fullstackgtm 0.48.0 → 0.50.0

package/dist/secureFile.js

@@ -0,0 +1,164 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, closeSync, constants, fsyncSync, fchmodSync, fstatSync, lstatSync, openSync, renameSync, unlinkSync, writeFileSync, readFileSync, } from "node:fs";
+import { dirname, isAbsolute, parse, resolve } from "node:path";
+export class UnsafeManagedPathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsafeManagedPathError";
+    }
+}
+export function assertNoSymlinkComponents(path) {
+    const absolute = isAbsolute(path) ? path : resolve(path);
+    const root = parse(absolute).root;
+    const relative = absolute.slice(root.length);
+    let current = root;
+    for (const component of relative.split(/[\\/]+/).filter(Boolean)) {
+        current = resolve(current, component);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to use unsafe path containing a symbolic link: ${current}`);
+        }
+    }
+}
+/** Read a managed file through a no-follow descriptor and require a regular file. */
+export function readSecureRegularFile(path, options = {}) {
+    const absolute = resolve(path);
+    assertNoSymlinkComponents(dirname(absolute));
+    try {
+        if (lstatSync(absolute).isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDONLY | noFollow);
+        const stat = fstatSync(fd);
+        if (!stat.isFile()) {
+            throw new UnsafeManagedPathError(`Refusing to read non-regular file: ${absolute}`);
+        }
+        if (options.tightenMode !== undefined) {
+            const previousMode = stat.mode & 0o777;
+            if ((previousMode & ~options.tightenMode) !== 0) {
+                try {
+                    fchmodSync(fd, options.tightenMode);
+                    options.onModeTightened?.(previousMode);
+                }
+                catch {
+                    // Windows and some non-POSIX filesystems do not implement chmod.
+                }
+            }
+        }
+        return readFileSync(fd, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ELOOP") {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Atomically replace a private file without ever opening the destination.
+ * Existing destination and parent symlinks are rejected. The temporary file
+ * is created exclusively beside the destination so rename remains atomic.
+ */
+export function writeSecureFileAtomic(path, contents) {
+    const destination = resolve(path);
+    const parent = dirname(destination);
+    assertNoSymlinkComponents(parent);
+    try {
+        if (lstatSync(destination).isSymbolicLink()) {
+            throw new Error(`Refusing to replace symbolic link: ${destination}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let temporary = "";
+    let fd;
+    try {
+        for (let attempt = 0; attempt < 10; attempt++) {
+            temporary = `${destination}.tmp-${process.pid}-${randomBytes(8).toString("hex")}`;
+            try {
+                const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+                fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+        }
+        if (fd === undefined)
+            throw new Error(`Unable to create an exclusive temporary file for ${destination}`);
+        writeFileSync(fd, contents);
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        try {
+            chmodSync(temporary, 0o600);
+        }
+        catch {
+            // Windows and some non-POSIX filesystems do not implement chmod.
+        }
+        // Recheck immediately before replacement. rename replaces a symlink rather
+        // than following it, but rejecting one makes managed-path policy explicit.
+        try {
+            if (lstatSync(destination).isSymbolicLink()) {
+                throw new Error(`Refusing to replace symbolic link: ${destination}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        assertNoSymlinkComponents(parent);
+        renameSync(temporary, destination);
+        temporary = "";
+        // Persist the directory entry where supported. Opening/fsyncing a
+        // directory is not available on Windows, so this durability enhancement is
+        // deliberately best-effort there.
+        let directoryFd;
+        try {
+            directoryFd = openSync(parent, constants.O_RDONLY);
+            fsyncSync(directoryFd);
+        }
+        catch {
+            // Unsupported by the platform/filesystem.
+        }
+        finally {
+            if (directoryFd !== undefined)
+                closeSync(directoryFd);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (temporary) {
+            try {
+                unlinkSync(temporary);
+            }
+            catch {
+                // Best-effort cleanup after a failed write.
+            }
+        }
+    }
+}

package/dist/types.d.ts

@@ -7,7 +7,7 @@
  */
 export type CrmProvider = "salesforce" | "hubspot" | "mock" | "unknown" | (string & {});
 export type RiskLevel = "low" | "medium" | "high";
-export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "rejected" | "applied";
+export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "applying" | "rejected" | "applied";
 export type GtmObjectType = "account" | "contact" | "deal" | "user" | "activity";
 export type GtmEvidenceSourceSystem = "salesforce" | "hubspot" | "gong" | "chorus" | "fathom" | "manual" | "csv" | "mock" | "web" | "unknown";
 export type PatchOperationType = "set_field" | "clear_field" | "link_record" | "archive_record" | "create_task" | "create_record" | "merge_records";

package/docs/api.md

@@ -62,6 +62,12 @@ release.
 
 - `fullstackgtm.config.json`: `{ policy?, rules?: { enabled?, disabled? }, rulePackages? }`.
 - Rule packages export `rules: GtmAuditRule[]`.
+- Rule packages are executable code and are fail-closed. CLI execution requires
+  an explicit `--config <path> --allow-plugins`; `--no-plugins` applies only
+  declarative policy/rule filters. An implicitly discovered config never grants
+  plugin trust.
+- MCP never executes rule packages. Mutable tool-call paths are not accepted as
+  a durable code-trust boundary; use the reviewed CLI plugin flow instead.
 - Precedence: CLI flags > config file > defaults.
 
 ## CLI
@@ -223,6 +229,15 @@ webhook landing-zone format (docs/signal-spool-format.md).
 
 ## Acquire (net-new lead generation)
 
+API discovery is continuation-aware. Completed acquire runs persist a
+provider/source/list/query-keyed Pipe0 cursor, Explorium page, or HeyReach list
+offset, plus the discovered → qualified → deduped → resolved → proposed funnel.
+Each list progresses independently. If a broker credential exists, GET/POST
+`/api/cli/acquisition-checkpoint` synchronizes the opaque checkpoint inside the
+token's organization using numeric compare-and-swap revisions; unpaired and
+offline CLIs remain local-first. A changed ICP/list starts a new traversal. CLI
+`--max` sets desired new leads while `--scan-limit` bounds raw candidates.
+
 `buildAcquirePlan` turns sourced-but-unmatched prospects into `create_record`
 operations (matched / ambiguous are skipped — resolve-first never creates over
 a possible dup), capped by the meter's headroom. `builtinAcquirePreset` is the
@@ -283,8 +298,40 @@ domain stamped — so the acquired account is immediately signal-watchable
 `CanonicalContact.linkedin` (mapped from HubSpot `hs_linkedin_url`) is the
 strong dedup key across all of the above.
 
+## Apply recovery
+
+Store-backed applies persist an apply-attempt claim before provider I/O. If the
+process exits without a completed run, the plan remains `applying`: the CLI
+cannot know whether a remote write landed and will not replay it. Inspect the
+attempt with `fullstackgtm plans show <id>` and reconcile the named provider's
+records. Only then run:
+
+```bash
+fullstackgtm plans recover <id> --acknowledge-uncertain-writes
+```
+
+Recovery performs no provider calls. It clears the old approvals and returns
+the plan to `needs_approval`, requiring a fresh review and signed approval
+before another apply. Provider APIs do not all expose idempotency keys, so this
+operator reconciliation remains necessary after a timeout or crash.
+
 ## Schedule
 
+## Hosted patch-plan mirror
+
+`uploadHostedPatchPlan(stored)` mirrors a bounded review document when the
+active profile has a secure broker pairing. `readHostedPatchPlan(planId)` reads
+the org-scoped hosted decision, and `reportHostedPlanLifecycle(stored)` reflects
+local approval/rejection/application. Upload is local-first and best-effort;
+immutable hash conflicts fail closed. Hosted approval does not carry local
+signing material: `apply --plan-id` verifies the hash and operation set before
+`PlanStore.approveOperations` generates machine-local approval digests.
+
+The hosted transport intentionally excludes findings, evidence, signing
+digests/keys, apply claims and attempt notes, provider results, and raw run
+errors. Operation before/after values are included because the paired
+organization needs them to review the proposed CRM changes.
+
 The horizontal scheduler: a declarative schedule-entry store, a
 dependency-free 5-field cron parser, and the read/plan-side `SCHEDULABLE`
 allowlist. `validateSchedulableArgv` enforces the allowlist at `schedule add`
@@ -347,8 +394,12 @@ the stored capture it cites before a set is accepted; failed captures read as
 Tools: `fullstackgtm_capabilities` (the machine-readable server contract —
 tool inventory with per-tool CRM-write flags, derived from the server's own
 registration table), `fullstackgtm_audit`, `fullstackgtm_rules`,
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_apply` (accepts only a stored `planId`; approved operation ids and
+placeholder values come exclusively from the HMAC-signed plan store),
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`, `fullstackgtm_resolve`,
 `fullstackgtm_market_worksheet`, `fullstackgtm_market_observe` (validates,
 verifies quoted spans against the stored captures, appends, returns front
-states). Input schemas are stable.
+states). Input schemas are stable. MCP never executes rule packages and cannot
+accept external plan files or caller-supplied approvals/value overrides. An
+uncertain apply is reconciled with the CLI `plans recover` workflow and is
+never replayed automatically.

package/docs/architecture.md

@@ -27,14 +27,22 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
                          plans approve  (planStore.ts + integrity.ts: HMAC-signed)
                                       │
                                       ▼
+                    atomic apply claim + durable attempt journal
+                                      │
+                                      ▼
                     applyPatchPlan (connector.ts): for each APPROVED op —
                     compare-and-set vs live value, precondition + guard recheck,
                     irreversible-op drift guard → connector.applyOperation()
                                       │
                                       ▼
-                               PatchPlanRun  (the audit record; auditLog.ts exports it)
+                               PatchPlanRun  (claim-bound audit record)
 ```
 
+An interrupted provider attempt stays `applying`/uncertain. Recovery never
+replays automatically: reconcile provider state, then `plans recover ...
+--acknowledge-uncertain-writes` clears approvals and returns the plan to
+`needs_approval` for a fresh signed review.
+
 ## Module map (`src/`)
 
 **Contracts & model**
@@ -49,12 +57,15 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
 - `audit.ts` — runs rules over a snapshot into a `PatchPlan`.
 - `suggest.ts` — derives concrete values for `requires_human_*` placeholders from
   snapshot evidence, with confidence + reasons.
-- `planStore.ts` — durable plan lifecycle (save / approve / record runs), 0600.
+- `planStore.ts` — durable plan lifecycle (save / approve / atomic claim /
+  attempt journal / no-replay recovery / claim-bound runs), atomic 0600 files.
 - `integrity.ts` — HMAC-signs approvals (per-install key) and verifies at apply.
 - `connector.ts` — `applyPatchPlan`: the safety contract (approval filter,
   placeholder refusal, CAS, precondition/guard recheck, irreversible-op drift
   guard). Provider-agnostic.
 - `auditLog.ts` — hash-chained, signed export of every apply run.
+- `secureFile.ts` — atomic no-follow sensitive-file reads/writes.
+- `publicHttp.ts` — DNS-pinned, redirect-validating, bounded public-only HTTP.
 
 **Governed write verbs (each builds a plan; never writes directly)**
 - `bulkUpdate.ts`, `dedupe.ts`, `reassign.ts`, `route.ts` — filtered,
@@ -83,6 +94,15 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
   translation, prospect fit scoring, and the agent-driven interview spec.
 - `acquireMeter.ts` — per-profile windowed budget (records + spend) for acquire.
 - `acquireSeen.ts` — cross-run "seen" cache so re-runs don't re-pay for dupes.
+- `acquireCheckpoint.ts` — secure profile-scoped, provider/source/list/query-keyed
+  continuation store; each audience advances independently.
+- `hostedAcquireCheckpoint.ts` — optional broker-authenticated checkpoint
+  transport. Organization identity is resolved server-side; numeric CAS
+  revisions prevent stale workers from overwriting newer continuation.
+- `hostedPatchPlan.ts` — best-effort paired-CLI plan mirroring and decision
+  reconciliation. Review documents are immutable/hash-bound; hosted approval
+  becomes executable only after the CLI verifies it and generates local HMAC
+  signatures. Hosted never owns the apply lease for CLI-origin plans.
 - `assign.ts` — `AssignmentPolicy` (fixed / round-robin / territory /
   account-owner): the pure owner-routing rule `buildAcquirePlan` stamps onto new
   leads (never born ownerless) and `reassign --assign-unowned` reuses to backfill.

package/llms.txt

@@ -10,6 +10,13 @@ CLI quick check: `fullstackgtm doctor --json`. Zero-credential demo:
 explicitly approved operation ids. Exit codes: 0 success, 1 error, 2 findings
 at/above `--fail-on`.
 
+MCP apply accepts only a stored `planId`; approvals and concrete values come
+from the HMAC-signed plan store, never the tool caller. MCP never executes rule
+packages or external plans. Store-backed apply is single-owner and journaled;
+an interrupted provider attempt remains uncertain and is never auto-replayed.
+After reconciling provider state, `plans recover <id>
+--acknowledge-uncertain-writes` clears approvals for a fresh human review.
+
 ## Docs
 
 - [README](https://github.com/fullstackgtm/core/blob/main/README.md): install, five-minute loop, auth ladder, MCP setup, programmatic use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",
@@ -45,10 +45,12 @@
     "DATA-FLOWS.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "clean": "node scripts/clean.mjs",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
     "pretest": "test -d tests || { echo 'No tests/ in this directory. In the published mirror, tests live here and `npm test` works. In the monorepo, run package tests from the repo ROOT: `node --experimental-strip-types --test tests/fullstackgtm*.test.ts` (the tests live at the monorepo root tests/).' >&2; exit 1; }",
     "test": "node --experimental-strip-types --test tests/*.test.ts",
-    "prepublishOnly": "npm run build && npm pack --dry-run && node dist/bin.js --help && node dist/mcp-bin.js --help"
+    "verify:package": "npm run build && node scripts/verify-packed-install.mjs --with-peers",
+    "prepublishOnly": "npm run verify:package"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/skills/fullstackgtm/SKILL.md

@@ -63,7 +63,7 @@ credentials AND stored plans per client org.
 | `backfill stripe\|runs [--since <iso>] [--pipeline <id\|label>]` | Paid Stripe invoices → proposed closed-won deals (amount = invoice total, close date = paid date, company matched by billing-email domain then name); deduped by a `stripe_invoice_id` deal property re-resolved at apply, so re-running never double-creates; a customer the CRM doesn't know gets a proposed account create in the same plan (freemail domains never used; `--skip-unmatched` = report-only); `--save` → approve → `apply`. `backfill runs` replays LOCAL run history + health timeline to the paired hosted app (idempotent; `--dry-run` to preview) |
 | `call parse\|score\|link\|plan` | Transcripts → evidence-quoted insights, rubric scorecards, deal linking, governed next-step writes |
 | `enrich append\|refresh\|ingest\|status` | Governed enrichment (Apollo pull / Clay ingest), fill-blanks-only plans |
-| `enrich acquire [--source explorium\|pipe0\|linkedin]` | Net-new ICP-targeted lead gen: resolve-first deduped `create_record` plans, capped by a per-profile windowed meter (records + spend); owner-stamped via `acquire.assign`/`--assign-owner` (never born ownerless); links each lead to a domain-stamped, signal-watchable account; `acquire.create.company` acquires accounts (ABM); `--source linkedin --list <id>` reads a HeyReach lead list (Phase 1 discovery, read-only — never sends); never auto-writes |
+| `enrich acquire [--source explorium\|pipe0\|linkedin] [--max <new>] [--scan-limit <raw>]` | Net-new ICP-targeted lead gen: independent per-provider/list/query checkpoints traverse full audiences instead of rereading page one; paired CLIs CAS-sync opaque, non-PII continuation to the hosted org; resolve-first deduped `create_record` plans, meter-capped and owner-stamped; `enrich status --runs` exposes funnel + continuation; never auto-writes |
 | `signals fetch\|list\|outcome\|weights` | Detect-side timing layer: capture fresh buying triggers into a profile-scoped ledger (free Greenhouse/Lever/Ashby ATS in the box; `--from` staged files; `--connector file\|serpapi-news\|hubspot-forms` to pull connected platforms / read the webhook spool `<home>/signals/spool`, secrets via the credential ladder), ranked by learned weights. Writes NOTHING to the CRM; `outcome --account <domain> --contact <id> --result …` re-weights which triggers earn a touch |
 | `icp interview\|set\|show\|judge\|eval` | Build the ICP, then `judge` ranks fresh signals into send/nurture/skip — pass a snapshot (`--provider`/`--input`) and each decision resolves its CRM target (`accountId` + the `contact`/`contacts` to reach). `eval` is the calibration gate (exit 2 below the bar) |
 | `draft [--from-judge latest] [--channel email\|linkedin\|task]` | One trigger-grounded opener per hot account → a governed `create_task` targeting the resolved `contact.id` (or `accountId`); rejects a domain-only decision ("acquire it first"). **Never sends** — after `plans approve`, `apply --provider <crm>` logs it as a CRM task, or `apply --channel outbox` renders it to `<home>/signals/outbox/<channel>.jsonl` for a downstream sender to drain; the CLI transmits nothing |
@@ -85,10 +85,16 @@ npx -y fullstackgtm-mcp
 
 Tools over stdio: `fullstackgtm_audit` (read-only), `fullstackgtm_rules`,
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`,
-`fullstackgtm_apply` (requires `approvedOperationIds`),
+`fullstackgtm_apply` (stored `planId` only; approvals and values come from the
+HMAC-signed plan store and cannot be supplied by the MCP caller),
 `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`,
 `fullstackgtm_market_observe`.
 
+MCP never executes rule packages or external plans. An uncertain apply is
+never replayed automatically: reconcile provider state, then use
+`fullstackgtm plans recover <id> --acknowledge-uncertain-writes`, which clears
+approvals and requires a fresh review.
+
 ## Composing the primitives into plays
 
 This CLI ships governed **primitives** — there is no `outbound` mega-command.

package/src/acquireCheckpoint.ts

@@ -0,0 +1,186 @@
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { credentialsDir, ensureSecureHomeDir } from "./credentials.ts";
+import {
+  assertNoSymlinkComponents,
+  readSecureRegularFile,
+  writeSecureFileAtomic,
+} from "./secureFile.ts";
+
+/** The complete identity of one independently traversable provider audience. */
+export type AcquireCheckpointKey = {
+  provider: string;
+  source: string;
+  listId: string | null;
+  queryFingerprint: string;
+};
+
+export type AcquireContinuation = {
+  cursor?: string | null;
+  offset?: number | null;
+  exhausted: boolean;
+};
+
+/** Versioned wire format shared by local persistence and hosted sync. */
+export type AcquireCheckpoint = {
+  version: 1;
+  id: string;
+  key: AcquireCheckpointKey;
+  continuation: AcquireContinuation;
+  updatedAt: string;
+};
+
+const COMPONENT_MAX = 512;
+
+function requireComponent(value: unknown, name: string): string {
+  if (typeof value !== "string" || value.length === 0 || value.length > COMPONENT_MAX || /[\u0000-\u001f]/.test(value)) {
+    throw new Error(`Invalid acquisition checkpoint ${name}`);
+  }
+  return value;
+}
+
+export function validateAcquireCheckpointKey(value: unknown): AcquireCheckpointKey {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid acquisition checkpoint key");
+  }
+  const candidate = value as Partial<AcquireCheckpointKey>;
+  const listId = candidate.listId;
+  if (listId !== null && listId !== undefined) requireComponent(listId, "listId");
+  return {
+    provider: requireComponent(candidate.provider, "provider"),
+    source: requireComponent(candidate.source, "source"),
+    listId: listId ?? null,
+    queryFingerprint: requireComponent(candidate.queryFingerprint, "queryFingerprint"),
+  };
+}
+
+/** Stable, non-secret filename/key suitable for both filesystem and hosted records. */
+export function acquireCheckpointId(key: AcquireCheckpointKey): string {
+  const valid = validateAcquireCheckpointKey(key);
+  const canonical = JSON.stringify([valid.provider, valid.source, valid.listId, valid.queryFingerprint]);
+  return `acqcp_${createHash("sha256").update(canonical).digest("hex")}`;
+}
+
+function validateContinuation(value: unknown): AcquireContinuation {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid acquisition checkpoint continuation");
+  }
+  const candidate = value as Partial<AcquireContinuation>;
+  if (typeof candidate.exhausted !== "boolean") throw new Error("Invalid acquisition checkpoint exhausted flag");
+  if (candidate.cursor !== undefined && candidate.cursor !== null) requireComponent(candidate.cursor, "cursor");
+  if (
+    candidate.offset !== undefined && candidate.offset !== null &&
+    (!Number.isSafeInteger(candidate.offset) || candidate.offset < 0)
+  ) {
+    throw new Error("Invalid acquisition checkpoint offset");
+  }
+  return {
+    ...(candidate.cursor !== undefined ? { cursor: candidate.cursor } : {}),
+    ...(candidate.offset !== undefined ? { offset: candidate.offset } : {}),
+    exhausted: candidate.exhausted,
+  };
+}
+
+export function validateAcquireCheckpoint(value: unknown): AcquireCheckpoint {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid acquisition checkpoint");
+  }
+  const candidate = value as Partial<AcquireCheckpoint>;
+  if (candidate.version !== 1) throw new Error(`Unsupported acquisition checkpoint version: ${String(candidate.version)}`);
+  const key = validateAcquireCheckpointKey(candidate.key);
+  const id = acquireCheckpointId(key);
+  if (candidate.id !== id) throw new Error("Acquisition checkpoint id does not match its key");
+  if (typeof candidate.updatedAt !== "string" || !Number.isFinite(Date.parse(candidate.updatedAt))) {
+    throw new Error("Invalid acquisition checkpoint updatedAt");
+  }
+  return {
+    version: 1,
+    id,
+    key,
+    continuation: validateContinuation(candidate.continuation),
+    updatedAt: candidate.updatedAt,
+  };
+}
+
+export function acquireCheckpointsDir(baseDir?: string): string {
+  return join(baseDir ?? credentialsDir(), "acquire", "checkpoints");
+}
+
+export interface AcquireCheckpointStore {
+  get(key: AcquireCheckpointKey): Promise<AcquireCheckpoint | null>;
+  put(key: AcquireCheckpointKey, continuation: AcquireContinuation, updatedAt?: Date): Promise<AcquireCheckpoint>;
+  /** Import a validated local/hosted record without changing its timestamp. */
+  putRecord(record: AcquireCheckpoint): Promise<AcquireCheckpoint>;
+  list(): Promise<AcquireCheckpoint[]>;
+}
+
+export function createFileAcquireCheckpointStore(baseDir?: string): AcquireCheckpointStore {
+  const directory = acquireCheckpointsDir(baseDir);
+
+  function fileForId(id: string): string {
+    return join(directory, `${id}.json`);
+  }
+
+  function readId(id: string): AcquireCheckpoint | null {
+    try {
+      return validateAcquireCheckpoint(JSON.parse(readSecureRegularFile(fileForId(id), { tightenMode: 0o600 })));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+      throw error;
+    }
+  }
+
+  function ensureDirectory(): void {
+    if (baseDir === undefined) ensureSecureHomeDir();
+    // Tighten both managed levels. mkdir's mode does not affect a directory
+    // restored or pre-created with broader permissions.
+    const levels = [join(baseDir ?? credentialsDir(), "acquire"), directory];
+    for (const level of levels) {
+      assertNoSymlinkComponents(level);
+      mkdirSync(level, { recursive: true, mode: 0o700 });
+      assertNoSymlinkComponents(level);
+      try { chmodSync(level, 0o700); } catch { /* chmod is unavailable on some filesystems. */ }
+    }
+  }
+
+  function writeRecord(value: AcquireCheckpoint): AcquireCheckpoint {
+    const record = validateAcquireCheckpoint(value);
+    ensureDirectory();
+    writeSecureFileAtomic(fileForId(record.id), `${JSON.stringify(record, null, 2)}\n`);
+    return record;
+  }
+
+  return {
+    async get(key) {
+      return readId(acquireCheckpointId(key));
+    },
+    async put(key, continuation, updatedAt = new Date()) {
+      const validKey = validateAcquireCheckpointKey(key);
+      return writeRecord({
+        version: 1,
+        id: acquireCheckpointId(validKey),
+        key: validKey,
+        continuation: validateContinuation(continuation),
+        updatedAt: updatedAt.toISOString(),
+      });
+    },
+    async putRecord(record) {
+      return writeRecord(record);
+    },
+    async list() {
+      let names: string[];
+      try {
+        assertNoSymlinkComponents(directory);
+        names = readdirSync(directory).filter((name) => /^acqcp_[a-f0-9]{64}\.json$/.test(name));
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+        throw error;
+      }
+      return names
+        .map((name) => readId(name.slice(0, -5)))
+        .filter((record): record is AcquireCheckpoint => record !== null)
+        .sort((a, b) => a.updatedAt.localeCompare(b.updatedAt));
+    },
+  };
+}

package/src/acquireLinkedIn.ts

@@ -49,6 +49,8 @@ export type DiscoverLinkedInOptions = {
   sourceId?: string;
   /** Hard cap on prospects pulled. */
   max?: number;
+  /** Opaque provider continuation cursor. */
+  cursor?: string;
 };
 
 /**
@@ -60,7 +62,7 @@ export async function discoverLinkedInProspects(
   provider: LinkedInProvider,
   options: DiscoverLinkedInOptions = {},
 ): Promise<Prospect[]> {
-  const raw = await provider.fetchProspects({ sourceId: options.sourceId, max: options.max });
+  const raw = await provider.fetchProspects({ sourceId: options.sourceId, max: options.max, cursor: options.cursor });
   return raw.map(linkedInProspectToProspect);
 }
 

package/src/cli/audit.ts

@@ -3,7 +3,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.ts";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.ts";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.ts";
 import { getCredential, resolveHubspotConnection } from "../credentials.ts";
 import { patchPlanToMarkdown } from "../format.ts";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile, type HealthRollup } from "../health.ts";
@@ -174,8 +174,9 @@ async function registerHubspotWithBroker(): Promise<void> {
 
 export async function audit(args: string[]) {
   const threshold = failOnThreshold(args);
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
   const snapshot = await readSnapshot(args);
 
   const policy = mergePolicy(defaultPolicy(), loaded?.config);
@@ -371,8 +372,9 @@ function shortDay(at: string): string {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const configuredRules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
 
   let plan: PatchPlan;
   let snapshot: CanonicalGtmSnapshot | undefined;
@@ -424,8 +426,9 @@ export async function reportCommand(args: string[]) {
 }
 
 export async function rulesCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
   if (args.includes("--json")) {
     console.log(
       JSON.stringify(