dsh-completion-guard 0.5.3 → 0.6.1

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as parseShellCommand, $n as isStatefulAction, $t as isWholeTaskCompletionClaim, A as createGitPrestateEnvelope, An as extractMethod, At as RC1_HOST_PACKAGES, B as CAPTURE_V042_NOTICE, Bn as namedActions, Bt as renderRecoveryPacket, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as evidenceAvailabilityReason, Ct as SUPPORTED_HOST_VERSIONS, D as GIT_COMMAND_TEMPLATES, Dn as captureItem, Dt as satisfiesSupportedHostRange, E as GIT_COMMAND_MANIFEST_IDS, En as captureClause, Et as parseHostVersion, F as verifiedLinearCommitReadback, Fn as interpretMessage, Ft as DEFAULT_RECOVERY_CHAR_BUDGET, G as evidenceFromPersistedToolResult, Gn as ACTION_MANIFEST, Gt as CONTROL_RECORD_PREFIX, H as PROTOCOL_V4_NOTICE, Hn as statefulActionsOfScope, Ht as evidenceCoverage, I as FIRST_STEP_GUIDANCE, In as isExecutableItem, It as MIN_RECOVERY_CHAR_BUDGET, J as isDeterministicCheck, Jn as SEMANTIC_ACTIONS, Jt as classifyCompletionClaim, K as extractTextContent, Kn as ACTION_MANIFEST_VERSION, Kt as NO_PROGRESS_RECORD_PREFIX, L as claimedBatchHasRealRootInput, Ln as isOpenObligation, Lt as closingHint, M as gitCommandMatchesTarget, Mn as isInformationalMessage, Mt as authorityCaptureCounts, N as parseGitCommandManifest, Nn as segmentClauses, Nt as segmentAuthorityBlocks, O as commitIndexSnapshotDigest, On as classifyClause, Ot as RC015_RC2_HOST_PACKAGES, P as revalidateGitPrestate, Pn as interpretClause, Pt as certifyCheckpoint, Q as parsePwshCommand, Qn as actionCompatible, Qt as isRootPauseRequest, R as lifecyclePhase, Rn as kindOfScope, Rt as openItems, S as SESSION_API_UNSUPPORTED, Sn as deriveItemDiagnosis, St as SUPPORTED_HOST_RANGE, T as snapshotSessionEvents, Tn as relevantEvidence, Tt as evaluateMinimumHostVersion, U as deriveProjection, Un as canonicalRegistryBase, Ut as evidenceMatchesItem, V as PROTOCOL_V3_NOTICE, Vn as semanticActionOfScope, Vt as bindingSatisfies, W as supersedeItem, Wn as npmEscapedPackageName, Wt as isVerifyingCapability, X as canonicalArgvFromCommand, Xn as STOP_PROTOCOL_VERSION, Xt as decideTurnStopping, Y as withDurability, Yn as STATEFUL_ACTIONS, Yt as decideTurnBoundary, Z as isRunExecutable, Zn as SUPPORTED_EVIDENCE_ADAPTERS, Zt as decisionBoundaryKey, _ as packageRowsFromPnpmLock, _n as rebindResponse, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as hasCurrentCertificate, ar as validateActionTarget, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as isFrozenV042RebindResponse, bt as LATEST_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as isCurrentAcceptedBoundary, cr as classifyTaskIntent, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as createProjection, dr as digestStrings, dt as LEGACY_HOST_COHORTS, en as latestAssistantText, er as requestedTargetAuthorizesMutation, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as confirmRebind, fr as normalizeClause, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as rebindAttemptKey, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as proposeRebindV042, hr as sha256, ht as evaluateHostCapability, i as canonicalProjection, in as goalCompletionDenial, ir as validateActionManifest, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as extractOperation, jt as ALPHA3_HOST_PACKAGES, k as commitTreeSnapshotDigest, kn as extractArtifactPaths, kt as RC015_HOST_PACKAGES, l as validateProofManifest, ln as qualifyBoundary, lr as classifyUserInteraction, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as proposeRebindOutcome, mr as sanitizeUrl, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as observeAssistantOutcome, nr as semanticActionFromCommand, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as availableBoundaryQualifications, or as COMMAND_SURFACE_MANIFEST, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebind, pr as sanitizeClauseText, pt as bindLiveGoalCapability, q as extractToolSubject, qn as CERTIFICATE_VERSION, qt as NO_PROGRESS_TURNS_BEFORE_STOP, r as bindProofToProjection, rn as progressFingerprint, rr as semanticActionFromText, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as effectuateBoundary, sr as validateManifest, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as latestRootInstruction, tr as requestedTargetMatchesResolved, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as currentContractDigest, ur as canonicalizePath, ut as HOST_COHORTS, v as readActiveHostGraph, vn as replayRebindResult, vt as hostVersionFromPackages, w as SessionApiError, wn as itemDiagnosis, wt as compareHostVersions, x as verifyComposedHostLockDump, xn as parseConfirmationMessage, xt as MIN_SUPPORTED_HOST_VERSION, y as resolveActiveProfileHostLock, yn as CONFIRM_LINE_PATTERN, yt as selectHostCohort, z as previewFirstStepInjection, zn as maskCodeSpans, zt as recoveryDigest } from "./domain-RuX9l07o.js";
+import { $ as extractToolSubject, $n as isFrozenV042RebindResponse, $r as sha256, $t as proofDigest, A as lifecyclePhase, An as decisionBoundaryKey, Ar as STATEFUL_ACTIONS, At as compareHostVersions, B as RELEASE_RESERVATION_PREFIX, Bn as effectuateBoundary, Br as semanticActionFromCommand, Bt as certifyCheckpoint, C as gitCommandMatchesTarget, Cn as isVerifyingCapability, Cr as npmEscapedPackageName, Ct as evaluateToolSurfaceCapability, D as FIRST_STEP_GUIDANCE, Dn as classifyCompletionClaim, Dr as CERTIFICATE_VERSION, Dt as MIN_SUPPORTED_HOST_VERSION, E as verifiedLinearCommitReadback, En as NO_PROGRESS_TURNS_BEFORE_STOP, Er as BOUNDED_ARTIFACT_TYPES, Et as LATEST_SUPPORTED_HOST_VERSION, F as PROTOCOL_V4_NOTICE, Fn as observeAssistantOutcome, Fr as boundedArtifactChoiceMatches, Ft as RC015_HOST_PACKAGES, G as readbackSettlesContract, Gn as confirmRebind, Gr as validateManifest, Gt as PROOF_PROTOCOL_VERSION, H as contractById, Hn as qualifyBoundary, Hr as validateActionManifest, Ht as PROOF_KINDS, I as PROTOCOL_V5_NOTICE, In as progressFingerprint, Ir as isStatefulAction, It as RC1_HOST_PACKAGES, J as releasePreEffectDecision, Jn as proposeRebindV042, Jr as canonicalizePath, Jt as bindProofV2ToProjection, K as releaseContractFor, Kn as proposeRebind, Kr as classifyTaskIntent, Kt as PROOF_PROTOCOL_VERSION_V2, L as deriveProjection, Ln as goalCompletionDenial, Lr as requestedIdentityKey, Lt as ALPHA3_HOST_PACKAGES, M as CAPTURE_V042_NOTICE, Mn as isWholeTaskCompletionClaim, Mr as STOP_PROTOCOL_VERSION_V2, Mt as parseHostVersion, N as DEFAULT_DELEGATION_TOOL_NAMES, Nn as latestAssistantText, Nr as SUPPORTED_EVIDENCE_ADAPTERS, Nt as satisfiesSupportedHostRange, O as claimedBatchHasRealRootInput, On as decideTurnBoundary, Or as CERTIFICATE_VERSION_V2, Ot as SUPPORTED_HOST_RANGE, P as PROTOCOL_V3_NOTICE, Pn as latestRootInstruction, Pr as actionCompatible, Pt as RC015_RC2_HOST_PACKAGES, Q as extractTextContent, Qn as CONFIRM_LINE_PATTERN, Qr as sanitizeUrl, Qt as proofCapabilityReport, R as RELEASE_OPERATIONS, Rn as hasCurrentCertificate, Rr as requestedTargetAuthorizesMutation, Rt as authorityCaptureCounts, S as executeRevalidatedGitEffect, Sn as evidenceMatchesItem, Sr as canonicalRegistryBase, St as evaluateHostLock, T as revalidateGitPrestate, Tn as NO_PROGRESS_RECORD_PREFIX, Tr as ACTION_MANIFEST_VERSION, Tt as selectHostCohort, U as inFlightReservation, Un as currentContractDigest, Ur as validateActionTarget, Ut as PROOF_KINDS_V2, V as RELEASE_SETTLEMENT_PREFIX, Vn as isCurrentAcceptedBoundary, Vr as semanticActionFromText, Vt as PROOF_CAPABILITY_MATRIX, W as normalizeReleaseContract, Wn as createProjection, Wr as COMMAND_SURFACE_MANIFEST, Wt as PROOF_MANIFEST_DOMAIN_V2, X as supersedeItem, Xn as rebindResponse, Xr as normalizeClause, Xt as createProofManifest, Y as reservationFor, Yn as rebindAttemptKey, Yr as digestStrings, Yt as canonicalProjection, Z as evidenceFromPersistedToolResult, Zn as replayRebindResult, Zr as sanitizeClauseText, Zt as createProofManifestV2, _ as GIT_COMMAND_MANIFEST_IDS, _n as openItems, _r as kindOfScope, _t as LEGACY_HOST_COHORTS, a as injectActiveProfileHostLock, an as requiredSubjectsOf, ar as captureClause, at as parseShellCommand, b as commitTreeSnapshotDigest, bn as bindingSatisfies, br as semanticActionOfScope, bt as evaluateExternalWaitCapability, c as packageRowsFromPnpmLock, cn as sessionQueryV2, cr as extractArtifactPaths, ct as ACTIVE_HOST_LAUNCHER_VERSION, d as resolveInstalledHostLock, dn as certifiableOpenItems, dr as isInformationalMessage, dt as BASE_HOST_PACKAGES, en as proofDigestV2, er as parseConfirmationMessage, et as isDeterministicCheck, f as verifyComposedHostLockDump, fn as certificateClosure, fr as segmentClauses, ft as DEFAULT_HOST_LOCK, g as snapshotSessionEvents, gn as closingHint, gr as isOpenObligation, gt as HOST_COHORTS, h as SessionApiError, hn as MIN_RECOVERY_CHAR_BUDGET, hr as isExecutableItem, ht as HOST_CAPABILITY_PACKAGE_GROUPS, i as hostLockRowsFromComposedDump, in as proofV2Rejection, ir as relevantEvidence, it as parsePwshCommand, j as previewFirstStepInjection, jn as isRootPauseRequest, jr as STOP_PROTOCOL_VERSION, jt as evaluateMinimumHostVersion, k as firstStepGuidance, kn as decideTurnStopping, kr as SEMANTIC_ACTIONS, kt as SUPPORTED_HOST_VERSIONS, l as readActiveHostGraph, ln as validateProofManifest, lr as extractMethod, lt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, m as SESSION_EVENT_ENVELOPE_INVALID, mn as DEFAULT_RECOVERY_CHAR_BUDGET, mr as interpretMessage, mt as GOAL_HOST_PACKAGES, n as combineHostPolicy, nn as proofHostSurfacesOf, nr as evidenceAvailabilityReason, nt as canonicalArgvFromCommand, o as inspectTargetHostGraph, on as scopeCoverageDigest, or as captureItem, ot as ACTIVE_HOST_COHORT_ID, p as SESSION_API_UNSUPPORTED, pn as unitDescendantIds, pr as interpretClause, pt as EXPECTED_HOST_PACKAGES, q as releaseCoverage, qn as proposeRebindOutcome, qr as classifyUserInteraction, qt as bindProofToProjection, r as hostLockContextFromComposedDump, rn as proofOperationMatches, rr as itemDiagnosis, rt as isRunExecutable, s as packageRowsFromActiveGraph, sn as sessionQuery, sr as classifyClause, st as ACTIVE_HOST_COHORT_IDS, t as HostProfileError, tn as proofEvidenceConstraints, tr as deriveItemDiagnosis, tt as withDurability, u as resolveActiveProfileHostLock, un as validateProofManifestV2, ur as extractOperation, ut as ALPHA2_HOST_PACKAGES, v as GIT_COMMAND_TEMPLATES, vn as recoveryDigest, vr as maskCodeSpans, vt as bindExecutableIdentity, w as parseGitCommandManifest, wn as CONTROL_RECORD_PREFIX, wr as ACTION_MANIFEST, wt as hostVersionFromPackages, x as createGitPrestateEnvelope, xn as evidenceCoverage, xr as statefulActionsOfScope, xt as evaluateHostCapability, y as commitIndexSnapshotDigest, yn as renderRecoveryPacket, yr as namedActions, yt as bindLiveGoalCapability, z as RELEASE_OPERATION_SURFACES, zn as availableBoundaryQualifications, zr as requestedTargetMatchesResolved, zt as segmentAuthorityBlocks } from "./domain-DKr8sLZZ.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -166,6 +166,7 @@ function checkpointPage(p, query, full) {
 		available_qualifications: []
 	};
 	if (full.certificate) output.certificate = full.certificate;
+	if (full.proof_state) output.proof_state = full.proof_state;
 	const pagination = {
 		snapshot: identity,
 		scope: evidence_scope,
@@ -357,6 +358,10 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 			detail_id: { type: "string" },
 			detail_offset: { type: "integer" },
 			detail_snapshot: { type: "string" },
+			proof: {
+				type: "object",
+				additionalProperties: true
+			},
 			bindings: {
 				type: "array",
 				required: true,
@@ -460,6 +465,25 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 						type: "object",
 						additionalProperties: true
 					},
+					proof_state: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							status: {
+								type: "string",
+								enum: [
+									"absent",
+									"bound",
+									"rejected",
+									"invalid"
+								]
+							},
+							reason_codes: {
+								type: "array",
+								items: { type: "string" }
+							}
+						}
+					},
 					reason_code: { type: "string" },
 					next_step: { type: "string" },
 					detail_id: { type: "string" },
@@ -599,6 +623,8 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 							evidence_sha256: { type: "string" },
 							binding_digest: { type: "string" },
 							certification_digest: { type: "string" },
+							unit_id: { type: "string" },
+							unit_closure_digest: { type: "string" },
 							goal_ref: { oneOf: [{
 								type: "object",
 								additionalProperties: false,
@@ -631,7 +657,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					rejected_bindings: []
 				};
 			}
-			const result = certifyCheckpoint(projection, args.bindings.map((binding) => ({
+			const bindings = args.bindings.map((binding) => ({
 				itemId: binding.item_id,
 				evidenceIds: binding.evidence_ids,
 				...binding.semantic_action ? { semanticAction: binding.semantic_action } : {},
@@ -654,7 +680,39 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					resolvedTarget: closure.resolved_target,
 					order: closure.order
 				})) } : {}
-			})), `C${projection.checkpoints.length + 1}`, false);
+			}));
+			let proofState = {
+				status: "absent",
+				reason_codes: []
+			};
+			if (args.proof !== void 0) {
+				const structural = validateProofManifestV2(args.proof);
+				if (structural.length) proofState = {
+					status: "invalid",
+					reason_codes: structural
+				};
+				else {
+					const binding = bindProofV2ToProjection(projection, args.proof);
+					proofState = binding.length ? {
+						status: "rejected",
+						reason_codes: binding
+					} : {
+						status: "bound",
+						reason_codes: []
+					};
+				}
+			}
+			const result = proofState.status === "rejected" || proofState.status === "invalid" ? {
+				status: "incomplete",
+				contractRevision: projection.contractRevision,
+				openItems: [],
+				rejectedBindings: []
+			} : certifyCheckpoint(projection, bindings, `C${projection.checkpoints.length + 1}`, false);
+			if (proofState.status === "rejected" || proofState.status === "invalid") for (const code of proofState.reason_codes) result.rejectedBindings.push({
+				itemId: "*",
+				reason: "the presented proof does not bind the current contract",
+				reasonCode: code
+			});
 			if (!result.checkpoint) onRejected();
 			const available_evidence = [...projection.evidence.values()].filter((evidence) => evidence.epoch === projection.epoch && (args.evidence_scope === "history" || [...projection.items.values()].some((item) => item.status === "pending" && relevantEvidence(projection, item, evidence)))).sort((a, b) => b.toolResultSeq - a.toolResultSeq || (a.id < b.id ? -1 : 1)).map((evidence) => ({
 				id: evidence.id,
@@ -680,6 +738,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 			}));
 			return checkpointPage(projection, args, {
 				status: result.status,
+				proof_state: proofState,
 				contract_revision: result.contractRevision,
 				blocking_total: result.openItems.length,
 				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item)),
@@ -711,6 +770,10 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					evidence_sha256: result.checkpoint.evidenceSha256,
 					binding_digest: result.checkpoint.bindingDigest,
 					certification_digest: result.checkpoint.certificationDigest,
+					...result.checkpoint.unitId !== void 0 ? {
+						unit_id: result.checkpoint.unitId,
+						unit_closure_digest: result.checkpoint.unitClosureDigest
+					} : {},
 					goal_ref: result.checkpoint.goalRef ?? null
 				} } : {}
 			});
@@ -849,59 +912,234 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 }
 
 //#endregion
-//#region src/tools/git-preparation.ts
-/** Input recipes are guidance only; live resolution remains authoritative. */
-function gitPreparation(action) {
-	if (![
-		"commit",
-		"push",
-		"fetch",
-		"pull"
-	].includes(action)) return void 0;
-	return {
-		selector_fields: action === "commit" ? ["repository", "branch"] : [
-			"repository",
-			"remote",
-			"refspec"
-		],
-		command_manifest_fields: ["planned_tool", "planned_arguments"],
-		planned_tools: ["bash", "pwsh"],
-		planned_argument_fields: ["command", "workdir"],
-		steps: [
-			"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
-			"Execute once with context_guard_action, semantic_action, resolution_call_id, target_digest, contract_item_id and contract_item_revision.",
-			"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful action call ID as effect_call_id.",
-			"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
-			"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
-		]
-	};
+//#region src/tools/action-preparation.ts
+const GUARD_TOOL_STEPS = [
+	"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
+	"Execute once with context_guard_action, semantic_action, resolution_call_id, target_digest, contract_item_id and contract_item_revision.",
+	"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful action call ID as effect_call_id.",
+	"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
+	"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
+];
+const NATIVE_WRITE_STEPS = [
+	"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
+	"Execute the planned effect once with the native write/edit tool named by command_manifest.planned_tool and exactly the planned_arguments.",
+	"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful write/edit call ID as effect_call_id.",
+	"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
+	"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
+];
+/**
+* The unified descriptor for one stateful action. Git actions keep their
+* historical selector/manifest/step shapes; the other six gain the same
+* complete recipe instead of Git-only coverage.
+*/
+function actionPreparation(action) {
+	switch (action) {
+		case "install":
+		case "apply": return {
+			action,
+			selector_fields: ["package_id", "profile"],
+			optional_selector_fields: ["version"],
+			command_manifest_fields: ["manifest_id", "tgz_path"],
+			command_manifest_ids: [action === "install" ? "dsh.plugin_add_tgz.install.v1" : "dsh.plugin_add_tgz.apply.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["version", "integrity_digest"],
+			readback_fields: [
+				"package_id",
+				"version",
+				"integrity_digest",
+				"profile"
+			],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "create": return {
+			action,
+			selector_fields: ["artifact_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["artifact.create.v1"],
+			planned_tools: ["write", "write_file"],
+			planned_argument_fields: ["file_path", "content"],
+			producer_fields: [
+				"scope",
+				"pre_digest",
+				"change_set_digest"
+			],
+			readback_fields: ["post_digest"],
+			execution_surface: "native_write_edit",
+			steps: NATIVE_WRITE_STEPS
+		};
+		case "modify": return {
+			action,
+			selector_fields: ["artifact_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["artifact.modify.v1"],
+			planned_tools: ["edit", "edit_file"],
+			planned_argument_fields: [
+				"file_path",
+				"old_string",
+				"new_string"
+			],
+			producer_fields: [
+				"scope",
+				"pre_digest",
+				"change_set_digest"
+			],
+			readback_fields: ["post_digest"],
+			execution_surface: "native_write_edit",
+			steps: NATIVE_WRITE_STEPS
+		};
+		case "restart": return {
+			action,
+			selector_fields: ["service_id"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["manifest_id"],
+			command_manifest_ids: ["dshmarket.restart.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["pre_generation"],
+			readback_fields: ["new_generation", "health"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "publish": return {
+			action,
+			selector_fields: [
+				"artifact_id",
+				"version",
+				"registry"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["manifest_id", "tgz_path"],
+			command_manifest_ids: ["npm.publish_tgz.v1"],
+			planned_tools: ["context_guard_action"],
+			planned_argument_fields: [],
+			producer_fields: ["integrity_digest"],
+			readback_fields: [
+				"artifact_id",
+				"version",
+				"registry",
+				"integrity_digest"
+			],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "commit": return {
+			action,
+			selector_fields: ["repository", "branch"],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.commit_index_tree.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["pre_head_oid", "change_set_digest"],
+			readback_fields: ["post_head_oid", "pre_head_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "push": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.push_explicit_refs.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["local_oid"],
+			readback_fields: ["remote_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "pull": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.pull_ff_only_explicit.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: [
+				"upstream_oid",
+				"pre_head_oid",
+				"pull_mode"
+			],
+			readback_fields: ["post_head_oid", "tracking_ref_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+		case "fetch": return {
+			action,
+			selector_fields: [
+				"repository",
+				"remote",
+				"refspec"
+			],
+			optional_selector_fields: [],
+			command_manifest_fields: ["planned_tool", "planned_arguments"],
+			command_manifest_ids: ["git.fetch_tracking_explicit.v2"],
+			planned_tools: ["bash", "pwsh"],
+			planned_argument_fields: ["command", "workdir"],
+			producer_fields: ["upstream_oid", "pre_head_oid"],
+			readback_fields: ["tracking_ref_oid", "post_head_oid"],
+			execution_surface: "context_guard_action",
+			steps: GUARD_TOOL_STEPS
+		};
+	}
 }
 
 //#endregion
 //#region src/tools/prepare.ts
+/** Discovery pages stay bounded like checkpoint pages. */
+const DISCOVERY_ITEM_LIMIT = 8;
+const encodeCursor = (cursor) => Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
 /**
-* Thin READ-ONLY preparation surface (v0.5): before any stateful action it
+* The items discovery lists for the CURRENT work: under a v5 boundary that is
+* the current unit's closure plus its required descendants (the same scope a
+* v2 certificate answers for, prohibitions included because a standing
+* constraint is never finished work) plus every pre-v5 obligation, which keeps
+* their birth rules and must never be silently dropped. A legacy session lists
+* the whole session. Switched-away sibling units keep their own history and
+* are reached by item ID, not re-listed here (0.6.1, W060-03).
+*/
+function discoveryItemIds(p) {
+	const pending = [...p.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || a.id.localeCompare(b.id));
+	if (p.boundaryProtocol !== 5) return pending.map((item) => item.id);
+	const closureUnits = new Set([...p.currentUnitId !== void 0 ? [p.currentUnitId, ...unitDescendantIds(p, p.currentUnitId)] : []]);
+	return pending.filter((item) => item.unitId === void 0 || item.unitId !== void 0 && closureUnits.has(item.unitId)).map((item) => item.id);
+}
+/**
+* Thin READ-ONLY preparation surface (v0.5/0.6): before any stateful action it
 * reports the supported command shape, the required resolution/effect/state
 * evidence order, existing reusable references, and the exact missing fields.
 * It never executes, installs, commits, pushes, restarts, or probes authority
 * through side effects, and it never upgrades a default into user authority.
+* Without an `item_id` it returns the bounded current-item discovery list, so
+* the first step of a session can find the right ID instead of guessing one.
 */
 function createPrepareTool(options) {
 	return defineTool({
 		name: "context_guard_prepare",
-		description: "Read-only pre-action preparation: report the supported command shape, required resolution/effect/state evidence order, existing references, and exact missing target fields for one contract item. Performs no action and grants no authority.",
+		description: "Read-only pre-action preparation: report the supported command shape, required evidence order, existing references, and exact missing target fields for one contract item. Omit item_id to list current open items with their IDs; a stateful change needs resolution/effect/state, a read-only verification needs one matching fact. Pagination follows page_cursor (bound to the contract revision) and semantic_action filters the listing. Performs no action and grants no authority.",
 		parameters: {
-			item_id: {
-				type: "string",
-				required: true
-			},
+			item_id: { type: "string" },
 			item_revision: { type: "number" },
 			semantic_action: { type: "string" },
 			requested_target: {
 				type: "object",
 				additionalProperties: true
 			},
-			planned_operation: { type: "string" }
+			planned_operation: { type: "string" },
+			page_cursor: { type: "string" }
 		},
 		output: {
 			schema: {
@@ -915,11 +1153,83 @@ function createPrepareTool(options) {
 		},
 		async execute(rawArgs) {
 			const args = rawArgs;
+			if (options.refreshProjection) {
+				let durable = false;
+				try {
+					durable = await options.refreshProjection() === true;
+				} catch {
+					durable = false;
+				}
+				if (!durable) return {
+					status: "unknown",
+					reason_code: "projection_durability_unavailable"
+				};
+			}
 			const p = options.getProjection();
 			if (!p || !p.enabled || p.integrity !== "valid") return {
 				status: "unknown",
 				reason_code: "guard_unavailable"
 			};
+			if (args.item_id === void 0) {
+				const filter = args.semantic_action ?? null;
+				const invalidCursor = (reason_code, note) => ({
+					status: "rejected",
+					reason_code,
+					mode: "discovery",
+					contract_revision: p.contractRevision,
+					...note !== void 0 ? { note } : { note: "Re-run discovery without page_cursor to list from the first page." }
+				});
+				let startAfter;
+				if (args.page_cursor !== void 0) {
+					let parsed;
+					try {
+						if (args.page_cursor.length <= 1024) {
+							const value = JSON.parse(Buffer.from(args.page_cursor, "base64url").toString("utf8"));
+							if (value?.v === 1 && Number.isSafeInteger(value.r) && (value.f === null || typeof value.f === "string") && Array.isArray(value.k) && Number.isSafeInteger(value.k[0]) && typeof value.k[1] === "string") parsed = value;
+						}
+					} catch {
+						parsed = void 0;
+					}
+					if (!parsed) return invalidCursor("discovery_cursor_malformed");
+					if (parsed.r !== p.contractRevision) return invalidCursor("discovery_cursor_stale", `The contract changed (cursor revision ${parsed.r}, current ${p.contractRevision}). Re-run discovery without page_cursor; items are never skipped by a stale page.`);
+					if ((parsed.f ?? null) !== (filter ?? null)) return invalidCursor("discovery_cursor_filter_mismatch");
+					startAfter = parsed.k;
+				}
+				const eligible = discoveryItemIds(p).map((id) => p.items.get(id)).filter((item$1) => filter === null || (item$1.semanticAction ?? "generic_run") === filter);
+				const startIndex = startAfter === void 0 ? 0 : eligible.findIndex((item$1) => item$1.revision === startAfter[0] && item$1.id === startAfter[1]) + 1;
+				if (startAfter !== void 0 && startIndex <= 0) return invalidCursor("discovery_cursor_stale", "The cursor names an item no longer in the current listing. Re-run discovery without page_cursor.");
+				const page = eligible.slice(startIndex, startIndex + DISCOVERY_ITEM_LIMIT);
+				const hasMore = startIndex + page.length < eligible.length;
+				return {
+					status: "prepared",
+					mode: "discovery",
+					durability: p.durabilityWatermark,
+					contract_revision: p.contractRevision,
+					total_open: eligible.length,
+					listed: page.length,
+					has_more: hasMore,
+					items: page.map((item$1) => {
+						const diagnosis$1 = deriveItemDiagnosis(p, item$1);
+						return {
+							id: item$1.id,
+							revision: item$1.revision,
+							kind: item$1.kind,
+							...item$1.taskKind !== void 0 ? { task_kind: item$1.taskKind } : {},
+							semantic_action: item$1.semanticAction ?? "generic_run",
+							reason_code: diagnosis$1.reason_code,
+							text: item$1.normalizedText
+						};
+					}),
+					...hasMore ? { next_cursor: encodeCursor({
+						v: 1,
+						r: p.contractRevision,
+						f: filter,
+						k: [page[page.length - 1].revision, page[page.length - 1].id]
+					}) } : {},
+					...filter !== null ? { filtered_by: { semantic_action: filter } } : {},
+					note: "Re-run with one item_id to prepare that item, or pass page_cursor for the next page. Preparation performs no action."
+				};
+			}
 			const item = p.items.get(args.item_id ?? "");
 			if (!item) return {
 				status: "rejected",
@@ -944,13 +1254,13 @@ function createPrepareTool(options) {
 				resolved_target: evidence.resolvedTarget,
 				tool_result_seq: evidence.toolResultSeq
 			}));
-			const requiredOrder = manifestEntry?.stateful ? [
+			const requiredOrder = plannedAction && isStatefulAction(plannedAction) ? [
 				"resolution (prestate facts from a trusted read)",
 				"effect (the exact planned change)",
 				"state (independent post-state readback)"
-			] : ["state (matching durable evidence for the requested verification)"];
-			const recipe = plannedAction ? gitPreparation(plannedAction) : void 0;
-			const missingTargetFields = manifestEntry?.stateful && plannedAction ? (recipe?.selector_fields ?? manifestEntry.resolvedTargetKeys).filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
+			] : ["effect (one matching durable verification fact)"];
+			const recipe = plannedAction && isStatefulAction(plannedAction) ? actionPreparation(plannedAction) : void 0;
+			const missingTargetFields = recipe ? recipe.selector_fields.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
 			const capability = plannedAction && options.hostCapability ? options.hostCapability(plannedAction) : void 0;
 			const commandShape = options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) : void 0;
 			return {
@@ -969,13 +1279,163 @@ function createPrepareTool(options) {
 					status: capability.status,
 					...capability.reasonCode !== void 0 ? { reason_code: capability.reasonCode } : {}
 				} } : {},
-				...recipe ? { evidence_input_contract: recipe } : {},
+				...recipe ? { evidence_input_contract: {
+					selector_fields: recipe.selector_fields,
+					optional_selector_fields: recipe.optional_selector_fields,
+					command_manifest_fields: recipe.command_manifest_fields,
+					command_manifest_ids: recipe.command_manifest_ids,
+					planned_tools: recipe.planned_tools,
+					planned_argument_fields: recipe.planned_argument_fields,
+					producer_fields: recipe.producer_fields,
+					readback_fields: recipe.readback_fields,
+					execution_surface: recipe.execution_surface,
+					steps: recipe.steps
+				} } : {},
 				note: "Preparation performs no action. A default or guessed target is not user authority; explicit root instruction is required for missing target fields."
 			};
 		}
 	});
 }
 
+//#endregion
+//#region src/tools/interpret.ts
+function parsePartition(args, extent) {
+	const read = (key) => {
+		const raw = args[key];
+		if (raw === void 0) return void 0;
+		if (!Array.isArray(raw)) return void 0;
+		const spans = [];
+		for (const entry of raw) {
+			const record$1 = entry;
+			const start = record$1?.start;
+			const end = record$1?.end;
+			if (typeof start !== "number" || !Number.isSafeInteger(start) || typeof end !== "number" || !Number.isSafeInteger(end) || start >= end) return void 0;
+			spans.push({
+				start,
+				end
+			});
+		}
+		return spans;
+	};
+	const information = read("information_spans");
+	const unknown = read("unknown_spans");
+	if (information === void 0 || unknown === void 0) return { error: "interpretation_partition_required" };
+	if (information.length === 0) return { error: "interpretation_partition_required" };
+	const all = [...information, ...unknown];
+	for (const span of all) if (span.start < extent.start || span.end > extent.end) return { error: "interpretation_span_outside_input" };
+	const ordered = [...all].sort((left, right) => left.start - right.start || left.end - right.end);
+	for (let index = 1; index < ordered.length; index += 1) if (ordered[index].start < ordered[index - 1].end) return { error: "interpretation_spans_overlap" };
+	return {
+		information,
+		unknown
+	};
+}
+/** The byte extent that covers every source span of one item. */
+function itemExtent(spans) {
+	return {
+		start: Math.min(...spans.map((span) => span.start)),
+		end: Math.max(...spans.map((span) => span.end))
+	};
+}
+function createInterpretTool(options) {
+	return defineTool({
+		name: "context_guard_interpret",
+		description: "Record the interpretation of one unresolved obligation: pass the item ID from context_guard_prepare plus the partition of its input spans you read as information (information_spans) and the sub-spans you could not resolve (unknown_spans); for an attached asset, the partition is unnecessary. Contract bookkeeping only — performs no action, grants no authority. Information sub-spans close when this turn's host-confirmed final answer is delivered; unknown sub-spans remain pending obligations. Correctness is never certified.",
+		parameters: {
+			item_id: {
+				type: "string",
+				required: true
+			},
+			information_spans: {
+				type: "array",
+				items: {
+					type: "object",
+					additionalProperties: true
+				}
+			},
+			unknown_spans: {
+				type: "array",
+				items: {
+					type: "object",
+					additionalProperties: true
+				}
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}]
+		},
+		async execute(rawArgs) {
+			const args = rawArgs;
+			const reject = (reason_code) => ({
+				status: "rejected",
+				reason_code
+			});
+			if (options.refreshProjection) {
+				let durable = false;
+				try {
+					durable = await options.refreshProjection() === true;
+				} catch {
+					durable = false;
+				}
+				if (!durable) return {
+					status: "unknown",
+					reason_code: "projection_durability_unavailable"
+				};
+			}
+			const p = options.getProjection();
+			if (!p || !p.enabled || p.integrity !== "valid") return reject("guard_unavailable");
+			const itemId = typeof args.item_id === "string" ? args.item_id.trim() : "";
+			if (!itemId) return reject("item_not_found");
+			const item = p.items.get(itemId);
+			if (!item) return reject("item_not_found");
+			if (item.status !== "pending") return reject("item_not_pending");
+			if (!item.asset && item.authorityDisposition !== "unresolved") return reject("not_interpretable");
+			if (item.asset) return {
+				status: "recorded",
+				item_id: item.id,
+				item_revision: item.revision,
+				kind: "asset",
+				asset: {
+					message_seq: item.asset.messageSeq,
+					part_index: item.asset.partIndex,
+					media_sha256: item.asset.mediaSha256
+				},
+				note: "Interpretation recorded for this asset obligation. It closes when the host-confirmed final answer of this interpreting turn is delivered; this record never certifies the interpretation's correctness and never authorizes or proves any execution."
+			};
+			if (!item.spans || item.spans.length === 0) return reject("item_spans_unavailable");
+			const partition = parsePartition(args, itemExtent(item.spans));
+			if ("error" in partition) return reject(partition.error);
+			return {
+				status: "recorded",
+				item_id: item.id,
+				item_revision: item.revision,
+				kind: "clause",
+				spans: item.spans.map((span) => ({
+					part_index: span.partIndex,
+					start: span.start,
+					end: span.end
+				})),
+				information_spans: partition.information.map((span) => ({
+					start: span.start,
+					end: span.end
+				})),
+				unknown_spans: partition.unknown.map((span) => ({
+					start: span.start,
+					end: span.end
+				})),
+				note: "Interpretation partition recorded for this unresolved clause: information sub-spans close when the host-confirmed final answer of this interpreting turn is delivered; every unknown sub-span remains a pending obligation and must still be resolved or performed. This record never certifies correctness and never authorizes any execution."
+			};
+		}
+	});
+}
+
 //#endregion
 //#region src/tools/evidence.ts
 const execFileAsync = promisify(execFile);
@@ -1315,12 +1775,63 @@ async function tgzIdentity(path) {
 		offset = bodyStart + Math.ceil(size$1 / 512) * 512;
 	}
 	if (typeof manifest?.name !== "string" || typeof manifest.version !== "string") return void 0;
+	const gitHead = typeof manifest.gitHead === "string" && /^[0-9a-f]{40}$/.test(manifest.gitHead) ? manifest.gitHead : void 0;
+	const repositoryField = manifest.repository;
+	const repository = typeof repositoryField === "string" ? repositoryField : record(repositoryField) && typeof record(repositoryField)?.url === "string" ? String(record(repositoryField).url) : void 0;
 	return {
 		name: manifest.name,
 		version: manifest.version,
-		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`
+		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`,
+		sha256: createHash("sha256").update(bytes).digest("hex"),
+		...gitHead ? { gitHead } : {},
+		...repository ? { repository } : {}
+	};
+}
+/**
+* Read the candidate identity of a publish from TRUSTED PRODUCERS only: the
+* exact tgz bytes (SHA-256 and npm SRI), the manifest the packer embedded
+* (package name, version, gitHead, repository) and, when the contract names a
+* ref, the local repository's own answer for that ref. Nothing here comes from
+* a model argument, so a caller cannot assert an identity the artifact does
+* not have.
+*/
+async function observePublishCandidate(resolution, roots, signal, cwd) {
+	const tgzPath = requireString(resolution.commandManifest, "tgz_path");
+	if (!tgzPath) return void 0;
+	const identity = await tgzIdentity(tgzPath);
+	if (!identity) return void 0;
+	const registry = typeof resolution.target.registry === "string" ? resolution.target.registry : void 0;
+	return {
+		packageId: identity.name,
+		version: identity.version,
+		artifactSha256: identity.sha256,
+		artifactSri: identity.integrity,
+		...identity.gitHead ? { fullSha40: identity.gitHead } : {},
+		...identity.repository ? { repository: identity.repository } : {},
+		...registry ? { registry } : {}
 	};
 }
+/**
+* Resolve one ref to its commit with the audited git executable. Exported so
+* the runtime can resolve the ref an ADOPTED CONTRACT names, which is the only
+* closed, reachable path for that identity: the action tool's manifest schema
+* has no field for it, and a model-supplied ref would not be authority.
+*/
+async function resolveAuditedRef(cwd, ref, roots, signal) {
+	if (!cwd || !/^refs\/[A-Za-z0-9._/-]+$/.test(ref)) return void 0;
+	try {
+		const identity = await (roots.readExecutableIdentity ?? executableIdentity)("git", signal);
+		if (!identity || identity.executable !== "git") return void 0;
+		const resolved = (await git(cwd, [
+			"rev-parse",
+			"--verify",
+			`${ref}^{commit}`
+		], signal, identity.realpath)).trim().toLowerCase();
+		return /^[0-9a-f]{40}$/.test(resolved) ? resolved : void 0;
+	} catch {
+		return;
+	}
+}
 const MARKET_SCHEMA = "dsh-market/update-api/v1";
 const MARKET_GENERATION_PREFIX = "dsh-market-instance/v1:";
 async function marketCapabilities(roots, signal) {
@@ -1518,7 +2029,7 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	if (action === "install" || action === "apply") {
 		const tgzPath = requireString(resolution.commandManifest, "tgz_path");
 		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
-		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.package_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || roots.profile?.name !== target.profile) return "unavailable";
+		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.package_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || roots.profile?.name !== target.profile) return { status: "unavailable" };
 		await runCommand(roots, executableIdentity$1, [
 			"plugin",
 			"--profile",
@@ -1526,13 +2037,13 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 			"add",
 			`file:${tgzPath}`
 		], void 0, signal);
-		return "completed";
+		return { status: "completed" };
 	}
 	if (action === "publish") {
 		const tgzPath = requireString(resolution.commandManifest, "tgz_path");
 		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
 		const registry = typeof target.registry === "string" ? canonicalRegistryBase(target.registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry }) : void 0;
-		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.artifact_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || !registry || registry !== target.registry) return "unavailable";
+		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.artifact_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || !registry || registry !== target.registry) return { status: "unavailable" };
 		await runCommand(roots, executableIdentity$1, [
 			"publish",
 			tgzPath,
@@ -1540,19 +2051,19 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 			registry,
 			"--ignore-scripts"
 		], void 0, signal);
-		return "completed";
+		return { status: "completed" };
 	}
 	if (action === "restart") {
 		const capabilities = await marketCapabilities(roots, signal);
-		if (!capabilities || !roots.marketOrigin || !resolutionCallId || !agent) return "unavailable";
-		if (!sameMarketProvider(target.pre_generation, capabilities.generation)) return "unavailable";
-		if (capabilities.generation !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? "completed" : "unavailable";
-		if (restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return "handoff_pending";
+		if (!capabilities || !roots.marketOrigin || !resolutionCallId || !agent) return { status: "unavailable" };
+		if (!sameMarketProvider(target.pre_generation, capabilities.generation)) return { status: "unavailable" };
+		if (capabilities.generation !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? { status: "completed" } : { status: "unavailable" };
+		if (restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return { status: "handoff_pending" };
 		if (!roots.persistRestartIntent || !await roots.persistRestartIntent(agent, {
 			resolutionCallId,
 			serviceId: String(target.service_id),
 			preGeneration: String(target.pre_generation)
-		})) return "unavailable";
+		})) return { status: "unavailable" };
 		const response = await (roots.fetcher ?? fetch)(`${roots.marketOrigin}/dsh-market/api/v1/restart`, {
 			method: "POST",
 			signal,
@@ -1564,21 +2075,25 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 			},
 			body: "{}"
 		});
-		if (!response.ok) return "unavailable";
-		return record(await response.json())?.schema === MARKET_SCHEMA ? "handoff_pending" : "unavailable";
+		if (!response.ok) return { status: "unavailable" };
+		return record(await response.json())?.schema === MARKET_SCHEMA ? { status: "handoff_pending" } : { status: "unavailable" };
 	}
 	if (action === "commit" || action === "push" || action === "pull" || action === "fetch") {
 		const binding = resolution.gitBinding;
 		const repository = requireString(resolution.target, "repository");
-		if (!executableIdentity$1 || !binding || !repository) return "unavailable";
+		if (!executableIdentity$1 || !binding || !repository) return { status: "unavailable" };
 		const targetIdentity = {
 			repository,
 			...typeof resolution.target.remote === "string" ? { remote: resolution.target.remote } : {},
 			...typeof resolution.target.refspec === "string" ? { refspec: resolution.target.refspec } : {}
 		};
 		const current = await gitPrestate(binding.manifest, repository, signal, executableIdentity$1.realpath);
-		if (!current) return "unavailable";
-		if ((await executeRevalidatedGitEffect(binding.envelope, binding.manifest, targetIdentity, current, async (_file, argv, workingDirectory) => runCommand(roots, executableIdentity$1, argv, workingDirectory, signal))).status !== "executed") return "unavailable";
+		if (!current) return { status: "unavailable" };
+		const executed = await executeRevalidatedGitEffect(binding.envelope, binding.manifest, targetIdentity, current, async (_file, argv, workingDirectory) => runCommand(roots, executableIdentity$1, argv, workingDirectory, signal));
+		if (executed.status !== "executed") return {
+			status: "unavailable",
+			reasonCode: executed.reasonCode
+		};
 		if (action === "commit") {
 			const commit = verifiedLinearCommitReadback(await gitBytes(repository, [
 				"rev-list",
@@ -1593,10 +2108,10 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 				"-z",
 				commit.postHeadOid
 			], signal, executableIdentity$1.realpath)) : void 0;
-			if (!commit || postTree !== resolution.target.change_set_digest) return "unavailable";
+			if (!commit || postTree !== resolution.target.change_set_digest) return { status: "unavailable" };
 		} else if (action === "push") {
 			const remoteOid = binding.manifest.remote && binding.manifest.destinationRef ? await exactRemoteOid(repository, binding.manifest.remote, binding.manifest.destinationRef, signal, executableIdentity$1.realpath) : void 0;
-			if (!remoteOid || remoteOid !== resolution.target.local_oid) return "unavailable";
+			if (!remoteOid || remoteOid !== resolution.target.local_oid) return { status: "unavailable" };
 		} else {
 			const upstream = String(resolution.target.upstream_oid ?? "");
 			const trackingRef = binding.manifest.action === "fetch" ? binding.manifest.trackingRef : binding.manifest.remote && binding.manifest.sourceRef ? `refs/remotes/${binding.manifest.remote}/${binding.manifest.sourceRef.slice(11)}` : void 0;
@@ -1605,13 +2120,13 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 				"--verify",
 				trackingRef
 			], signal, executableIdentity$1.realpath)) : void 0;
-			if (!tracking || tracking !== upstream) return "unavailable";
-			if (action === "pull" && oid(await git(repository, ["rev-parse", "HEAD"], signal, executableIdentity$1.realpath)) !== upstream) return "unavailable";
-			if (action === "fetch" && oid(await git(repository, ["rev-parse", "HEAD"], signal, executableIdentity$1.realpath)) !== resolution.target.pre_head_oid) return "unavailable";
+			if (!tracking || tracking !== upstream) return { status: "unavailable" };
+			if (action === "pull" && oid(await git(repository, ["rev-parse", "HEAD"], signal, executableIdentity$1.realpath)) !== upstream) return { status: "unavailable" };
+			if (action === "fetch" && oid(await git(repository, ["rev-parse", "HEAD"], signal, executableIdentity$1.realpath)) !== resolution.target.pre_head_oid) return { status: "unavailable" };
 		}
-		return "completed";
+		return { status: "completed" };
 	}
-	return "unavailable";
+	return { status: "unavailable" };
 }
 async function gitBytes(repository, args, signal, file = "git") {
 	const { stdout } = await execFileAsync(file, args, {
@@ -2050,7 +2565,9 @@ function normalizedRoots(options) {
 		...options.authorizeMutation ? { authorizeMutation: options.authorizeMutation } : {},
 		...options.prepareMutation ? { prepareMutation: options.prepareMutation } : {},
 		...options.readExecutableIdentity ? { readExecutableIdentity: options.readExecutableIdentity } : {},
-		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {}
+		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
+		...options.releaseGate ? { releaseGate: options.releaseGate } : {},
+		...options.releaseSettle ? { releaseSettle: options.releaseSettle } : {}
 	};
 }
 function createActionTool(options = {}) {
@@ -2219,14 +2736,70 @@ function createActionTool(options = {}) {
 					...identity
 				};
 			}
+			const releaseOperation = action === "publish" ? "npm_publish" : void 0;
+			let releaseGranted = false;
+			let releaseContractId;
+			if (releaseOperation && roots.releaseGate) {
+				const observed = await observePublishCandidate(resolution, roots, exec.signal, cwdOf(agent));
+				if (!observed) return {
+					status: "unavailable",
+					reason_code: "release_candidate_unobservable",
+					...identity
+				};
+				let decision;
+				try {
+					decision = await roots.releaseGate({
+						agent,
+						operation: releaseOperation,
+						callId: args.resolution_call_id,
+						resolvedTarget: resolution.target,
+						observed
+					});
+				} catch {
+					decision = void 0;
+				}
+				if (decision === void 0) return {
+					status: "unavailable",
+					reason_code: "release_gate_unavailable",
+					...identity
+				};
+				if (decision.status !== "granted") return {
+					status: "unavailable",
+					reason_code: decision.reasonCode,
+					...identity
+				};
+				releaseGranted = true;
+				releaseContractId = decision.contractId;
+			}
 			try {
-				const status = await executeGuardAction(action, resolution, roots, exec.signal, currentExecutable, args.resolution_call_id, agent);
+				const outcome = await executeGuardAction(action, resolution, roots, exec.signal, currentExecutable, args.resolution_call_id, agent);
+				if (releaseOperation && releaseGranted && roots.releaseSettle) {
+					const readback$1 = outcome.status === "completed" ? await publishReadback(resolution.target, roots, exec.signal) : void 0;
+					await roots.releaseSettle({
+						agent,
+						operation: releaseOperation,
+						callId: args.resolution_call_id,
+						...releaseContractId !== void 0 ? { contractId: releaseContractId } : {},
+						effect: outcome.status === "completed" ? "completed" : outcome.status === "unavailable" ? "not_effected" : "unknown",
+						readback: readback$1 === void 0 ? "unavailable" : {
+							kind: "npm_integrity",
+							identity: readback$1
+						}
+					});
+				}
 				return {
-					status,
-					reason_code: status === "completed" ? "action_completed" : status === "handoff_pending" ? "restart_handoff_pending" : "action_execution_failed",
+					status: outcome.status,
+					reason_code: outcome.status === "completed" ? "action_completed" : outcome.status === "handoff_pending" ? "restart_handoff_pending" : outcome.reasonCode === "effect_already_applied" ? "action_already_applied" : "action_execution_failed",
 					...identity
 				};
 			} catch {
+				if (releaseOperation && releaseGranted && roots.releaseSettle) await roots.releaseSettle({
+					agent,
+					operation: releaseOperation,
+					callId: args.resolution_call_id,
+					effect: "unknown",
+					readback: "unavailable"
+				});
 				return {
 					status: "unavailable",
 					reason_code: "action_execution_failed",
@@ -2236,6 +2809,23 @@ function createActionTool(options = {}) {
 		}
 	});
 }
+/**
+* The trusted npm readback identity for a completed publish: the registry's
+* own `dist.integrity` for the exact package version. `undefined` means no
+* producer is reachable, which keeps the release attempt `unconfirmed` instead
+* of claiming a verified release.
+*/
+async function publishReadback(target, roots, signal) {
+	const registry = typeof target.registry === "string" ? target.registry : void 0;
+	const artifact = typeof target.artifact_id === "string" ? target.artifact_id : void 0;
+	const version = typeof target.version === "string" ? target.version : void 0;
+	if (!registry || !artifact || !version) return void 0;
+	try {
+		return await registryIntegrity(registry, artifact, version, roots, signal);
+	} catch {
+		return;
+	}
+}
 function createEvidenceTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
@@ -2452,17 +3042,26 @@ function createEvidenceTool(options = {}) {
 			if (!agent) return unavailable(action, role, "producer_agent_unavailable");
 			try {
 				if (role === "resolution") {
-					const recipe = gitPreparation(action);
-					if (recipe) {
+					const recipe = actionPreparation(action);
+					{
 						const manifest = record(args.command_manifest);
 						const plannedArgs = record(manifest?.planned_arguments);
 						const selector = record(args.selector);
+						const needsManifestId = [
+							"install",
+							"apply",
+							"publish",
+							"restart"
+						].includes(action);
+						const needsPlannedEffect = !needsManifestId;
 						const missing = [
 							...recipe.selector_fields.filter((key) => !requireString(selector ?? {}, key)).map((key) => `selector.${key}`),
-							...!requireString(manifest ?? {}, "planned_tool") ? ["command_manifest.planned_tool"] : [],
-							...recipe.planned_argument_fields.filter((key) => !requireString(plannedArgs ?? {}, key)).map((key) => `command_manifest.planned_arguments.${key}`)
+							...needsManifestId && !requireString(manifest ?? {}, "manifest_id") ? ["command_manifest.manifest_id"] : [],
+							...needsManifestId && recipe.command_manifest_fields.includes("tgz_path") && !requireString(manifest ?? {}, "tgz_path") ? ["command_manifest.tgz_path"] : [],
+							...needsPlannedEffect && !requireString(manifest ?? {}, "planned_tool") ? ["command_manifest.planned_tool"] : [],
+							...needsPlannedEffect ? recipe.planned_argument_fields.filter((key) => !requireString(plannedArgs ?? {}, key)).map((key) => `command_manifest.planned_arguments.${key}`) : []
 						];
-						if (missing.length) return unavailable(action, role, "resolution_input_missing", missing, "Supply the listed resolution inputs before execution. Use context_guard_prepare for the exact Git input contract. A manifest_id alone does not describe a planned tool call.");
+						if (missing.length) return unavailable(action, role, "resolution_input_missing", missing, "Supply the listed resolution inputs before execution. Use context_guard_prepare for the exact input contract of this action. A manifest_id alone does not describe a planned tool call.");
 					}
 					const executable$1 = executableFor(action);
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
@@ -2514,6 +3113,135 @@ function createEvidenceTool(options = {}) {
 	});
 }
 
+//#endregion
+//#region src/tools/release.ts
+const RELEASE_TOOL = "context_guard_release";
+function createReleaseTool(options) {
+	return defineTool({
+		name: RELEASE_TOOL,
+		description: "Read the explicit release state, or reconcile a release attempt whose effect was unknown by reading back the external identity. This tool never re-sends a release.",
+		parameters: {
+			operation: {
+				type: "string",
+				required: true,
+				enum: ["status", "reconcile"]
+			},
+			contract_id: { type: "string" },
+			resolution_call_id: { type: "string" }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}]
+		},
+		async execute(rawArgs, exec) {
+			const args = rawArgs;
+			const projection = options.getProjection();
+			if (!projection) return {
+				status: "unknown",
+				reason_code: "guard_unavailable"
+			};
+			if (args.operation === "status") return {
+				status: "available",
+				policy: projection.policy,
+				state_damaged: projection.releaseStateDamaged,
+				coverage_surface: Object.keys(RELEASE_OPERATION_SURFACES).map((operation$1) => ({
+					operation: operation$1,
+					...RELEASE_OPERATION_SURFACES[operation$1]
+				})),
+				contracts: projection.releaseContracts.map((contract$1) => ({
+					contract_id: contract$1.contractId,
+					revoked_at_seq: contract$1.revokedAtSeq ?? null,
+					adopted_at_revision: contract$1.adoptedAtRevision,
+					operations: releaseCoverage(contract$1),
+					candidate: contract$1.candidate
+				})),
+				reservations: projection.releaseReservations.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, startedAtSeq, observedArtifactSri }) => ({
+					contract_id: contractId$1,
+					operation: operation$1,
+					resolution_call_id: callId$1,
+					started_at_seq: startedAtSeq,
+					observed_artifact_sri: observedArtifactSri ?? null,
+					in_flight: inFlightReservation(projection, contractId$1, operation$1)?.callId === callId$1
+				})),
+				settlements: projection.releaseSettlements.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, outcome: outcome$1, readback: readback$2, settledAtSeq }) => ({
+					contract_id: contractId$1,
+					operation: operation$1,
+					resolution_call_id: callId$1,
+					outcome: outcome$1,
+					readback: readback$2,
+					settled_at_seq: settledAtSeq
+				})),
+				diagnostics: projection.releaseDiagnostics
+			};
+			if (args.operation !== "reconcile") return {
+				status: "rejected",
+				reason_code: "release_subcommand_unknown"
+			};
+			const contractId = args.contract_id ?? "";
+			const callId = args.resolution_call_id ?? "";
+			const contract = contractById(projection, contractId);
+			if (!contract) return {
+				status: "rejected",
+				reason_code: "release_contract_unknown"
+			};
+			const reservation = reservationFor(projection, contractId, callId);
+			if (!reservation) return {
+				status: "rejected",
+				reason_code: "release_reservation_unknown"
+			};
+			const operation = reservation.operation;
+			const settled = projection.releaseSettlements.find((entry) => entry.contractId === contractId && entry.operation === operation && entry.callId === callId && (entry.outcome === "settled" || entry.outcome === "not_effected"));
+			if (settled) return {
+				status: "already_resolved",
+				outcome: settled.outcome,
+				reason_code: "release_already_resolved"
+			};
+			const registry = contract.candidate.registry;
+			const packageId = contract.candidate.packageId;
+			const version = contract.candidate.version;
+			if (!registry || !packageId || !version) return {
+				status: "unavailable",
+				reason_code: "release_readback_identity_incomplete"
+			};
+			const identity = await registryIntegrity(registry, packageId, version, options, exec.signal);
+			if (!identity) return {
+				status: "unavailable",
+				reason_code: "release_readback_unavailable"
+			};
+			const readback$1 = {
+				kind: "npm_integrity",
+				identity
+			};
+			const verdict = readbackSettlesContract(contract, readback$1, reservation.observedArtifactSri);
+			const outcome = verdict === "settled" ? "settled" : "unknown";
+			if (!await options.persistSettlement({
+				agent: exec.agent,
+				contractId,
+				operation,
+				callId,
+				readback: readback$1,
+				outcome
+			})) return {
+				status: "unknown",
+				reason_code: "release_settlement_not_durable"
+			};
+			return {
+				status: verdict === "settled" ? "settled" : verdict === "mismatch" ? "mismatch" : "unconfirmed",
+				outcome,
+				readback: readback$1,
+				reason_code: verdict === "settled" ? "release_reconciled" : verdict === "mismatch" ? "release_readback_identity_mismatch" : "release_readback_identity_unavailable",
+				note: "Reconciliation never re-sends the release operation."
+			};
+		}
+	});
+}
+
 //#endregion
 //#region src/tools/external-operation.ts
 function createExternalOperationTool(read, capability) {
@@ -2589,17 +3317,168 @@ function createExternalOperationTool(read, capability) {
 	});
 }
 
+//#endregion
+//#region src/domain/migration.ts
+/** The frozen digest domains: a migration never rewrites any of them. */
+const PRESERVED_DIGEST_DOMAINS = [
+	"ccg.sessionRefDigest.v3",
+	"ccg.hostLockDigest.v3",
+	"ccg.evidenceFact.v3",
+	"ccg.evidenceSha256.v3",
+	"ccg.predParams.v3",
+	"ccg.binding.v3",
+	"ccg.bindingDigest.v3",
+	"ccg.certificationDigest.v3",
+	"ccg.locator.v1",
+	"ccg.proofManifest.v1"
+];
+function migrationReport(projection) {
+	const v5 = projection.boundaryProtocol === 5;
+	const legacyItemIds = certifiableOpenItems(projection).filter((item) => item.unitId === void 0).map((item) => item.id);
+	const closure = v5 ? certificateClosure(projection) : { itemIds: [] };
+	const reasonCodes = [];
+	if (!v5) reasonCodes.push("legacy_session_keeps_v4_contract");
+	if (v5 && legacyItemIds.length > 0) reasonCodes.push("pre_v5_obligations_retained_in_closure");
+	return {
+		ruleMode: v5 ? "v5" : "legacy-v4",
+		certificateVersion: v5 ? CERTIFICATE_VERSION_V2 : CERTIFICATE_VERSION,
+		stopProtocolVersion: v5 ? STOP_PROTOCOL_VERSION_V2 : STOP_PROTOCOL_VERSION,
+		unitClosure: v5,
+		...v5 && projection.currentUnitId !== void 0 ? { currentUnitId: projection.currentUnitId } : {},
+		legacyItemIds,
+		unitClosureItemIds: [...closure.itemIds],
+		preservedDigestDomains: [...PRESERVED_DIGEST_DOMAINS],
+		historyOnlyCertificateVersions: v5 ? [CERTIFICATE_VERSION] : [],
+		rollbackRequiresStateSnapshot: v5,
+		rollbackInstruction: v5 ? "Restore the 0.5.x state snapshot before starting the older binary. Replaying a v5 log with 0.5.x fails closed with certificate_replay_mismatch; never migrate new-schema data down by hand." : "No rollback action is required for this session: it has not written a v5 boundary.",
+		reasonCodes
+	};
+}
+
 //#endregion
 //#region src/commands/context-guard.ts
 function pendingCount(projection) {
 	return [...projection.items.values()].filter((item) => item.status === "pending").length;
 }
+/**
+* The release surface. Adoption is deliberately NOT performed here: the
+* derivation adopts a contract only from the durable root `command/run` for
+* `/context-guard release adopt <json>`, so the command handler's job is to
+* report the resulting state (and to explain what is not protectable), never
+* to grant authority itself.
+*/
+function releaseResponse(projection, rawInput) {
+	const rest = rawInput.trim().slice(7).trim();
+	const [verb] = rest.split(/\s+/, 1);
+	if (verb === "adopt") {
+		const payload = rest.slice(5).trim();
+		let parsed;
+		try {
+			parsed = JSON.parse(payload);
+		} catch {
+			return {
+				kind: "error",
+				text: "Context Guard release adopt: the contract must be one JSON object."
+			};
+		}
+		const normalized = normalizeReleaseContract(parsed, {
+			seq: -1,
+			digest: ""
+		});
+		if (!normalized.contract) return {
+			kind: "error",
+			text: `Context Guard release adopt rejected: ${normalized.errors.join(", ")}`
+		};
+		const contract = normalized.contract;
+		const adopted = projection.releaseContracts.some((entry) => entry.contractId === contract.contractId) ? projection.releaseContracts.find((entry) => entry.contractId === contract.contractId) : contract;
+		return {
+			kind: "success",
+			text: JSON.stringify({
+				status: "adopted",
+				contract_id: adopted.contractId,
+				candidate: adopted.candidate,
+				operations: releaseCoverage(adopted),
+				readiness_refs: adopted.readinessRefs,
+				closure_cert_ref: adopted.closureCertRef ?? null,
+				expires_at_epoch_ms: adopted.expiresAtEpochMs ?? null,
+				note: "The contract becomes authoritative from the durable root command that carried it. It grants no authority in this process."
+			})
+		};
+	}
+	if (verb === "revoke") {
+		const contractId = rest.slice(6).trim();
+		if (!contractId) return {
+			kind: "error",
+			text: "Usage: /context-guard release revoke <contract_id>"
+		};
+		const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+		if (!contract) return {
+			kind: "error",
+			text: `Context Guard release revoke: unknown contract ${contractId}`
+		};
+		return {
+			kind: "success",
+			text: JSON.stringify({
+				status: contract.revokedAtSeq === void 0 ? "revoking" : "revoked",
+				contract_id: contractId,
+				revoked_at_seq: contract.revokedAtSeq ?? null,
+				in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId }) => ({
+					operation,
+					call_id: callId
+				})),
+				note: "Revocation is recorded durably and keeps the audit trail. It denies the next effect; an operation already in flight still needs its trusted readback to be reconciled."
+			})
+		};
+	}
+	if (verb !== "" && verb !== "status") return {
+		kind: "error",
+		text: "Usage: /context-guard release status | release adopt <json contract> | release revoke <contract_id>. Adoption and revocation are recorded from this command itself; they never grant authority in-process."
+	};
+	const contracts = projection.releaseContracts.map((contract) => ({
+		contract_id: contract.contractId,
+		adopted_at_seq: contract.adoptedBy.seq,
+		revoked_at_seq: contract.revokedAtSeq ?? null,
+		candidate: contract.candidate,
+		readiness_refs: contract.readinessRefs,
+		closure_cert_ref: contract.closureCertRef ?? null,
+		operations: releaseCoverage(contract),
+		expires_at_epoch_ms: contract.expiresAtEpochMs ?? null,
+		consumed_operations: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId && settlement.outcome === "settled").map((settlement) => settlement.operation),
+		in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contract.contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId, startedAtSeq }) => ({
+			operation,
+			call_id: callId,
+			started_at_seq: startedAtSeq
+		})),
+		settlements: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId).map(({ operation, callId, outcome, readback: readback$1, settledAtSeq }) => ({
+			operation,
+			call_id: callId,
+			outcome,
+			readback: readback$1,
+			settled_at_seq: settledAtSeq
+		}))
+	}));
+	return {
+		kind: "success",
+		text: JSON.stringify({
+			profile_applicable: projection.policy === "release" || contracts.length > 0,
+			policy: projection.policy,
+			state_damaged: projection.releaseStateDamaged,
+			adopted_contracts: contracts,
+			coverage_surface: RELEASE_OPERATIONS.map((operation) => ({
+				operation,
+				...RELEASE_OPERATION_SURFACES[operation]
+			})),
+			diagnostics: projection.releaseDiagnostics,
+			note: "A release is never implicit: only an explicit root adoption creates a contract, and only operations with a Guard execution surface can be protected."
+		})
+	};
+}
 function createContextGuardCommand(projectionFor, setEnabled, clearContract, lifecycleFor) {
 	return {
 		name: "context-guard",
-		description: "Enable, disable, clear, inspect, or diagnose Context Guard for this session.",
+		description: "Enable, disable, clear, inspect, diagnose, or manage the explicit release contract for this session.",
 		recordInput: true,
-		input: { hint: "on|off|clear|status|diagnose" },
+		input: { hint: "on|off|clear|status|diagnose|migration|release status|release adopt <json>|release revoke <id>" },
 		handler: ({ agent, rawInput }) => {
 			const projection = projectionFor(agent);
 			const [subcommand] = rawInput.trim().split(/\s+/, 1);
@@ -2627,22 +3506,31 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 					text: `Context Guard contract cleared: ${before - after} requirement/acceptance item(s) superseded; ${after} pending remain (prohibitions retained).`
 				};
 			}
+			if (resolved === "release") return releaseResponse(projection, rawInput);
+			if (resolved === "migration") return {
+				kind: "success",
+				text: JSON.stringify(migrationReport(projection))
+			};
 			if (resolved !== "status" && resolved !== "diagnose") return {
 				kind: "error",
-				text: "Usage: /context-guard on|off|clear|status|diagnose"
+				text: "Usage: /context-guard on|off|clear|status|diagnose|migration|release status|release adopt <json>|release revoke <id>"
 			};
 			const passed = [...projection.items.values()].filter((item) => item.status === "passed").length;
 			let certifiable_missing_evidence = 0;
 			let unsupported = 0;
+			const reason_classes = {};
 			for (const item of projection.items.values()) {
 				if (item.status !== "pending") continue;
 				const diagnosis = deriveItemDiagnosis(projection, item);
+				reason_classes[diagnosis.reason_class] = (reason_classes[diagnosis.reason_class] ?? 0) + 1;
 				if (diagnosis.repairability === "agent_repairable") certifiable_missing_evidence += 1;
 				else if (diagnosis.certification === "unsupported") unsupported += 1;
 			}
+			const migration = migrationReport(projection);
 			const response = {
 				enabled: projection.enabled,
 				lifecycle: lifecycleFor?.(agent) ?? (projection.enabled ? "active" : "disabled"),
+				policy: projection.policy,
 				epoch: projection.epoch,
 				contract_revision: projection.contractRevision,
 				pending: pendingCount(projection),
@@ -2650,11 +3538,25 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 				diagnosis: {
 					certified: passed,
 					certifiable_missing_evidence,
-					unsupported
+					unsupported,
+					reason_classes
 				},
 				evidence: projection.evidence.size,
 				integrity: projection.integrity,
-				last_source_seq: projection.lastObservedSourceSeq
+				last_source_seq: projection.lastObservedSourceSeq,
+				migration: {
+					rule_mode: migration.ruleMode,
+					certificate_version: migration.certificateVersion,
+					unit_closure: migration.unitClosure,
+					legacy_open_items: migration.legacyItemIds.length
+				},
+				release: {
+					policy: projection.policy,
+					state_damaged: projection.releaseStateDamaged,
+					adopted_contracts: projection.releaseContracts.length,
+					in_flight: projection.releaseReservations.filter((reservation) => !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && settlement.outcome === "settled")).length,
+					applicable: projection.policy === "release" || projection.releaseContracts.length > 0
+				}
 			};
 			return {
 				kind: "success",
@@ -3464,6 +4366,7 @@ defineMethod("transform", [
 //#region src/config.ts
 const Config = Schema.object({
 	activation: Schema.string().default("opt-in"),
+	policy: Schema.string().default("standard"),
 	hostLockPlatform: Schema.string(),
 	hostLockProfile: Schema.string(),
 	hostLockPolicy: Schema.string(),
@@ -3478,6 +4381,8 @@ const Config = Schema.object({
 function resolveConfig(config) {
 	const activation = config.activation ?? "opt-in";
 	if (activation !== "opt-in" && activation !== "always") throw new TypeError(`activation must be "opt-in" or "always", received ${JSON.stringify(activation)}`);
+	const policy = config.policy ?? "standard";
+	if (policy !== "standard" && policy !== "strict" && policy !== "release") throw new TypeError(`policy must be "standard", "strict", or "release", received ${JSON.stringify(policy)}`);
 	let hostLockPackages;
 	if (config.hostLockPackages !== void 0) {
 		if (!Array.isArray(config.hostLockPackages)) throw new TypeError("hostLockPackages must be an array");
@@ -3508,6 +4413,7 @@ function resolveConfig(config) {
 		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
 		...typeof config.hostLockProfileRoot === "string" ? { hostLockProfileRoot: config.hostLockProfileRoot } : {},
 		activation,
+		policy,
 		...hostLockPackages ? { hostLockPackages } : {},
 		...config.hostLockPlatform ? { hostLockPlatform: config.hostLockPlatform } : {},
 		...config.hostLockProfile ? { hostLockProfile: config.hostLockProfile } : {}
@@ -3584,7 +4490,12 @@ function authorizeMutationFromProjection(projection, request) {
 		status: "denied",
 		reasonCode: "mutation_target_clarification_required"
 	};
-	if (!requestedTargetAuthorizesMutation(request.action, item.requestedTarget, request.resolvedTarget)) return {
+	const boundedAuthorized = (scope) => requestedTargetAuthorizesMutation(request.action, {
+		...item.requestedTarget,
+		scope
+	}, request.resolvedTarget);
+	const selectionAuthorized = projection.trustedSelections.some((selection) => selection.kind === "directory" && typeof item.requestedTarget?.artifact_type === "string" && item.unitId !== void 0 && boundedAuthorized(selection.selected));
+	if (!requestedTargetAuthorizesMutation(request.action, item.requestedTarget, request.resolvedTarget) && !selectionAuthorized) return {
 		status: "denied",
 		reasonCode: "mutation_requested_target_mismatch"
 	};
@@ -3860,10 +4771,12 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	const session = agent.session;
 	let pendingRecovery = false;
 	let durabilityConfirmed = false;
+	let durabilityWatermark = "unknown";
 	let observedEpoch = -1;
 	let observedCompactionSeq = -1;
 	let observedContractRevision = -1;
 	let protocolV4Present = false;
+	let protocolV5Present = false;
 	let realRootInputSeen = false;
 	let lifecycle = "armed";
 	const continuationAttempts = projection.continuationAttempts;
@@ -3882,7 +4795,10 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
 			return;
 		}
-		const derived = deriveProjection(events, { activation: config.activation }, {
+		const derived = deriveProjection(events, {
+			activation: config.activation,
+			policy: config.policy
+		}, {
 			cwd: typeof header?.cwd === "string" ? header.cwd : "",
 			sessionHeader
 		}, durabilityConfirmed, hostLock);
@@ -3904,7 +4820,9 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.continuationAttempts = continuationAttempts;
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
 		projection.lastRecoveryDigest = priorRecoveryDigest;
+		projection.durabilityWatermark = durabilityWatermark;
 		protocolV4Present = derived.protocolV4Present;
+		protocolV5Present = derived.boundaryV5;
 		realRootInputSeen = derived.realRootInputSeen;
 		lifecycle = lifecyclePhase({
 			enabled: projection.enabled,
@@ -3931,6 +4849,8 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	};
 	const setDurability = (confirmed) => {
 		durabilityConfirmed = confirmed;
+		durabilityWatermark = confirmed ? "confirmed" : "failed";
+		projection.durabilityWatermark = durabilityWatermark;
 	};
 	const markRecoveryNeeded = () => {
 		pendingRecovery = true;
@@ -3950,6 +4870,9 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		get protocolV4Present() {
 			return protocolV4Present;
 		},
+		get protocolV5Present() {
+			return protocolV5Present;
+		},
 		sync,
 		setEnabled,
 		setDurability,
@@ -3957,6 +4880,15 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		consumeRecovery
 	};
 }
+/** The durable session working directory, when the V3 header carries one. */
+function sessionCwd(session) {
+	const header = session.header;
+	return typeof header?.cwd === "string" && header.cwd.length > 0 ? header.cwd : void 0;
+}
+/** A bounded signal for a short trusted readback performed by the gate. */
+function requestSignal() {
+	return AbortSignal.timeout(5e3);
+}
 /** Delegated/subagent sessions never receive root-conversation injections. */
 function isDelegatedSession(session) {
 	const header = session.header;
@@ -3992,9 +4924,9 @@ function revalidateCoreLock(config, expected) {
 		};
 	}
 }
-function apply(ctx, rawConfig = {}) {
+function apply(ctx, rawConfig = {}, seams = {}) {
 	const config = resolveConfig(rawConfig);
-	const installedHostLock = evaluateHostLock(config.hostLockPackages ?? [], {
+	const installedHostLock = seams.hostLock ?? evaluateHostLock(config.hostLockPackages ?? [], {
 		platform: config.hostLockPlatform,
 		profileKind: config.hostLockProfile
 	});
@@ -4006,7 +4938,7 @@ function apply(ctx, rawConfig = {}) {
 		if (!runtime) {
 			const goals = optionalGoalService(ctx, agent);
 			const refreshHostLock = () => {
-				const current = bindLiveGoalCapability(revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
+				const current = bindLiveGoalCapability(seams.hostLock ?? revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
 				hostLocks.set(agent, current);
 				return current;
 			};
@@ -4045,8 +4977,41 @@ function apply(ctx, rawConfig = {}) {
 			runtime.sync();
 			return durable;
 		}, () => runtime.markRecoveryNeeded()));
+		/**
+		* Persist one C10 release record through the plugin-notice channel and make
+		* it durable before returning. A record that cannot be flushed is reported
+		* as a failure: an unflushed reservation is not an in-flight operation, and
+		* an unflushed settlement would let a consumed ticket look unused.
+		*/
+		const persistReleaseRecord = async (toolAgent, prefix, payload) => {
+			const target = toolAgent.session;
+			target.append.bind(target)("user/message", createUserMessage({
+				content: [{
+					type: "text",
+					text: `${prefix}${JSON.stringify(payload)}`
+				}],
+				source: {
+					kind: "plugin",
+					plugin: "context-guard",
+					form: "notice",
+					summary: boundContextSummary("recording an explicit release record")
+				}
+			}), { surfaceOp: "append" });
+			let durable = false;
+			try {
+				durable = await ctx.sessions.flush(target);
+			} catch {
+				durable = false;
+			}
+			runtime.setDurability(durable);
+			runtime.sync();
+			return durable;
+		};
 		const evidenceOptions = {
 			hostCapability: createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock),
+			...seams.commandRunner ? { commandRunner: seams.commandRunner } : {},
+			...seams.fetcher ? { fetcher: seams.fetcher } : {},
+			...seams.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
 			prepareMutation: async (toolAgent) => {
 				if (toolAgent.session !== agent.session) return false;
 				const durable = await ctx.sessions.flush(agent.session);
@@ -4059,6 +5024,63 @@ function apply(ctx, rawConfig = {}) {
 				return authorizeMutationFromProjection(runtime.projection, request);
 			},
 			marketOrigin: optionalMarketOrigin(ctx, agent),
+			releaseGate: async (request) => {
+				runtime.sync();
+				const projection = runtime.projection;
+				if (!(projection.policy === "release" || projection.releaseContracts.length > 0)) return {
+					status: "granted",
+					reasonCode: "release_profile_not_adopted"
+				};
+				const observed = { ...request.observed };
+				const declaredRef = releaseContractFor(projection, request.operation)?.candidate.ref;
+				if (declaredRef !== void 0 && observed.ref === void 0) {
+					const refSha = await resolveAuditedRef(sessionCwd(runtime.session), declaredRef, evidenceOptions, requestSignal());
+					if (refSha !== void 0) {
+						observed.ref = declaredRef;
+						observed.refSha = refSha;
+					}
+				}
+				const decision = releasePreEffectDecision(projection, {
+					operation: request.operation,
+					observed,
+					resolvedTarget: request.resolvedTarget,
+					nowEpochMs: Date.now()
+				});
+				if (decision.status !== "granted" || decision.contractId === void 0) return {
+					status: "denied",
+					reasonCode: decision.reasonCode
+				};
+				return await persistReleaseRecord(agent, RELEASE_RESERVATION_PREFIX, {
+					contractId: decision.contractId,
+					operation: request.operation,
+					callId: request.callId,
+					startedAtSeq: 0,
+					status: "in_flight",
+					...observed.artifactSri !== void 0 ? { observedArtifactSri: observed.artifactSri } : {}
+				}) ? {
+					status: "granted",
+					reasonCode: decision.reasonCode,
+					contractId: decision.contractId
+				} : {
+					status: "denied",
+					reasonCode: "release_reservation_not_durable"
+				};
+			},
+			releaseSettle: async (request) => {
+				const contractId = request.contractId ?? releaseContractFor(runtime.projection, request.operation)?.contractId ?? "unknown";
+				const contract = runtime.projection.releaseContracts.find((entry) => entry.contractId === contractId);
+				const reservation = reservationFor(runtime.projection, contractId, request.callId);
+				let outcome = request.effect === "not_effected" ? "not_effected" : "unknown";
+				if (request.effect === "completed" && contract) outcome = readbackSettlesContract(contract, request.readback, reservation?.observedArtifactSri) === "settled" ? "settled" : "unknown";
+				await persistReleaseRecord(agent, RELEASE_SETTLEMENT_PREFIX, {
+					contractId,
+					operation: request.operation,
+					callId: request.callId,
+					settledAtSeq: 0,
+					readback: request.readback,
+					outcome
+				});
+			},
 			persistRestartIntent: async (toolAgent, intent) => {
 				const session = toolAgent.session;
 				session.append.bind(session)("user/message", createUserMessage({
@@ -4094,7 +5116,35 @@ function apply(ctx, rawConfig = {}) {
 					reasonCode: evaluation.reasonCode
 				};
 			},
-			commandTemplate: (action) => GIT_COMMAND_TEMPLATES[action]
+			commandTemplate: (action) => GIT_COMMAND_TEMPLATES[action],
+			refreshProjection: async () => {
+				const durable = await ctx.sessions.flush(agent.session);
+				runtime.setDurability(durable);
+				runtime.sync();
+				return durable;
+			}
+		}));
+		agent.ctx.tools.register(createInterpretTool({
+			getProjection: () => runtime.projection,
+			refreshProjection: async () => {
+				const durable = await ctx.sessions.flush(agent.session);
+				runtime.setDurability(durable);
+				runtime.sync();
+				return durable;
+			}
+		}));
+		agent.ctx.tools.register(createReleaseTool({
+			getProjection: () => runtime.projection,
+			fetcher: evidenceOptions.fetcher,
+			...evidenceOptions.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
+			persistSettlement: async (request) => persistReleaseRecord(request.agent, RELEASE_SETTLEMENT_PREFIX, {
+				contractId: request.contractId,
+				operation: request.operation,
+				callId: request.callId,
+				settledAtSeq: 0,
+				readback: request.readback,
+				outcome: request.outcome
+			})
 		}));
 		agent.ctx.tools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
 		agent.ctx.tools.guard((exec) => goalCompletionDenial(runtime.projection, exec.name, exec.arguments));
@@ -4108,12 +5158,14 @@ function apply(ctx, rawConfig = {}) {
 		if (decision.kind !== "enter") return decision;
 		const injected = [];
 		const delegated = isDelegatedSession(agent.session);
-		let boundaryPending = !runtime.protocolV4Present;
+		let boundaryPending = !runtime.protocolV5Present;
 		const firstStep = previewFirstStepInjection({
 			activation: config.activation,
 			enabled: runtime.projection.enabled,
+			boundaryV5Present: runtime.protocolV5Present,
 			boundaryPresent: runtime.protocolV4Present,
-			delegated
+			delegated,
+			policy: runtime.projection.policy
 		}, claimedBatchHasRealRootInput(decision.messages));
 		if (firstStep) {
 			injected.push(pluginNoticeMessage(firstStep.boundary, "Context Guard recorded a replay version boundary"));
@@ -4128,7 +5180,7 @@ function apply(ctx, rawConfig = {}) {
 			if (recovery && digest$2 !== runtime.projection.lastRecoveryDigest) {
 				runtime.projection.lastRecoveryDigest = digest$2;
 				if (boundaryPending && !delegated) {
-					injected.push(pluginNoticeMessage(PROTOCOL_V4_NOTICE, "Context Guard recorded a replay version boundary"));
+					injected.push(pluginNoticeMessage(PROTOCOL_V5_NOTICE, "Context Guard recorded a replay version boundary"));
 					boundaryPending = false;
 				}
 				injected.push(createUserMessage({
@@ -4272,4 +5324,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };