enigma-memory 0.1.16 → 0.1.17

package/packages/proof-network/src/index.js

@@ -5,12 +5,16 @@ export const PROOF_NETWORK_CAPABILITY_GRANT_SCHEMA = 'enigma.proof_network.capab
 export const PROOF_NETWORK_CAPABILITY_REVOCATION_SCHEMA = 'enigma.proof_network.capability_revocation.v1';
 export const PROOF_NETWORK_BENCHMARK_ATTESTATION_SCHEMA = 'enigma.proof_network.benchmark_attestation.v1';
 export const PROOF_NETWORK_PACKET_SCHEMA = 'enigma.proof_network.packet.v1';
+export const PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA = 'enigma.proof_network.registry_entry.v1';
+export const PROOF_NETWORK_REGISTRY_BATCH_SCHEMA = 'enigma.proof_network.registry_batch.v1';
 
 export const ANCHOR_BATCH_SCHEMA = PROOF_NETWORK_ANCHOR_BATCH_SCHEMA;
 export const CAPABILITY_GRANT_SCHEMA = PROOF_NETWORK_CAPABILITY_GRANT_SCHEMA;
 export const CAPABILITY_REVOCATION_SCHEMA = PROOF_NETWORK_CAPABILITY_REVOCATION_SCHEMA;
 export const BENCHMARK_ATTESTATION_SCHEMA = PROOF_NETWORK_BENCHMARK_ATTESTATION_SCHEMA;
 export const PACKET_SCHEMA = PROOF_NETWORK_PACKET_SCHEMA;
+export const REGISTRY_ENTRY_SCHEMA = PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA;
+export const REGISTRY_BATCH_SCHEMA = PROOF_NETWORK_REGISTRY_BATCH_SCHEMA;
 
 export const PROOF_NETWORK_SCHEMAS = Object.freeze({
   anchor_batch: PROOF_NETWORK_ANCHOR_BATCH_SCHEMA,
@@ -18,6 +22,8 @@ export const PROOF_NETWORK_SCHEMAS = Object.freeze({
   capability_revocation: PROOF_NETWORK_CAPABILITY_REVOCATION_SCHEMA,
   benchmark_attestation: PROOF_NETWORK_BENCHMARK_ATTESTATION_SCHEMA,
   packet: PROOF_NETWORK_PACKET_SCHEMA,
+  registry_entry: PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA,
+  registry_batch: PROOF_NETWORK_REGISTRY_BATCH_SCHEMA,
 });
 
 const SHA256_PREFIX = 'sha256:';
@@ -36,6 +42,14 @@ const SAFE_FIELD_NAMES = new Set(Object.keys(SAFE_BOOLEAN_BOUNDARIES));
 const FORBIDDEN_KEY_RE = /(?:^|_)(?:raw|plaintext|plain_text|prompt|prompts|message|messages|text|content|document|documents|transcript|transcripts|completion|completions|embedding|embeddings|acl|acl_body|access_control_list|provider_response|provider_responses|response_body|credential|credentials|api_key|secret|password|private_key|seed|seed_phrase|mnemonic|tenant_name|customer_name|organization_name|org_name)(?:$|_)/iu;
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|(?:seed phrase|mnemonic phrase|raw memory|private prompt|full transcript|provider response|embedding vector))/iu;
 const SUPPORTED_ARTIFACT_SCHEMAS = new Set(Object.values(PROOF_NETWORK_SCHEMAS));
+const REGISTRY_ENTRY_TYPES = Object.freeze(new Set([
+  'anchor_batch',
+  'benchmark_attestation',
+  'connector_conformance',
+  'health_report',
+  'operator_receipt',
+  'settlement_job',
+]));
 
 function isPlainObject(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -296,6 +310,10 @@ function artifactHash(artifact, index) {
       return requiredString(artifact.benchmark_attestation_hash, `artifacts[${index}].benchmark_attestation_hash`);
     case PROOF_NETWORK_PACKET_SCHEMA:
       return requiredString(artifact.proof_network_packet_hash, `artifacts[${index}].proof_network_packet_hash`);
+    case PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA:
+      return requiredString(artifact.registry_entry_hash, `artifacts[${index}].registry_entry_hash`);
+    case PROOF_NETWORK_REGISTRY_BATCH_SCHEMA:
+      return requiredString(artifact.registry_batch_hash, `artifacts[${index}].registry_batch_hash`);
     default:
       throw new TypeError(`artifacts[${index}] has unsupported schema`);
   }
@@ -313,6 +331,10 @@ function validateSupportedArtifact(artifact) {
       return validateBenchmarkAttestation(artifact);
     case PROOF_NETWORK_PACKET_SCHEMA:
       return validateProofNetworkPacket(artifact);
+    case PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA:
+      return validateRegistryEntry(artifact);
+    case PROOF_NETWORK_REGISTRY_BATCH_SCHEMA:
+      return validateRegistryBatch(artifact);
     default:
       return Object.freeze({ ok: false, valid: false, errors: Object.freeze(['unsupported artifact schema']) });
   }
@@ -568,3 +590,120 @@ export function validateProofNetworkPacket(packet) {
     validateIdentity(packet, errors, 'proof_network_packet_id', 'proof_network_packet_hash', 'pnp');
   });
 }
+
+function registryEntryType(value, field = 'entry_type') {
+  const type = optionalString(value, undefined, field);
+  if (type === undefined || !REGISTRY_ENTRY_TYPES.has(type)) {
+    throw new TypeError(`${field} must be one of ${[...REGISTRY_ENTRY_TYPES].join(', ')}`);
+  }
+  return type;
+}
+
+export function createRegistryEntry(input = {}) {
+  requiredObject(input, 'input');
+  assertNoPrivateProofPayload(input, 'input');
+  const entryType = registryEntryType(input.entry_type ?? input.entryType ?? input.type, 'entry_type');
+  const artifactHash = digestRef(input.artifact_hash ?? input.artifactHash ?? input.digest_ref ?? input.digestRef, 'artifact_hash');
+  const artifactSchemaRef = publicRef(input.artifact_schema_ref ?? input.artifactSchemaRef ?? input.schema_ref ?? input.schemaRef, 'artifact_schema_ref');
+  const digestRefs = digestArray(input.digest_refs ?? input.digestRefs ?? input.digest_roots ?? input.digestRoots ?? input.roots ?? artifactHash, 'digest_refs', { min: 1, max: 64 });
+  const signerRefs = publicRefArray(input.signer_refs ?? input.signerRefs ?? input.signer_ref ?? input.signerRef, 'signer_refs', { min: 0, max: 64 });
+  const entryRef = optionalPublicRef(input.entry_ref ?? input.entryRef, refFromDigest('registry-entry', artifactHash), 'entry_ref');
+  const body = {
+    schema: PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA,
+    registered_at: isoTimestamp(input.registered_at ?? input.registeredAt ?? input.created_at ?? input.createdAt ?? input.generated_at ?? input.generatedAt, 'registered_at'),
+    entry_type: entryType,
+    entry_ref: entryRef,
+    registry_ref: optionalPublicRef(input.registry_ref ?? input.registryRef ?? input.marketplace_ref ?? input.marketplaceRef, 'registry:memory-drive-marketplace', 'registry_ref'),
+    artifact_schema_ref: artifactSchemaRef,
+    artifact_hash: artifactHash,
+    digest_root: sha256Json(digestRefs),
+    digest_refs: digestRefs,
+    signer_refs: signerRefs,
+    entry_count: nonNegativeInteger(input.entry_count ?? input.entryCount ?? input.count, 'entry_count', 1),
+    ...((input.signature_ref ?? input.signatureRef) ? { signature_ref: signatureRef(input.signature_ref ?? input.signatureRef, 'signature_ref') } : {}),
+    ...SAFE_BOOLEAN_BOUNDARIES,
+  };
+  return freezeArtifact(body, 'registry_entry_id', 'registry_entry_hash', 'pnrg');
+}
+
+export function validateRegistryEntry(entry) {
+  return collectValidation((errors) => {
+    requiredObject(entry, 'entry');
+    assertNoPrivateProofPayload(entry, 'entry');
+    if (entry.schema !== PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA) errors.push(`schema must be ${PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA}`);
+    requireSafeBoundaries(entry, errors, 'entry');
+    isoTimestamp(entry.registered_at, 'registered_at');
+    if (!REGISTRY_ENTRY_TYPES.has(entry.entry_type)) errors.push(`entry_type must be one of ${[...REGISTRY_ENTRY_TYPES].join(', ')}`);
+    publicRef(entry.entry_ref, 'entry_ref');
+    publicRef(entry.registry_ref, 'registry_ref');
+    publicRef(entry.artifact_schema_ref, 'artifact_schema_ref');
+    digestRef(entry.artifact_hash, 'artifact_hash');
+    const digestRefs = digestArray(entry.digest_refs, 'digest_refs', { min: 1, max: 64 });
+    if (entry.digest_root !== sha256Json(digestRefs)) errors.push('digest_root mismatch');
+    publicRefArray(entry.signer_refs, 'signer_refs', { min: 0, max: 64 });
+    nonNegativeInteger(entry.entry_count, 'entry_count');
+    if (entry.signature_ref !== undefined) signatureRef(entry.signature_ref, 'signature_ref');
+    validateIdentity(entry, errors, 'registry_entry_id', 'registry_entry_hash', 'pnrg');
+  });
+}
+
+export function createRegistryBatch(input = {}) {
+  requiredObject(input, 'input');
+  assertNoPrivateProofPayload(input, 'input');
+  const entries = Object.freeze(arrayInput(input.entries ?? input.registry_entries ?? input.registryEntries).map((entry, index) => {
+    requiredObject(entry, `entries[${index}]`);
+    if (entry.schema !== PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA) throw new TypeError(`entries[${index}] must be a ${PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA}`);
+    const validation = validateRegistryEntry(entry);
+    if (!validation.ok) throw new TypeError(`entries[${index}] is invalid: ${validation.errors.join('; ')}`);
+    return Object.freeze(entry);
+  }));
+  if (entries.length === 0) throw new TypeError('entries must be non-empty');
+  if (entries.length > 128) throw new TypeError('entries must contain at most 128 entries');
+  const entryHashes = Object.freeze(entries.map((entry) => requiredString(entry.registry_entry_hash, 'entries.registry_entry_hash')).sort());
+  const registryRoot = sha256Json(entryHashes);
+  const body = {
+    schema: PROOF_NETWORK_REGISTRY_BATCH_SCHEMA,
+    created_at: isoTimestamp(input.created_at ?? input.createdAt ?? input.generated_at ?? input.generatedAt, 'created_at'),
+    registry_ref: optionalPublicRef(input.registry_ref ?? input.registryRef ?? input.marketplace_ref ?? input.marketplaceRef, refFromDigest('registry-batch', registryRoot), 'registry_ref'),
+    entry_count: entries.length,
+    registry_root: registryRoot,
+    entry_hashes: entryHashes,
+    entries,
+    ...SAFE_BOOLEAN_BOUNDARIES,
+  };
+  return freezeArtifact(body, 'registry_batch_id', 'registry_batch_hash', 'pnrb');
+}
+
+export function validateRegistryBatch(batch) {
+  return collectValidation((errors) => {
+    requiredObject(batch, 'batch');
+    assertNoPrivateProofPayload(batch, 'batch');
+    if (batch.schema !== PROOF_NETWORK_REGISTRY_BATCH_SCHEMA) errors.push(`schema must be ${PROOF_NETWORK_REGISTRY_BATCH_SCHEMA}`);
+    requireSafeBoundaries(batch, errors, 'batch');
+    isoTimestamp(batch.created_at, 'created_at');
+    publicRef(batch.registry_ref, 'registry_ref');
+    const entries = Array.isArray(batch.entries) ? batch.entries : [];
+    if (entries.length === 0 || entries.length > 128) errors.push('entries must contain 1-128 entries');
+    const entryHashes = [];
+    for (const [index, entry] of entries.entries()) {
+      requiredObject(entry, `entries[${index}]`);
+      if (entry.schema !== PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA) {
+        errors.push(`entries[${index}] must be a ${PROOF_NETWORK_REGISTRY_ENTRY_SCHEMA}`);
+        continue;
+      }
+      const validation = validateRegistryEntry(entry);
+      if (!validation.ok) errors.push(`entries[${index}] is invalid: ${validation.errors.join('; ')}`);
+      entryHashes.push(requiredString(entry.registry_entry_hash, `entries[${index}].registry_entry_hash`));
+    }
+    entryHashes.sort();
+    if (batch.entry_count !== entries.length) errors.push('entry_count mismatch');
+    if (batch.registry_root !== sha256Json(entryHashes)) errors.push('registry_root mismatch');
+    if (JSON.stringify(batch.entry_hashes) !== JSON.stringify(entryHashes)) errors.push('entry_hashes mismatch');
+    validateIdentity(batch, errors, 'registry_batch_id', 'registry_batch_hash', 'pnrb');
+  });
+}
+
+export const createProofRegistryEntry = createRegistryEntry;
+export const validateProofRegistryEntry = validateRegistryEntry;
+export const createProofRegistryBatch = createRegistryBatch;
+export const validateProofRegistryBatch = validateRegistryBatch;

package/scripts/build-benchmark-proof-release.mjs

@@ -23,6 +23,7 @@ const SHA256_PREFIX = 'sha256:';
 const PUBLIC_REF_RE = /^[a-z0-9][a-z0-9._:/@+-]{2,191}$/u;
 const SCORE_KEY_RE = /^[a-z][a-z0-9_.:-]{1,63}$/u;
 const PRIVATE_REPORT_KEY_RE = /(?:^|_)(?:raw_memory|memory_plaintext|plaintext|plain_text|prompt|prompts|conversation|conversations|message|messages|content|body|payload|payloads|document|documents|transcript|transcripts|completion|completions|embedding|embeddings|provider_response|provider_responses|response_body|credential|credentials|api_key|secret|password|private_key|seed|seed_phrase|mnemonic|tenant_name|customer_name|organization_name|org_name|account_id)(?:$|_)/iu;
+const RAW_ANSWER_REPORT_KEY_RE = /(?:^|_)(?:raw_answer|raw_answers|answer_text|answer_texts|answer_body|answer_content|generated_answer|generated_answers|final_answer|final_answers|model_answer|model_answers|llm_answer|llm_answers|provider_answer|provider_answers)(?:$|_)/iu;
 const ALLOWED_FALSE_REPORT_KEYS = new Set([
   'raw_private_memory_plaintext_included',
   'raw_question_text_included',
@@ -55,6 +56,9 @@ const ALLOWED_PUBLIC_REPORT_KEYS = new Set([
   'estimated_prompt_tokens',
   'baseline_prompt_tokens',
   'optimized_prompt_tokens',
+  'prompt_refs',
+  'same_prompts_for_all_rows',
+  'prompts_fixed',
 ]);
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|(?:seed phrase|mnemonic phrase|raw memory|private prompt|full transcript|provider response|embedding vector))/iu;
 const ABSOLUTE_LOCAL_PATH_RE = /^(?:[A-Za-z]:[\\/]|\\\\|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\b)/u;
@@ -62,6 +66,7 @@ const CLAIM_SCORE_KEY_RE = /(?:provider|competitor|roi|profit|savings|solana|tra
 const PROOF_COMPATIBLE_REPORT_SCHEMAS = new Set([
   'enigma.memory_benchmark_suite.v1',
   'enigma.standard_memory_benchmark_suite.v1',
+  'enigma.standard_memory_benchmark_protocol_plan.v1',
 ]);
 const REQUIRED_FALSE_BOUNDARY_KEYS = Object.freeze([
   'external_provider_calls',
@@ -172,7 +177,7 @@ export function parseArgs(argv = process.argv.slice(2)) {
 export function usage() {
   return `Usage: node scripts/build-benchmark-proof-release.mjs --report <path> --dataset-ref <ref> --runner-ref <ref> --package-ref <ref> [--score key=value ...] [--out-dir <dir>]
 
-Builds a dependency-free, local benchmark proof release from an existing public-safe benchmark report. The report must use a compatible benchmark schema and explicit offline benchmark boundaries. The report file is parsed for public-safety checks and hashed, but its body and local path are never copied into the attestation or proof packet. The generated artifacts are local benchmark attestation/proof only: no API calls, provider answer-accuracy claims, Mem0 or competitor performance claims, Solana submissions, hosted SaaS claims, ROI/profit/savings claims, raw memory, prompts, transcripts, embeddings, credentials, account ids, private keys, or provider responses are written.
+Builds a dependency-free, local benchmark proof release from an existing public-safe benchmark report. The report must use a compatible benchmark schema (a scored retrieval proxy report such as enigma.standard_memory_benchmark_suite.v1, or a full-answer protocol plan such as enigma.standard_memory_benchmark_protocol_plan.v1) and explicit offline benchmark boundaries. The report file is parsed for public-safety checks and hashed, but its body and local path are never copied into the attestation or proof packet. The generated artifacts are local benchmark attestation/proof only: no API calls, provider answer-accuracy claims, Mem0 or competitor performance claims, Solana submissions, hosted SaaS claims, ROI/profit/savings claims, raw memory, prompts, transcripts, embeddings, credentials, account ids, private keys, or provider responses are written. A protocol-plan report is accepted as protocol-readiness evidence only and is rejected if it contains raw answers, prompts, provider responses, or competitor scores.
 `;
 }
 
@@ -205,7 +210,7 @@ function assertPublicReportPayload(value, path = 'report') {
   }
   if (!isPlainObject(value)) return;
   for (const [key, child] of Object.entries(value)) {
-    if (PRIVATE_REPORT_KEY_RE.test(key) && !ALLOWED_PUBLIC_REPORT_KEYS.has(key)) {
+    if ((PRIVATE_REPORT_KEY_RE.test(key) || RAW_ANSWER_REPORT_KEY_RE.test(key)) && !ALLOWED_PUBLIC_REPORT_KEYS.has(key)) {
       if (!ALLOWED_FALSE_REPORT_KEYS.has(key) || child !== false) throw new UsageError(`${path}.${key} is not allowed in public benchmark proof artifacts`);
     }
     assertPublicReportPayload(child, `${path}.${key}`);
@@ -275,6 +280,13 @@ function assertProofCompatibleBenchmarkBoundaries(report) {
   if (report.schema === 'enigma.memory_benchmark_suite.v1') {
     if (boundaries.local_only !== true) throw new UsageError('local memory benchmark report must set benchmark_boundaries.local_only true');
   }
+  if (report.schema === 'enigma.standard_memory_benchmark_protocol_plan.v1') {
+    const protocolBoundaries = report.protocol_boundaries;
+    if (!isPlainObject(protocolBoundaries)) throw new UsageError('protocol plan report must include protocol_boundaries');
+    for (const key of ['network_required', 'provider_calls_made', 'answers_generated', 'judged']) {
+      requireFalseField(protocolBoundaries, key, 'report.protocol_boundaries');
+    }
+  }
   assertCommandBoundaries(report);
   assertExternalAdaptersUnscored(report);
 }
@@ -404,7 +416,7 @@ export async function buildBenchmarkProofRelease(args, options = {}) {
   const schema = reportSchema(report);
   const sampleCount = sampleCountFromReport(report);
   const datasetCount = Array.isArray(report.datasets) ? report.datasets.length : 0;
-  const commitments = scoreCommitments(args.scores, reportHash);
+  const commitments = scoreCommitments(Array.isArray(args.scores) ? args.scores : [], reportHash);
   const metricRoots = commitments.map((score) => score.score_hash);
 
   const attestation = createBenchmarkAttestation({

package/scripts/build-hosted-api-key-lifecycle.mjs

@@ -13,7 +13,7 @@ import {
 } from '../packages/hosted-cloud/src/index.js';
 
 export const HOSTED_API_KEY_LIFECYCLE_PACKET_SCHEMA = HOSTED_CLOUD_API_KEY_LIFECYCLE_PACKET_SCHEMA;
-export const HOSTED_API_KEY_LIFECYCLE_RELEASE_TARGET = '0.1.16';
+export const HOSTED_API_KEY_LIFECYCLE_RELEASE_TARGET = '0.1.17';
 
 const PROVIDED = 'provided';
 const BLOCKED = 'blocked_external_dependency';

package/scripts/build-hosted-customer-lifecycle.mjs

@@ -25,10 +25,13 @@ import {
   buildUserAccountContract,
   buildCustomerLifecyclePacket,
   validateCustomerLifecyclePacket,
+  buildHostedCloudReadinessPacket,
+  HOSTED_CLOUD_READINESS_PACKET_SCHEMA,
 } from 'enigma-memory/hosted-cloud';
 
 export const HOSTED_CUSTOMER_LIFECYCLE_PACKET_SCHEMA = HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA;
-export const HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET = '0.1.16';
+export const HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET = '0.1.17';
+export const HOSTED_CLOUD_READINESS_RELEASE_SCHEMA = HOSTED_CLOUD_READINESS_PACKET_SCHEMA;
 
 const PROVIDED = 'provided';
 const BLOCKED_MISSING = 'blocked_missing_evidence';
@@ -379,6 +382,16 @@ export function buildHostedCustomerLifecyclePacket(options = {}) {
   };
 }
 
+export function buildHostedCloudReadinessPacketFromArgs(options = {}) {
+  const generatedAt = options.generatedAt ?? new Date().toISOString();
+  const lifecyclePacket = buildHostedCustomerLifecyclePacket({ ...options, generatedAt });
+  return buildHostedCloudReadinessPacket({
+    generated_at: generatedAt,
+    customer_lifecycle_packet: lifecyclePacket,
+    operator_go_live_ref: options.operatorGoLiveRef ?? null,
+  });
+}
+
 export function parseArgs(argv) {
   const args = {
     tenant: undefined,
@@ -386,6 +399,7 @@ export function parseArgs(argv) {
     environment: undefined,
     operatorGoLiveRef: undefined,
     evidenceRefs: [],
+    readiness: false,
     out: undefined,
     help: false,
   };
@@ -395,6 +409,7 @@ export function parseArgs(argv) {
       args.help = true;
       continue;
     }
+    if (arg === '--readiness') { args.readiness = true; continue; }
     const readValue = (name) => {
       index += 1;
       if (index >= argv.length || argv[index].startsWith('--')) throw new Error(`${name} requires a value`);
@@ -414,7 +429,7 @@ export function parseArgs(argv) {
 export function usage() {
   return `Usage: node scripts/build-hosted-customer-lifecycle.mjs [options]
 
-Build a public-safe hosted customer lifecycle packet. This script validates local contract fragments only; it does not deploy, create accounts, call providers, or write secrets.
+Build a public-safe hosted customer lifecycle packet, or with --readiness a hosted cloud readiness aggregator packet. This script validates local contract fragments only; it does not deploy, create accounts, call providers, or write secrets.
 
 Options:
   --tenant <id>                    Tenant id. Defaults to blocked:tenant.
@@ -424,6 +439,9 @@ Options:
   --evidence-ref <key=status:ref>  Repeatable evidence ref. key=<ref> implies provided.
                                    Status: provided, blocked_missing_evidence, blocked_external_dependency.
                                    Keys: ${HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS.join(', ')}
+  --readiness                      Emit a hosted cloud readiness aggregator packet (enigma.hosted_cloud.readiness_packet.v1)
+                                   that wraps the lifecycle packet and rolls all readiness surfaces plus
+                                   propagated lifecycle blockers into one public-safe readiness assessment.
   --out <file>                     Also write the packet JSON to a file.
   --help                           Show this help.
 `;
@@ -435,7 +453,9 @@ export async function main(argv = process.argv.slice(2)) {
     process.stdout.write(usage());
     return 0;
   }
-  const packet = buildHostedCustomerLifecyclePacket(args);
+  const packet = args.readiness
+    ? buildHostedCloudReadinessPacketFromArgs(args)
+    : buildHostedCustomerLifecyclePacket(args);
   const json = `${JSON.stringify(packet, null, 2)}\n`;
   if (args.out) {
     try {

package/scripts/build-installer-assets.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 
 export const INSTALLER_ASSET_SCHEMA = 'enigma.installer_assets.v1';
 export const INSTALLER_ASSET_PACKAGE = 'enigma-memory';
-export const INSTALLER_ASSET_VERSION = '0.1.16';
+export const INSTALLER_ASSET_VERSION = '0.1.17';
 export const INSTALLER_ASSET_GENERATED_AT = '1970-01-01T00:00:00.000Z';
 
 const SCRIPT_PATH = fileURLToPath(import.meta.url);