enigma-memory 0.1.13 → 0.1.14

package/scripts/build-installer-assets.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 
 export const INSTALLER_ASSET_SCHEMA = 'enigma.installer_assets.v1';
 export const INSTALLER_ASSET_PACKAGE = 'enigma-memory';
-export const INSTALLER_ASSET_VERSION = '0.1.13';
+export const INSTALLER_ASSET_VERSION = '0.1.14';
 export const INSTALLER_ASSET_GENERATED_AT = '1970-01-01T00:00:00.000Z';
 
 const SCRIPT_PATH = fileURLToPath(import.meta.url);
@@ -94,14 +94,48 @@ function assertPublicSafe(content, label = 'asset') {
 }
 
 function windowsInstallerScript() {
-  return `# Enigma Memory source installer for Windows PowerShell.\n# Dry-run is the default; pass -Execute to mutate global npm state and create local quickstart files.\nparam(\n  [switch]$Execute,\n  [string]$Bundle = '.\\.enigma\\bundle.json'\n)\n$ErrorActionPreference = 'Stop'\n$PackageName = '${INSTALLER_ASSET_PACKAGE}'\n\nWrite-Output 'Enigma Memory Windows installer source asset'\nWrite-Output 'Default mode: dry-run. No native .exe, code-signing, tokens, or hosted credentials are included.'\nWrite-Output "Package: $PackageName"\nWrite-Output "Bundle: $Bundle"\n\n$steps = @(\n  'npm install -g enigma-memory',\n  'enigma quickstart --bundle <bundle> --overwrite',\n  'enigma doctor'\n)\n\nif (-not $Execute) {\n  Write-Output 'Preview only. Re-run with -Execute after reviewing these steps.'\n  $steps | ForEach-Object { Write-Output "DRY-RUN: $_" }\n  exit 0\n}\n\nnpm install -g $PackageName\nenigma quickstart --bundle $Bundle --overwrite\nenigma doctor\n`;
+  return `# Enigma Memory source installer for Windows PowerShell.
+# Dry-run is the default; pass -Execute to mutate global npm state and create local setup files.
+param(
+  [switch]$Execute,
+  [string]$Bundle = '.\\.enigma\\bundle.json'
+)
+$ErrorActionPreference = 'Stop'
+$PackageName = '${INSTALLER_ASSET_PACKAGE}'
+$NextClientConnect = 'enigma connect <client> --dry-run'
+
+Write-Output 'Enigma Memory Windows installer source asset'
+Write-Output 'Default mode: dry-run. No native .exe, code-signing, tokens, or hosted credentials are included.'
+Write-Output "Package: $PackageName"
+Write-Output "Bundle: $Bundle"
+
+$steps = @(
+  'npm install -g enigma-memory',
+  'enigma test-drive --dry-run',
+  'enigma setup --bundle <bundle> --overwrite',
+  'enigma doctor',
+  "Next client-connect preview: $NextClientConnect"
+)
+
+if (-not $Execute) {
+  Write-Output 'Preview only. Re-run with -Execute after reviewing these steps.'
+  $steps | ForEach-Object { Write-Output "DRY-RUN: $_" }
+  exit 0
+}
+
+npm install -g $PackageName
+enigma test-drive --dry-run
+enigma setup --bundle $Bundle --overwrite
+enigma doctor
+Write-Output "Next client-connect preview: $NextClientConnect"
+`;
 }
 
 function linuxInstallerScript() {
   return [
     '#!/usr/bin/env sh',
     '# Enigma Memory source installer for Linux.',
-    '# Dry-run is the default; pass --execute to mutate global npm state and create local quickstart files.',
+    '# Dry-run is the default; pass --execute to mutate global npm state and create local setup files.',
     'set -eu',
     '',
     'execute=0',
@@ -112,7 +146,7 @@ function linuxInstallerScript() {
     '    --dry-run) execute=0 ;;',
     '    --bundle) shift; bundle="${1:-}" ;;',
     '    --help|-h)',
-    "      printf '%s\\n' 'Usage: ./install-linux.sh [--execute] [--bundle ./.enigma/bundle.json]'",
+    "      printf '%s\\n' 'Usage: ./install-linux.sh [--execute|--dry-run] [--bundle ./.enigma/bundle.json]'",
     '      exit 0',
     '      ;;',
     '    *)',
@@ -124,6 +158,7 @@ function linuxInstallerScript() {
     'done',
     '',
     `package='${INSTALLER_ASSET_PACKAGE}'`,
+    "next_client_connect='enigma connect <client> --dry-run'",
     "printf '%s\\n' 'Enigma Memory Linux installer source asset'",
     "printf '%s\\n' 'Default mode: dry-run. No native package, signing key, tokens, or hosted credentials are included.'",
     'printf \'%s\\n\' "Package: $package"',
@@ -132,24 +167,86 @@ function linuxInstallerScript() {
     'if [ "$execute" -ne 1 ]; then',
     "  printf '%s\\n' 'Preview only. Re-run with --execute after reviewing these steps.'",
     "  printf '%s\\n' 'DRY-RUN: npm install -g enigma-memory'",
-    "  printf '%s\\n' 'DRY-RUN: enigma quickstart --bundle <bundle> --overwrite'",
+    "  printf '%s\\n' 'DRY-RUN: enigma test-drive --dry-run'",
+    "  printf '%s\\n' 'DRY-RUN: enigma setup --bundle <bundle> --overwrite'",
     "  printf '%s\\n' 'DRY-RUN: enigma doctor'",
+    '  printf \'%s\\n\' "DRY-RUN: Next client-connect preview: $next_client_connect"',
     '  exit 0',
     'fi',
     '',
     'npm install -g "$package"',
-    'enigma quickstart --bundle "$bundle" --overwrite',
+    'enigma test-drive --dry-run',
+    'enigma setup --bundle "$bundle" --overwrite',
     'enigma doctor',
+    'printf \'%s\\n\' "Next client-connect preview: $next_client_connect"',
     '',
   ].join('\n');
 }
 
 function homebrewFormulaDraft() {
-  return `# Draft only. This formula is not submitted to a Homebrew tap by this generator.\n# Release engineering must replace the tarball URL and sha256 after a real source archive exists.\nclass EnigmaMemory < Formula\n  desc "Provider-agnostic AI memory passport and offline-verifiable proof layer"\n  homepage "https://github.com/Enigma-Memory/enigma-memory"\n  url "https://example.invalid/enigma-memory-${INSTALLER_ASSET_VERSION}.tar.gz"\n  sha256 "REPLACE_WITH_RELEASE_TARBALL_SHA256"\n  license "Apache-2.0"\n\n  depends_on "node"\n\n  def install\n    system "npm", "install", *Language::Node.local_npm_install_args\n    bin.install_symlink libexec/"bin/enigma"\n    bin.install_symlink libexec/"bin/enigma-verify"\n    bin.install_symlink libexec/"bin/enigma-mcp"\n    bin.install_symlink libexec/"bin/enigma-relay"\n    bin.install_symlink libexec/"bin/enigma-gateway"\n    bin.install_symlink libexec/"bin/enigma-native-host"\n  end\n\n  test do\n    assert_match "enigma", shell_output("#{bin}/enigma --help")\n  end\nend\n`;
+  return `# Draft only. This formula is not submitted to a Homebrew tap by this generator.
+# Release engineering must replace the tarball URL and sha256 after a real source archive exists.
+# Post-install smoke path:
+#   enigma test-drive --dry-run
+#   enigma setup --overwrite
+#   enigma doctor
+#   enigma connect <client> --dry-run
+class EnigmaMemory < Formula
+  desc "Provider-agnostic AI memory passport and offline-verifiable proof layer"
+  homepage "https://github.com/Enigma-Memory/enigma-memory"
+  url "https://example.invalid/enigma-memory-${INSTALLER_ASSET_VERSION}.tar.gz"
+  sha256 "REPLACE_WITH_RELEASE_TARBALL_SHA256"
+  license "Apache-2.0"
+
+  depends_on "node"
+
+  def install
+    system "npm", "install", *Language::Node.local_npm_install_args
+    bin.install_symlink libexec/"bin/enigma"
+    bin.install_symlink libexec/"bin/enigma-verify"
+    bin.install_symlink libexec/"bin/enigma-mcp"
+    bin.install_symlink libexec/"bin/enigma-relay"
+    bin.install_symlink libexec/"bin/enigma-gateway"
+    bin.install_symlink libexec/"bin/enigma-native-host"
+  end
+
+  test do
+    assert_match "enigma", shell_output("#{bin}/enigma --help")
+    assert_match "enigma.test_drive.v1", shell_output("#{bin}/enigma test-drive --dry-run")
+    assert_match "enigma.setup.v1", shell_output("#{bin}/enigma setup --dry-run")
+    shell_output("#{bin}/enigma doctor")
+    puts "Next client-connect preview: enigma connect <client> --dry-run"
+  end
+end
+`;
 }
 
 function macosPkgReadme() {
-  return `# macOS pkgbuild source manifest\n\nThis directory is an honest source plan for a future macOS package. It is not a signed .pkg and it does not claim notarization.\n\nCurrent supported path:\n\n\`\`\`sh\nnpm install -g ${INSTALLER_ASSET_PACKAGE}\nenigma quickstart --bundle ./.enigma/bundle.json --overwrite\nenigma doctor\n\`\`\`\n\nBlockers before shipping a native .pkg:\n\n- A reproducible package staging tree for the npm-installed command shims.\n- macOS pkgbuild/productbuild tooling on a macOS release runner.\n- Developer ID Installer certificate, signing identity selection, and notarization workflow.\n- Human review that package scripts do not print local absolute paths, credentials, account identifiers, raw memory, or provider transcripts.\n\nThe generated JSON manifest in this directory records those blockers explicitly.\n`;
+  return `# macOS pkgbuild source manifest
+
+This directory is an honest source plan for a future macOS package. It is not a signed .pkg and it does not claim notarization.
+
+Current supported path:
+
+\`\`\`sh
+npm install -g ${INSTALLER_ASSET_PACKAGE}
+enigma test-drive --dry-run
+enigma setup --overwrite
+enigma doctor
+enigma connect <client> --dry-run
+\`\`\`
+
+\`enigma connect <client> --dry-run\` is the next client-connect preview command. Remove \`--dry-run\` only after reviewing the planned client config change.
+
+Blockers before shipping a native .pkg:
+
+- A reproducible package staging tree for the npm-installed command shims.
+- macOS pkgbuild/productbuild tooling on a macOS release runner.
+- Developer ID Installer certificate, signing identity selection, and notarization workflow.
+- Human review that package scripts do not print local absolute paths, credentials, account identifiers, raw memory, or provider transcripts.
+
+The generated JSON manifest in this directory records those blockers explicitly.
+`;
 }
 
 function macosPkgManifest() {
@@ -159,13 +256,19 @@ function macosPkgManifest() {
     version: INSTALLER_ASSET_VERSION,
     generated_native_pkg: false,
     source_only: true,
-    package_id: 'ai.enigma.memory',
+    package_id: '<reverse-dns-package-id>',
     install_prefix: '<homebrew-or-npm-managed-prefix>',
     commands: [
       ['npm', 'install', '-g', INSTALLER_ASSET_PACKAGE],
-      ['enigma', 'quickstart', '--bundle', '<bundle-path>', '--overwrite'],
+      ['enigma', 'test-drive', '--dry-run'],
+      ['enigma', 'setup', '--overwrite'],
       ['enigma', 'doctor'],
     ],
+    next_client_connect: ['enigma', 'connect', '<client>', '--dry-run'],
+    execution_gate: {
+      default_mode: 'dry-run',
+      mutation_requires: ['--execute', '-Execute'],
+    },
     blockers: [
       { code: 'MACOS_PKGBUILD_TOOLING_REQUIRED', message: 'pkgbuild/productbuild must run on a macOS release runner.' },
       { code: 'MACOS_SIGNING_REQUIRED', message: 'A Developer ID Installer certificate and notarization workflow are required before distributing a .pkg.' },
@@ -215,10 +318,23 @@ export function buildInstallerAssets(options = {}, runtime = {}) {
     generated_native_installers: false,
     files,
     native_installers: nativeInstallerBlockers(runtime.tooling),
+    installer_smoke: {
+      default_preview_commands: [
+        'npm install -g enigma-memory',
+        'enigma test-drive --dry-run',
+        'enigma setup --overwrite',
+        'enigma doctor',
+      ],
+      next_client_connect: 'enigma connect <client> --dry-run',
+      mutation_requires: ['--execute', '-Execute'],
+    },
     safety: {
       embeds_tokens: false,
       embeds_local_absolute_paths: false,
       embeds_raw_memory: false,
+      embeds_account_ids: false,
+      embeds_provider_responses: false,
+      embeds_private_keys: false,
       default_dry_run: true,
       requires_write_flag_for_filesystem_mutation: true,
     },

package/scripts/build-production-handoff-packet.mjs

@@ -344,6 +344,13 @@ export async function buildProductionHandoffPacket(input = {}, options = {}) {
   const liveUrl = optionalText(input.liveUrl, domain ? `https://${domain}/` : null);
   const expectTitle = optionalText(input.expectTitle, 'Enigma');
 
+  const providedInfrastructure = requireInfrastructureReadinessResult(await loadInfrastructureReadiness(input));
+  const operatorPacket = await loadOperatorAcceptancePacket(input) ?? await buildOperatorAcceptancePacket({ generated_at: generatedAt });
+  assertNoSecretOutput('operator acceptance packet', operatorPacket);
+  const operatorAcceptance = validateOperatorAcceptancePacket(operatorPacket, { generated_at: generatedAt });
+  if (operatorAcceptance.ok === true) requireInfrastructureReadinessResult(operatorPacket.readiness);
+  const providedReleaseAudit = requireReleaseAuditResult(await loadReleaseAudit(input));
+
   const pages = await buildCloudflarePagesReleasePacket({
     site,
     projectName,
@@ -356,7 +363,6 @@ export async function buildProductionHandoffPacket(input = {}, options = {}) {
     fetchImpl: options.fetchImpl ?? globalThis.fetch,
   });
 
-  const providedInfrastructure = requireInfrastructureReadinessResult(await loadInfrastructureReadiness(input));
   const infrastructure = providedInfrastructure ?? await runInfrastructureReadiness({
     manifest: await buildProductionReadinessManifest({
       env,
@@ -369,11 +375,6 @@ export async function buildProductionHandoffPacket(input = {}, options = {}) {
     now: new Date(generatedAt),
     fetchImpl: options.fetchImpl ?? globalThis.fetch,
   });
-  const operatorPacket = await loadOperatorAcceptancePacket(input) ?? await buildOperatorAcceptancePacket({ generated_at: generatedAt });
-  assertNoSecretOutput('operator acceptance packet', operatorPacket);
-  const operatorAcceptance = validateOperatorAcceptancePacket(operatorPacket, { generated_at: generatedAt });
-  if (operatorAcceptance.ok === true) requireInfrastructureReadinessResult(operatorPacket.readiness);
-  const providedReleaseAudit = requireReleaseAuditResult(await loadReleaseAudit(input));
 
   const hostedProbe = buildHostedProbeWorkerBundle({ generated_at: generatedAt });
   const pageSummary = summarizePages(pages);

package/scripts/build-production-unblocker.mjs

@@ -0,0 +1,409 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const PRODUCTION_UNBLOCKER_SCHEMA = 'enigma.production_unblocker.v1';
+export const CURRENT_PUBLIC_PACKAGE_VERSION = '0.1.13';
+
+const STATUS_VALUES = Object.freeze([
+  'ready_now',
+  'contract_ready',
+  'blocked_external_dependency',
+  'operator_evidence_required',
+]);
+
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|cf-[A-Za-z0-9_-]{12,})/iu;
+const LOCAL_PATH_RE = /(?<![A-Za-z])(?:[A-Za-z]:[\\/]|\\\\[^\\/]+[\\/][^\\/]+|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\/[^\s"']+)/u;
+const FORBIDDEN_KEY_RE = /(?:password|passwd|pwd|api[_-]?key|private[_-]?key|secret|token|account[_-]?id|raw[_-]?memory|plaintext|plain[_-]?text|prompt|completion|transcript|embedding|provider[_-]?response|cookie|session|seed|mnemonic|wallet[_-]?private|private[_-]?path|customer[_-]?name|tenant[_-]?name)/iu;
+const SAFE_FIELD_NAMES = new Set([
+  'credentials_required',
+  'credentials_used',
+  'requires_credentials',
+  'secret_values_printed',
+  'transaction_submitted',
+  'raw_memory_on_chain',
+  'raw_memory_in_public_artifacts',
+  'hosted_saas_live',
+  'hosted_cloud_live_claim',
+  'solana_mainnet_live_claim',
+  'solana_transaction_claim',
+  'provider_response_claim',
+  'model_forgetting_claim',
+  'provider_deletion_claim',
+  'benchmark_leadership_claim',
+  'token_roi_claim',
+  'token_profit_claim',
+  'provider_invoice_savings_claim',
+  'external_provider_called',
+]);
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function assertPublicSafe(value, path = 'production_unblocker') {
+  if (typeof value === 'string') {
+    if (SECRET_VALUE_RE.test(value)) throw new Error(`${path} contains secret-looking material`);
+    if (LOCAL_PATH_RE.test(value)) throw new Error(`${path} contains a local absolute path`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertPublicSafe(item, `${path}[${index}]`));
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    if (FORBIDDEN_KEY_RE.test(key) && !SAFE_FIELD_NAMES.has(key)) throw new Error(`${path}.${key} is not allowed in public production unblocker input`);
+    assertPublicSafe(child, `${path}.${key}`);
+  }
+}
+
+function publicPackageSummary(packageJson = {}, options = {}) {
+  const bins = isPlainObject(packageJson.bin) ? Object.keys(packageJson.bin).sort() : [];
+  const sourceVersion = typeof packageJson.version === 'string' ? packageJson.version : null;
+  const currentPublicVersion = typeof options.currentPublicVersion === 'string' ? options.currentPublicVersion : CURRENT_PUBLIC_PACKAGE_VERSION;
+  return {
+    name: typeof packageJson.name === 'string' ? packageJson.name : 'enigma-memory',
+    version: sourceVersion,
+    source_version: sourceVersion,
+    current_public_version: currentPublicVersion,
+    node: typeof packageJson.engines?.node === 'string' ? packageJson.engines.node : '>=24',
+    bins,
+  };
+}
+
+const ALLOWED_INPUT_KEYS = new Set(['packageJson', 'currentPublicVersion', 'evidence']);
+
+function assertKnownInputs(inputs) {
+  if (!isPlainObject(inputs)) throw new Error('production unblocker inputs must be an object');
+  for (const key of Object.keys(inputs)) {
+    if (!ALLOWED_INPUT_KEYS.has(key)) throw new Error(`unsupported production unblocker input field: ${key}`);
+  }
+}
+
+
+function command(id, purpose, value, options = {}) {
+  return {
+    id,
+    purpose,
+    command: value,
+    mode: options.mode ?? 'dry_run_or_planning',
+    requires_credentials: options.requires_credentials === true,
+    mutates_external_systems: options.mutates_external_systems === true,
+  };
+}
+
+function section(id, title, status, summary, details) {
+  if (!STATUS_VALUES.includes(status)) throw new Error(`invalid unblocker status for ${id}`);
+  return {
+    id,
+    title,
+    status,
+    summary,
+    evidence_available: details.evidence_available ?? [],
+    blockers: details.blockers ?? [],
+    non_claims: details.non_claims ?? [],
+    next_commands: details.next_commands ?? [],
+  };
+}
+
+function buildSections(packageSummary) {
+  const packageRef = `${packageSummary.name}@${packageSummary.version ?? '<version>'}`;
+  return [
+    section(
+      'npm_install_readiness',
+      'npm install readiness',
+      'ready_now',
+      'The npm install path is the current supported production install tier; this report distinguishes the current public package from the local source release candidate.',
+      {
+        evidence_available: [
+          `Current public install baseline: ${packageSummary.name}@${packageSummary.current_public_version}.`,
+          `Local source release candidate: ${packageSummary.name}@${packageSummary.source_version ?? '<unknown>'}.`,
+          `Package metadata requires Node ${packageSummary.node}.`,
+          `CLI bins listed in package metadata: ${packageSummary.bins.join(', ') || 'none listed'}.`,
+        ],
+        blockers: [],
+        non_claims: [
+          'npm install readiness does not mean the source release candidate has already been published.',
+          'Installing the package does not make hosted cloud live.',
+          'Installing the package does not submit Solana transactions.',
+          'Installing the package does not prove provider deletion, model forgetting, compliance, ROI, or provider invoice savings.',
+        ],
+        next_commands: [
+          command('build-unblocker-report', 'Regenerate this consolidated public-safe unblocker report.', 'npm run production:unblocker -- --out .enigma/production-unblocker.json'),
+          command('registry-install-plan-current', 'Validate the current public registry install plan without network install.', `npm run registry:verify -- --package ${packageSummary.name} --version ${packageSummary.current_public_version} --skip-network`),
+          command('registry-install-execute-current', 'Collect real current public registry install evidence in an isolated temporary prefix.', `npm run registry:verify -- --package ${packageSummary.name} --version ${packageSummary.current_public_version} --execute`, { mode: 'explicit_execute_network', mutates_external_systems: false }),
+          command('registry-install-execute-candidate', 'After release publication only, collect registry install evidence for the local source release candidate.', `npm run registry:verify -- --package ${packageSummary.name} --version ${packageSummary.source_version ?? '<candidate-version>'} --execute`, { mode: 'explicit_execute_network_after_publish', mutates_external_systems: false }),
+        ],
+      },
+    ),
+    section(
+      'hosted_cloud_external_blockers',
+      'Hosted cloud external blockers',
+      'blocked_external_dependency',
+      'Hosted-cloud package contracts exist, but sellable hosted SaaS remains blocked on real provider wiring, legal/security approvals, operations ownership, and operator go-live evidence.',
+      {
+        evidence_available: [
+          'Hosted-cloud builders and validators can produce public-safe customer lifecycle and API-key lifecycle packets.',
+          'Operator evidence starter and backend env kit commands can generate templates and public-safe fill plans.',
+        ],
+        blockers: [
+          'Auth provider, billing provider, legal terms, data-processing terms, support ownership, and external security review evidence are not created by the package.',
+          'Hosted relay/gateway/storage/KMS/SIEM/backup/monitoring/domain/TLS evidence must be supplied by an operator.',
+          'Operator go-live approval is required before hosted_cloud_sellable can be true.',
+        ],
+        non_claims: [
+          'No hosted account, customer tenant, customer API key, invoice, support ticket, Cloudflare resource, provider resource, or deployment is created by this report.',
+          'Contract readiness is not live hosted SaaS readiness.',
+        ],
+        next_commands: [
+          command('operator-evidence-starter', 'Generate public-safe hosted evidence templates and fill order.', 'npm run production:evidence-starter -- --out-dir .enigma/operator-evidence --domain enigmamemory.com --tenant <tenant-id>'),
+          command('backend-env-kit', 'Generate the backend environment kit and public summary for operator completion outside public artifacts.', 'npm run production:backend-env -- --out-dir .enigma/backend-env-kit --domain enigmamemory.com --tenant <tenant-id> --environment production'),
+          command('hosted-live-validate', 'Validate completed hosted live evidence after real operator refs exist.', 'npm run production:hosted-live -- --evidence .enigma/operator-evidence/hosted-backend-live.json', { mode: 'operator_evidence_validation' }),
+          command('hosted-customer-lifecycle', 'Build hosted customer lifecycle contract evidence from public-safe refs.', 'npm run production:hosted-customer -- --tenant <tenant-id> --domain enigmamemory.com --environment production --out .enigma/hosted-customer-lifecycle.json'),
+          command('hosted-api-key-lifecycle', 'Build customer API-key lifecycle contract evidence from refs, not key material.', 'npm run production:hosted-api-key -- --tenant <tenant-id> --subject <opaque-subject-ref> --operation issue --out .enigma/hosted-api-key-lifecycle.json'),
+        ],
+      },
+    ),
+    section(
+      'solana_proof_rail_status',
+      'Solana proof rail status',
+      'contract_ready',
+      'The proof rail is local planning and verification: artifacts are Solana-ready commitments, not submitted transactions or live mainnet infrastructure.',
+      {
+        evidence_available: [
+          'Local chain CLI commands create anchor, grant, revocation, benchmark-attestation, and verification artifacts with transaction_submitted:false.',
+          'The proof packet builder hashes benchmark reports and emits public-safe proof-network packets.',
+        ],
+        blockers: [
+          'Devnet/mainnet program deployment, transaction submission, program security review, governance, indexer evidence, and operational ownership are separate external work.',
+          'Any future network mutation must be explicit and must not be implied by local planning artifacts.',
+        ],
+        non_claims: [
+          'No Solana transaction is submitted by this report or by default local proof commands.',
+          'Raw memory is not placed on-chain.',
+          'No token ROI, profit, provider invoice savings, provider deletion, model-forgetting, compliance, or hosted SaaS claim is created by proof artifacts.',
+        ],
+        next_commands: [
+          command('chain-attest-local', 'Create a local benchmark attestation from a reviewed report hash/file and public refs.', `enigma chain attest --report-file .enigma/standard-memory-benchmark-sample.json --dataset-ref sha256:<dataset-manifest-hash> --runner-ref run-standard-memory-benchmarks.mjs@<reviewed-revision> --package-ref ${packageRef} --score retrieval_evidence_proxy=<value-copied-from-report> --out .enigma/standard-memory-benchmark-attestation.json`),
+          command('chain-verify-local', 'Verify a local proof-network artifact offline.', 'enigma chain verify --file .enigma/standard-memory-benchmark-attestation.json'),
+          command('proof-packet-local', 'Bundle public-safe roots and a benchmark report hash into a local proof packet.', 'npm run proof:packet -- --active-root sha256:<active-root> --receipt-root sha256:<receipt-root> --benchmark-report .enigma/standard-memory-benchmark-sample.json --dataset-hash sha256:<dataset-manifest-hash> --runner-hash sha256:<runner-hash> --operator-ref operator:<public-ref> --out .enigma/proof-network-packet.json'),
+        ],
+      },
+    ),
+    section(
+      'benchmark_claim_status',
+      'Benchmark claim status',
+      'operator_evidence_required',
+      'Local and official-dataset retrieval/evidence proxy benchmark commands exist; public claims require exact report, dataset manifest, runner/package refs, and claim-boundary review.',
+      {
+        evidence_available: [
+          'The local deterministic memory suite can produce enigma.memory_benchmark_suite.v1 without provider credentials.',
+          'The standard runner can score local LoCoMo/LongMemEval files as retrieval/evidence proxy evidence only.',
+        ],
+        blockers: [
+          'Official dataset files and hashes must be collected locally before standard benchmark claims.',
+          'Provider answer-accuracy, competitor, leaderboard, savings, compliance, model-forgetting, and provider-deletion claims require separate reviewed runs and are not present by default.',
+        ],
+        non_claims: [
+          'No provider API, hosted memory service, competitor SDK, ChatGPT native memory, or Claude memory tool is called by the local default benchmark paths.',
+          'Retrieval/evidence proxy metrics are not LLM answer accuracy or benchmark leadership.',
+        ],
+        next_commands: [
+          command('benchmark-dataset-plan', 'Preview dataset fetches without downloading raw data.', 'npm run benchmark:datasets -- --dry-run'),
+          command('benchmark-dataset-download', 'Download supported official datasets and write a public-safe manifest.', 'npm run benchmark:datasets -- --execute --dataset all --out-dir .enigma/benchmarks/datasets --manifest .enigma/benchmarks/dataset-manifest.json', { mode: 'explicit_execute_network' }),
+          command('benchmark-standard-sample', 'Run a bounded standard retrieval/evidence proxy benchmark from local dataset files.', 'npm run benchmark:standard -- --locomo .enigma/benchmarks/datasets/locomo10.json --longmemeval .enigma/benchmarks/datasets/longmemeval_s_cleaned.json --max-locomo-qa 25 --max-longmemeval-items 25 --top-k 5 --out .enigma/standard-memory-benchmark-sample.json'),
+          command('benchmark-local-suite', 'Run the local deterministic package benchmark suite.', 'npm run benchmark:memory-suite -- --out .enigma/memory-benchmark-suite.json'),
+        ],
+      },
+    ),
+    section(
+      'installer_distribution_status',
+      'Installer distribution status',
+      'blocked_external_dependency',
+      'npm is the production install tier now; native signed installer distribution remains blocked on external signing, notarization, release runners, and review evidence.',
+      {
+        evidence_available: [
+          'The installer asset generator can produce reviewable source installer assets with dry-run/planning defaults.',
+          'Generated source installer assets do not by themselves publish a Homebrew tap, signed Windows executable, or signed/notarized macOS package.',
+        ],
+        blockers: [
+          'Windows distribution needs installer builder selection, code-signing certificate, signing workflow, and release review.',
+          'macOS distribution needs package build runner, Developer ID Installer certificate, notarization workflow, and release review.',
+          'Homebrew distribution needs a real release archive URL/SHA and tap workflow approval.',
+        ],
+        non_claims: [
+          'No signed native installer exists from this report.',
+          'Installer source assets are not a completed OS-native distribution channel.',
+        ],
+        next_commands: [
+          command('installer-assets-preview', 'Preview reviewable installer source assets.', 'npm run installer:assets -- --out-dir dist/installer-assets'),
+          command('installer-assets-write', 'Write reviewable installer source assets for release engineering.', 'npm run installer:assets -- --out-dir dist/installer-assets --write', { mode: 'local_write_explicit' }),
+        ],
+      },
+    ),
+    section(
+      'monitoring_ops_status',
+      'Monitoring and operations status',
+      'operator_evidence_required',
+      'Ops validators and dry-run monitors exist, but production monitoring, alert routing, backup/restore, incident drill, support/SLA, and acceptance evidence must be supplied by operators.',
+      {
+        evidence_available: [
+          'Live endpoint monitoring has a dry-run mode and public-safe endpoint constraints.',
+          'Production validators exist for monitoring/alerting, backup/restore drill, incident drill, support/SLA, legal/compliance, network, KMS, usage, settlement, site security, and threat model evidence.',
+        ],
+        blockers: [
+          'Monitoring provider, alert routing, on-call ownership, incident commander, support escalation, backup target, restore rehearsal, and legal/security approvals are external operator evidence.',
+          'Public site health is not hosted backend readiness; relay/gateway readiness requires exact live endpoint and operator acceptance evidence.',
+        ],
+        non_claims: [
+          'Dry-run monitoring does not prove future availability or contractual SLA performance.',
+          'Validator acceptance of a ref packet is not a compliance certification.',
+        ],
+        next_commands: [
+          command('live-monitor-dry-run', 'Validate default public endpoint monitor configuration without network probes.', 'npm run production:live-monitor:dry-run'),
+          command('live-monitor-public-safe', 'Collect live endpoint monitoring evidence only after endpoints are intentionally public and secret-free.', 'npm run production:live-monitor -- --endpoint public_site=https://enigmamemory.com/ --endpoint relay_readyz=https://relay.enigmamemory.com/readyz --endpoint gateway_readyz=https://gateway.enigmamemory.com/readyz --out .enigma/live-endpoint-monitor.json', { mode: 'operator_network_observation' }),
+          command('monitoring-validator', 'Validate operator monitoring/alerting evidence packet.', 'npm run production:monitoring -- --monitoring .enigma/operator-evidence/monitoring-alerting.json --out .enigma/monitoring-alerting-result.json', { mode: 'operator_evidence_validation' }),
+          command('backup-drill-validator', 'Validate operator backup/restore drill evidence packet.', 'npm run production:backup-drill -- --drill .enigma/operator-evidence/backup-restore-drill.json --out .enigma/backup-restore-drill-result.json', { mode: 'operator_evidence_validation' }),
+          command('incident-drill-validator', 'Validate operator incident drill evidence packet.', 'npm run production:incident-drill -- --drill .enigma/operator-evidence/incident-drill.json --out .enigma/incident-drill-result.json', { mode: 'operator_evidence_validation' }),
+        ],
+      },
+    ),
+  ];
+}
+
+function statusCounts(sections) {
+  const counts = Object.fromEntries(STATUS_VALUES.map((status) => [status, 0]));
+  for (const item of sections) counts[item.status] += 1;
+  return counts;
+}
+
+function flattenCommands(sections) {
+  return sections.flatMap((item) => item.next_commands.map((entry) => ({ section: item.id, ...entry })));
+}
+
+export function buildProductionUnblocker(inputs = {}, options = {}) {
+  assertKnownInputs(inputs);
+  if (inputs.evidence !== undefined) assertPublicSafe(inputs.evidence, 'production_unblocker.evidence');
+  const generatedAt = options.generated_at ?? options.generatedAt ?? new Date().toISOString();
+  const packageSummary = publicPackageSummary(inputs.packageJson ?? {}, { currentPublicVersion: inputs.currentPublicVersion ?? options.current_public_version ?? options.currentPublicVersion });
+  const sections = buildSections(packageSummary);
+  const blockers = sections.flatMap((item) => item.blockers.map((blocker) => ({ section: item.id, status: item.status, blocker })));
+  const report = {
+    schema: PRODUCTION_UNBLOCKER_SCHEMA,
+    generated_at: generatedAt,
+    mode: 'dry_run_planning',
+    credentials_required: false,
+    credentials_used: false,
+    mutates_external_systems: false,
+    overall_status: blockers.length === 0 ? 'ready_now' : 'blocked_external_dependency',
+    package: packageSummary,
+    status_legend: {
+      ready_now: 'Usable now within the stated local/package boundary.',
+      contract_ready: 'Interfaces, validators, or local planning artifacts exist, but live external operation is not claimed.',
+      blocked_external_dependency: 'External provider, credential, signing, deployment, legal, security, or operator system is required.',
+      operator_evidence_required: 'The repository supplies the command or validator, but an operator must provide current public-safe evidence.',
+    },
+    status_counts: statusCounts(sections),
+    sections,
+    go_live_blockers: blockers,
+    operator_next_commands: flattenCommands(sections),
+    live_claims: {
+      hosted_saas_live: false,
+      hosted_cloud_live_claim: false,
+      solana_mainnet_live_claim: false,
+      solana_transaction_claim: false,
+      transaction_submitted: false,
+      raw_memory_on_chain: false,
+      raw_memory_in_public_artifacts: false,
+      external_provider_called: false,
+      provider_response_claim: false,
+      model_forgetting_claim: false,
+      provider_deletion_claim: false,
+      benchmark_leadership_claim: false,
+      token_roi_claim: false,
+      token_profit_claim: false,
+      provider_invoice_savings_claim: false,
+    },
+    claim_boundary: [
+      'This report is public-safe planning evidence. It does not publish, deploy, create accounts, submit transactions, create credentials, call model providers, or mutate external systems.',
+      'ready_now means ready within the named local/package boundary only; it does not imply hosted SaaS, Solana mainnet, benchmark leadership, compliance, provider deletion, model forgetting, ROI, profit, or provider invoice savings.',
+      'contract_ready means schemas, validators, CLI planning, or local proof artifacts exist; an operator must still supply external evidence before live or sellable claims.',
+      'Commands marked explicit_execute_network or operator_network_observation should only be run by an operator with approval for that environment.',
+    ],
+  };
+  assertPublicSafe(report);
+  return report;
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    out: null,
+    generatedAt: null,
+    help: false,
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === '--help' || token === '-h') {
+      args.help = true;
+      continue;
+    }
+    const readValue = () => {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value.length === 0 || value.startsWith('--')) throw new UsageError(`${token} requires a value`);
+      index += 1;
+      return value;
+    };
+    if (token === '--out') args.out = readValue();
+    else if (token === '--generated-at' || token === '--generatedAt') args.generatedAt = readValue();
+    else throw new UsageError(`unknown production unblocker option: ${token}`);
+  }
+  return args;
+}
+
+function usage() {
+  return `Usage: node scripts/build-production-unblocker.mjs [--out <file>] [--generated-at <iso>]
+
+Builds a dependency-free public-safe production unblocker report. The command is dry-run/planning by default: it requires no credentials, does not publish, does not deploy, does not submit Solana transactions, does not call providers, and does not mutate external systems.
+`;
+}
+
+async function readPackageJson() {
+  const packageUrl = new URL('../package.json', import.meta.url);
+  try {
+    return JSON.parse(await readFile(packageUrl, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) return { text: usage(), code: 0 };
+  const report = buildProductionUnblocker({ packageJson: await readPackageJson() }, { generated_at: args.generatedAt ?? new Date().toISOString() });
+  const text = `${JSON.stringify(report, null, 2)}\n`;
+  if (args.out) {
+    const outPath = resolve(args.out);
+    await mkdir(dirname(outPath), { recursive: true });
+    await writeFile(outPath, text, 'utf8');
+  }
+  return { text, code: 0 };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().then(({ text, code }) => {
+    process.stdout.write(text);
+    process.exitCode = code;
+  }).catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message ?? 'failed to build production unblocker'}\n`);
+    process.exitCode = 2;
+  });
+}