gate-evm-tools 1.0.28 → 1.0.31

package/runtime/delivery/config.ts

@@ -0,0 +1,93 @@
+import YAML from 'yaml';
+import { validateManifestPolicy, validateNetworkAlias } from './policy';
+import { address, object, type DeliveryEnvironment } from './protocol';
+import { confinedFile, readFile } from './project';
+import { parseProjectNetworkSnapshots } from './project';
+import { deepFreeze } from '../workflow/lib/canonicalData';
+import { strictData } from './data';
+import { parseInputDocument, readInputBytes } from './input-files';
+import {parseSafeTarget,type SafeTarget} from './safe-prepare';
+import { isAddress } from 'ethers';
+
+export interface DeliveryTarget {
+  network: string;
+  environment: DeliveryEnvironment;
+  finality: { confirmations: number };
+  admin?: string;
+  openzeppelin?: { manifestDir: string };
+  create2?: { scheme: 'evm'; factory: string; leadingZeroBytes?: number; caller?: string };
+  uups?: { placeholderImplementation: string };
+  safe?: SafeTarget;
+  multicall?: { controlledMulticall: string };
+}
+export type DeliveryTargetConfig = Omit<DeliveryTarget, 'network'> & { openzeppelin: { manifestDir: string } };
+export interface DeliveryPublicTarget extends DeliveryTarget { version: 1; id: string; chainId: number }
+function validateTargetAddress(value: unknown, label: string): void {
+  if (!isAddress(address(value, label))) throw new Error(`Invalid ${label} address`);
+}
+export function validateDeliveryTarget(input: unknown): DeliveryTarget {
+  const target = object(strictData(input), 'delivery target', ['network', 'environment', 'finality', 'openzeppelin', 'admin', 'create2', 'uups', 'multicall', 'safe']);
+  validateNetworkAlias(target.network, 'network', false);
+  const dir = target.openzeppelin === undefined ? (target.environment === 'prod' ? '.openzeppelin' : '.openzeppelin.dev')
+    : object(target.openzeppelin, 'openzeppelin', ['manifestDir']).manifestDir;
+  validateManifestPolicy(target.environment, dir, 'delivery');
+  const finality = object(target.finality, 'finality', ['confirmations']);
+  if (typeof finality.confirmations !== 'number' || !Number.isSafeInteger(finality.confirmations) || finality.confirmations < 0) throw new Error('finality.confirmations must be a non-negative safe integer');
+  if(target.safe!==undefined)parseSafeTarget(target.safe);
+  if (target.admin !== undefined) {
+    if (typeof target.admin !== 'string') throw new Error('Invalid admin definition');
+    const admin = target.admin.trim();
+    if (admin && admin.toLowerCase() !== 'deployer' && !isAddress(admin)) throw new Error('Invalid admin address');
+  }
+  if (target.create2 !== undefined) {
+    const create2 = object(target.create2, 'create2', ['scheme', 'factory', 'leadingZeroBytes', 'caller']);
+    if (create2.scheme !== 'evm') throw new Error('Delivery create2.scheme must be evm');
+    validateTargetAddress(create2.factory, 'create2.factory');
+    if (create2.leadingZeroBytes !== undefined && (!Number.isSafeInteger(create2.leadingZeroBytes) || Number(create2.leadingZeroBytes) < 0 || Number(create2.leadingZeroBytes) > 20)) throw new Error('Invalid create2.leadingZeroBytes');
+    if (create2.caller !== undefined) validateTargetAddress(create2.caller, 'create2.caller');
+  }
+  if (target.uups !== undefined) validateTargetAddress(object(target.uups, 'uups', ['placeholderImplementation']).placeholderImplementation, 'uups.placeholderImplementation');
+  if (target.multicall !== undefined) validateTargetAddress(object(target.multicall, 'multicall', ['controlledMulticall']).controlledMulticall, 'multicall.controlledMulticall');
+  return deepFreeze({ ...target, openzeppelin: { manifestDir: dir } }) as unknown as DeliveryTarget;
+}
+export function configDocument(root: string): YAML.Document {
+  const contents = readFile(root, 'config.yaml');
+  const doc = contents === undefined ? new YAML.Document({}) : YAML.parseDocument(contents);
+  if (doc.errors.length || !YAML.isMap(doc.contents)) throw new Error('config.yaml must be a valid mapping');
+  return doc;
+}
+/** Validate only the selected delivery target. No fallback to dev, legacy environment, or another target. */
+export function loadDeliveryTarget(root: string, network: string, environment?: DeliveryEnvironment): DeliveryTargetConfig {
+  const target = parseSelectedTarget(parseInputDocument(readInputBytes(root, 'config.yaml'), 'yaml'), network, environment);
+  confinedFile(root, target.openzeppelin.manifestDir, 'directory');
+  return target;
+}
+function parseSelectedTarget(document: unknown, network: string, environment?: DeliveryEnvironment): DeliveryTargetConfig {
+  validateNetworkAlias(network, 'network', false);
+  const configuration = object(document, 'config.yaml');
+  const value = object(configuration[network], `selected config target ${network}`,
+    ['environment', 'finality', 'openzeppelin', 'admin', 'create2', 'uups', 'multicall', 'safe']);
+  if (environment && value.environment !== environment) throw new Error(`Selected target ${network} environment mismatch`);
+  const manifest = object(value.openzeppelin, 'openzeppelin');
+  validateManifestPolicy(value.environment, manifest.manifestDir, 'delivery');
+  const { network: _network, ...validated } = validateDeliveryTarget({ ...value, network });
+  return deepFreeze(validated) as DeliveryTargetConfig;
+}
+/** Pure projection from the owner's exact captured buffers; creates no input/receipt authority. */
+export function parseDeliveryPublicTargets(configBytes: Buffer, projectConfigBytes: Buffer,
+  selected: readonly { network: string; environment?: DeliveryEnvironment }[],
+): DeliveryPublicTarget[] {
+  const configuration = parseInputDocument(configBytes, 'yaml');
+  const projectSource = new TextDecoder('utf-8', { fatal: true }).decode(projectConfigBytes);
+  const networks = parseProjectNetworkSnapshots(projectSource, selected.map(target => target.network));
+  return deepFreeze(selected.map(({ network, environment }, index) => ({
+    version: 1 as const, id: network, network, chainId: networks[index].chainId,
+    ...parseSelectedTarget(configuration, network, environment),
+  })));
+}
+/** Declared chain ID only. Full static config/HRE capability correspondence is a separate gate. */
+export function loadDeliveryPublicTarget(root: string, network: string, environment?: DeliveryEnvironment): DeliveryPublicTarget {
+  const [target] = parseDeliveryPublicTargets(readInputBytes(root, 'config.yaml'), readInputBytes(root, 'hardhat.config.ts'), [{ network, environment }]);
+  confinedFile(root, target.openzeppelin!.manifestDir, 'directory');
+  return target;
+}

package/runtime/delivery/configuration-definition.ts

@@ -0,0 +1,133 @@
+/** Finite source adapter. Evaluated capabilities are private to the owner, never evidence. */
+import ts from 'typescript';
+import { parseProjectConfig } from './project';
+import { inputDigest } from './input-files';
+import { validateNetworkAlias } from './policy';
+import { deepFreeze } from '../workflow/lib/canonicalData';
+
+type Data = Record<string, any>;
+export type SecretDefinition = {kind:'literal'; definitionHash:string} | {kind:'env'; name:string}
+  | {kind:'fallback'; operator:'||'|'??'; left:SecretDefinition; right:SecretDefinition};
+const fail = (): never => { throw new Error('Unsupported static delivery configuration'); };
+const literalDefinition = (value:string):SecretDefinition => ({kind:'literal',definitionHash:inputDigest(`gate-delivery-secret-definition@1\0${value}`)});
+function unwrap(n:ts.Expression):ts.Expression { while(ts.isParenthesizedExpression(n)||ts.isAsExpression(n)||ts.isSatisfiesExpression(n)) n=n.expression; return n; }
+function fields(n:ts.Expression):Map<string,ts.Expression> {
+  n=unwrap(n); if(!ts.isObjectLiteralExpression(n)) return fail();
+  const out=new Map<string,ts.Expression>();
+  for(const p of n.properties) {
+    if(!ts.isPropertyAssignment(p)||(!ts.isIdentifier(p.name)&&!ts.isStringLiteral(p.name)&&!ts.isNumericLiteral(p.name)))return fail();
+    const k=p.name.text;if(out.has(k)||['__proto__','prototype','constructor'].includes(k))return fail();out.set(k,unwrap(p.initializer));
+  }return out;
+}
+function keys(value:Data,allowed:string[]):void { if(!value||Array.isArray(value)||typeof value!=='object'||Object.keys(value).some(k=>!allowed.includes(k)))fail(); }
+function data(n:ts.Expression):any {
+  n=unwrap(n);
+  if(ts.isStringLiteral(n))return n.text;
+  if(ts.isNumericLiteral(n)){const v=Number(n.text);if(!Number.isSafeInteger(v))return fail();return v;}
+  if(n.kind===ts.SyntaxKind.TrueKeyword)return true;if(n.kind===ts.SyntaxKind.FalseKeyword)return false;
+  if(ts.isArrayLiteralExpression(n))return n.elements.map(e=>data(e as ts.Expression));
+  return Object.fromEntries([...fields(n)].map(([k,v])=>[k,data(v)]));
+}
+function secret(n:ts.Expression,env:NodeJS.ProcessEnv):{value:string|undefined;definition:SecretDefinition} {
+  n=unwrap(n);if(ts.isStringLiteral(n))return {value:n.text,definition:literalDefinition(n.text)};
+  const envBase=(x:ts.Expression)=>ts.isPropertyAccessExpression(x)&&ts.isIdentifier(x.expression)&&x.expression.text==='process'&&x.name.text==='env';
+  let name:string|undefined;
+  if(ts.isPropertyAccessExpression(n)&&envBase(n.expression))name=n.name.text;
+  if(ts.isElementAccessExpression(n)&&envBase(n.expression)&&ts.isStringLiteral(n.argumentExpression))name=n.argumentExpression.text;
+  if(name!==undefined){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))return fail();return {value:env[name],definition:{kind:'env',name}};}
+  if(ts.isBinaryExpression(n)&&[ts.SyntaxKind.BarBarToken,ts.SyntaxKind.QuestionQuestionToken].includes(n.operatorToken.kind)){
+    const left=secret(n.left,env),right=secret(n.right,env),operator=n.operatorToken.kind===ts.SyntaxKind.BarBarToken?'||':'??';
+    return {value:operator==='||'?left.value||right.value:left.value??right.value,definition:{kind:'fallback',operator,left:left.definition,right:right.definition}};
+  }return fail();
+}
+function headers(n:ts.Expression,env:NodeJS.ProcessEnv):{value:Data;definition:any} {
+  const value:Data={},definition:any[]=[];
+  for(const [key,node] of fields(n)){const item=secret(node,env);value[key]=item.value;definition.push({name:literalDefinition(key),value:item.definition});}
+  return {value,definition};
+}
+function accounts(n:ts.Expression,local:boolean,env:NodeJS.ProcessEnv):{value:any;definition:any} {
+  n=unwrap(n);
+  if(ts.isStringLiteral(n)&&n.text==='remote'&&!local)return {value:'remote',definition:{kind:'remote'}};
+  if(ts.isArrayLiteralExpression(n)){
+    const entries=n.elements.map(e=>{
+      if(!local){const s=secret(e as ts.Expression,env);return {value:s.value,definition:s.definition};}
+      const f=fields(e as ts.Expression);if([...f.keys()].sort().join()!=='balance,privateKey')return fail();
+      const key=secret(f.get('privateKey')!,env),balance=data(f.get('balance')!);if(typeof balance!=='string'||!/^\d+$/.test(balance))return fail();
+      return {value:{privateKey:key.value,balance},definition:{privateKey:key.definition,balance}};
+    });
+    return {value:entries.map(x=>x.value),definition:{kind:entries.length?'key-array':'empty',entries:entries.map(x=>x.definition)}};
+  }
+  const f=fields(n),value:Data={},policy:Data={},secrets:Data={};
+  for(const [key,node] of f){
+    if(['mnemonic','passphrase'].includes(key)){const s=secret(node,env);value[key]=s.value;secrets[key]=s.definition;}
+    else if(['initialIndex','count','path',...(local?['accountsBalance']:[])].includes(key))value[key]=policy[key]=data(node);
+    else return fail();
+  }
+  if(!local&&!f.has('mnemonic'))return fail();
+  for(const key of ['initialIndex','count'])if(key in policy&&(!Number.isSafeInteger(policy[key])||policy[key]<0))return fail();
+  for(const key of ['path','accountsBalance'])if(key in policy&&typeof policy[key]!=='string')return fail();
+  return {value,definition:{kind:'hd',policy,secrets}};
+}
+const common=['chainId','from','gas','gasPrice','gasMultiplier'];
+const localFields=[...common,'initialBaseFeePerGas','hardfork','mining','accounts','blockGasLimit','minGasPrice','throwOnTransactionFailures','throwOnCallFailures','allowUnlimitedContractSize','allowBlocksWithSameTimestamp','initialDate','loggingEnabled','forking','coinbase','chains','enableTransientStorage','enableRip7212'];
+const httpFields=[...common,'url','timeout','httpHeaders','accounts'];
+function network(n:ts.Expression,local:boolean,env:NodeJS.ProcessEnv):{value:Data;definition:Data} {
+  const value:Data={},definition:Data={};
+  for(const [key,node] of fields(n)){
+    if(!(local?localFields:httpFields).includes(key))return fail();
+    if(key==='url'){const s=secret(node,env);value[key]=s.value;definition[key]=s.definition;}
+    else if(key==='accounts'){const a=accounts(node,local,env);value[key]=a.value;definition[key]=a.definition;}
+    else if(key==='httpHeaders'){const h=headers(node,env);value[key]=h.value;definition[key]=h.definition;}
+    else if(key==='forking'){
+      const v:Data={},d:Data={};for(const [k,x] of fields(node)){
+        if(k==='url'){const s=secret(x,env);v[k]=s.value;d[k]=s.definition;}
+        else if(k==='httpHeaders'){const h=headers(x,env);v[k]=h.value;d[k]=h.definition;}
+        else if(['enabled','blockNumber'].includes(k))v[k]=d[k]=data(x);else return fail();
+      }if(typeof v.url!=='string'||!v.url||('enabled'in v&&typeof v.enabled!=='boolean')||('blockNumber'in v&&(!Number.isSafeInteger(v.blockNumber)||v.blockNumber<0)))return fail();value[key]=v;definition[key]=d;
+    }else value[key]=definition[key]=data(node);
+  }
+  for(const key of ['chainId','gasMultiplier','blockGasLimit'])if(key in value&&(!Number.isSafeInteger(value[key])||value[key]<=0))return fail();
+  for(const key of ['gas','gasPrice','timeout','initialBaseFeePerGas'])if(key in value&&!(value[key]==='auto'&&['gas','gasPrice'].includes(key))&&(!Number.isSafeInteger(value[key])||value[key]<0))return fail();
+  for(const key of ['throwOnTransactionFailures','throwOnCallFailures','allowUnlimitedContractSize','allowBlocksWithSameTimestamp','loggingEnabled','enableTransientStorage','enableRip7212'])if(key in value&&typeof value[key]!=='boolean')return fail();
+  for(const key of ['from','coinbase'])if(key in value&&(typeof value[key]!=='string'||!/^0x[a-fA-F0-9]{40}$/.test(value[key])))return fail();
+  if('minGasPrice'in value&&!((typeof value.minGasPrice==='string'&&/^\d+$/.test(value.minGasPrice))||(Number.isSafeInteger(value.minGasPrice)&&value.minGasPrice>=0)))return fail();
+  if('initialDate'in value&&(typeof value.initialDate!=='string'||!Number.isFinite(Date.parse(value.initialDate))))return fail();
+  if('hardfork'in value&&!['chainstart','homestead','dao','tangerineWhistle','spuriousDragon','byzantium','constantinople','petersburg','istanbul','muirGlacier','berlin','london','arrowGlacier','grayGlacier','merge','shanghai','cancun','prague'].includes(value.hardfork))return fail();
+  if(value.mining){keys(value.mining,['auto','interval','mempool']);if('auto'in value.mining&&typeof value.mining.auto!=='boolean')return fail();if('interval'in value.mining){const i=value.mining.interval;if(!(Number.isSafeInteger(i)&&i>=0)&&!(Array.isArray(i)&&i.length===2&&i.every(x=>Number.isSafeInteger(x)&&x>=0)&&i[0]<=i[1]))return fail();}if(value.mining.mempool){keys(value.mining.mempool,['order']);if(!['priority','fifo'].includes(value.mining.mempool.order))return fail();}}
+  if(value.chains)for(const [id,c] of Object.entries(value.chains)){if(!/^[1-9]\d*$/.test(id)||!Number.isSafeInteger(Number(id)))return fail();keys(c as Data,['hardforkHistory']);for(const [fork,block] of Object.entries((c as Data).hardforkHistory??{})){if(typeof fork!=='string'||!Number.isSafeInteger(block)||(block as number)<0)return fail();}}
+  if(!local&&(!('url'in value)||!Number.isSafeInteger(value.chainId)||value.chainId<=0))return fail();
+  return {value,definition};
+}
+function compiler(config:any):void {
+  if(typeof config==='string'){if(!/^\d+\.\d+\.\d+$/.test(config))fail();return;}
+  if('version'in config){keys(config,['version','settings']);compiler(config.version);if(config.settings){keys(config.settings,['optimizer','evmVersion','viaIR','outputSelection','metadata','libraries','remappings','debug','stopAfter']);if(config.settings.optimizer){keys(config.settings.optimizer,['enabled','runs','details']);if(config.settings.optimizer.details)keys(config.settings.optimizer.details,['peephole','inliner','jumpdestRemover','orderLiterals','deduplicate','cse','constantOptimizer','yul','yulDetails']);}if(config.settings.metadata)keys(config.settings.metadata,['appendCBOR','useLiteralContent','bytecodeHash']);if(config.settings.debug)keys(config.settings.debug,['revertStrings','debugInfo']);}return;}
+  keys(config,['compilers','overrides']);if(!Array.isArray(config.compilers)||!config.compilers.length)fail();config.compilers.forEach(compiler);if(config.overrides)Object.values(config.overrides).forEach(compiler);
+}
+export interface ParsedConfiguration { userConfig:Data; definition:Data; plugins:string[]; explicitDate:boolean }
+/** Internal only: callers must not expose userConfig, which contains private evaluated capabilities. */
+export function parseConfigurationDefinition(bytes:Buffer,selected:string,env:NodeJS.ProcessEnv=process.env):ParsedConfiguration {
+  try {
+    validateNetworkAlias(selected,'network',false);if(selected==='hardhat')fail();
+    const {file,fields:top,networks}=parseProjectConfig(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
+    const plugins:string[]=[];
+    const exported=unwrap(file.statements.filter(ts.isExportAssignment)[0].expression);
+    for(const statement of file.statements){
+      if(ts.isImportDeclaration(statement)){
+        if(!ts.isStringLiteral(statement.moduleSpecifier)||statement.attributes)fail();
+        const name=(statement.moduleSpecifier as ts.StringLiteral).text;
+        if(statement.importClause){if(name!=='hardhat/config'||!statement.importClause.isTypeOnly||statement.importClause.name||!statement.importClause.namedBindings||!ts.isNamedImports(statement.importClause.namedBindings)||statement.importClause.namedBindings.elements.some(e=>e.name.text!=='HardhatUserConfig'||e.propertyName))fail();}
+        else {if(!['gate-evm-tools/delivery-hardhat','@nomicfoundation/hardhat-ethers','@nomicfoundation/hardhat-chai-matchers','@openzeppelin/hardhat-upgrades'].includes(name)||plugins.includes(name))fail();plugins.push(name);}
+      }else if(ts.isVariableStatement(statement)){if(!ts.isIdentifier(exported)||statement.declarationList.declarations[0]?.name.getText(file)!==exported.text||statement.modifiers?.length||statement.declarationList.declarations.length!==1||!(statement.declarationList.flags&ts.NodeFlags.Const)||file.statements.filter(ts.isVariableStatement).length!==1)fail();}
+      else if(!ts.isExportAssignment(statement))fail();
+    }
+    if(plugins.includes('gate-evm-tools/delivery-hardhat')&&plugins[0]!=='gate-evm-tools/delivery-hardhat')fail();
+    const userConfig:Data={},definition:Data={networks:{},plugins};
+    for(const [key,node] of top){if(!['solidity','networks','paths','defaultNetwork'].includes(key))fail();if(key!=='networks')userConfig[key]=definition[key]=data(node);}
+    if(!('solidity'in userConfig))fail();compiler(userConfig.solidity);
+    if(userConfig.paths){keys(userConfig.paths,['sources','cache','artifacts','tests']);for(const value of Object.values(userConfig.paths))if(typeof value!=='string'||!value||value.startsWith('/')||value.includes('\\')||value.split('/').some(p=>!p||p==='..'))fail();}
+    if(userConfig.defaultNetwork!==undefined)validateNetworkAlias(userConfig.defaultNetwork,'defaultNetwork');
+    userConfig.networks={};for(const [name,node] of networks){validateNetworkAlias(name,'network');const n=network(node,name==='hardhat',env);userConfig.networks[name]=n.value;definition.networks[name]=n.definition;}
+    if(!userConfig.networks[selected])fail();
+    return {userConfig,definition:deepFreeze(definition),plugins,explicitDate:Object.hasOwn(userConfig.networks.hardhat??{},'initialDate')};
+  }catch{throw new Error('Unsupported static delivery configuration');}
+}

package/runtime/delivery/configuration-hre.ts

@@ -0,0 +1,130 @@
+/** Association and exact post-extender correspondence; no provider operation is performed. */
+import path from 'node:path';
+import ts from 'typescript';
+import { createRequire } from 'node:module';
+import type { HardhatRuntimeEnvironment } from 'hardhat/types';
+import type { ParsedConfiguration } from './configuration-definition';
+import { confinedFile } from './project-files';
+import { semanticHash } from '../workflow/lib/canonicalData';
+import type { CompilerFiles } from './compiler-files';
+import {originalRunnerPolicy} from './aggregate-bootstrap';
+
+type Data=Record<string,any>;
+const startups=new WeakMap<object,{initialDate:string;network:string;run:Function;provider:object}>();
+/** Called by the owned bootstrap before the supported environment extenders. */
+export function registerConfigurationEnvironment(extendEnvironment:typeof import('hardhat/config').extendEnvironment):void {
+  extendEnvironment(hre=>{startups.set(hre,{initialDate:(hre.config.networks.hardhat as any).initialDate,network:hre.network.name,run:hre.run,provider:hre.network.provider});});
+}
+/** Portable own-data projection only; private equality below separately preserves runtime types. */
+export function configurationData(value:any):any {
+  if(value===undefined)return {$undefined:true};
+  if(typeof value==='bigint')return {$bigint:value.toString()};
+  if(value instanceof Map)return {$map:[...Map.prototype.entries.call(value)].map(([k,v])=>[configurationData(k),configurationData(v)])};
+  if(value===null||['string','boolean'].includes(typeof value))return value;
+  if(typeof value==='number'&&Number.isSafeInteger(value))return value;
+  if(!value||typeof value!=='object'||(!Array.isArray(value)&&![Object.prototype,null].includes(Object.getPrototypeOf(value)))||Object.getOwnPropertySymbols(value).length)throw new Error('Unsupported effective configuration data');
+  const out:any=Array.isArray(value)?[]:{};
+  for(const key of Object.getOwnPropertyNames(value)){
+    if(Array.isArray(value)&&key==='length')continue;
+    const d=Object.getOwnPropertyDescriptor(value,key)!;if(!d.enumerable||!('value'in d))throw new Error('Unsupported effective configuration property');
+    Object.defineProperty(out,key,{value:configurationData(d.value),enumerable:true,writable:true,configurable:true});
+  }return out;
+}
+/** Private typed tree: every value is tagged, including ordinary objects and arrays.
+ * Nothing from this representation is exposed as evidence or in errors. */
+function effectiveConfigurationData(value:unknown):unknown {
+  if(value===undefined)return ['undefined'];
+  if(value===null)return ['null'];
+  if(typeof value==='bigint')return ['bigint',value.toString()];
+  if(typeof value==='string'||typeof value==='boolean')return [typeof value,value];
+  if(typeof value==='number'&&Number.isSafeInteger(value))return ['number',Object.is(value,-0)?'-0':String(value)];
+  if(!value||typeof value!=='object'||Object.getOwnPropertySymbols(value).length)throw new Error('Unsupported effective configuration data');
+  if(value instanceof Map){
+    if(Object.getPrototypeOf(value)!==Map.prototype||Object.getOwnPropertyNames(value).length)throw new Error('Unsupported effective configuration Map');
+    return ['map',[...Map.prototype.entries.call(value)].map(([key,item])=>[effectiveConfigurationData(key),effectiveConfigurationData(item)])];
+  }
+  const array=Array.isArray(value);
+  if(!array&&![Object.prototype,null].includes(Object.getPrototypeOf(value)))throw new Error('Unsupported effective configuration data');
+  const names=Object.getOwnPropertyNames(value).filter(key=>!array||key!=='length').sort();
+  if(array&&(names.length!==value.length||names.some(key=>!Object.hasOwn(value,key)||!/^\d+$/.test(key)||Number(key)>=value.length)))throw new Error('Unsupported effective configuration array');
+  const properties=names.map(key=>{
+    const descriptor=Object.getOwnPropertyDescriptor(value,key)!;
+    if(!descriptor.enumerable||!('value'in descriptor))throw new Error('Unsupported effective configuration property');
+    return [key,effectiveConfigurationData(descriptor.value)];
+  });
+  return [array?'array':'object',properties];
+}
+/** Internal assertion only: no private normalized values or caller authority are returned. */
+export function assertEffectiveConfigurationEqual(a:unknown,b:unknown):void {
+  if(semanticHash(effectiveConfigurationData(a))!==semanticHash(effectiveConfigurationData(b)))throw new Error('Actual HRE configuration mismatch');
+}
+const equal=assertEffectiveConfigurationEqual;
+/** Extract registration callbacks only from the actual verified adapter files. No source evaluation. */
+function registrations(files:CompilerFiles,entries:string[]):Map<string,Set<string>> {
+  const out=new Map(['extendConfig','extendEnvironment','extendProvider'].map(k=>[k,new Set<string>()]));
+  for(const entry of entries){
+    const source=files.read(entry).toString('utf8'),ast=ts.createSourceFile('adapter.js',source,ts.ScriptTarget.Latest,true,ts.ScriptKind.JS);
+    const visit=(node:ts.Node)=>{
+      if(ts.isCallExpression(node)){
+        const expression=node.expression.getText(ast),kind=[...out.keys()].find(k=>new RegExp(`(?:\\.|\\b)${k}\\)?$`).test(expression));
+        if(kind&&node.arguments.length){let callback=node.arguments[0];while(ts.isParenthesizedExpression(callback))callback=callback.expression;if(ts.isArrowFunction(callback)||ts.isFunctionExpression(callback))out.get(kind)!.add(callback.getText(ast));}
+      }ts.forEachChild(node,visit);
+    };visit(ast);
+  }return out;
+}
+export interface HreObservation { hre:HardhatRuntimeEnvironment; configuration:Data; assertUnchanged(parsed:ParsedConfiguration):void }
+export function observeConfigurationHre(root:string,selected:string,parsed:ParsedConfiguration,files:CompilerFiles):HreObservation {
+  const req=createRequire(path.join(root,'package.json'));
+  const contextPath=files.resolve(path.join(root,'package.json'),'hardhat/internal/context');files.package(contextPath,true);
+  const ctx=req('hardhat/internal/context').HardhatContext.getHardhatContext();
+  const hre=ctx.getHardhatRuntimeEnvironment() as HardhatRuntimeEnvironment;
+  const bootstrap=startups.get(hre);
+  if(!bootstrap||require.cache[req.resolve('hardhat')]?.exports!==hre||path.resolve(hre.config.paths.root)!==root||bootstrap.network!==hre.network.name||!['hardhat',selected].includes(hre.network.name))throw new Error('Actual HRE owned bootstrap association required');
+  const entries=[path.join(__dirname,'hardhat.js'),path.join(__dirname,'compiler.js'),path.join(__dirname,'aggregate-bootstrap.js'),__filename];
+  for(const name of ['@nomicfoundation/hardhat-ethers','@openzeppelin/hardhat-upgrades']){const entry=files.resolve(path.join(root,'package.json'),name);files.package(entry,true);entries.push(entry);}
+  for(const name of parsed.plugins){const entry=files.resolve(path.join(root,'hardhat.config.ts'),name);if(!name.startsWith('gate-evm-tools/'))files.package(entry,true);entries.push(entry);}
+  const callbacks=registrations(files,entries);
+  const extenderLists=[['extendConfig',ctx.configExtenders],['extendEnvironment',ctx.environmentExtenders],['extendProvider',ctx.providerExtenders]] as const;
+  for(const [kind,list] of extenderLists)if(list.some((fn:Function)=>!callbacks.get(kind)!.has(Function.prototype.toString.call(fn))))throw new Error('Unsupported HRE extender');
+  const captured=extenderLists.map(([kind,list])=>({kind,functions:[...list]}));
+  const resolver=files.resolve(path.join(root,'package.json'),'hardhat/internal/core/config/config-resolution');
+  const validator=files.resolve(path.join(root,'package.json'),'hardhat/internal/core/config/config-validation');
+  const resolve=req(resolver).resolveConfig,validate=req(validator).validateConfig;
+  function expected(definition:ParsedConfiguration):Data {
+    validate(definition.userConfig);
+    const value=resolve(path.join(root,'hardhat.config.ts'),definition.userConfig);
+    // Actual pinned official extenders supply outputSelection/storageLayout and all defaults.
+    for(const fn of captured[0].functions)fn(value,definition.userConfig);
+    if(!definition.explicitDate)value.networks.hardhat.initialDate=bootstrap!.initialDate;
+    return value;
+  }
+  const baseline=expected(parsed);
+  function check(definition:ParsedConfiguration):Data {
+    if(ctx.getHardhatRuntimeEnvironment()!==hre||require.cache[req.resolve('hardhat')]?.exports!==hre||startups.get(hre)!==bootstrap||hre.run!==bootstrap!.run||hre.network.provider!==bootstrap!.provider||hre.network.name!==bootstrap!.network)throw new Error('Actual HRE lifecycle drift');
+    for(let i=0;i<extenderLists.length;i++){const current=ctx[(['configExtenders','environmentExtenders','providerExtenders'] as const)[i]];if(current.length!==captured[i].functions.length||current.some((f:Function,j:number)=>f!==captured[i].functions[j]))throw new Error('Actual HRE extender drift');}
+    // Terminal checks never invoke extenders or the resolver again. Re-evaluate only the finite secret definitions.
+    equal(definition.userConfig,parsed.userConfig);
+    const value=baseline;
+    equal(hre.config,value);equal(hre.network.config,value.networks[hre.network.name]);
+    // A stable path string can acquire a symlink or unsafe type after open.
+    for(const name of ['sources','cache','artifacts','tests'])confinedFile(root,path.relative(root,value.paths[name]).split(path.sep).join('/'),'directory');
+    const http=value.networks[selected];if(typeof http.url!=='string'||!http.url.trim())throw new Error('Selected HTTP capability unavailable');
+    const url=new URL(http.url);if(!['http:','https:'].includes(url.protocol))throw new Error('Selected HTTP capability unavailable');
+    // Hardhat's own validator checks key/HD/header value types; explicitly reject missing env capabilities.
+    for(const header of Object.values(http.httpHeaders))if(typeof header!=='string')throw new Error('Selected header capability unavailable');
+    const a=http.accounts;if(Array.isArray(a)&&a.some((k:any)=>typeof k!=='string'||!/^0x[a-fA-F0-9]{64}$/.test(k)))throw new Error('Selected accounts capability unavailable');
+    if(a&&typeof a==='object'&&!Array.isArray(a)&&(typeof a.mnemonic!=='string'||!a.mnemonic.trim()||typeof a.passphrase!=='string'))throw new Error('Selected HD capability unavailable');
+    return value;
+  }
+  const resolved=check(parsed),paths:Data={root:'.',configFile:'hardhat.config.ts'};
+  for(const name of ['sources','cache','artifacts','tests']){const relative=path.relative(root,resolved.paths[name]).split(path.sep).join('/');paths[name]=relative;}
+  const {url:_url,accounts:_accounts,httpHeaders:_headers,...http}=resolved.networks[selected];
+  const {accounts:_runnerAccounts,forking:_fork,initialDate:_date,...runner}=originalRunnerPolicy(resolved as any);
+  const runnerPublic:Data=configurationData(runner);
+  runnerPublic.accounts=parsed.definition.networks.hardhat?.accounts??{kind:'hardhat-default-hd'};
+  runnerPublic.initialDate=parsed.explicitDate?{kind:'configured',value:_date}:{kind:'startup-observation'};
+  // Explicitly configured fork policy is stable; endpoint/header capabilities stay in definitions only.
+  runnerPublic.forking=_fork?{enabled:_fork.enabled,...(_fork.blockNumber===undefined?{}:{blockNumber:_fork.blockNumber}),definition:parsed.definition.networks.hardhat.forking}:{kind:'disabled'};
+  const configuration={adapter:'hardhat-2.26.3-static-v1',network:selected,definition:parsed.definition,solidity:configurationData(resolved.solidity),defaultNetwork:resolved.defaultNetwork,paths,plugins:parsed.plugins,http,runner:runnerPublic,extenders:captured.map(x=>({kind:x.kind,callbacks:x.functions.map((f:Function)=>semanticHash(Function.prototype.toString.call(f)))}))};
+  return {hre,configuration,assertUnchanged(current){check(current);}};
+}

package/runtime/delivery/configuration-runtime.ts

@@ -0,0 +1,163 @@
+/** Actual installed payload and late CJS dependency observation. Compiler pins are reused unchanged. */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import Module, {createRequire} from 'node:module';
+import {CompilerFiles,relative,type CompilerPackage} from './compiler-files';
+import {deepFreeze,semanticHash} from '../workflow/lib/canonicalData';
+
+const moduleApi=Module as any;
+const ownRoot=path.resolve(__dirname,'../..');
+let active:RuntimeObservation|undefined;
+export interface RuntimeEvidence {
+  version:1; payloadFormat:'regular-package-payload@1'; declared:{version:string;digest:string}; package:CompilerPackage;
+  node:{version:string;platform:string;arch:string;abi:string};
+  dependencies:CompilerPackage[]; resolutions:CompilerFiles['resolutions']; modules:Array<{path:string;digest:string}>;
+}
+export class RuntimeObservation {
+  readonly files:CompilerFiles;
+  readonly #owned:CompilerPackage;
+  readonly #declared:{version:string;digest:string};
+  readonly #originalResolve:any;
+  readonly #hook:any;
+  readonly #originalLoad:any;
+  readonly #loadHook:any;
+  readonly #edges=new Map<string,{issuer:string;specifier:string;resolved:string}>();
+  readonly #seenModules=new Set<string>();
+  #closed=false;
+  #invalidNativeLoad=false;
+  constructor(readonly root:string){
+    if(active)throw new Error('A runtime observation is already open');
+    if(process.env.NODE_PATH||/--(?:conditions|loader|import|require)/.test(process.env.NODE_OPTIONS??''))throw new Error('Unsupported runtime Node resolution hooks');
+    this.files=new CompilerFiles(root);
+    const metadata=JSON.parse(this.files.read(path.join(ownRoot,'package.json')).toString('utf8'));
+    if(metadata.name!=='gate-evm-tools')throw new Error('Running GateTool package mismatch');
+    this.#owned=this.files.package(__filename);
+    for(const name of ['gate-evm-tools/delivery-configuration','gate-evm-tools/delivery-hardhat','gate-evm-tools/workflow']){
+      const entry=this.files.resolve(path.join(root,'package.json'),name),p=this.files.package(entry);
+      if(path.join(root,p.lockLocation)!==ownRoot)throw new Error('Project resolves a different GateTool package');
+    }
+    const declared=JSON.parse(this.files.read(path.join(ownRoot,'dist-runtime/runtime-identity.json')).toString('utf8'));
+    if(Object.keys(declared).sort().join()!=='digest,version'||declared.version!==metadata.version||!/^\w{64}$/.test(declared.digest))throw new Error('Invalid declared runtime identity');
+    this.#declared=declared;
+    this.verifyDeclared();
+    this.#originalResolve=moduleApi._resolveFilename;
+    this.#originalLoad=moduleApi._load;
+    const self=this;
+    this.#hook=function(request:string,parent:any,...args:any[]){
+      const result=self.#originalResolve.call(this,request,parent,...args);
+      if(parent?.filename&&typeof result==='string'&&path.isAbsolute(result))self.edge(parent.filename,request,result);
+      return result;
+    };
+    this.#loadHook=function(request:string,parent:any,isMain:boolean){
+      const resolved=self.#originalResolve.call(moduleApi,request,parent,isMain);
+      if(typeof resolved==='string'&&path.isAbsolute(resolved)){
+        const config=resolved===path.join(self.root,'hardhat.config.ts')&&parent?.filename===path.join(self.root,'node_modules/hardhat/internal/core/config/config-loading.js');
+        if(!resolved.startsWith(path.join(self.root,'node_modules')+path.sep)&&!config){
+          self.#invalidNativeLoad=true;
+          throw new Error('Unsupported native project runtime entry');
+        }
+        if(parent?.filename)self.edge(parent.filename,request,resolved);
+      }
+      return self.#originalLoad.call(this,request,parent,isMain);
+    };
+    // Resolve-only lookups remain available to the bounded owned custom loader;
+    // native evaluation of arbitrary project entries is a separate unsupported capability.
+    active=this;moduleApi._resolveFilename=this.#hook;moduleApi._load=this.#loadHook;
+    try{this.capture();}catch(error){this.close();throw error;}
+  }
+  private verifyDeclared():void {
+    const hash=crypto.createHash('sha256');
+    // Exact scripts/write-runtime-package.mjs ordering and path spelling.
+    const visit=(dir:string):void=>{for(const name of fs.readdirSync(path.join(ownRoot,dir)).sort()){
+      const rel=`${dir}/${name}`,file=path.join(ownRoot,rel),stat=fs.lstatSync(file);
+      if(stat.isSymbolicLink()||(!stat.isDirectory()&&(!stat.isFile()||stat.nlink!==1)))throw new Error('Unsafe runtime package input');
+      if(stat.isDirectory())visit(rel);else if(/\.(?:c?js)$/.test(rel)){hash.update(rel);hash.update(this.files.read(file));}
+    }};
+    for(const dir of ['dist-runtime','dist','dist-cjs','bin'])visit(dir);
+    if(hash.digest('hex')!==this.#declared.digest)throw new Error('Declared runtime digest mismatch');
+  }
+  private edge(issuer:string,specifier:string,resolved:string):void {
+    if(!issuer.startsWith(this.root+path.sep))throw new Error('Runtime issuer is outside project');
+    // Builtins never reach here. Host-specific absolute requests are represented relative to their issuer.
+    relative(this.root,resolved);
+    if(path.isAbsolute(specifier))specifier='./'+path.relative(path.dirname(issuer),resolved).split(path.sep).join('/');
+    if(!specifier||specifier.includes('\\')||/[\x00-\x1f]/.test(specifier))throw new Error('Unsupported runtime resolution');
+    const key=`${issuer}\0${specifier}`,old=this.#edges.get(key);
+    if(old&&old.resolved!==resolved)throw new Error('Runtime resolution drift');
+    this.#edges.set(key,{issuer,specifier,resolved});
+  }
+  private currentResolution(issuer:string,specifier:string):string {
+    // Node's positive path cache otherwise conceals a newly introduced nearer dependency.
+    const previous=moduleApi._pathCache;moduleApi._pathCache=Object.create(null);
+    try{return this.files.resolve(issuer,specifier);}finally{moduleApi._pathCache=previous;}
+  }
+  private initialChild(issuer:string,child:string):void {
+    const parts=relative(this.root,child).split('/'),npm=parts.lastIndexOf('node_modules');
+    if(npm<0){
+      if(child!==path.join(this.root,'hardhat.config.ts')||issuer!==path.join(this.root,'node_modules/hardhat/internal/core/config/config-loading.js'))throw new Error('Unsupported runtime child outside installed packages');
+      this.edge(issuer,'./'+path.relative(path.dirname(issuer),child).split(path.sep).join('/'),child);return;
+    }
+    const end=npm+(parts[npm+1].startsWith('@')?3:2),directory=path.join(this.root,...parts.slice(0,end));
+    const issuerParts=relative(this.root,issuer).split('/'),issuerNpm=issuerParts.lastIndexOf('node_modules');
+    const issuerDirectory=path.join(this.root,...issuerParts.slice(0,issuerNpm+(issuerParts[issuerNpm+1].startsWith('@')?3:2)));
+    if(directory!==issuerDirectory&&![...this.#edges.values()].some(e=>e.issuer===issuer&&e.resolved===child)){
+      const name=parts.slice(npm+1,end).join('/'),within=relative(directory,child),metadata=JSON.parse(this.files.read(path.join(directory,'package.json')).toString('utf8'));
+      const candidates=new Set([name,`${name}/${within}`]);
+      const targets=(value:any):string[]=>typeof value==='string'?[value]:value&&typeof value==='object'?Object.values(value).flatMap(targets):[];
+      if(metadata.exports&&typeof metadata.exports==='object')for(const [key,value] of Object.entries(metadata.exports)){
+        if(!key.startsWith('./'))continue;
+        for(const target of targets(value)){
+          if(target===`./${within}`)candidates.add(name+key.slice(1));
+          const at=target.indexOf('*');if(at>=0&&(`./${within}`).startsWith(target.slice(0,at))&&(`./${within}`).endsWith(target.slice(at+1))){const replacement=(`./${within}`).slice(at,(`./${within}`).length-target.length+at+1);candidates.add(name+key.slice(1).replace('*',replacement));}
+        }
+      }
+      let found=false;
+      for(const candidate of candidates){let resolved:string;try{resolved=this.#originalResolve.call(moduleApi,candidate,require.cache[issuer]);}catch{continue;}if(resolved===child){this.edge(issuer,candidate,child);found=true;break;}}
+      // Reviewed initial adapters must have a reconstructible logical package request. Never treat a physical fallback as package-resolution proof.
+      if(!found)throw new Error('Unsupported initial dynamic package resolution');
+    }
+    this.edge(issuer,'./'+path.relative(path.dirname(issuer),child).split(path.sep).join('/'),child);
+  }
+  private capture():void {
+    if(this.#invalidNativeLoad||moduleApi._resolveFilename!==this.#hook||moduleApi._load!==this.#loadHook)throw new Error('Runtime loader drift or unsupported native entry');
+    const packages=new Set<string>();
+    for(const file of Object.keys(require.cache).sort()){
+      if(!file.includes(`${path.sep}node_modules${path.sep}`))continue;
+      if(!file.startsWith(path.join(this.root,'node_modules')+path.sep))throw new Error('Loaded runtime dependency is outside project');
+      const data=this.files.read(file),location=relative(this.root,file).split('/');
+      const npm=location.lastIndexOf('node_modules'),packageLocation=location.slice(0,npm+(location[npm+1].startsWith('@')?3:2)).join('/');
+      this.files.modules.set(relative(this.root,file),crypto.createHash('sha256').update(data).digest('hex'));
+      if(!packages.has(packageLocation)){
+        packages.add(packageLocation);
+        if(!this.files.packages.has(packageLocation))this.files.package(file,packageLocation!==this.#owned.lockLocation);
+      }
+      if(this.#seenModules.has(file))continue;this.#seenModules.add(file);
+      const mod=require.cache[file]!;
+      // Recover already-loaded literal CommonJS edges. Future dynamic edges are captured by the hook.
+      const children=new Set(mod.children.map(x=>x.filename));
+      for(const match of data.toString('utf8').matchAll(/\brequire(?:\.resolve)?\s*\(\s*(['"])([^'"\r\n]+)\1\s*\)/g)){
+        let result:string;try{result=this.#originalResolve.call(moduleApi,match[2],mod);}catch{continue;}
+        if(children.has(result))this.edge(file,match[2],result);
+      }
+      // Every observed child additionally has an actual issuer-relative file association, including computed imports.
+      for(const child of mod.children)if(path.isAbsolute(child.filename))this.initialChild(file,child.filename);
+    }
+    for(const edge of [...this.#edges.values()]){
+      const resolved=this.currentResolution(edge.issuer,edge.specifier);
+      if(resolved!==edge.resolved)throw new Error('Runtime resolution drift');
+    }
+  }
+  observe():RuntimeEvidence {
+    if(this.#closed)throw new Error('Runtime observation closed');
+    if(moduleApi._resolveFilename!==this.#hook)throw new Error('Runtime resolver drift');
+    this.capture();
+    return deepFreeze({version:1,payloadFormat:'regular-package-payload@1',declared:this.#declared,package:this.#owned,
+      node:{version:process.version,platform:process.platform,arch:process.arch,abi:process.versions.modules},
+      dependencies:[...this.files.packages.values()].filter(p=>p.lockLocation!==this.#owned.lockLocation).sort((a,b)=>a.lockLocation.localeCompare(b.lockLocation,'en')),
+      resolutions:[...this.files.resolutions].sort((a,b)=>semanticHash(a).localeCompare(semanticHash(b),'en')),
+      modules:[...this.files.modules].map(([path,digest])=>({path,digest})).sort((a,b)=>a.path.localeCompare(b.path,'en'))});
+  }
+  assertUnchanged():void {if(this.#closed)throw new Error('Runtime observation closed');this.capture();this.verifyDeclared();this.files.verify();}
+  close():void {if(this.#closed)return;this.#closed=true;if(moduleApi._resolveFilename===this.#hook)moduleApi._resolveFilename=this.#originalResolve;if(moduleApi._load===this.#loadHook)moduleApi._load=this.#originalLoad;if(active===this)active=undefined;}
+}

package/runtime/delivery/configuration.ts

@@ -0,0 +1,64 @@
+/** Owned configuration/runtime contributor. It grants no planning, signing or execution authority. */
+import path from 'node:path';
+import {projectRoot,parseCoreMarker} from './project-files';
+import {readInputBytes,inputDigest} from './input-files';
+import {parseConfigurationDefinition} from './configuration-definition';
+import {observeConfigurationHre} from './configuration-hre';
+import {RuntimeObservation,type RuntimeEvidence} from './configuration-runtime';
+import {openPlanCodecObservation,type PlanCodecObservation} from './codec';
+import {deepFreeze,semanticHash,exactObject} from '../workflow/lib/canonicalData';
+import type {DeepReadonly} from './source';
+
+export interface DeliveryConfigurationOptions {workspaceRoot:string;projectRoot:string;network:string}
+export interface DeliveryConfigurationEvidence {
+  version:1; files:Array<{path:string;digest:string}>;
+  configuration:Record<string,any>;runtime:RuntimeEvidence;codec:Readonly<PlanCodecObservation>;
+  compiler:{adapter:string;stableDigest:string;exactDigest:string}|null;
+  /** Contributor identity only. C must bind this with all other actual inputs. */
+  configurationRuntimeHash:string;
+}
+export interface DeliveryConfigurationHandle {
+  readonly snapshot:DeepReadonly<DeliveryConfigurationEvidence>;
+  /** Reread without compile, producer evaluation, RPC or preparation. Failure revokes the owner. */
+  assertUnchanged():void;
+  /** Terminal observation includes modules first loaded after open. */
+  seal():DeepReadonly<DeliveryConfigurationEvidence>;
+  close():void;
+}
+/** The initialized project singleton is looked up internally; a caller HRE/JSON is never accepted. */
+export function openDeliveryConfiguration(raw:DeliveryConfigurationOptions):DeliveryConfigurationHandle {
+  let runtime:RuntimeObservation|undefined,codec:ReturnType<typeof openPlanCodecObservation>|undefined;
+  try{
+    exactObject(raw,['workspaceRoot','projectRoot','network'],'configuration options');
+    const root=projectRoot(raw.workspaceRoot,raw.projectRoot);
+    if(path.resolve(process.cwd())!==root)throw new Error();
+    const config=readInputBytes(root,'hardhat.config.ts'),marker=readInputBytes(root,'.gate-template.json');
+    // Marker describes generation provenance; current source is independently observed.
+    parseCoreMarker(marker);
+    const parsed=parseConfigurationDefinition(config,raw.network);
+    runtime=new RuntimeObservation(root);codec=openPlanCodecObservation();
+    const hre=observeConfigurationHre(root,raw.network,parsed,runtime.files);
+    const files=[{path:'hardhat.config.ts',digest:inputDigest(config)},{path:'.gate-template.json',digest:inputDigest(marker)}];
+    const observe=():DeepReadonly<DeliveryConfigurationEvidence>=>{
+      // Reuse the actual owned compiler association when present, without recapturing any compiler jobs.
+      const {ownedDeliveryCompiler}=require('./compiler') as typeof import('./compiler');
+      const compiler=ownedDeliveryCompiler(hre.hre)?.evidence();
+      const body={version:1 as const,files,configuration:hre.configuration,runtime:runtime!.observe(),codec:codec!.snapshot,
+        compiler:compiler?{adapter:compiler.adapter,stableDigest:compiler.stableDigest,exactDigest:compiler.exactDigest}:null};
+      return deepFreeze({...body,configurationRuntimeHash:semanticHash({...body,compiler:compiler?{adapter:compiler.adapter,stableDigest:compiler.stableDigest}:null})});
+    };
+    const snapshot=observe();let status:'open'|'sealed'|'failed'|'closed'='open';
+    const close=()=>{runtime!.close();codec!.close();};
+    const check=()=>{
+      const current=readInputBytes(root,'hardhat.config.ts');
+      if(inputDigest(current)!==files[0].digest||inputDigest(readInputBytes(root,'.gate-template.json'))!==files[1].digest)throw new Error();
+      hre.assertUnchanged(parseConfigurationDefinition(current,raw.network));codec!.assertUnchanged();runtime!.assertUnchanged();
+    };
+    const assertOpen=()=>{if(status!=='open')throw new Error('Delivery configuration session closed');};
+    return Object.freeze({snapshot,
+      assertUnchanged(){assertOpen();try{check();}catch{status='failed';close();throw new Error('Delivery configuration/runtime drift or mismatch');}},
+      seal(){assertOpen();status='failed';try{check();const result=observe();codec!.seal();status='sealed';return result;}catch{throw new Error('Delivery configuration/runtime drift or mismatch');}finally{close();}},
+      close(){status='closed';close();},
+    });
+  }catch{runtime?.close();codec?.close();throw new Error('Unsupported delivery configuration/runtime observation');}
+}