enigma-memory 0.1.7 → 0.1.9

package/apps/relay/src/server.mjs

@@ -1296,13 +1296,34 @@ export async function loadRelayStateFromFile(path, options = {}) {
   }
 }
 
+function retryableRelayRenameError(error) {
+  return error?.code === 'EBUSY' || error?.code === 'EPERM' || error?.code === 'EACCES';
+}
+
+async function delayRelayRenameRetry(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function renameRelayStateAtomically(tempPath, filePath) {
+  const delays = [10, 25, 50, 100, 200];
+  for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+    try {
+      await rename(tempPath, filePath);
+      return;
+    } catch (error) {
+      if (attempt === delays.length || !retryableRelayRenameError(error)) throw error;
+      await delayRelayRenameRetry(delays[attempt]);
+    }
+  }
+}
+
 export async function saveRelayStateToFile(state, path) {
   const filePath = assertString(path, 'relay state file path');
   const snapshot = serializeRelayState(state);
   const tempPath = join(dirname(filePath), `.${basename(filePath)}.${randomBytes(6).toString('hex')}.tmp`);
   try {
     await writeFile(tempPath, `${JSON.stringify(snapshot, null, 2)}\n`, 'utf8');
-    await rename(tempPath, filePath);
+    await renameRelayStateAtomically(tempPath, filePath);
   } catch (error) {
     await unlink(tempPath).catch(() => undefined);
     throw error;

package/docs/developer-ecosystem.md

@@ -60,7 +60,7 @@ The example app prints ids, counts, roots, and verification status only. It does
 
 ## CLI and CI loop
 
-The CI example installs Node 24, installs the published `enigma-memory@0.1.7` package, runs:
+The CI example installs Node 24, installs the published `enigma-memory@0.1.9` package, runs:
 
 ```sh
 npx --yes --package enigma-memory enigma setup --overwrite

package/docs/hosted-cloud-product.md

@@ -13,10 +13,13 @@ The source package now has pure contract builders and validators in `packages/ho
 - usage billing records;
 - dashboard summaries;
 - backup drill records;
-- incident and SLA reference records.
+- incident and SLA reference records;
+- customer lifecycle packets that aggregate those surfaces for launch-readiness evidence.
 
 These functions are contract and validation code only. They do not call an auth provider, billing provider, cloud deployment, KMS, backup target, support desk, status page, SIEM, or model provider. They are safe to import as package code because they do not start servers, read user files, mutate deployment state, publish packages, or contact external accounts.
 
+The lifecycle packet public API is `buildCustomerLifecyclePacket(input)` and `validateCustomerLifecyclePacket(packet)` under `enigma-memory/hosted-cloud`; the script command below emits the same schema for release evidence.
+
 The validators enforce hosted-cloud boundaries:
 
 - contract artifacts must include `operator_evidence_refs` for auth provider, billing provider, legal docs, data processing terms, support ownership, and external security review;
@@ -27,7 +30,7 @@ The validators enforce hosted-cloud boundaries:
 - hosted vault contracts are opaque-record and plaintext-minimized contracts only;
 - billing records remain contract records until an external billing provider invoice flow is wired.
 
-Every builder emits `readiness.contract_ready: true` and `readiness.integration_kind: "contract_validator_only"`. It also emits `readiness.hosted_cloud_sellable: false` because contract readiness is not provider wiring, legal approval, security review, or operator go-live approval.
+Individual surface builders emit `readiness.contract_ready: true`, `readiness.integration_kind: "contract_validator_only"`, and `readiness.hosted_cloud_sellable: false` because contract readiness is not provider wiring, legal approval, security review, or operator go-live approval. A customer lifecycle packet may only mark `hosted_cloud_sellable: true` when every lifecycle surface has a provided evidence ref and an explicit operator go-live approval ref is supplied; the packet remains evidence validation, not live hosted SaaS or provider wiring.
 
 ## Externally blocked before hosted cloud can be sold
 
@@ -44,6 +47,12 @@ Hosted cloud remains blocked until an operator wires and records evidence for al
 
 A `provided` operator evidence ref means the contract can point to external evidence. It still does not by itself make hosted cloud sellable; an operator must complete the release checklist and issue go-live approval. A `blocked_external_dependency` ref is an explicit blocker, not fake evidence.
 
+## Customer lifecycle packet
+
+`npm run production:hosted-customer -- --tenant <id> --domain <domain> --environment <env> --out <file>` builds `enigma.hosted_cloud.customer_lifecycle_packet.v1` readiness evidence for a tenant launch packet. Operators may pass repeatable `--evidence-ref <key=status:ref>` values and `--operator-go-live-ref <ref>` when real external evidence exists. The command writes public-safe validation evidence only: it creates no hosted account, tenant, vault, API key, invoice, support ticket, backup, Cloudflare resource, provider resource, secret, or deployment.
+
+The lifecycle packet records lifecycle phases, required surfaces, external blockers, missing evidence refs, no-secret/no-plaintext guarantees, and the sellability gate. Missing surfaces, blocked evidence refs, or absent operator go-live approval keep `hosted_cloud_sellable:false`.
+
 ## Non-claims
 
 Hosted cloud collateral must not say or imply:

package/docs/sdk-api.md

@@ -1,6 +1,6 @@
 # SDK and API guide
 
-This guide covers the public package imports for `enigma-memory@0.1.7`. The SDK runs locally by default: vaults, passports, context packs, receipts, relay/gateway demo state, storage contracts, metering artifacts, and settlement artifacts are package-level developer surfaces. They are not evidence of hosted Enigma cloud, provider-side deletion, provider model forgetting, token ROI, invoice savings, compliance certification, or benchmark leadership.
+This guide covers the public package imports for `enigma-memory@0.1.9`. The SDK runs locally by default: vaults, passports, context packs, receipts, relay/gateway demo state, storage contracts, metering artifacts, and settlement artifacts are package-level developer surfaces. They are not evidence of hosted Enigma cloud, provider-side deletion, provider model forgetting, token ROI, invoice savings, compliance certification, or benchmark leadership.
 
 ## Install and import style
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-memory",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
   "description": "Provider-agnostic AI memory passport and offline-verifiable proof layer.",
   "license": "Apache-2.0",
@@ -84,6 +84,7 @@
     "scripts/monitor-live-endpoints.mjs",
     "scripts/collect-hosted-backend-live-evidence.mjs",
     "scripts/build-hosted-probe-worker.mjs",
+    "scripts/build-hosted-customer-lifecycle.mjs",
     "scripts/build-edge-backend-workers.mjs",
     "scripts/validate-cloudflare-worker-inspect.mjs",
     "scripts/validate-production-manifests.mjs",
@@ -175,6 +176,7 @@
     "production:edge-deploy": "node scripts/deploy-edge-backend-workers.mjs",
     "production:edge-live": "node scripts/collect-edge-backend-bootstrap-evidence.mjs",
     "production:ref-draft": "node scripts/build-hosted-ref-draft.mjs",
+    "production:hosted-customer": "node scripts/build-hosted-customer-lifecycle.mjs",
     "production:storage-bootstrap": "node scripts/cloudflare-storage-bootstrap.mjs",
     "production:worker-inspect": "node scripts/validate-cloudflare-worker-inspect.mjs",
     "production:cloudflare-credentials": "node scripts/validate-cloudflare-credentials.mjs",

package/packages/hosted-cloud/src/index.js

@@ -8,6 +8,7 @@ export const HOSTED_CLOUD_USAGE_BILLING_SCHEMA = 'enigma.hosted_cloud.usage_bill
 export const HOSTED_CLOUD_DASHBOARD_SCHEMA = 'enigma.hosted_cloud.dashboard_summary.v1';
 export const HOSTED_CLOUD_BACKUP_DRILL_SCHEMA = 'enigma.hosted_cloud.backup_drill.v1';
 export const HOSTED_CLOUD_INCIDENT_SLA_SCHEMA = 'enigma.hosted_cloud.incident_sla_refs.v1';
+export const HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA = 'enigma.hosted_cloud.customer_lifecycle_packet.v1';
 
 export const HOSTED_CLOUD_EXTERNAL_BLOCKERS = Object.freeze([
   'auth_provider',
@@ -35,6 +36,48 @@ const BLOCKER_LABELS = Object.freeze({
   support_ownership: 'Support ownership is not assigned.',
   external_security_review: 'External security review is not complete.',
 });
+
+export const HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PHASES = Object.freeze([
+  'account',
+  'tenant',
+  'vault',
+  'api_key',
+  'billing',
+  'dashboard',
+  'backup',
+  'incident_sla',
+  'support',
+  'monitoring',
+  'legal',
+  'security_review',
+  'operator_go_live',
+]);
+const CUSTOMER_LIFECYCLE_CONTRACT_PHASES = Object.freeze([
+  'account',
+  'tenant',
+  'vault',
+  'api_key',
+  'billing',
+  'dashboard',
+  'backup',
+  'incident_sla',
+]);
+const CUSTOMER_LIFECYCLE_REQUIRED_EVIDENCE_PHASES = Object.freeze(HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PHASES.filter((phase) => phase !== 'operator_go_live'));
+const CUSTOMER_LIFECYCLE_BLOCKER_LABELS = Object.freeze({
+  account: 'Hosted account contract evidence is not provided.',
+  tenant: 'Hosted tenant contract evidence is not provided.',
+  vault: 'Hosted vault contract evidence is not provided.',
+  api_key: 'Hosted API key metadata evidence is not provided.',
+  billing: 'Hosted billing evidence is not provided.',
+  dashboard: 'Hosted dashboard evidence is not provided.',
+  backup: 'Hosted backup drill evidence is not provided.',
+  incident_sla: 'Hosted incident/SLA evidence is not provided.',
+  support: 'Hosted support ownership evidence is not provided.',
+  monitoring: 'Hosted monitoring evidence is not provided.',
+  legal: 'Hosted legal approval evidence is not provided.',
+  security_review: 'Hosted security review evidence is not provided.',
+  operator_go_live: 'Explicit operator go-live approval is not provided.',
+});
 const FORBIDDEN_KEY_RE = /(?:^|_)(?:raw_?memory|plaintext|plain_text|prompt|prompts|completion|completions|message_body|transcript|conversation|provider_?response|response_?body|credential|credentials|secret|password|private_?key|bearer|access_token|refresh_token|token_value|api_key_value|api_secret|token_?roi|token_?profit|roi_claim|profit_claim|provider_?deletion|provider_?erasure|model_?forgetting|model_?erasure)(?:$|_)/iu;
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|raw memory|private prompt|provider response|full transcript|decrypted memory)/iu;
 const FORBIDDEN_CLAIM_RE = /(?:token\s+(?:roi|profit|return|investment|price)|(?:roi|profit|return)\s+(?:from|on)\s+token|guaranteed\s+(?:savings|profit|return)|provider(?:-side|\s+side)?\s+(?:deletion|erasure)|model\s+(?:forgetting|forgot|erasure)|makes?\s+models?\s+forget|deleted\s+from\s+every\s+provider)/iu;
@@ -536,3 +579,406 @@ export function validateIncidentSlaRefs(contract) {
   requiredTrue(contract.incident_boundary.external_review_required, 'incident_boundary.external_review_required');
   return true;
 }
+
+function lifecycleContractIdKey(phase) {
+  switch (phase) {
+    case 'account': return 'account_id';
+    case 'tenant': return 'tenant_id';
+    case 'vault': return 'vault_id';
+    case 'api_key': return 'api_key_id';
+    case 'billing': return 'billing_record_id';
+    case 'dashboard': return 'dashboard_id';
+    case 'backup': return 'backup_drill_id';
+    case 'incident_sla': return 'incident_sla_id';
+    default: throw new TypeError(`unknown lifecycle phase: ${phase}`);
+  }
+}
+
+function lifecycleContractSource(input, aliases) {
+  if (isPlainObject(input.contracts)) {
+    for (const alias of aliases) {
+      if (input.contracts[alias] !== undefined) return input.contracts[alias];
+    }
+  }
+  for (const alias of aliases) {
+    if (input[alias] !== undefined) return input[alias];
+  }
+  return undefined;
+}
+
+function buildOrValidateLifecycleContract(phase, source) {
+  if (source === undefined || source === null) return null;
+  if (!isPlainObject(source)) throw new TypeError(`contracts.${phase} must be an object`);
+  switch (phase) {
+    case 'account':
+      if (source.schema === HOSTED_CLOUD_USER_ACCOUNT_SCHEMA) {
+        validateUserAccountContract(source);
+        return source;
+      }
+      return buildUserAccountContract(source);
+    case 'tenant':
+      if (source.schema === HOSTED_CLOUD_TENANT_SCHEMA) {
+        validateTenantContract(source);
+        return source;
+      }
+      return buildTenantContract(source);
+    case 'vault':
+      if (source.schema === HOSTED_CLOUD_VAULT_SCHEMA) {
+        validateHostedVaultContract(source);
+        return source;
+      }
+      return buildHostedVaultContract(source);
+    case 'api_key':
+      if (source.schema === HOSTED_CLOUD_API_KEY_SCHEMA) {
+        validateApiKeyContract(source);
+        return source;
+      }
+      return buildApiKeyContract(source);
+    case 'billing':
+      if (source.schema === HOSTED_CLOUD_USAGE_BILLING_SCHEMA) {
+        validateUsageBillingRecord(source);
+        return source;
+      }
+      return buildUsageBillingRecord(source);
+    case 'dashboard':
+      if (source.schema === HOSTED_CLOUD_DASHBOARD_SCHEMA) {
+        validateDashboardSummary(source);
+        return source;
+      }
+      return buildDashboardSummary(source);
+    case 'backup':
+      if (source.schema === HOSTED_CLOUD_BACKUP_DRILL_SCHEMA) {
+        validateBackupDrillContract(source);
+        return source;
+      }
+      return buildBackupDrillContract(source);
+    case 'incident_sla':
+      if (source.schema === HOSTED_CLOUD_INCIDENT_SLA_SCHEMA) {
+        validateIncidentSlaRefs(source);
+        return source;
+      }
+      return buildIncidentSlaRefs(source);
+    default:
+      throw new TypeError(`unknown lifecycle phase: ${phase}`);
+  }
+}
+
+function lifecycleContractsFrom(input) {
+  return {
+    account: buildOrValidateLifecycleContract('account', lifecycleContractSource(input, ['account', 'user_account', 'userAccount', 'account_contract', 'accountContract', 'user_account_contract', 'userAccountContract'])),
+    tenant: buildOrValidateLifecycleContract('tenant', lifecycleContractSource(input, ['tenant', 'tenant_contract', 'tenantContract'])),
+    vault: buildOrValidateLifecycleContract('vault', lifecycleContractSource(input, ['vault', 'hosted_vault', 'hostedVault', 'vault_contract', 'vaultContract', 'hosted_vault_contract', 'hostedVaultContract'])),
+    api_key: buildOrValidateLifecycleContract('api_key', lifecycleContractSource(input, ['api_key', 'apiKey', 'api_key_contract', 'apiKeyContract'])),
+    billing: buildOrValidateLifecycleContract('billing', lifecycleContractSource(input, ['billing', 'usage_billing_record', 'usageBillingRecord', 'billing_record', 'billingRecord', 'billing_contract', 'billingContract'])),
+    dashboard: buildOrValidateLifecycleContract('dashboard', lifecycleContractSource(input, ['dashboard', 'dashboard_summary', 'dashboardSummary', 'dashboard_contract', 'dashboardContract'])),
+    backup: buildOrValidateLifecycleContract('backup', lifecycleContractSource(input, ['backup', 'backup_drill', 'backupDrill', 'backup_contract', 'backupContract', 'backup_drill_contract', 'backupDrillContract'])),
+    incident_sla: buildOrValidateLifecycleContract('incident_sla', lifecycleContractSource(input, ['incident_sla', 'incidentSla', 'incident_sla_refs', 'incidentSlaRefs', 'incident_sla_contract', 'incidentSlaContract'])),
+  };
+}
+
+function explicitLifecycleEvidenceRefs(input) {
+  const refs = input.required_evidence_refs ?? input.requiredEvidenceRefs ?? input.lifecycle_evidence_refs ?? input.lifecycleEvidenceRefs ?? input.evidence_refs ?? input.evidenceRefs ?? input.operator_evidence_refs ?? input.operatorEvidenceRefs;
+  if (refs === undefined || refs === null) return {};
+  if (!isPlainObject(refs)) throw new TypeError('required_evidence_refs must be an object');
+  return refs;
+}
+
+function requirePublicSafeLifecycleRef(value, name) {
+  const ref = requiredString(value, name);
+  assertNoForbiddenPayload(ref, name);
+  if (ref.startsWith('blocked:')) throw new TypeError(`${name} must be a public-safe evidence ref, not a blocker ref`);
+  return ref;
+}
+
+function lifecycleEvidenceRefFor(key, value) {
+  const fallback = { ref: `blocked:${key}`, status: BLOCKED, blocker: CUSTOMER_LIFECYCLE_BLOCKER_LABELS[key] };
+  if (value === undefined || value === null) return fallback;
+  if (typeof value === 'string') return { ref: requirePublicSafeLifecycleRef(value, `required_evidence_refs.${key}`), status: PROVIDED };
+  if (!isPlainObject(value)) throw new TypeError(`required_evidence_refs.${key} must be a string or object`);
+  const status = stringOrDefault(value.status, PROVIDED);
+  if (!EVIDENCE_STATUSES.has(status)) throw new TypeError(`required_evidence_refs.${key}.status is invalid`);
+  const ref = status === PROVIDED
+    ? requirePublicSafeLifecycleRef(value.ref, `required_evidence_refs.${key}.ref`)
+    : requiredString(value.ref, `required_evidence_refs.${key}.ref`);
+  assertNoForbiddenPayload(ref, `required_evidence_refs.${key}.ref`);
+  const evidence = { ref, status };
+  const owner = optionalString(value.owner, `required_evidence_refs.${key}.owner`);
+  const blocker = optionalString(value.blocker, `required_evidence_refs.${key}.blocker`);
+  if (owner) evidence.owner = owner;
+  if (status === BLOCKED) evidence.blocker = blocker ?? CUSTOMER_LIFECYCLE_BLOCKER_LABELS[key];
+  return evidence;
+}
+
+function contractEvidenceRef(phase, contract) {
+  if (!contract) return lifecycleEvidenceRefFor(phase, undefined);
+  const idKey = lifecycleContractIdKey(phase);
+  return {
+    ref: requiredString(contract.contract_hash, `contracts.${phase}.contract_hash`),
+    status: PROVIDED,
+    contract_schema: requiredString(contract.schema, `contracts.${phase}.schema`),
+    contract_id: requiredString(contract[idKey], `contracts.${phase}.${idKey}`),
+  };
+}
+
+function lifecycleEvidenceRefsFrom(input, contracts) {
+  const explicitRefs = explicitLifecycleEvidenceRefs(input);
+  const evidenceRefs = {};
+  for (const phase of CUSTOMER_LIFECYCLE_REQUIRED_EVIDENCE_PHASES) {
+    evidenceRefs[phase] = explicitRefs[phase] === undefined && CUSTOMER_LIFECYCLE_CONTRACT_PHASES.includes(phase)
+      ? contractEvidenceRef(phase, contracts[phase])
+      : lifecycleEvidenceRefFor(phase, explicitRefs[phase]);
+  }
+  return evidenceRefs;
+}
+
+function operatorGoLiveRefFromInput(input) {
+  const value = input.operator_go_live_ref ?? input.operatorGoLiveRef;
+  if (value === undefined || value === null) return null;
+  return requirePublicSafeLifecycleRef(value, 'operator_go_live_ref');
+}
+
+function operatorGoLiveRefFromPacket(packet) {
+  if (!Object.prototype.hasOwnProperty.call(packet, 'operator_go_live_ref')) throw new TypeError('operator_go_live_ref must be present');
+  if (packet.operator_go_live_ref === null) return null;
+  return requirePublicSafeLifecycleRef(packet.operator_go_live_ref, 'operator_go_live_ref');
+}
+
+function missingLifecycleEvidenceRefs(requiredEvidenceRefs) {
+  return CUSTOMER_LIFECYCLE_REQUIRED_EVIDENCE_PHASES
+    .filter((phase) => requiredEvidenceRefs[phase].status !== PROVIDED)
+    .map((phase) => ({
+      key: phase,
+      ref: requiredEvidenceRefs[phase].ref,
+      blocker: requiredEvidenceRefs[phase].blocker ?? CUSTOMER_LIFECYCLE_BLOCKER_LABELS[phase],
+    }));
+}
+
+function lifecycleContractExternalBlockers(contracts) {
+  if (!isPlainObject(contracts)) return [];
+  const blockers = [];
+  for (const phase of CUSTOMER_LIFECYCLE_CONTRACT_PHASES) {
+    const contract = contracts[phase];
+    if (!isPlainObject(contract) || !Array.isArray(contract.readiness?.external_blockers)) continue;
+    for (const blocker of contract.readiness.external_blockers) {
+      blockers.push({
+        key: `${phase}.${requiredString(blocker.key, `contracts.${phase}.readiness.external_blockers.key`)}`,
+        ref: requiredString(blocker.ref, `contracts.${phase}.readiness.external_blockers.ref`),
+        blocker: stringOrDefault(blocker.blocker, CUSTOMER_LIFECYCLE_BLOCKER_LABELS[phase]),
+      });
+    }
+  }
+  return blockers;
+}
+
+function customerLifecycleExternalBlockers(requiredEvidenceRefs, operatorGoLiveRef, contracts = null) {
+  const blockers = missingLifecycleEvidenceRefs(requiredEvidenceRefs).concat(lifecycleContractExternalBlockers(contracts));
+  if (operatorGoLiveRef === null) {
+    blockers.push({
+      key: 'operator_go_live',
+      ref: 'blocked:operator_go_live',
+      blocker: CUSTOMER_LIFECYCLE_BLOCKER_LABELS.operator_go_live,
+    });
+  }
+  return blockers;
+}
+
+function missingLifecycleSurfaceRefs(contracts) {
+  return CUSTOMER_LIFECYCLE_CONTRACT_PHASES
+    .filter((phase) => contracts[phase] === null)
+    .map((phase) => ({
+      key: phase,
+      ref: `blocked:${phase}`,
+      blocker: CUSTOMER_LIFECYCLE_BLOCKER_LABELS[phase],
+    }));
+}
+
+function customerLifecycleReadiness(requiredEvidenceRefs, operatorGoLiveRef, contracts = null) {
+  const missingEvidenceRefs = missingLifecycleEvidenceRefs(requiredEvidenceRefs);
+  const contractBlockers = lifecycleContractExternalBlockers(contracts);
+  const externalLifecycleBlockers = customerLifecycleExternalBlockers(requiredEvidenceRefs, operatorGoLiveRef, contracts);
+  const sellable = missingEvidenceRefs.length === 0 && contractBlockers.length === 0 && operatorGoLiveRef !== null;
+  return {
+    ...HOSTED_CLOUD_CONTRACT_READY,
+    status: sellable ? 'operator_approved_evidence_packet' : 'blocked_lifecycle_evidence_or_operator_go_live',
+    evidence_validation_only: true,
+    lifecycle_evidence_complete: missingEvidenceRefs.length === 0,
+    operator_go_live_approved: operatorGoLiveRef !== null,
+    external_wiring_ready: externalLifecycleBlockers.length === 0,
+    hosted_cloud_sellable: sellable,
+    selling_gate: sellable ? 'evidence_complete_operator_go_live_approved' : 'blocked_until_lifecycle_evidence_and_operator_go_live',
+    external_blockers: externalLifecycleBlockers,
+    missing_evidence_refs: missingEvidenceRefs,
+  };
+}
+
+function lifecyclePhaseRows(requiredEvidenceRefs, contracts, operatorGoLiveRef) {
+  return HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PHASES.map((phase) => {
+    if (phase === 'operator_go_live') {
+      return {
+        phase,
+        evidence_ref: operatorGoLiveRef ?? 'blocked:operator_go_live',
+        evidence_status: operatorGoLiveRef === null ? BLOCKED : PROVIDED,
+        ready: operatorGoLiveRef !== null,
+        blocker: operatorGoLiveRef === null ? CUSTOMER_LIFECYCLE_BLOCKER_LABELS.operator_go_live : undefined,
+      };
+    }
+    const evidence = requiredEvidenceRefs[phase];
+    const row = {
+      phase,
+      evidence_ref: evidence.ref,
+      evidence_status: evidence.status,
+      ready: evidence.status === PROVIDED,
+    };
+    if (evidence.status === BLOCKED) row.blocker = evidence.blocker ?? CUSTOMER_LIFECYCLE_BLOCKER_LABELS[phase];
+    if (CUSTOMER_LIFECYCLE_CONTRACT_PHASES.includes(phase) && contracts[phase]) {
+      row.contract_schema = contracts[phase].schema;
+      row.contract_id = contracts[phase][lifecycleContractIdKey(phase)];
+      row.contract_hash = contracts[phase].contract_hash;
+    }
+    return row;
+  });
+}
+
+function customerLifecycleSafetyGuarantees() {
+  return {
+    opaque_reference_only: true,
+    customer_content_absent: true,
+    sensitive_text_absent: true,
+    auth_material_absent: true,
+    provider_payloads_absent: true,
+    financial_outcome_claim_absent: true,
+    remote_erasure_claim_absent: true,
+  };
+}
+
+function validateCustomerLifecycleSafetyGuarantees(guarantees) {
+  if (!isPlainObject(guarantees)) throw new TypeError('public_safety_guarantees must be present');
+  requiredTrue(guarantees.opaque_reference_only, 'public_safety_guarantees.opaque_reference_only');
+  requiredTrue(guarantees.customer_content_absent, 'public_safety_guarantees.customer_content_absent');
+  requiredTrue(guarantees.sensitive_text_absent, 'public_safety_guarantees.sensitive_text_absent');
+  requiredTrue(guarantees.auth_material_absent, 'public_safety_guarantees.auth_material_absent');
+  requiredTrue(guarantees.provider_payloads_absent, 'public_safety_guarantees.provider_payloads_absent');
+  requiredTrue(guarantees.financial_outcome_claim_absent, 'public_safety_guarantees.financial_outcome_claim_absent');
+  requiredTrue(guarantees.remote_erasure_claim_absent, 'public_safety_guarantees.remote_erasure_claim_absent');
+}
+
+function assertSameLifecycleArray(actual, expected, name) {
+  if (!Array.isArray(actual)) throw new TypeError(`${name} must be an array`);
+  if (JSON.stringify(canonicalize(actual)) !== JSON.stringify(canonicalize(expected))) throw new TypeError(`${name} must match required_evidence_refs and operator_go_live_ref`);
+}
+
+function validateCustomerLifecycleEvidenceRefs(requiredEvidenceRefs) {
+  if (!isPlainObject(requiredEvidenceRefs)) throw new TypeError('required_evidence_refs must be present');
+  for (const phase of CUSTOMER_LIFECYCLE_REQUIRED_EVIDENCE_PHASES) {
+    if (!Object.prototype.hasOwnProperty.call(requiredEvidenceRefs, phase)) throw new TypeError(`required_evidence_refs.${phase} must be present`);
+    const evidence = lifecycleEvidenceRefFor(phase, requiredEvidenceRefs[phase]);
+    requiredEvidenceRefs[phase] = evidence;
+  }
+  return requiredEvidenceRefs;
+}
+
+function validateCustomerLifecycleContracts(contracts) {
+  if (!isPlainObject(contracts)) throw new TypeError('contracts must be present');
+  for (const phase of CUSTOMER_LIFECYCLE_CONTRACT_PHASES) {
+    if (!Object.prototype.hasOwnProperty.call(contracts, phase)) throw new TypeError(`contracts.${phase} must be present`);
+    const contract = contracts[phase];
+    if (contract === null) continue;
+    if (!isPlainObject(contract)) throw new TypeError(`contracts.${phase} must be an object or null`);
+    switch (phase) {
+      case 'account':
+        validateUserAccountContract(contract);
+        break;
+      case 'tenant':
+        validateTenantContract(contract);
+        break;
+      case 'vault':
+        validateHostedVaultContract(contract);
+        break;
+      case 'api_key':
+        validateApiKeyContract(contract);
+        break;
+      case 'billing':
+        validateUsageBillingRecord(contract);
+        break;
+      case 'dashboard':
+        validateDashboardSummary(contract);
+        break;
+      case 'backup':
+        validateBackupDrillContract(contract);
+        break;
+      case 'incident_sla':
+        validateIncidentSlaRefs(contract);
+        break;
+      default:
+        throw new TypeError(`unknown lifecycle phase: ${phase}`);
+    }
+  }
+}
+
+function validateCustomerLifecycleReadiness(readiness, expected) {
+  if (!isPlainObject(readiness)) throw new TypeError('readiness must be present');
+  requiredTrue(readiness.contract_ready, 'readiness.contract_ready');
+  if (readiness.integration_kind !== HOSTED_CLOUD_CONTRACT_READY.integration_kind) throw new TypeError('readiness.integration_kind must remain contract_validator_only');
+  requiredTrue(readiness.no_external_provider_calls, 'readiness.no_external_provider_calls');
+  requiredTrue(readiness.evidence_validation_only, 'readiness.evidence_validation_only');
+  if (readiness.status !== expected.status) throw new TypeError('readiness.status must match lifecycle evidence and operator go-live approval');
+  if (readiness.lifecycle_evidence_complete !== expected.lifecycle_evidence_complete) throw new TypeError('readiness.lifecycle_evidence_complete must match required_evidence_refs');
+  if (readiness.operator_go_live_approved !== expected.operator_go_live_approved) throw new TypeError('readiness.operator_go_live_approved must match operator_go_live_ref');
+  if (readiness.external_wiring_ready !== expected.external_wiring_ready) throw new TypeError('readiness.external_wiring_ready must match blockers');
+  if (readiness.hosted_cloud_sellable !== expected.hosted_cloud_sellable) throw new TypeError('readiness.hosted_cloud_sellable must match lifecycle evidence and operator go-live approval');
+  if (readiness.selling_gate !== expected.selling_gate) throw new TypeError('readiness.selling_gate must match lifecycle evidence and operator go-live approval');
+  assertSameLifecycleArray(readiness.external_blockers, expected.external_blockers, 'readiness.external_blockers');
+  assertSameLifecycleArray(readiness.missing_evidence_refs, expected.missing_evidence_refs, 'readiness.missing_evidence_refs');
+}
+
+export function buildCustomerLifecyclePacket(input = {}) {
+  if (!isPlainObject(input)) throw new TypeError('buildCustomerLifecyclePacket requires an options object');
+  assertNoForbiddenPayload(input, 'input');
+  const contracts = lifecycleContractsFrom(input);
+  const requiredEvidenceRefs = lifecycleEvidenceRefsFrom(input, contracts);
+  const operatorGoLiveRef = operatorGoLiveRefFromInput(input);
+  const missingSurfaceRefs = missingLifecycleSurfaceRefs(contracts);
+  const readiness = customerLifecycleReadiness(requiredEvidenceRefs, operatorGoLiveRef, contracts);
+  const body = {
+    schema: HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA,
+    packet_id: stringOrDefault(input.packet_id ?? input.packetId, undefined),
+    generated_at: isoTimestamp(input.generated_at ?? input.generatedAt, 'generated_at'),
+    contracts,
+    required_evidence_refs: requiredEvidenceRefs,
+    lifecycle_phases: lifecyclePhaseRows(requiredEvidenceRefs, contracts, operatorGoLiveRef),
+    missing_surface_refs: missingSurfaceRefs,
+    external_blockers: readiness.external_blockers,
+    missing_evidence_refs: readiness.missing_evidence_refs,
+    operator_go_live_ref: operatorGoLiveRef,
+    readiness,
+    hosted_cloud_sellable: readiness.hosted_cloud_sellable,
+    guarantees: customerLifecycleSafetyGuarantees(),
+    public_safety_guarantees: customerLifecycleSafetyGuarantees(),
+  };
+  const packet = withContractIdentity(body, 'hcclp', 'packet_id');
+  validateCustomerLifecyclePacket(packet);
+  return packet;
+}
+
+export function validateCustomerLifecyclePacket(packet) {
+  if (!isPlainObject(packet)) throw new TypeError('packet must be an object');
+  assertNoForbiddenPayload(packet, 'packet');
+  if (packet.schema !== HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA) throw new TypeError(`schema must be ${HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA}`);
+  requiredString(packet.packet_id, 'packet_id');
+  isoTimestamp(packet.generated_at, 'generated_at');
+  requiredString(packet.contract_hash, 'contract_hash');
+  validateCustomerLifecycleContracts(packet.contracts);
+  if (!isPlainObject(packet.required_evidence_refs)) throw new TypeError('required_evidence_refs must be present');
+  const requiredEvidenceRefs = validateCustomerLifecycleEvidenceRefs({ ...packet.required_evidence_refs });
+  const operatorGoLiveRef = operatorGoLiveRefFromPacket(packet);
+  const expectedReadiness = customerLifecycleReadiness(requiredEvidenceRefs, operatorGoLiveRef, packet.contracts);
+  const expectedPhases = lifecyclePhaseRows(requiredEvidenceRefs, packet.contracts, operatorGoLiveRef);
+  assertSameLifecycleArray(packet.lifecycle_phases, expectedPhases, 'lifecycle_phases');
+  assertSameLifecycleArray(packet.external_blockers, expectedReadiness.external_blockers, 'external_blockers');
+  assertSameLifecycleArray(packet.missing_surface_refs, missingLifecycleSurfaceRefs(packet.contracts), 'missing_surface_refs');
+  assertSameLifecycleArray(packet.missing_evidence_refs, expectedReadiness.missing_evidence_refs, 'missing_evidence_refs');
+  validateCustomerLifecycleReadiness(packet.readiness, expectedReadiness);
+  if (packet.hosted_cloud_sellable !== expectedReadiness.hosted_cloud_sellable) throw new TypeError('hosted_cloud_sellable must match readiness.hosted_cloud_sellable');
+  validateCustomerLifecycleSafetyGuarantees(packet.guarantees ?? packet.public_safety_guarantees);
+  return true;
+}

package/packages/mcp-server/src/index.js

@@ -17,7 +17,7 @@ import {
 const DEFAULT_BUNDLE = '.enigma/bundle.json';
 const JSONRPC_VERSION = '2.0';
 const MCP_PROTOCOL_VERSION = '2024-11-05';
-const SERVER_INFO = Object.freeze({ name: 'enigma-mcp-server', version: '0.1.7' });
+const SERVER_INFO = Object.freeze({ name: 'enigma-mcp-server', version: '0.1.9' });
 const JSON_RPC_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
 const JSON_RPC_ERROR = Object.freeze({
   INVALID_REQUEST: -32600,

package/scripts/build-hosted-customer-lifecycle.mjs

@@ -0,0 +1,493 @@
+#!/usr/bin/env node
+import { writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+
+import {
+  HOSTED_CLOUD_API_KEY_SCHEMA,
+  HOSTED_CLOUD_BACKUP_DRILL_SCHEMA,
+  HOSTED_CLOUD_DASHBOARD_SCHEMA,
+  HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA,
+  HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PHASES,
+  HOSTED_CLOUD_EXTERNAL_BLOCKERS,
+  HOSTED_CLOUD_INCIDENT_SLA_SCHEMA,
+  HOSTED_CLOUD_TENANT_SCHEMA,
+  HOSTED_CLOUD_USAGE_BILLING_SCHEMA,
+  HOSTED_CLOUD_USER_ACCOUNT_SCHEMA,
+  HOSTED_CLOUD_VAULT_SCHEMA,
+  buildApiKeyContract,
+  buildBackupDrillContract,
+  buildDashboardSummary,
+  buildHostedVaultContract,
+  buildIncidentSlaRefs,
+  buildTenantContract,
+  buildUsageBillingRecord,
+  buildUserAccountContract,
+  buildCustomerLifecyclePacket,
+  validateCustomerLifecyclePacket,
+} from '../packages/hosted-cloud/src/index.js';
+
+export const HOSTED_CUSTOMER_LIFECYCLE_PACKET_SCHEMA = HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA;
+export const HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET = '0.1.9';
+
+const PROVIDED = 'provided';
+const BLOCKED_MISSING = 'blocked_missing_evidence';
+const BLOCKED_EXTERNAL = 'blocked_external_dependency';
+const ALLOWED_STATUSES = new Set([PROVIDED, BLOCKED_MISSING, BLOCKED_EXTERNAL]);
+const STATUS_ALIASES = Object.freeze({
+  blocked: BLOCKED_MISSING,
+  missing: BLOCKED_MISSING,
+  external: BLOCKED_EXTERNAL,
+});
+
+const CONTRACT_EVIDENCE = Object.freeze([
+  {
+    key: 'user_account',
+    label: 'Hosted user account contract',
+    schema: HOSTED_CLOUD_USER_ACCOUNT_SCHEMA,
+    contractKey: 'user_account',
+    idField: 'account_id',
+  },
+  {
+    key: 'tenant',
+    label: 'Hosted tenant contract',
+    schema: HOSTED_CLOUD_TENANT_SCHEMA,
+    contractKey: 'tenant',
+    idField: 'tenant_id',
+  },
+  {
+    key: 'hosted_vault',
+    label: 'Hosted vault contract',
+    schema: HOSTED_CLOUD_VAULT_SCHEMA,
+    contractKey: 'hosted_vault',
+    idField: 'vault_id',
+  },
+  {
+    key: 'api_key_metadata',
+    label: 'API key metadata contract',
+    schema: HOSTED_CLOUD_API_KEY_SCHEMA,
+    contractKey: 'api_key_metadata',
+    idField: 'api_key_id',
+  },
+  {
+    key: 'billing',
+    label: 'Usage billing contract',
+    schema: HOSTED_CLOUD_USAGE_BILLING_SCHEMA,
+    contractKey: 'billing',
+    idField: 'billing_record_id',
+  },
+  {
+    key: 'dashboard',
+    label: 'Dashboard summary contract',
+    schema: HOSTED_CLOUD_DASHBOARD_SCHEMA,
+    contractKey: 'dashboard',
+    idField: 'dashboard_id',
+  },
+  {
+    key: 'backup_drill',
+    label: 'Backup drill contract',
+    schema: HOSTED_CLOUD_BACKUP_DRILL_SCHEMA,
+    contractKey: 'backup_drill',
+    idField: 'backup_drill_id',
+  },
+  {
+    key: 'incident_sla_refs',
+    label: 'Incident and SLA refs contract',
+    schema: HOSTED_CLOUD_INCIDENT_SLA_SCHEMA,
+    contractKey: 'incident_sla_refs',
+    idField: 'incident_sla_id',
+  },
+]);
+const CONTRACT_EVIDENCE_KEYS = new Set(CONTRACT_EVIDENCE.map(({ key }) => key));
+const EXTERNAL_BLOCKER_KEYS = new Set(HOSTED_CLOUD_EXTERNAL_BLOCKERS);
+const ADDITIONAL_LIFECYCLE_EVIDENCE_KEYS = Object.freeze(['monitoring']);
+const EVIDENCE_KEY_ALIASES = Object.freeze({
+  account: 'user_account',
+  vault: 'hosted_vault',
+  api_key: 'api_key_metadata',
+  backup: 'backup_drill',
+  incident_sla: 'incident_sla_refs',
+  support: 'support_ownership',
+  legal: 'legal_docs',
+  security_review: 'external_security_review',
+});
+export const HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS = Object.freeze([
+  ...CONTRACT_EVIDENCE.map(({ key }) => key),
+  ...HOSTED_CLOUD_EXTERNAL_BLOCKERS,
+  ...ADDITIONAL_LIFECYCLE_EVIDENCE_KEYS,
+]);
+const LIFECYCLE_EVIDENCE_KEY_SET = new Set([
+  ...HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS,
+  ...Object.keys(EVIDENCE_KEY_ALIASES),
+]);
+
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw memory|plaintext prompts?|plain text prompts?|private prompts?|provider responses?|full transcript|decrypted memory|credentials?|secrets?|passwords?|private keys?|api key secret|api secrets?|access tokens?|refresh tokens?|token values?|credential material)\b)/iu;
+const FORBIDDEN_CLAIM_RE = /(?:token\s+(?:roi|profit|return|investment|price)|financial\s+roi|roi\s+claim|(?:roi|profit|return)\s+(?:from|on)\s+token|guaranteed\s+(?:savings|profit|return)|provider(?:-side|\s+side)?\s+(?:deletion|erasure)|model\s+(?:forgetting|forgot|erasure)|makes?\s+models?\s+forget|deleted\s+from\s+every\s+provider)/iu;
+
+function assertPublicSafeString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new Error(`${label} must be a non-empty public ref`);
+  if (SECRET_VALUE_RE.test(value) || FORBIDDEN_CLAIM_RE.test(value)) {
+    throw new Error(`${label} contains non-public hosted-cloud material`);
+  }
+  return value.trim();
+}
+
+function normalizeStatus(status, key) {
+  const normalized = STATUS_ALIASES[status] ?? status;
+  if (!ALLOWED_STATUSES.has(normalized)) throw new Error('evidence status must be provided, blocked_missing_evidence, or blocked_external_dependency');
+  if (EXTERNAL_BLOCKER_KEYS.has(key) && normalized === BLOCKED_MISSING) return BLOCKED_EXTERNAL;
+  if (CONTRACT_EVIDENCE_KEYS.has(key) && normalized === BLOCKED_EXTERNAL) return BLOCKED_MISSING;
+  return normalized;
+}
+
+function defaultEvidenceRef(key) {
+  const status = EXTERNAL_BLOCKER_KEYS.has(key) ? BLOCKED_EXTERNAL : BLOCKED_MISSING;
+  return {
+    key,
+    status,
+    ref: `blocked:${key}`,
+    blocker: EXTERNAL_BLOCKER_KEYS.has(key)
+      ? `External ${key.replaceAll('_', ' ')} evidence is not provided.`
+      : `Public-safe ${key.replaceAll('_', ' ')} evidence is not provided.`,
+  };
+}
+
+function normalizeEvidenceRecord(key, record) {
+  const status = normalizeStatus(record.status ?? PROVIDED, key);
+  const ref = assertPublicSafeString(record.ref, 'evidence ref');
+  const output = { key, status, ref };
+  if (status !== PROVIDED) output.blocker = record.blocker ?? defaultEvidenceRef(key).blocker;
+  return output;
+}
+
+export function parseEvidenceRef(value) {
+  const raw = assertPublicSafeString(value, 'evidence ref argument');
+  const equalsIndex = raw.indexOf('=');
+  if (equalsIndex <= 0 || equalsIndex === raw.length - 1) throw new Error('evidence refs must use key=status:ref');
+  const rawKey = raw.slice(0, equalsIndex).trim();
+  const key = EVIDENCE_KEY_ALIASES[rawKey] ?? rawKey;
+  if (!LIFECYCLE_EVIDENCE_KEY_SET.has(rawKey) || !HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS.includes(key)) throw new Error(`evidence key must be one of: ${HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS.join(', ')}`);
+  const body = raw.slice(equalsIndex + 1).trim();
+  const colonIndex = body.indexOf(':');
+  if (colonIndex > 0) {
+    const possibleStatus = body.slice(0, colonIndex);
+    if (ALLOWED_STATUSES.has(possibleStatus) || STATUS_ALIASES[possibleStatus]) {
+      return normalizeEvidenceRecord(key, { status: possibleStatus, ref: body.slice(colonIndex + 1) });
+    }
+  }
+  return normalizeEvidenceRecord(key, { status: PROVIDED, ref: body });
+}
+
+function normalizeEvidenceRefs(records = []) {
+  const refs = Object.fromEntries(HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS.map((key) => [key, defaultEvidenceRef(key)]));
+  for (const rawRecord of records) {
+    const record = typeof rawRecord === 'string' ? parseEvidenceRef(rawRecord) : rawRecord;
+    refs[record.key] = normalizeEvidenceRecord(record.key, record);
+  }
+  return refs;
+}
+
+function operatorEvidenceRefsFrom(evidenceRefs) {
+  return Object.fromEntries(HOSTED_CLOUD_EXTERNAL_BLOCKERS.map((key) => {
+    const evidence = evidenceRefs[key];
+    if (evidence.status === PROVIDED) return [key, { status: PROVIDED, ref: evidence.ref }];
+    return [key, { status: BLOCKED_EXTERNAL, ref: evidence.ref, blocker: evidence.blocker }];
+  }));
+}
+
+function phaseFor(definition, evidence, contract) {
+  return {
+    phase: definition.key,
+    label: definition.label,
+    contract_schema: definition.schema,
+    evidence_ref: evidence.ref,
+    status: evidence.status === PROVIDED ? 'evidence_ref_provided' : evidence.status,
+    contract_id: contract?.[definition.idField] ?? null,
+  };
+}
+
+function lifecycleReadiness(evidenceRefs, operatorGoLiveRef) {
+  const missingEvidenceRefs = Object.values(evidenceRefs)
+    .filter((evidence) => evidence.status !== PROVIDED)
+    .map(({ key, status, ref, blocker }) => ({ key, status, ref, blocker }));
+  const allEvidenceProvided = missingEvidenceRefs.length === 0;
+  const operatorGoLiveProvided = typeof operatorGoLiveRef === 'string' && operatorGoLiveRef.length > 0;
+  const hostedCloudSellable = allEvidenceProvided && operatorGoLiveProvided;
+  const status = hostedCloudSellable
+    ? 'operator_approved_evidence_packet'
+    : allEvidenceProvided
+      ? 'blocked_operator_go_live_approval'
+      : 'blocked_missing_evidence';
+  return {
+    status,
+    hosted_cloud_sellable: hostedCloudSellable,
+    evidence_validation_only: true,
+    provider_wiring_performed: false,
+    no_external_provider_calls: true,
+    all_evidence_refs_provided: allEvidenceProvided,
+    operator_go_live_approval_ref: operatorGoLiveRef ?? 'blocked:operator_go_live_approval',
+    operator_go_live_approval_provided: operatorGoLiveProvided,
+    missing_evidence_refs: missingEvidenceRefs,
+    external_blockers: HOSTED_CLOUD_EXTERNAL_BLOCKERS
+      .map((key) => evidenceRefs[key])
+      .filter((evidence) => evidence.status !== PROVIDED)
+      .map(({ key, ref, blocker }) => ({ key, ref, blocker })),
+  };
+}
+
+function refFor(evidenceRefs, key) {
+  return evidenceRefs[key].ref;
+}
+
+function buildContractFragments({ tenantId, generatedAt, evidenceRefs }) {
+  const operator_evidence_refs = operatorEvidenceRefsFrom(evidenceRefs);
+  const base = { tenant_id: tenantId, generated_at: generatedAt, operator_evidence_refs };
+  const tenant = buildTenantContract({
+    ...base,
+    tenant_ref: refFor(evidenceRefs, 'tenant'),
+    policy_ref: refFor(evidenceRefs, 'tenant'),
+    retention_policy_ref: refFor(evidenceRefs, 'tenant'),
+    data_residency_ref: refFor(evidenceRefs, 'tenant'),
+  });
+  const userAccount = buildUserAccountContract({
+    ...base,
+    subject_ref: refFor(evidenceRefs, 'user_account'),
+    auth_provider_user_ref: refFor(evidenceRefs, 'auth_provider'),
+  });
+  const hostedVault = buildHostedVaultContract({
+    ...base,
+    vault_ref: refFor(evidenceRefs, 'hosted_vault'),
+    storage_ref: refFor(evidenceRefs, 'hosted_vault'),
+    kms_key_ref: refFor(evidenceRefs, 'hosted_vault'),
+    backup_policy_ref: refFor(evidenceRefs, 'backup_drill'),
+    retention_policy_ref: refFor(evidenceRefs, 'tenant'),
+  });
+  const apiKeyMetadata = buildApiKeyContract({
+    ...base,
+    subject_ref: refFor(evidenceRefs, 'user_account'),
+    key_fingerprint: `fingerprint:${refFor(evidenceRefs, 'api_key_metadata')}`,
+    issued_at: generatedAt,
+    rotation_ref: refFor(evidenceRefs, 'api_key_metadata'),
+  });
+  const billing = buildUsageBillingRecord({
+    ...base,
+    period_start: generatedAt,
+    period_end: generatedAt,
+    billing_provider_customer_ref: refFor(evidenceRefs, 'billing_provider'),
+    usage_aggregate_ref: refFor(evidenceRefs, 'billing'),
+    metered_event_count: 0,
+    billable_units: 0,
+    amount_due_minor_units: 0,
+  });
+  const incidentSlaRefs = buildIncidentSlaRefs({
+    ...base,
+    incident_response_ref: refFor(evidenceRefs, 'incident_sla_refs'),
+    sla_policy_ref: refFor(evidenceRefs, 'incident_sla_refs'),
+    support_owner_ref: refFor(evidenceRefs, 'support_ownership'),
+    escalation_policy_ref: refFor(evidenceRefs, 'incident_sla_refs'),
+    status_page_ref: refFor(evidenceRefs, 'incident_sla_refs'),
+  });
+  const backupDrill = buildBackupDrillContract({
+    ...base,
+    vault_ref: hostedVault.vault_ref,
+    performed_at: generatedAt,
+    backup_snapshot_ref: refFor(evidenceRefs, 'backup_drill'),
+    restore_evidence_ref: refFor(evidenceRefs, 'backup_drill'),
+    rpo_minutes: 0,
+    rto_minutes: 0,
+  });
+  const dashboard = buildDashboardSummary({
+    ...base,
+    account_count: 0,
+    active_api_key_count: 0,
+    hosted_vault_count: 0,
+    billing_period_ref: billing.billing_record_id,
+    open_incident_count: 0,
+    backup_drill_ref: backupDrill.backup_drill_id,
+    incident_sla_ref: incidentSlaRefs.incident_sla_id,
+  });
+  return {
+    user_account: userAccount,
+    tenant,
+    hosted_vault: hostedVault,
+    api_key_metadata: apiKeyMetadata,
+    billing,
+    dashboard,
+    backup_drill: backupDrill,
+    incident_sla_refs: incidentSlaRefs,
+  };
+}
+
+function canonicalContractsFrom(contracts) {
+  return {
+    account: contracts.user_account,
+    tenant: contracts.tenant,
+    vault: contracts.hosted_vault,
+    api_key: contracts.api_key_metadata,
+    billing: contracts.billing,
+    dashboard: contracts.dashboard,
+    backup: contracts.backup_drill,
+    incident_sla: contracts.incident_sla_refs,
+  };
+}
+
+function firstBlockedEvidence(evidenceRefs, keys) {
+  for (const key of keys) {
+    if (evidenceRefs[key].status !== PROVIDED) return evidenceRefs[key];
+  }
+  return null;
+}
+
+function providedLifecycleEvidence(evidence) {
+  return { status: PROVIDED, ref: evidence.ref };
+}
+
+function blockedLifecycleEvidence(evidence) {
+  return {
+    status: BLOCKED_EXTERNAL,
+    ref: evidence.ref,
+    blocker: evidence.blocker,
+  };
+}
+
+function coreEvidenceFor(evidenceRefs, phase, keys) {
+  const blocked = firstBlockedEvidence(evidenceRefs, keys);
+  if (blocked) return blockedLifecycleEvidence(blocked);
+  return providedLifecycleEvidence(evidenceRefs[keys[0]]);
+}
+
+function coreRequiredEvidenceRefs(evidenceRefs) {
+  const refs = {
+    account: coreEvidenceFor(evidenceRefs, 'account', ['user_account', 'auth_provider']),
+    tenant: coreEvidenceFor(evidenceRefs, 'tenant', ['tenant']),
+    vault: coreEvidenceFor(evidenceRefs, 'vault', ['hosted_vault']),
+    api_key: coreEvidenceFor(evidenceRefs, 'api_key', ['api_key_metadata']),
+    billing: coreEvidenceFor(evidenceRefs, 'billing', ['billing', 'billing_provider']),
+    dashboard: coreEvidenceFor(evidenceRefs, 'dashboard', ['dashboard']),
+    backup: coreEvidenceFor(evidenceRefs, 'backup', ['backup_drill']),
+    incident_sla: coreEvidenceFor(evidenceRefs, 'incident_sla', ['incident_sla_refs']),
+    support: coreEvidenceFor(evidenceRefs, 'support', ['support_ownership']),
+    monitoring: coreEvidenceFor(evidenceRefs, 'monitoring', ['monitoring']),
+    legal: coreEvidenceFor(evidenceRefs, 'legal', ['legal_docs', 'data_processing_terms']),
+    security_review: coreEvidenceFor(evidenceRefs, 'security_review', ['external_security_review']),
+  };
+  return Object.fromEntries(HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PHASES
+    .filter((phase) => phase !== 'operator_go_live')
+    .map((phase) => [phase, refs[phase]]));
+}
+
+function scriptBoundary() {
+  return {
+    public_safe_packet_only: true,
+    aggregates_contract_validators_only: true,
+    deploys_or_calls_external_providers: false,
+    sensitive_material_written: false,
+    customer_content_stored: false,
+    provider_wiring_required_elsewhere: true,
+  };
+}
+
+export function buildHostedCustomerLifecyclePacket(options = {}) {
+  const generatedAt = options.generatedAt ?? new Date().toISOString();
+  const tenantId = assertPublicSafeString(options.tenant ?? options.tenantId ?? 'blocked:tenant', 'tenant');
+  const domain = assertPublicSafeString(options.domain ?? 'blocked:domain', 'domain');
+  const environment = assertPublicSafeString(options.environment ?? 'blocked:environment', 'environment');
+  const operatorGoLiveRef = options.operatorGoLiveRef === undefined
+    ? null
+    : assertPublicSafeString(options.operatorGoLiveRef, 'operator go-live ref');
+  const evidenceRefs = normalizeEvidenceRefs(options.evidenceRefs ?? []);
+  const contractFragments = buildContractFragments({ tenantId, generatedAt, evidenceRefs });
+  const packet = buildCustomerLifecyclePacket({
+    generated_at: generatedAt,
+    contracts: canonicalContractsFrom(contractFragments),
+    required_evidence_refs: coreRequiredEvidenceRefs(evidenceRefs),
+    operator_go_live_ref: operatorGoLiveRef,
+  });
+  validateCustomerLifecyclePacket(packet);
+  return {
+    ...packet,
+    release_target: HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET,
+    tenant_id: tenantId,
+    domain,
+    environment,
+    evidence_refs: Object.fromEntries(Object.entries(evidenceRefs).map(([key, value]) => [key, { ...value }])),
+    operator_external_evidence_refs: operatorEvidenceRefsFrom(evidenceRefs),
+    boundary: scriptBoundary(),
+  };
+}
+
+export function parseArgs(argv) {
+  const args = {
+    tenant: undefined,
+    domain: undefined,
+    environment: undefined,
+    operatorGoLiveRef: undefined,
+    evidenceRefs: [],
+    out: undefined,
+    help: false,
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') {
+      args.help = true;
+      continue;
+    }
+    const readValue = (name) => {
+      index += 1;
+      if (index >= argv.length || argv[index].startsWith('--')) throw new Error(`${name} requires a value`);
+      return argv[index];
+    };
+    if (arg === '--tenant') args.tenant = assertPublicSafeString(readValue('--tenant'), 'tenant');
+    else if (arg === '--domain') args.domain = assertPublicSafeString(readValue('--domain'), 'domain');
+    else if (arg === '--environment') args.environment = assertPublicSafeString(readValue('--environment'), 'environment');
+    else if (arg === '--operator-go-live-ref') args.operatorGoLiveRef = assertPublicSafeString(readValue('--operator-go-live-ref'), 'operator go-live ref');
+    else if (arg === '--evidence-ref') args.evidenceRefs.push(parseEvidenceRef(readValue('--evidence-ref')));
+    else if (arg === '--out') args.out = assertPublicSafeString(readValue('--out'), 'output file');
+    else throw new Error('unknown option; use --help');
+  }
+  return args;
+}
+
+export function usage() {
+  return `Usage: node scripts/build-hosted-customer-lifecycle.mjs [options]
+
+Build a public-safe hosted customer lifecycle packet. This script validates local contract fragments only; it does not deploy, create accounts, call providers, or write secrets.
+
+Options:
+  --tenant <id>                    Tenant id. Defaults to blocked:tenant.
+  --domain <domain>                Customer domain. Defaults to blocked:domain.
+  --environment <env>              Environment label. Defaults to blocked:environment.
+  --operator-go-live-ref <ref>     Explicit operator approval evidence ref.
+  --evidence-ref <key=status:ref>  Repeatable evidence ref. key=<ref> implies provided.
+                                   Status: provided, blocked_missing_evidence, blocked_external_dependency.
+                                   Keys: ${HOSTED_CUSTOMER_LIFECYCLE_EVIDENCE_KEYS.join(', ')}
+  --out <file>                     Also write the packet JSON to a file.
+  --help                           Show this help.
+`;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(usage());
+    return 0;
+  }
+  const packet = buildHostedCustomerLifecyclePacket(args);
+  const json = `${JSON.stringify(packet, null, 2)}\n`;
+  if (args.out) {
+    try {
+      await writeFile(args.out, json, 'utf8');
+    } catch {
+      throw new Error('failed to write lifecycle packet output');
+    }
+  }
+  process.stdout.write(json);
+  return 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().catch((error) => {
+    process.stderr.write(`Error: ${error?.message ?? 'failed to build lifecycle packet'}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/build-installer-assets.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 
 export const INSTALLER_ASSET_SCHEMA = 'enigma.installer_assets.v1';
 export const INSTALLER_ASSET_PACKAGE = 'enigma-memory';
-export const INSTALLER_ASSET_VERSION = '0.1.7';
+export const INSTALLER_ASSET_VERSION = '0.1.9';
 export const INSTALLER_ASSET_GENERATED_AT = '1970-01-01T00:00:00.000Z';
 
 const SCRIPT_PATH = fileURLToPath(import.meta.url);

package/scripts/run-standard-memory-benchmarks.mjs

@@ -995,7 +995,7 @@ function buildSuiteReport(datasetRows, topK, options) {
     generated_at: options.generated_at ?? new Date().toISOString(),
     package: {
       name: 'enigma-memory',
-      version: '0.1.7',
+      version: '0.1.9',
     },
     public_safe: true,
     top_k: topK,