: "object",
 								additionalProperties: false,
@@ -631,7 +657,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					rejected_bindings: []
 				};
 			}
-			const result = certifyCheckpoint(projection, args.bindings.map((binding) => ({
+			const bindings = args.bindings.map((binding) => ({
 				itemId: binding.item_id,
 				evidenceIds: binding.evidence_ids,
 				...binding.semantic_action ? { semanticAction: binding.semantic_action } : {},
@@ -654,7 +680,39 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					resolvedTarget: closure.resolved_target,
 					order: closure.order
 				})) } : {}
-			})), `C${projection.checkpoints.length + 1}`, false);
+			}));
+			let proofState = {
+				status: "absent",
+				reason_codes: []
+			};
+			if (args.proof !== void 0) {
+				const structural = validateProofManifestV2(args.proof);
+				if (structural.length) proofState = {
+					status: "invalid",
+					reason_codes: structural
+				};
+				else {
+					const binding = bindProofV2ToProjection(projection, args.proof);
+					proofState = binding.length ? {
+						status: "rejected",
+						reason_codes: binding
+					} : {
+						status: "bound",
+						reason_codes: []
+					};
+				}
+			}
+			const result = proofState.status === "rejected" || proofState.status === "invalid" ? {
+				status: "incomplete",
+				contractRevision: projection.contractRevision,
+				openItems: [],
+				rejectedBindings: []
+			} : certifyCheckpoint(projection, bindings, `C${projection.checkpoints.length + 1}`, false);
+			if (proofState.status === "rejected" || proofState.status === "invalid") for (const code of proofState.reason_codes) result.rejectedBindings.push({
+				itemId: "*",
+				reason: "the presented proof does not bind the current contract",
+				reasonCode: code
+			});
 			if (!result.checkpoint) onRejected();
 			const available_evidence = [...projection.evidence.values()].filter((evidence) => evidence.epoch === projection.epoch && (args.evidence_scope === "history" || [...projection.items.values()].some((item) => item.status === "pending" && relevantEvidence(projection, item, evidence)))).sort((a, b) => b.toolResultSeq - a.toolResultSeq || (a.id < b.id ? -1 : 1)).map((evidence) => ({
 				id: evidence.id,
@@ -680,6 +738,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 			}));
 			return checkpointPage(projection, args, {
 				status: result.status,
+				proof_state: proofState,
 				contract_revision: result.contractRevision,
 				blocking_total: result.openItems.length,
 				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item)),
@@ -711,6 +770,10 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					evidence_sha256: result.checkpoint.evidenceSha256,
 					binding_digest: result.checkpoint.bindingDigest,
 					certification_digest: result.checkpoint.certificationDigest,
+					...result.checkpoint.unitId !== void 0 ? {
+						unit_id: result.checkpoint.unitId,
+						unit_closure_digest: result.checkpoint.unitClosureDigest
+					} : {},
 					goal_ref: result.checkpoint.goalRef ?? null
 				} } : {}
 			});
@@ -848,24 +911,211 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 	});
 }
 
+//#endregion
+//#region src/tools/action-preparation.ts
+const GUARD_TOOL_STEPS = [
+	"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
+	"Execute once with context_guard_action, semantic_action, resolution_call_id, target_digest, contract_item_id and contract_item_revision.",
+	"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful action call ID as effect_call_id.",
+	"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
+	"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
+];
+const NATIVE_WRITE_STEPS = [
+	"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
+	"Execute the planned effect once with the native write/edit tool named by command_manifest.planned_tool and exactly the planned_arguments.",
+	"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful write/edit call ID as effect_call_id.",
+	"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
+	"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
+];
+/**
+* The unified descriptor for one stateful action. Git actions keep their
+* historical selector/manifest/step shapes; the other six gain the same
+* complete recipe instead of Git-only coverage.
+*/
+function actionPreparation(action) {
+	switch (action) {
+		case "install":
+		case "apply": return {
+			action,
+			selector_fields: ["package_id", "profile"],
+			optional_selector_fields: ["version"],
+			command_manifest_fields: ["manifest_id", "tgz_path"],
+			command_manifest_ids: [action === "install" ? "dsh.plugin_add_tgz.install.v1" : "dsh.plugin_add_tgz.apply.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["version", "integrity_digest"],
+			readback_fields: [
+				"package_id",
+				"version",
+				"integrity_digest",
+				"profile"
+			],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "create": return {
+			action,
+			selector_fields: ["artifact_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["artifact.create.v1"],
+			planned_tools: ["write", "write_file"],
+			planned_argument_fields: ["file_path", "content"],
+			producer_fields: [
+				"scope",
+				"pre_digest",
+				"change_set_digest"
+			],
+			readback_fields: ["post_digest"],
+			execution_surface: "native_write_edit",
+			steps: NATIVE_WRITE_STEPS
+		};
+		case "modify": return {
+			action,
+			selector_fields: ["artifact_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["artifact.modify.v1"],
+			planned_tools: ["edit", "edit_file"],
+			planned_argument_fields: [
+				"file_path",
+				"old_string",
+				"new_string"
+			],
+			producer_fields: [
+				"scope",
+				"pre_digest",
+				"change_set_digest"
+			],
+			readback_fields: ["post_digest"],
+			execution_surface: "native_write_edit",
+			steps: NATIVE_WRITE_STEPS
+		};
+		case "restart": return {
+			action,
+			selector_fields: ["service_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["manifest_id"],
+			command_manifest_ids: ["dshmarket.restart.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["pre_generation"],
+			readback_fields: ["new_generation", "health"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "publish": return {
+			action,
+			selector_fields: [
+				"artifact_id",
+				"version",
+				"registry"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["manifest_id", "tgz_path"],
+			command_manifest_ids: ["npm.publish_tgz.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["integrity_digest"],
+			readback_fields: [
+				"artifact_id",
+				"version",
+				"registry",
+				"integrity_digest"
+			],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "commit": return {
+			action,
+			selector_fields: ["repository", "branch"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.commit_index_tree.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["pre_head_oid", "change_set_digest"],
+			readback_fields: ["post_head_oid", "pre_head_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "push": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.push_explicit_refs.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["local_oid"],
+			readback_fields: ["remote_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "pull": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.pull_ff_only_explicit.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: [
+				"upstream_oid",
+				"pre_head_oid",
+				"pull_mode"
+			],
+			readback_fields: ["post_head_oid", "tracking_ref_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "fetch": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.fetch_tracking_explicit.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["upstream_oid", "pre_head_oid"],
+			readback_fields: ["tracking_ref_oid", "post_head_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+	}
+}
+
 //#endregion
 //#region src/tools/prepare.ts
+/** Discovery pages stay bounded like checkpoint pages. */
+const DISCOVERY_ITEM_LIMIT = 8;
 /**
-* Thin READ-ONLY preparation surface (v0.5): before any stateful action it
+* Thin READ-ONLY preparation surface (v0.5/0.6): before any stateful action it
 * reports the supported command shape, the required resolution/effect/state
 * evidence order, existing reusable references, and the exact missing fields.
 * It never executes, installs, commits, pushes, restarts, or probes authority
 * through side effects, and it never upgrades a default into user authority.
+* Without an `item_id` it returns the bounded current-item discovery list, so
+* the first step of a session can find the right ID instead of guessing one.
 */
 function createPrepareTool(options) {
 	return defineTool({
 		name: "context_guard_prepare",
-		description: "Read-only pre-action preparation: report the supported command shape, required resolution/effect/state evidence order, existing references, and exact missing target fields for one contract item. Performs no action and grants no authority.",
+		description: "Read-only pre-action preparation: report the supported command shape, required resolution/effect/state evidence order, existing references, and exact missing target fields for one contract item. Omit item_id to list current open items with their IDs. Performs no action and grants no authority.",
 		parameters: {
-			item_id: {
-				type: "string",
-				required: true
-			},
+			item_id: { type: "string" },
 			item_revision: { type: "number" },
 			semantic_action: { type: "string" },
 			requested_target: {
@@ -886,11 +1136,46 @@ function createPrepareTool(options) {
 		},
 		async execute(rawArgs) {
 			const args = rawArgs;
+			if (options.refreshProjection) {
+				let durable = false;
+				try {
+					durable = await options.refreshProjection() === true;
+				} catch {
+					durable = false;
+				}
+				if (!durable) return {
+					status: "unknown",
+					reason_code: "projection_durability_unavailable"
+				};
+			}
 			const p = options.getProjection();
 			if (!p || !p.enabled || p.integrity !== "valid") return {
 				status: "unknown",
 				reason_code: "guard_unavailable"
 			};
+			if (args.item_id === void 0) {
+				const open = [...p.items.values()].filter((item$1) => item$1.status === "pending").sort((a, b) => a.revision - b.revision || a.id.localeCompare(b.id));
+				return {
+					status: "prepared",
+					mode: "discovery",
+					durability: p.durabilityWatermark,
+					contract_revision: p.contractRevision,
+					total_open: open.length,
+					items: open.slice(0, DISCOVERY_ITEM_LIMIT).map((item$1) => {
+						const diagnosis$1 = deriveItemDiagnosis(p, item$1);
+						return {
+							id: item$1.id,
+							revision: item$1.revision,
+							kind: item$1.kind,
+							...item$1.taskKind !== void 0 ? { task_kind: item$1.taskKind } : {},
+							semantic_action: item$1.semanticAction ?? "generic_run",
+							reason_code: diagnosis$1.reason_code,
+							text: item$1.normalizedText
+						};
+					}),
+					note: "Re-run with one item_id to prepare that item. Preparation performs no action."
+				};
+			}
 			const item = p.items.get(args.item_id ?? "");
 			if (!item) return {
 				status: "rejected",
@@ -920,7 +1205,8 @@ function createPrepareTool(options) {
 				"effect (the exact planned change)",
 				"state (independent post-state readback)"
 			] : ["state (matching durable evidence for the requested verification)"];
-			const missingTargetFields = manifestEntry?.stateful && plannedAction ? manifestEntry.resolvedTargetKeys.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
+			const recipe = plannedAction && isStatefulAction(plannedAction) ? actionPreparation(plannedAction) : void 0;
+			const missingTargetFields = recipe ? recipe.selector_fields.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
 			const capability = plannedAction && options.hostCapability ? options.hostCapability(plannedAction) : void 0;
 			const commandShape = options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) : void 0;
 			return {
@@ -937,7 +1223,19 @@ function createPrepareTool(options) {
 				missing_target_fields: missingTargetFields,
 				...capability ? { host_capability: {
 					status: capability.status,
-					reason_code: capability.reasonCode
+					...capability.reasonCode !== void 0 ? { reason_code: capability.reasonCode } : {}
+				} } : {},
+				...recipe ? { evidence_input_contract: {
+					selector_fields: recipe.selector_fields,
+					optional_selector_fields: recipe.optional_selector_fields,
+					command_manifest_fields: recipe.command_manifest_fields,
+					command_manifest_ids: recipe.command_manifest_ids,
+					planned_tools: recipe.planned_tools,
+					planned_argument_fields: recipe.planned_argument_fields,
+					producer_fields: recipe.producer_fields,
+					readback_fields: recipe.readback_fields,
+					execution_surface: recipe.execution_surface,
+					steps: recipe.steps
 				} } : {},
 				note: "Preparation performs no action. A default or guessed target is not user authority; explicit root instruction is required for missing target fields."
 			};
@@ -1037,12 +1335,14 @@ function adapterId(action) {
 	if (action === "publish") return "context-guard.registry.v1";
 	return "context-guard.git.v1";
 }
-function unavailable(action, role, reason) {
+function unavailable(action, role, reason, missingFields, nextStep) {
 	return {
 		status: "unavailable",
 		reason_code: reason,
 		semantic_action: action,
 		evidence_role: role,
+		...missingFields?.length ? { missing_fields: missingFields } : {},
+		...nextStep ? { next_step: nextStep } : {},
 		resolved_target: {},
 		observed_state: {},
 		adapter_id: adapterId(action),
@@ -1282,12 +1582,63 @@ async function tgzIdentity(path) {
 		offset = bodyStart + Math.ceil(size$1 / 512) * 512;
 	}
 	if (typeof manifest?.name !== "string" || typeof manifest.version !== "string") return void 0;
+	const gitHead = typeof manifest.gitHead === "string" && /^[0-9a-f]{40}$/.test(manifest.gitHead) ? manifest.gitHead : void 0;
+	const repositoryField = manifest.repository;
+	const repository = typeof repositoryField === "string" ? repositoryField : record(repositoryField) && typeof record(repositoryField)?.url === "string" ? String(record(repositoryField).url) : void 0;
 	return {
 		name: manifest.name,
 		version: manifest.version,
-		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`
+		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`,
+		sha256: createHash("sha256").update(bytes).digest("hex"),
+		...gitHead ? { gitHead } : {},
+		...repository ? { repository } : {}
+	};
+}
+/**
+* Read the candidate identity of a publish from TRUSTED PRODUCERS only: the
+* exact tgz bytes (SHA-256 and npm SRI), the manifest the packer embedded
+* (package name, version, gitHead, repository) and, when the contract names a
+* ref, the local repository's own answer for that ref. Nothing here comes from
+* a model argument, so a caller cannot assert an identity the artifact does
+* not have.
+*/
+async function observePublishCandidate(resolution, roots, signal, cwd) {
+	const tgzPath = requireString(resolution.commandManifest, "tgz_path");
+	if (!tgzPath) return void 0;
+	const identity = await tgzIdentity(tgzPath);
+	if (!identity) return void 0;
+	const registry = typeof resolution.target.registry === "string" ? resolution.target.registry : void 0;
+	return {
+		packageId: identity.name,
+		version: identity.version,
+		artifactSha256: identity.sha256,
+		artifactSri: identity.integrity,
+		...identity.gitHead ? { fullSha40: identity.gitHead } : {},
+		...identity.repository ? { repository: identity.repository } : {},
+		...registry ? { registry } : {}
 	};
 }
+/**
+* Resolve one ref to its commit with the audited git executable. Exported so
+* the runtime can resolve the ref an ADOPTED CONTRACT names, which is the only
+* closed, reachable path for that identity: the action tool's manifest schema
+* has no field for it, and a model-supplied ref would not be authority.
+*/
+async function resolveAuditedRef(cwd, ref, roots, signal) {
+	if (!cwd || !/^refs\/[A-Za-z0-9._/-]+$/.test(ref)) return void 0;
+	try {
+		const identity = await (roots.readExecutableIdentity ?? executableIdentity)("git", signal);
+		if (!identity || identity.executable !== "git") return void 0;
+		const resolved = (await git(cwd, [
+			"rev-parse",
+			"--verify",
+			`${ref}^{commit}`
+		], signal, identity.realpath)).trim().toLowerCase();
+		return /^[0-9a-f]{40}$/.test(resolved) ? resolved : void 0;
+	} catch {
+		return;
+	}
+}
 const MARKET_SCHEMA = "dsh-market/update-api/v1";
 const MARKET_GENERATION_PREFIX = "dsh-market-instance/v1:";
 async function marketCapabilities(roots, signal) {
@@ -2017,7 +2368,9 @@ function normalizedRoots(options) {
 		...options.authorizeMutation ? { authorizeMutation: options.authorizeMutation } : {},
 		...options.prepareMutation ? { prepareMutation: options.prepareMutation } : {},
 		...options.readExecutableIdentity ? { readExecutableIdentity: options.readExecutableIdentity } : {},
-		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {}
+		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
+		...options.releaseGate ? { releaseGate: options.releaseGate } : {},
+		...options.releaseSettle ? { releaseSettle: options.releaseSettle } : {}
 	};
 }
 function createActionTool(options = {}) {
@@ -2186,14 +2539,70 @@ function createActionTool(options = {}) {
 					...identity
 				};
 			}
+			const releaseOperation = action === "publish" ? "npm_publish" : void 0;
+			let releaseGranted = false;
+			let releaseContractId;
+			if (releaseOperation && roots.releaseGate) {
+				const observed = await observePublishCandidate(resolution, roots, exec.signal, cwdOf(agent));
+				if (!observed) return {
+					status: "unavailable",
+					reason_code: "release_candidate_unobservable",
+					...identity
+				};
+				let decision;
+				try {
+					decision = await roots.releaseGate({
+						agent,
+						operation: releaseOperation,
+						callId: args.resolution_call_id,
+						resolvedTarget: resolution.target,
+						observed
+					});
+				} catch {
+					decision = void 0;
+				}
+				if (decision === void 0) return {
+					status: "unavailable",
+					reason_code: "release_gate_unavailable",
+					...identity
+				};
+				if (decision.status !== "granted") return {
+					status: "unavailable",
+					reason_code: decision.reasonCode,
+					...identity
+				};
+				releaseGranted = true;
+				releaseContractId = decision.contractId;
+			}
 			try {
 				const status = await executeGuardAction(action, resolution, roots, exec.signal, currentExecutable, args.resolution_call_id, agent);
+				if (releaseOperation && releaseGranted && roots.releaseSettle) {
+					const readback$1 = status === "completed" ? await publishReadback(resolution.target, roots, exec.signal) : void 0;
+					await roots.releaseSettle({
+						agent,
+						operation: releaseOperation,
+						callId: args.resolution_call_id,
+						...releaseContractId !== void 0 ? { contractId: releaseContractId } : {},
+						effect: status === "completed" ? "completed" : status === "unavailable" ? "not_effected" : "unknown",
+						readback: readback$1 === void 0 ? "unavailable" : {
+							kind: "npm_integrity",
+							identity: readback$1
+						}
+					});
+				}
 				return {
 					status,
 					reason_code: status === "completed" ? "action_completed" : status === "handoff_pending" ? "restart_handoff_pending" : "action_execution_failed",
 					...identity
 				};
 			} catch {
+				if (releaseOperation && releaseGranted && roots.releaseSettle) await roots.releaseSettle({
+					agent,
+					operation: releaseOperation,
+					callId: args.resolution_call_id,
+					effect: "unknown",
+					readback: "unavailable"
+				});
 				return {
 					status: "unavailable",
 					reason_code: "action_execution_failed",
@@ -2203,6 +2612,23 @@ function createActionTool(options = {}) {
 		}
 	});
 }
+/**
+* The trusted npm readback identity for a completed publish: the registry's
+* own `dist.integrity` for the exact package version. `undefined` means no
+* producer is reachable, which keeps the release attempt `unconfirmed` instead
+* of claiming a verified release.
+*/
+async function publishReadback(target, roots, signal) {
+	const registry = typeof target.registry === "string" ? target.registry : void 0;
+	const artifact = typeof target.artifact_id === "string" ? target.artifact_id : void 0;
+	const version = typeof target.version === "string" ? target.version : void 0;
+	if (!registry || !artifact || !version) return void 0;
+	try {
+		return await registryIntegrity(registry, artifact, version, roots, signal);
+	} catch {
+		return;
+	}
+}
 function createEvidenceTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
@@ -2292,6 +2718,11 @@ function createEvidenceTool(options = {}) {
 						type: "string",
 						required: true
 					},
+					missing_fields: {
+						type: "array",
+						items: { type: "string" }
+					},
+					next_step: { type: "string" },
 					evidence_role: {
 						type: "string",
 						required: true,
@@ -2414,6 +2845,27 @@ function createEvidenceTool(options = {}) {
 			if (!agent) return unavailable(action, role, "producer_agent_unavailable");
 			try {
 				if (role === "resolution") {
+					const recipe = actionPreparation(action);
+					{
+						const manifest = record(args.command_manifest);
+						const plannedArgs = record(manifest?.planned_arguments);
+						const selector = record(args.selector);
+						const needsManifestId = [
+							"install",
+							"apply",
+							"publish",
+							"restart"
+						].includes(action);
+						const needsPlannedEffect = !needsManifestId;
+						const missing = [
+							...recipe.selector_fields.filter((key) => !requireString(selector ?? {}, key)).map((key) => `selector.${key}`),
+							...needsManifestId && !requireString(manifest ?? {}, "manifest_id") ? ["command_manifest.manifest_id"] : [],
+							...needsManifestId && recipe.command_manifest_fields.includes("tgz_path") && !requireString(manifest ?? {}, "tgz_path") ? ["command_manifest.tgz_path"] : [],
+							...needsPlannedEffect && !requireString(manifest ?? {}, "planned_tool") ? ["command_manifest.planned_tool"] : [],
+							...needsPlannedEffect ? recipe.planned_argument_fields.filter((key) => !requireString(plannedArgs ?? {}, key)).map((key) => `command_manifest.planned_arguments.${key}`) : []
+						];
+						if (missing.length) return unavailable(action, role, "resolution_input_missing", missing, "Supply the listed resolution inputs before execution. Use context_guard_prepare for the exact input contract of this action. A manifest_id alone does not describe a planned tool call.");
+					}
 					const executable$1 = executableFor(action);
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
 					if (executable$1 && !executableBinding) return unavailable(action, role, "executable_identity_unavailable");
@@ -2425,7 +2877,7 @@ function createEvidenceTool(options = {}) {
 					if (!expectedTransition) return unavailable(action, role, "expected_transition_unavailable");
 					return supported(action, role, resolved.target, {}, commandManifest, gitBinding, executableBinding, expectedTransition);
 				}
-				if (!args.resolution_call_id) return unavailable(action, role, "producer_reference_missing");
+				if (!args.resolution_call_id) return unavailable(action, role, "producer_reference_missing", ["resolution_call_id", ...!args.effect_call_id ? ["effect_call_id"] : []], "Use the successful pre-action resolution call ID and matching action call ID. Selectors and evidence IDs cannot replace call IDs. If execution already happened without resolution, report the historical gap; do not repeat the mutation.");
 				const resolution = findResolution(snapshotSessionEvents(agent.session), args.resolution_call_id, action);
 				if (!resolution) return unavailable(action, role, "persisted_effect_mismatch");
 				const executable = executableFor(action);
@@ -2444,7 +2896,7 @@ function createEvidenceTool(options = {}) {
 					"pull",
 					"fetch"
 				].includes(action);
-				if (!args.effect_call_id) return unavailable(action, role, "producer_reference_missing");
+				if (!args.effect_call_id) return unavailable(action, role, "producer_reference_missing", ["effect_call_id"], "Supply the successful matching effect call ID. Git/package/service effects must come from context_guard_action; do not repeat an already completed mutation to manufacture missing evidence.");
 				if (ownedEffect) {
 					const events = snapshotSessionEvents(agent.session);
 					const actionCall = actionCallMatches(events, args.effect_call_id, action, args.resolution_call_id, resolution.target);
@@ -2464,6 +2916,135 @@ function createEvidenceTool(options = {}) {
 	});
 }
 
+//#endregion
+//#region src/tools/release.ts
+const RELEASE_TOOL = "context_guard_release";
+function createReleaseTool(options) {
+	return defineTool({
+		name: RELEASE_TOOL,
+		description: "Read the explicit release state, or reconcile a release attempt whose effect was unknown by reading back the external identity. This tool never re-sends a release.",
+		parameters: {
+			operation: {
+				type: "string",
+				required: true,
+				enum: ["status", "reconcile"]
+			},
+			contract_id: { type: "string" },
+			resolution_call_id: { type: "string" }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}]
+		},
+		async execute(rawArgs, exec) {
+			const args = rawArgs;
+			const projection = options.getProjection();
+			if (!projection) return {
+				status: "unknown",
+				reason_code: "guard_unavailable"
+			};
+			if (args.operation === "status") return {
+				status: "available",
+				policy: projection.policy,
+				state_damaged: projection.releaseStateDamaged,
+				coverage_surface: Object.keys(RELEASE_OPERATION_SURFACES).map((operation$1) => ({
+					operation: operation$1,
+					...RELEASE_OPERATION_SURFACES[operation$1]
+				})),
+				contracts: projection.releaseContracts.map((contract$1) => ({
+					contract_id: contract$1.contractId,
+					revoked_at_seq: contract$1.revokedAtSeq ?? null,
+					adopted_at_revision: contract$1.adoptedAtRevision,
+					operations: releaseCoverage(contract$1),
+					candidate: contract$1.candidate
+				})),
+				reservations: projection.releaseReservations.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, startedAtSeq, observedArtifactSri }) => ({
+					contract_id: contractId$1,
+					operation: operation$1,
+					resolution_call_id: callId$1,
+					started_at_seq: startedAtSeq,
+					observed_artifact_sri: observedArtifactSri ?? null,
+					in_flight: inFlightReservation(projection, contractId$1, operation$1)?.callId === callId$1
+				})),
+				settlements: projection.releaseSettlements.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, outcome: outcome$1, readback: readback$2, settledAtSeq }) => ({
+					contract_id: contractId$1,
+					operation: operation$1,
+					resolution_call_id: callId$1,
+					outcome: outcome$1,
+					readback: readback$2,
+					settled_at_seq: settledAtSeq
+				})),
+				diagnostics: projection.releaseDiagnostics
+			};
+			if (args.operation !== "reconcile") return {
+				status: "rejected",
+				reason_code: "release_subcommand_unknown"
+			};
+			const contractId = args.contract_id ?? "";
+			const callId = args.resolution_call_id ?? "";
+			const contract = contractById(projection, contractId);
+			if (!contract) return {
+				status: "rejected",
+				reason_code: "release_contract_unknown"
+			};
+			const reservation = reservationFor(projection, contractId, callId);
+			if (!reservation) return {
+				status: "rejected",
+				reason_code: "release_reservation_unknown"
+			};
+			const operation = reservation.operation;
+			const settled = projection.releaseSettlements.find((entry) => entry.contractId === contractId && entry.operation === operation && entry.callId === callId && (entry.outcome === "settled" || entry.outcome === "not_effected"));
+			if (settled) return {
+				status: "already_resolved",
+				outcome: settled.outcome,
+				reason_code: "release_already_resolved"
+			};
+			const registry = contract.candidate.registry;
+			const packageId = contract.candidate.packageId;
+			const version = contract.candidate.version;
+			if (!registry || !packageId || !version) return {
+				status: "unavailable",
+				reason_code: "release_readback_identity_incomplete"
+			};
+			const identity = await registryIntegrity(registry, packageId, version, options, exec.signal);
+			if (!identity) return {
+				status: "unavailable",
+				reason_code: "release_readback_unavailable"
+			};
+			const readback$1 = {
+				kind: "npm_integrity",
+				identity
+			};
+			const verdict = readbackSettlesContract(contract, readback$1, reservation.observedArtifactSri);
+			const outcome = verdict === "settled" ? "settled" : "unknown";
+			if (!await options.persistSettlement({
+				agent: exec.agent,
+				contractId,
+				operation,
+				callId,
+				readback: readback$1,
+				outcome
+			})) return {
+				status: "unknown",
+				reason_code: "release_settlement_not_durable"
+			};
+			return {
+				status: verdict === "settled" ? "settled" : verdict === "mismatch" ? "mismatch" : "unconfirmed",
+				outcome,
+				readback: readback$1,
+				reason_code: verdict === "settled" ? "release_reconciled" : verdict === "mismatch" ? "release_readback_identity_mismatch" : "release_readback_identity_unavailable",
+				note: "Reconciliation never re-sends the release operation."
+			};
+		}
+	});
+}
+
 //#endregion
 //#region src/tools/external-operation.ts
 function createExternalOperationTool(read, capability) {
@@ -2539,17 +3120,168 @@ function createExternalOperationTool(read, capability) {
 	});
 }
 
+//#endregion
+//#region src/domain/migration.ts
+/** The frozen digest domains: a migration never rewrites any of them. */
+const PRESERVED_DIGEST_DOMAINS = [
+	"ccg.sessionRefDigest.v3",
+	"ccg.hostLockDigest.v3",
+	"ccg.evidenceFact.v3",
+	"ccg.evidenceSha256.v3",
+	"ccg.predParams.v3",
+	"ccg.binding.v3",
+	"ccg.bindingDigest.v3",
+	"ccg.certificationDigest.v3",
+	"ccg.locator.v1",
+	"ccg.proofManifest.v1"
+];
+function migrationReport(projection) {
+	const v5 = projection.boundaryProtocol === 5;
+	const legacyItemIds = certifiableOpenItems(projection).filter((item) => item.unitId === void 0).map((item) => item.id);
+	const closure = v5 ? certificateClosure(projection) : { itemIds: [] };
+	const reasonCodes = [];
+	if (!v5) reasonCodes.push("legacy_session_keeps_v4_contract");
+	if (v5 && legacyItemIds.length > 0) reasonCodes.push("pre_v5_obligations_retained_in_closure");
+	return {
+		ruleMode: v5 ? "v5" : "legacy-v4",
+		certificateVersion: v5 ? CERTIFICATE_VERSION_V2 : CERTIFICATE_VERSION,
+		stopProtocolVersion: v5 ? STOP_PROTOCOL_VERSION_V2 : STOP_PROTOCOL_VERSION,
+		unitClosure: v5,
+		...v5 && projection.currentUnitId !== void 0 ? { currentUnitId: projection.currentUnitId } : {},
+		legacyItemIds,
+		unitClosureItemIds: [...closure.itemIds],
+		preservedDigestDomains: [...PRESERVED_DIGEST_DOMAINS],
+		historyOnlyCertificateVersions: v5 ? [CERTIFICATE_VERSION] : [],
+		rollbackRequiresStateSnapshot: v5,
+		rollbackInstruction: v5 ? "Restore the 0.5.x state snapshot before starting the older binary. Replaying a v5 log with 0.5.x fails closed with certificate_replay_mismatch; never migrate new-schema data down by hand." : "No rollback action is required for this session: it has not written a v5 boundary.",
+		reasonCodes
+	};
+}
+
 //#endregion
 //#region src/commands/context-guard.ts
 function pendingCount(projection) {
 	return [...projection.items.values()].filter((item) => item.status === "pending").length;
 }
+/**
+* The release surface. Adoption is deliberately NOT performed here: the
+* derivation adopts a contract only from the durable root `command/run` for
+* `/context-guard release adopt <json>`, so the command handler's job is to
+* report the resulting state (and to explain what is not protectable), never
+* to grant authority itself.
+*/
+function releaseResponse(projection, rawInput) {
+	const rest = rawInput.trim().slice(7).trim();
+	const [verb] = rest.split(/\s+/, 1);
+	if (verb === "adopt") {
+		const payload = rest.slice(5).trim();
+		let parsed;
+		try {
+			parsed = JSON.parse(payload);
+		} catch {
+			return {
+				kind: "error",
+				text: "Context Guard release adopt: the contract must be one JSON object."
+			};
+		}
+		const normalized = normalizeReleaseContract(parsed, {
+			seq: -1,
+			digest: ""
+		});
+		if (!normalized.contract) return {
+			kind: "error",
+			text: `Context Guard release adopt rejected: ${normalized.errors.join(", ")}`
+		};
+		const contract = normalized.contract;
+		const adopted = projection.releaseContracts.some((entry) => entry.contractId === contract.contractId) ? projection.releaseContracts.find((entry) => entry.contractId === contract.contractId) : contract;
+		return {
+			kind: "success",
+			text: JSON.stringify({
+				status: "adopted",
+				contract_id: adopted.contractId,
+				candidate: adopted.candidate,
+				operations: releaseCoverage(adopted),
+				readiness_refs: adopted.readinessRefs,
+				closure_cert_ref: adopted.closureCertRef ?? null,
+				expires_at_epoch_ms: adopted.expiresAtEpochMs ?? null,
+				note: "The contract becomes authoritative from the durable root command that carried it. It grants no authority in this process."
+			})
+		};
+	}
+	if (verb === "revoke") {
+		const contractId = rest.slice(6).trim();
+		if (!contractId) return {
+			kind: "error",
+			text: "Usage: /context-guard release revoke <contract_id>"
+		};
+		const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+		if (!contract) return {
+			kind: "error",
+			text: `Context Guard release revoke: unknown contract ${contractId}`
+		};
+		return {
+			kind: "success",
+			text: JSON.stringify({
+				status: contract.revokedAtSeq === void 0 ? "revoking" : "revoked",
+				contract_id: contractId,
+				revoked_at_seq: contract.revokedAtSeq ?? null,
+				in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId }) => ({
+					operation,
+					call_id: callId
+				})),
+				note: "Revocation is recorded durably and keeps the audit trail. It denies the next effect; an operation already in flight still needs its trusted readback to be reconciled."
+			})
+		};
+	}
+	if (verb !== "" && verb !== "status") return {
+		kind: "error",
+		text: "Usage: /context-guard release status | release adopt <json contract> | release revoke <contract_id>. Adoption and revocation are recorded from this command itself; they never grant authority in-process."
+	};
+	const contracts = projection.releaseContracts.map((contract) => ({
+		contract_id: contract.contractId,
+		adopted_at_seq: contract.adoptedBy.seq,
+		revoked_at_seq: contract.revokedAtSeq ?? null,
+		candidate: contract.candidate,
+		readiness_refs: contract.readinessRefs,
+		closure_cert_ref: contract.closureCertRef ?? null,
+		operations: releaseCoverage(contract),
+		expires_at_epoch_ms: contract.expiresAtEpochMs ?? null,
+		consumed_operations: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId && settlement.outcome === "settled").map((settlement) => settlement.operation),
+		in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contract.contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId, startedAtSeq }) => ({
+			operation,
+			call_id: callId,
+			started_at_seq: startedAtSeq
+		})),
+		settlements: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId).map(({ operation, callId, outcome, readback: readback$1, settledAtSeq }) => ({
+			operation,
+			call_id: callId,
+			outcome,
+			readback: readback$1,
+			settled_at_seq: settledAtSeq
+		}))
+	}));
+	return {
+		kind: "success",
+		text: JSON.stringify({
+			profile_applicable: projection.policy === "release" || contracts.length > 0,
+			policy: projection.policy,
+			state_damaged: projection.releaseStateDamaged,
+			adopted_contracts: contracts,
+			coverage_surface: RELEASE_OPERATIONS.map((operation) => ({
+				operation,
+				...RELEASE_OPERATION_SURFACES[operation]
+			})),
+			diagnostics: projection.releaseDiagnostics,
+			note: "A release is never implicit: only an explicit root adoption creates a contract, and only operations with a Guard execution surface can be protected."
+		})
+	};
+}
 function createContextGuardCommand(projectionFor, setEnabled, clearContract, lifecycleFor) {
 	return {
 		name: "context-guard",
-		description: "Enable, disable, clear, inspect, or diagnose Context Guard for this session.",
+		description: "Enable, disable, clear, inspect, diagnose, or manage the explicit release contract for this session.",
 		recordInput: true,
-		input: { hint: "on|off|clear|status|diagnose" },
+		input: { hint: "on|off|clear|status|diagnose|migration|release status|release adopt <json>|release revoke <id>" },
 		handler: ({ agent, rawInput }) => {
 			const projection = projectionFor(agent);
 			const [subcommand] = rawInput.trim().split(/\s+/, 1);
@@ -2577,22 +3309,31 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 					text: `Context Guard contract cleared: ${before - after} requirement/acceptance item(s) superseded; ${after} pending remain (prohibitions retained).`
 				};
 			}
+			if (resolved === "release") return releaseResponse(projection, rawInput);
+			if (resolved === "migration") return {
+				kind: "success",
+				text: JSON.stringify(migrationReport(projection))
+			};
 			if (resolved !== "status" && resolved !== "diagnose") return {
 				kind: "error",
-				text: "Usage: /context-guard on|off|clear|status|diagnose"
+				text: "Usage: /context-guard on|off|clear|status|diagnose|migration|release status|release adopt <json>|release revoke <id>"
 			};
 			const passed = [...projection.items.values()].filter((item) => item.status === "passed").length;
 			let certifiable_missing_evidence = 0;
 			let unsupported = 0;
+			const reason_classes = {};
 			for (const item of projection.items.values()) {
 				if (item.status !== "pending") continue;
 				const diagnosis = deriveItemDiagnosis(projection, item);
+				reason_classes[diagnosis.reason_class] = (reason_classes[diagnosis.reason_class] ?? 0) + 1;
 				if (diagnosis.repairability === "agent_repairable") certifiable_missing_evidence += 1;
 				else if (diagnosis.certification === "unsupported") unsupported += 1;
 			}
+			const migration = migrationReport(projection);
 			const response = {
 				enabled: projection.enabled,
 				lifecycle: lifecycleFor?.(agent) ?? (projection.enabled ? "active" : "disabled"),
+				policy: projection.policy,
 				epoch: projection.epoch,
 				contract_revision: projection.contractRevision,
 				pending: pendingCount(projection),
@@ -2600,11 +3341,25 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 				diagnosis: {
 					certified: passed,
 					certifiable_missing_evidence,
-					unsupported
+					unsupported,
+					reason_classes
 				},
 				evidence: projection.evidence.size,
 				integrity: projection.integrity,
-				last_source_seq: projection.lastObservedSourceSeq
+				last_source_seq: projection.lastObservedSourceSeq,
+				migration: {
+					rule_mode: migration.ruleMode,
+					certificate_version: migration.certificateVersion,
+					unit_closure: migration.unitClosure,
+					legacy_open_items: migration.legacyItemIds.length
+				},
+				release: {
+					policy: projection.policy,
+					state_damaged: projection.releaseStateDamaged,
+					adopted_contracts: projection.releaseContracts.length,
+					in_flight: projection.releaseReservations.filter((reservation) => !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && settlement.outcome === "settled")).length,
+					applicable: projection.policy === "release" || projection.releaseContracts.length > 0
+				}
 			};
 			return {
 				kind: "success",
@@ -3414,6 +4169,7 @@ defineMethod("transform", [
 //#region src/config.ts
 const Config = Schema.object({
 	activation: Schema.string().default("opt-in"),
+	policy: Schema.string().default("standard"),
 	hostLockPlatform: Schema.string(),
 	hostLockProfile: Schema.string(),
 	hostLockPolicy: Schema.string(),
@@ -3428,6 +4184,8 @@ const Config = Schema.object({
 function resolveConfig(config) {
 	const activation = config.activation ?? "opt-in";
 	if (activation !== "opt-in" && activation !== "always") throw new TypeError(`activation must be "opt-in" or "always", received ${JSON.stringify(activation)}`);
+	const policy = config.policy ?? "standard";
+	if (policy !== "standard" && policy !== "strict" && policy !== "release") throw new TypeError(`policy must be "standard", "strict", or "release", received ${JSON.stringify(policy)}`);
 	let hostLockPackages;
 	if (config.hostLockPackages !== void 0) {
 		if (!Array.isArray(config.hostLockPackages)) throw new TypeError("hostLockPackages must be an array");
@@ -3458,6 +4216,7 @@ function resolveConfig(config) {
 		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
 		...typeof config.hostLockProfileRoot === "string" ? { hostLockProfileRoot: config.hostLockProfileRoot } : {},
 		activation,
+		policy,
 		...hostLockPackages ? { hostLockPackages } : {},
 		...config.hostLockPlatform ? { hostLockPlatform: config.hostLockPlatform } : {},
 		...config.hostLockProfile ? { hostLockProfile: config.hostLockProfile } : {}
@@ -3534,7 +4293,12 @@ function authorizeMutationFromProjection(projection, request) {
 		status: "denied",
 		reasonCode: "mutation_target_clarification_required"
 	};
-	if (!requestedTargetAuthorizesMutation(request.action, item.requestedTarget, request.resolvedTarget)) return {
+	const boundedAuthorized = (scope) => requestedTargetAuthorizesMutation(request.action, {
+		...item.requestedTarget,
+		scope
+	}, request.resolvedTarget);
+	const selectionAuthorized = projection.trustedSelections.some((selection) => selection.kind === "directory" && typeof item.requestedTarget?.artifact_type === "string" && item.unitId !== void 0 && boundedAuthorized(selection.selected));
+	if (!requestedTargetAuthorizesMutation(request.action, item.requestedTarget, request.resolvedTarget) && !selectionAuthorized) return {
 		status: "denied",
 		reasonCode: "mutation_requested_target_mismatch"
 	};
@@ -3810,10 +4574,12 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	const session = agent.session;
 	let pendingRecovery = false;
 	let durabilityConfirmed = false;
+	let durabilityWatermark = "unknown";
 	let observedEpoch = -1;
 	let observedCompactionSeq = -1;
 	let observedContractRevision = -1;
 	let protocolV4Present = false;
+	let protocolV5Present = false;
 	let realRootInputSeen = false;
 	let lifecycle = "armed";
 	const continuationAttempts = projection.continuationAttempts;
@@ -3832,7 +4598,10 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
 			return;
 		}
-		const derived = deriveProjection(events, { activation: config.activation }, {
+		const derived = deriveProjection(events, {
+			activation: config.activation,
+			policy: config.policy
+		}, {
 			cwd: typeof header?.cwd === "string" ? header.cwd : "",
 			sessionHeader
 		}, durabilityConfirmed, hostLock);
@@ -3854,7 +4623,9 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.continuationAttempts = continuationAttempts;
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
 		projection.lastRecoveryDigest = priorRecoveryDigest;
+		projection.durabilityWatermark = durabilityWatermark;
 		protocolV4Present = derived.protocolV4Present;
+		protocolV5Present = derived.boundaryV5;
 		realRootInputSeen = derived.realRootInputSeen;
 		lifecycle = lifecyclePhase({
 			enabled: projection.enabled,
@@ -3881,6 +4652,8 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	};
 	const setDurability = (confirmed) => {
 		durabilityConfirmed = confirmed;
+		durabilityWatermark = confirmed ? "confirmed" : "failed";
+		projection.durabilityWatermark = durabilityWatermark;
 	};
 	const markRecoveryNeeded = () => {
 		pendingRecovery = true;
@@ -3900,6 +4673,9 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		get protocolV4Present() {
 			return protocolV4Present;
 		},
+		get protocolV5Present() {
+			return protocolV5Present;
+		},
 		sync,
 		setEnabled,
 		setDurability,
@@ -3907,6 +4683,15 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		consumeRecovery
 	};
 }
+/** The durable session working directory, when the V3 header carries one. */
+function sessionCwd(session) {
+	const header = session.header;
+	return typeof header?.cwd === "string" && header.cwd.length > 0 ? header.cwd : void 0;
+}
+/** A bounded signal for a short trusted readback performed by the gate. */
+function requestSignal() {
+	return AbortSignal.timeout(5e3);
+}
 /** Delegated/subagent sessions never receive root-conversation injections. */
 function isDelegatedSession(session) {
 	const header = session.header;
@@ -3942,9 +4727,9 @@ function revalidateCoreLock(config, expected) {
 		};
 	}
 }
-function apply(ctx, rawConfig = {}) {
+function apply(ctx, rawConfig = {}, seams = {}) {
 	const config = resolveConfig(rawConfig);
-	const installedHostLock = evaluateHostLock(config.hostLockPackages ?? [], {
+	const installedHostLock = seams.hostLock ?? evaluateHostLock(config.hostLockPackages ?? [], {
 		platform: config.hostLockPlatform,
 		profileKind: config.hostLockProfile
 	});
@@ -3956,7 +4741,7 @@ function apply(ctx, rawConfig = {}) {
 		if (!runtime) {
 			const goals = optionalGoalService(ctx, agent);
 			const refreshHostLock = () => {
-				const current = bindLiveGoalCapability(revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
+				const current = bindLiveGoalCapability(seams.hostLock ?? revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
 				hostLocks.set(agent, current);
 				return current;
 			};
@@ -3995,8 +4780,41 @@ function apply(ctx, rawConfig = {}) {
 			runtime.sync();
 			return durable;
 		}, () => runtime.markRecoveryNeeded()));
+		/**
+		* Persist one C10 release record through the plugin-notice channel and make
+		* it durable before returning. A record that cannot be flushed is reported
+		* as a failure: an unflushed reservation is not an in-flight operation, and
+		* an unflushed settlement would let a consumed ticket look unused.
+		*/
+		const persistReleaseRecord = async (toolAgent, prefix, payload) => {
+			const target = toolAgent.session;
+			target.append.bind(target)("user/message", createUserMessage({
+				content: [{
+					type: "text",
+					text: `${prefix}${JSON.stringify(payload)}`
+				}],
+				source: {
+					kind: "plugin",
+					plugin: "context-guard",
+					form: "notice",
+					summary: boundContextSummary("recording an explicit release record")
+				}
+			}), { surfaceOp: "append" });
+			let durable = false;
+			try {
+				durable = await ctx.sessions.flush(target);
+			} catch {
+				durable = false;
+			}
+			runtime.setDurability(durable);
+			runtime.sync();
+			return durable;
+		};
 		const evidenceOptions = {
 			hostCapability: createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock),
+			...seams.commandRunner ? { commandRunner: seams.commandRunner } : {},
+			...seams.fetcher ? { fetcher: seams.fetcher } : {},
+			...seams.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
 			prepareMutation: async (toolAgent) => {
 				if (toolAgent.session !== agent.session) return false;
 				const durable = await ctx.sessions.flush(agent.session);
@@ -4009,6 +4827,63 @@ function apply(ctx, rawConfig = {}) {
 				return authorizeMutationFromProjection(runtime.projection, request);
 			},
 			marketOrigin: optionalMarketOrigin(ctx, agent),
+			releaseGate: async (request) => {
+				runtime.sync();
+				const projection = runtime.projection;
+				if (!(projection.policy === "release" || projection.releaseContracts.length > 0)) return {
+					status: "granted",
+					reasonCode: "release_profile_not_adopted"
+				};
+				const observed = { ...request.observed };
+				const declaredRef = releaseContractFor(projection, request.operation)?.candidate.ref;
+				if (declaredRef !== void 0 && observed.ref === void 0) {
+					const refSha = await resolveAuditedRef(sessionCwd(runtime.session), declaredRef, evidenceOptions, requestSignal());
+					if (refSha !== void 0) {
+						observed.ref = declaredRef;
+						observed.refSha = refSha;
+					}
+				}
+				const decision = releasePreEffectDecision(projection, {
+					operation: request.operation,
+					observed,
+					resolvedTarget: request.resolvedTarget,
+					nowEpochMs: Date.now()
+				});
+				if (decision.status !== "granted" || decision.contractId === void 0) return {
+					status: "denied",
+					reasonCode: decision.reasonCode
+				};
+				return await persistReleaseRecord(agent, RELEASE_RESERVATION_PREFIX, {
+					contractId: decision.contractId,
+					operation: request.operation,
+					callId: request.callId,
+					startedAtSeq: 0,
+					status: "in_flight",
+					...observed.artifactSri !== void 0 ? { observedArtifactSri: observed.artifactSri } : {}
+				}) ? {
+					status: "granted",
+					reasonCode: decision.reasonCode,
+					contractId: decision.contractId
+				} : {
+					status: "denied",
+					reasonCode: "release_reservation_not_durable"
+				};
+			},
+			releaseSettle: async (request) => {
+				const contractId = request.contractId ?? releaseContractFor(runtime.projection, request.operation)?.contractId ?? "unknown";
+				const contract = runtime.projection.releaseContracts.find((entry) => entry.contractId === contractId);
+				const reservation = reservationFor(runtime.projection, contractId, request.callId);
+				let outcome = request.effect === "not_effected" ? "not_effected" : "unknown";
+				if (request.effect === "completed" && contract) outcome = readbackSettlesContract(contract, request.readback, reservation?.observedArtifactSri) === "settled" ? "settled" : "unknown";
+				await persistReleaseRecord(agent, RELEASE_SETTLEMENT_PREFIX, {
+					contractId,
+					operation: request.operation,
+					callId: request.callId,
+					settledAtSeq: 0,
+					readback: request.readback,
+					outcome
+				});
+			},
 			persistRestartIntent: async (toolAgent, intent) => {
 				const session = toolAgent.session;
 				session.append.bind(session)("user/message", createUserMessage({
@@ -4044,7 +4919,26 @@ function apply(ctx, rawConfig = {}) {
 					reasonCode: evaluation.reasonCode
 				};
 			},
-			commandTemplate: (action) => GIT_COMMAND_TEMPLATES[action]
+			commandTemplate: (action) => GIT_COMMAND_TEMPLATES[action],
+			refreshProjection: async () => {
+				const durable = await ctx.sessions.flush(agent.session);
+				runtime.setDurability(durable);
+				runtime.sync();
+				return durable;
+			}
+		}));
+		agent.ctx.tools.register(createReleaseTool({
+			getProjection: () => runtime.projection,
+			fetcher: evidenceOptions.fetcher,
+			...evidenceOptions.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
+			persistSettlement: async (request) => persistReleaseRecord(request.agent, RELEASE_SETTLEMENT_PREFIX, {
+				contractId: request.contractId,
+				operation: request.operation,
+				callId: request.callId,
+				settledAtSeq: 0,
+				readback: request.readback,
+				outcome: request.outcome
+			})
 		}));
 		agent.ctx.tools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
 		agent.ctx.tools.guard((exec) => goalCompletionDenial(runtime.projection, exec.name, exec.arguments));
@@ -4058,10 +4952,11 @@ function apply(ctx, rawConfig = {}) {
 		if (decision.kind !== "enter") return decision;
 		const injected = [];
 		const delegated = isDelegatedSession(agent.session);
-		let boundaryPending = !runtime.protocolV4Present;
+		let boundaryPending = !runtime.protocolV5Present;
 		const firstStep = previewFirstStepInjection({
 			activation: config.activation,
 			enabled: runtime.projection.enabled,
+			boundaryV5Present: runtime.protocolV5Present,
 			boundaryPresent: runtime.protocolV4Present,
 			delegated
 		}, claimedBatchHasRealRootInput(decision.messages));
@@ -4078,7 +4973,7 @@ function apply(ctx, rawConfig = {}) {
 			if (recovery && digest$2 !== runtime.projection.lastRecoveryDigest) {
 				runtime.projection.lastRecoveryDigest = digest$2;
 				if (boundaryPending && !delegated) {
-					injected.push(pluginNoticeMessage(PROTOCOL_V4_NOTICE, "Context Guard recorded a replay version boundary"));
+					injected.push(pluginNoticeMessage(PROTOCOL_V5_NOTICE, "Context Guard recorded a replay version boundary"));
 					boundaryPending = false;
 				}
 				injected.push(createUserMessage({
@@ -4222,4 +5117,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };