gate-evm-tools 1.0.31 → 1.2.1

package/runtime/delivery/release.ts

@@ -1,3 +1,5 @@
+import {deploymentPurpose} from './source';
+import {parseCalldataReviews} from './calldata-review';
 /** Developer-owned production qualification and two-phase, marker-last release publication. */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -11,13 +13,16 @@ import {parsePreparationJournal} from './journal';
 import {expectedDevelopmentAssertions} from './development';
 import {verifyCapturedForkAudit} from './forkAudit';
 import {parseCanonicalPlan,projectCanonicalDefinitions} from './source';
-import {readReleaseUniverse,currentReleasePrerequisites,readReleaseGraph,sameReleaseData as same,type ReleaseGraphOptions} from './release-graph';
+import {readReleaseUniverse,currentReleasePrerequisites,readReleaseGraph,isDevelopmentAcceptancePrerequisite,sameReleaseData as same,type ReleaseGraphOptions} from './release-graph';
 import {aggregateInputHash,validateHistoricalDevelopmentFiles,verifyHistoricalDevelopmentChain,type HistoricalDevelopmentFiles} from './release-history';
 import {atomicDevelopmentWrite,fileBytes,withDevelopmentFileLock,byteHash} from './materialization';
 import {canonicalJson,deepFreeze,semanticHash,exactObject} from '../workflow/lib/canonicalData';
 import {strictData} from './data';
 import {historicalRegistrationFile} from './history-registration';
-export {readReleaseGraph} from './release-graph';
+import {captureCommittedContractSource} from './contract-source';
+import {captureReleaseInputs,readReleaseInputSnapshot,restoreReleaseInputs} from './release-inputs';
+export type {ContractSourceIdentity} from './contract-source';
+export {readReleaseGraph,isDevelopmentAcceptancePrerequisite} from './release-graph';
 export {captureDevelopmentReleaseHistory} from './release-history-capture';
 export type {HistoricalDevelopmentFiles} from './release-history';
 type Scope=Omit<ReleaseGraphOptions,'releaseRef'>;
@@ -32,10 +37,11 @@ function taskEvidence(input:Scope&{planKey:string}){
  if(!row||plan.lanes[row.lane].state!=='enabled'||row.task.status!=='completed'||row.task.result?.kind!=='success'||row.task.adoptedRev!==row.task.rev)throw Error('Prerequisite current task is incomplete or stale');
  const result=row.task.result,codeRef=result.codeRef??(row.task.scope?.deployment as any)?.sourceCodeRef;
  if(typeof codeRef!=='string'||!codeRef.trim()||!Array.isArray(result.evidence)||!result.evidence.length)throw Error('Prerequisite requires codeRef and actual report evidence');
- const artifacts=result.evidence.map((entry:any)=>{if(!entry||typeof entry.ref!=='string')throw Error('Prerequisite report ref missing');portablePath(entry.ref,'prerequisite artifact');const bytes=readInputBytes(root,entry.ref);if(!bytes.length)throw Error('Empty prerequisite report');return {path:entry.ref,sha256:inputDigest(bytes)};});
- for(const expected of row.task.expectedArtifacts??[])if(!artifacts.some(a=>a.path===expected))throw Error('Missing declared prerequisite artifact');
- if(new Set(artifacts.map(a=>a.path)).size!==artifacts.length)throw Error('Duplicate prerequisite artifact');
- if(row.lane==='audit'&&!artifacts.some(a=>a.path==='audit-reports/security-audit-report.md'))throw Error('Audit prerequisite requires actual security audit report');
+ const refs=result.evidence.map((entry:any)=>{if(!entry||typeof entry.ref!=='string')throw Error('Prerequisite report ref missing');return entry.ref as string;});
+ if(new Set(refs).size!==refs.length)throw Error('Duplicate prerequisite artifact');
+ for(const expected of row.task.expectedArtifacts??[])if(!refs.includes(expected))refs.push(expected);
+ const artifacts=refs.map(ref=>{portablePath(ref,'prerequisite artifact');const bytes=readInputBytes(root,ref);if(!bytes.length)throw Error('Empty prerequisite report/artifact');return {path:ref,sha256:inputDigest(bytes)};});
+ if(row.lane==='audit'&&!result.evidence.some((entry:any)=>entry.ref==='audit-reports/security-audit-report.md'))throw Error('Audit prerequisite requires actual security audit report');
  return {root,envelope:{schema:'gate-delivery-prerequisite',version:1,producer:'gate-evm-tools/delivery-release',taskId:plan.taskId,planKey:row.task.planKey,rev:row.task.rev,definitionHash:semanticHash(projectCanonicalDefinitions(text,{roots:[row.task.planKey],mode:'full'}).snapshot),codeRef,artifacts}};
 }
 /** Invoke after the corresponding skill has produced its report and completed the current task.
@@ -44,15 +50,17 @@ export function recordDeliveryPrerequisite(input:Scope&{planKey:string}){const {
 export function validateDeliveryPrerequisite(input:Scope&{planKey:string}){const {root,envelope}=taskEvidence(input),actual=JSON.parse(readInputBytes(root,prerequisitePath(input.taskId,input.planKey)).toString());same(actual,envelope,'Current prerequisite report/artifact binding');return deepFreeze(actual);}
 function prerequisites(scope:Scope,history:ReturnType<typeof validateHistoricalDevelopmentFiles>){
  const current=currentReleasePrerequisites(scope),receipts=[];
- for(const {task} of current.required){if(['deploy','check-code'].includes(task.step??'')){const d=task.scope?.deployment as any;if(d?.environment!=='dev'||d.targetNetwork!==history.plan.target||d.deploymentId!==history.plan.deploymentId)throw Error('Development prerequisite scope mismatch');if(task.step==='deploy'&&(task.planKey!==history.source.targets[0].request.sourceRef.planKey||task.rev!==history.source.targets[0].request.sourceRef.rev))throw Error('Stale development prerequisite revision');const evidence=task.result?.evidence;if(!Array.isArray(evidence)||!evidence.some((e:any)=>e.ref===scopePath(history,task.step!)))throw Error('Development prerequisite must reference actual acceptance/CheckCode');receipts.push({planKey:task.planKey,rev:task.rev,definitionHash:semanticHash(projectCanonicalDefinitions(current.text,{roots:[task.planKey],mode:'full'}).snapshot),evidenceHash:semanticHash(task.step==='deploy'?history.acceptance:history.acceptance.checkCode)});}
+ for(const {task} of current.required){if(isDevelopmentAcceptancePrerequisite(task)){const d=task.scope?.deployment as any;if(d?.environment!=='dev'||d.targetNetwork!==history.plan.target||d.deploymentId!==history.plan.deploymentId)throw Error('Development prerequisite scope mismatch');if(!verificationOnly(task)&&(task.planKey!==history.source.targets[0].request.sourceRef.planKey||task.rev!==history.source.targets[0].request.sourceRef.rev))throw Error('Stale development prerequisite revision');const evidence=task.result?.evidence;if(!Array.isArray(evidence)||!evidence.some((e:any)=>e.ref===scopePath(history,verificationOnly(task))))throw Error('Development prerequisite must reference actual acceptance/CheckCode');receipts.push({planKey:task.planKey,rev:task.rev,definitionHash:semanticHash(projectCanonicalDefinitions(current.text,{roots:[task.planKey],mode:'full'}).snapshot),evidenceHash:semanticHash(verificationOnly(task)?history.acceptance.checkCode:history.acceptance)});}
   else receipts.push(validateDeliveryPrerequisite({...scope,planKey:task.planKey}));}
  return receipts;
 }
-function scopePath(history:ReturnType<typeof validateHistoricalDevelopmentFiles>,step:string){return step==='check-code'?history.acceptance.checkCode.rawFile:`.gate-delivery/development/${history.plan.executionId}.acceptance.json`;}
+function verificationOnly(task:any){const actions=task.scope?.deployment?.allowedActions;return Array.isArray(actions)&&actions.length===1&&actions[0]==='verify';}
+function scopePath(history:ReturnType<typeof validateHistoricalDevelopmentFiles>,verifyOnly:boolean){return verifyOnly?history.acceptance.checkCode.rawFile:`.gate-delivery/development/${history.plan.executionId}.acceptance.json`;}
 function verifyQualification(aggregate:DeliveryAggregate,source:DeliveryAggregateOptions){
  if(aggregate.version!==1||aggregateInputHash(aggregate)!==aggregate.inputsHash||semanticHash(aggregate.inputs.sourceDefinitions)!==aggregate.sourceDefinitionHash)throw Error('Qualification aggregate identity mismatch');
  same(aggregate.collections.map(c=>c.plan.target),aggregate.inputs.business.targets.map(t=>t.id),'Complete target qualification');same(source.targets.map(t=>t.request.network),aggregate.inputs.business.targets.map(t=>t.id),'Current selected target order');
  for(const [i,c] of aggregate.collections.entries()){const plan=parseDeliveryPlan(c.plan),request=source.targets[i].request;
+  parseCalldataReviews(c.calldata,plan.transactions);
   if(plan.environment!=='prod'||plan.inputsHash!==aggregate.inputsHash||plan.sourceDefinitionHash!==aggregate.sourceDefinitionHash||plan.executionId!==source.targets[i].executionId||plan.operator!==request.operator?.toLowerCase()||!request.fork||!plan.transactions.length)throw Error('Invalid production qualification identity');
   same(plan.runtimeIdentity,aggregate.inputs.runtime.declared,'Qualification runtime');expectedDevelopmentAssertions(c,aggregate.inputs.business.steps);
   parsePreparationJournal(c.preparations,plan.transactions,plan.derivedBindings,{target:plan.target,chainId:plan.chainId,expectedStepIds:plan.deploymentBindings.map(b=>b.stepId)});
@@ -60,17 +68,22 @@ function verifyQualification(aggregate:DeliveryAggregate,source:DeliveryAggregat
  }
 }
 function currentFiles(root:string,files:readonly {path:string;digest:string}[]){for(const file of files)if(inputDigest(readInputBytes(root,file.path))!==file.digest)throw Error(`Current release input changed: ${file.path}`);}
-function currentCandidate(scope:Scope,c:any){
+function currentCandidate(scope:Scope,c:any,requireCommittedSources=false){
  if(c.schema!=='gate-delivery-release-candidate'||c.version!==1||c.generation!=='complete'||c.producer!=='gate-evm-tools/delivery-release')throw Error('Invalid completed release candidate');
  same(c.scope,{projectRoot:scope.projectRoot,handoff:scope.handoff,taskId:scope.taskId,deploymentId:scope.deploymentId},'Release current scope');
  const {candidateHash,...body}=c;same(semanticHash(body),candidateHash,'Release candidate hash');
+ if(c.inputSnapshot?.path!==`scripts/tasks/${scope.deploymentId}/releases/${c.releaseRef.releaseId}/inputs.snapshot.json`)throw Error('Noncanonical release input snapshot reference');
  const root=projectRoot(scope.workspaceRoot,scope.projectRoot),source={workspaceRoot:scope.workspaceRoot,projectRoot:scope.projectRoot,selection:'release' as const,targets:c.targets};
+ if(requireCommittedSources)same(captureCommittedContractSource(root,c.aggregate),c.contractSource,'Current committed contract source');
+ const snapshot=readReleaseInputSnapshot(root,c.inputSnapshot);same(snapshot.contractSource,c.contractSource,'Release snapshot contract source');
+ const snapshotFiles=new Map(snapshot.files.map(file=>[file.path,file.digest]));
+ for(const file of c.aggregate.inputs.files)if(!file.path.split('/').includes('node_modules')&&snapshotFiles.get(file.path)!==file.digest)throw Error('Release snapshot does not cover qualified input');
+ for(const file of snapshot.files)if(inputDigest(readInputBytes(root,file.path))!==file.digest)throw Error(`Current release snapshot input changed: ${file.path}`);
  verifyQualification(c.aggregate,source);currentFiles(root,c.aggregate.inputs.files);currentFiles(root,c.historical.files.filter((f:any)=>!historicalRegistrationFile(f.path)));
  same(openAggregateSources({workspaceRoot:scope.workspaceRoot,projectRoot:scope.projectRoot,requests:c.targets.map((t:any)=>t.request)}).definitions,c.aggregate.inputs.sourceDefinitions,'Current full upstream source');
  const h=validateHistoricalDevelopmentFiles({root,workspaceRoot:scope.workspaceRoot,projectRoot:scope.projectRoot,history:c.development});same(h.association,c.historical.association,'Historical development association');same(prerequisites(scope,h),c.prerequisites,'Current prerequisite evidence');
  same(h.files.filter(f=>historicalRegistrationFile(f.path)),c.historical.files.filter((f:any)=>historicalRegistrationFile(f.path)),'Original historical registry baseline');
  same(readReleaseUniverse(scope).targets,c.aggregate.inputs.business.targets.map((t:any)=>t.id),'Current full selected target set');
- const docs=readInputBytes(root,'docs/prod-execution-plan.md');same(inputDigest(docs),c.explanationHash,'Production execution explanation');
  return {root,source,history:h};
 }
 /** Qualification is generated by the actual owned aggregate, never accepted from caller JSON. */
@@ -81,17 +94,25 @@ export async function prepareDeliveryRelease(raw:ReleasePreparationOptions){
  if(fileBytes(root,`scripts/tasks/${deploymentId}/releases/${input.releaseId}/release.json`)!==null)throw Error('Release already has a ready marker');
  same(input.targets.map(t=>({network:t.request.network,sourceRef:t.request.sourceRef,purpose:t.request.purpose,environment:t.request.environment,mode:t.request.mode})),u.qualifications.map(t=>({network:(t.scope!.deployment as any).targetNetwork,sourceRef:{path:handoff,taskId,planKey:t.planKey,rev:t.rev},purpose:'prod-qualification',environment:'prod',mode:'simulate'})),'Exact current qualification tasks');
  const history=validateHistoricalDevelopmentFiles({root,workspaceRoot,projectRoot:relative,history:input.development}),prerequisiteEvidence=prerequisites(scope,history);
+ const committedBefore=captureCommittedContractSource(root,history.aggregate);
  await verifyHistoricalDevelopmentChain(history,root);
- const explanation=readInputBytes(root,'docs/prod-execution-plan.md').toString();for(const ref of ['manifest.yaml','parameters.yaml','recovery'])if(!explanation.includes(ref))throw Error('Production explanation must reference canonical inputs and recovery instructions');
  const source:DeliveryAggregateOptions={workspaceRoot,projectRoot:relative,selection:'release',targets:input.targets};
  const aggregate=await collectDeliveryAggregate(source);verifyQualification(aggregate,source);
+ const contractSource=captureCommittedContractSource(root,aggregate),snapshot=captureReleaseInputs(root,aggregate,contractSource);
+ same(contractSource,committedBefore,'Contract source during release qualification');
+ const inputSnapshot={path:`scripts/tasks/${deploymentId}/releases/${input.releaseId}/inputs.snapshot.json`,hash:snapshot.snapshotHash,sha256:byteHash(encode(snapshot))};
  const releaseRef={path:`scripts/tasks/${deploymentId}/releases/${input.releaseId}/release.json`,releaseId:input.releaseId,inputsHash:aggregate.inputsHash};
- const body={schema:'gate-delivery-release-candidate',version:1,generation:'complete',producer:'gate-evm-tools/delivery-release',releaseRef,scope:{projectRoot:relative,handoff,taskId,deploymentId},targets:input.targets,development:input.development,aggregate,historical:{files:history.files,association:history.association,acceptanceHash:semanticHash(history.acceptance)},prerequisites:prerequisiteEvidence,explanationHash:inputDigest(Buffer.from(explanation))};
- const candidate=deepFreeze({...body,candidateHash:semanticHash(body)});currentCandidate(scope,candidate);
- await withDevelopmentFileLock(root,async()=>{const previous=fileBytes(root,candidatePath(input.releaseId));if(previous!==null&&previous!==encode(candidate))throw Error('Release ID already belongs to a different frozen generation');atomicDevelopmentWrite(root,candidatePath(input.releaseId),encode(candidate));});
+ const body={schema:'gate-delivery-release-candidate',version:1,generation:'complete',producer:'gate-evm-tools/delivery-release',releaseRef,scope:{projectRoot:relative,handoff,taskId,deploymentId},targets:input.targets,development:input.development,aggregate,contractSource,inputSnapshot,historical:{files:history.files,association:history.association,acceptanceHash:semanticHash(history.acceptance)},prerequisites:prerequisiteEvidence};
+ const candidate=deepFreeze({...body,candidateHash:semanticHash(body)});
+ await withDevelopmentFileLock(root,async()=>{
+  const previous=fileBytes(root,candidatePath(input.releaseId));if(previous!==null&&previous!==encode(candidate))throw Error('Release ID already belongs to a different frozen generation');
+  const saved=fileBytes(root,inputSnapshot.path);if(saved!==null&&saved!==encode(snapshot))throw Error('Immutable release input snapshot conflict');
+  atomicDevelopmentWrite(root,inputSnapshot.path,encode(snapshot));currentCandidate(scope,candidate,true);
+  atomicDevelopmentWrite(root,candidatePath(input.releaseId),encode(candidate));
+ });
  return deepFreeze({status:'prepared' as const,releaseRef,sourceDefinitionHash:aggregate.sourceDefinitionHash,inputsHash:aggregate.inputsHash,candidateHash:candidate.candidateHash});
 }
-function bundleFor(c:any,graph:ReturnType<typeof readReleaseGraph>){return {schema:'gate-delivery-release',version:1,releaseRef:c.releaseRef,sourceDefinitionHash:c.aggregate.sourceDefinitionHash,inputsHash:c.aggregate.inputsHash,prodTaskGraphHash:graph.prodTaskGraphHash,prodTaskGraph:graph.graph,targets:c.aggregate.inputs.business.targets,operations:c.aggregate.inputs.business.steps,parameters:c.aggregate.inputs.business.parameters,qualification:c.aggregate.collections,runtime:c.aggregate.inputs.runtime,immutableFiles:c.aggregate.inputs.files,sourceDefinitions:c.aggregate.inputs.sourceDefinitions,historicalDevelopment:{...c.historical.association,acceptanceHash:c.historical.acceptanceHash},prerequisites:c.prerequisites,explanation:{path:'docs/prod-execution-plan.md',sha256:c.explanationHash},candidate:{path:candidatePath(c.releaseRef.releaseId),sha256:byteHash(encode(c))}};}
+function bundleFor(c:any,graph:ReturnType<typeof readReleaseGraph>){return {schema:'gate-delivery-release',version:1,releaseRef:c.releaseRef,sourceDefinitionHash:c.aggregate.sourceDefinitionHash,inputsHash:c.aggregate.inputsHash,prodTaskGraphHash:graph.prodTaskGraphHash,prodTaskGraph:graph.graph,targets:c.aggregate.inputs.business.targets,operations:c.aggregate.inputs.business.steps,parameters:c.aggregate.inputs.business.parameters,qualification:c.aggregate.collections,runtime:c.aggregate.inputs.runtime,immutableFiles:c.aggregate.inputs.files,sourceDefinitions:c.aggregate.inputs.sourceDefinitions,contractSource:c.contractSource,inputSnapshot:c.inputSnapshot,historicalDevelopment:{...c.historical.association,acceptanceHash:c.historical.acceptanceHash},prerequisites:c.prerequisites,recovery:{strategy:'resume-original-execution',instructions:'Reconcile the original per-network executionId before retrying; preserve submitted transactions, receipts and finality records. Never replay completed operations as a new execution.'},candidate:{path:candidatePath(c.releaseRef.releaseId),sha256:byteHash(encode(c))}};}
 /** Finalizer rereads the actual handoff AFTER mainAgent writes all existing production stages. */
 export async function finalizeDeliveryRelease(raw:Scope&{releaseId:string;onFileCommitted?:(file:string)=>void}){
  // Detach own scalar data before the RPC boundary; caller options may be reused while it awaits.
@@ -103,16 +124,16 @@ export async function finalizeDeliveryRelease(raw:Scope&{releaseId:string;onFile
  if(Object.values(input).some(value=>typeof value!=='string'))throw Error('Release finalization scope requires strings');
  safeId(input.taskId,'taskId');safeId(input.deploymentId,'deploymentId');portablePath(input.handoff,'handoff');
  const root=projectRoot(input.workspaceRoot,input.projectRoot),c=JSON.parse(readInputBytes(root,candidatePath(input.releaseId)).toString());
- const initial=currentCandidate(input,c);await verifyHistoricalDevelopmentChain(initial.history,root);
+ const initial=currentCandidate(input,c,true);await verifyHistoricalDevelopmentChain(initial.history,root);
  return withDevelopmentFileLock(root,async()=>{
-  same(JSON.parse(readInputBytes(root,candidatePath(input.releaseId)).toString()),c,'Current candidate generation');currentCandidate(input,c);
+  same(JSON.parse(readInputBytes(root,candidatePath(input.releaseId)).toString()),c,'Current candidate generation');currentCandidate(input,c,true);
   const graph=readReleaseGraph({...input,releaseRef:c.releaseRef}),bundle=bundleFor(c,graph),bundleHash=semanticHash(bundle),bundlePath=`scripts/tasks/${input.deploymentId}/releases/${input.releaseId}/bundle.json`;
   const marker={schema:'gate-delivery-release-ready',version:1,status:'release_ready',generation:'complete',releaseRef:c.releaseRef,sourceDefinitionHash:c.aggregate.sourceDefinitionHash,inputsHash:c.aggregate.inputsHash,prodTaskGraphHash:graph.prodTaskGraphHash,bundle:{path:bundlePath,hash:bundleHash,sha256:byteHash(encode(bundle))}};
   const previous=fileBytes(root,c.releaseRef.path);if(previous!==null){same(JSON.parse(previous),marker,'Published release is immutable');return inspectDeliveryRelease({...input,releaseRef:c.releaseRef});}
   const existing=fileBytes(root,bundlePath);if(existing!==null&&existing!==encode(bundle))throw Error('Immutable release bundle conflict');
   atomicDevelopmentWrite(root,bundlePath,encode(bundle));onFileCommitted?.(bundlePath);
   // Async notification or competing edits cannot publish stale graph/evidence. Authoritative marker comes last.
-  currentCandidate(input,c);same(readReleaseGraph({...input,releaseRef:c.releaseRef}),graph,'Current production graph');
+  currentCandidate(input,c,true);same(readReleaseGraph({...input,releaseRef:c.releaseRef}),graph,'Current production graph');
   if(fileBytes(root,bundlePath)!==encode(bundle))throw Error('Prepared bundle changed before publication');
   atomicDevelopmentWrite(root,c.releaseRef.path,encode(marker));return inspectDeliveryRelease({...input,releaseRef:c.releaseRef});
  });
@@ -126,3 +147,20 @@ export function inspectDeliveryRelease(input:Scope&{releaseRef:ReleaseGraphOptio
  const expected={schema:'gate-delivery-release-ready',version:1,status:'release_ready',generation:'complete',releaseRef:c.releaseRef,sourceDefinitionHash:c.aggregate.sourceDefinitionHash,inputsHash:c.aggregate.inputsHash,prodTaskGraphHash:graph.prodTaskGraphHash,bundle:{path:bundlePath,hash:semanticHash(bundle),sha256:byteHash(encode(bundle))}};
  same(marker,expected,'Complete ready content identity');same(readInputBytes(root,bundlePath).toString(),encode(bundle),'Immutable published bundle bytes');return deepFreeze({status:'release_ready' as const,release:bundle,bundleHash:marker.bundle.hash});
 }
+/** File-only historical input recovery; current project edits do not rewrite the old release. */
+export function restoreDeliveryReleaseInputs(raw:Scope&{releaseRef:ReleaseGraphOptions['releaseRef'];destination:string}){
+ const input=strictData(raw);exactObject(input,['workspaceRoot','projectRoot','handoff','taskId','deploymentId','releaseRef','destination'],'release input restore');
+ const root=projectRoot(input.workspaceRoot,input.projectRoot),ref=input.releaseRef;
+ safeId(input.deploymentId,'deploymentId');safeId(ref.releaseId,'releaseId');
+ const base=`scripts/tasks/${input.deploymentId}/releases/${ref.releaseId}`;
+ if(ref.path!==`${base}/release.json`)throw Error('Noncanonical release restore reference');
+ const marker=JSON.parse(readInputBytes(root,ref.path).toString());
+ if(marker.schema!=='gate-delivery-release-ready'||marker.version!==1||marker.status!=='release_ready'||marker.generation!=='complete')throw Error('Release restore requires a completed published release');
+ same(marker.releaseRef,ref,'Restore release reference');
+ const bytes=readInputBytes(root,`${base}/bundle.json`),bundle=JSON.parse(bytes.toString());
+ if(marker.bundle.path!==`${base}/bundle.json`||marker.bundle.sha256!==byteHash(bytes)||marker.bundle.hash!==semanticHash(bundle)||bytes.toString()!==encode(bundle))throw Error('Published release bundle changed');
+ if(bundle.schema!=='gate-delivery-release'||bundle.version!==1||bundle.inputSnapshot.path!==`${base}/inputs.snapshot.json`)throw Error('Invalid release restore bundle');
+ same(bundle.releaseRef,ref,'Restore bundle release reference');same(bundle.inputsHash,ref.inputsHash,'Restore bundle input identity');
+ const snapshot=readReleaseInputSnapshot(root,bundle.inputSnapshot);same(snapshot.contractSource,bundle.contractSource,'Restore committed contract source');
+ return {...restoreReleaseInputs(root,bundle.inputSnapshot,input.destination),releaseRef:ref};
+}

package/runtime/delivery/safe.ts

@@ -12,6 +12,7 @@ import { uint256 } from "./observations";
 import type { EoaFinality } from "./eoa-observation";
 import type { DeliveryPlan } from "./plan";
 import { SAFE_RUNTIME_HASHES } from "./safe-manifest";
+import { createCalldataInvocation } from './calldata-review';
 export const SAFE_ADAPTER = deepFreeze({
   id: "safe-1.4.1-call-only/v1",
   version: "1.4.1",
@@ -326,14 +327,24 @@ export function verifySafeExec(
 }
 export function renderSafeExport(rawPlan: unknown, raw: unknown) {
   const plan = immutableDeliveryPlan(rawPlan),
-    envelope = parseSafeEnvelope(raw, plan),
-    model = deepFreeze({
+    envelope = parseSafeEnvelope(raw, plan);
+  const unsignedExecTransaction = encodeSafeExec(envelope, '0x');
+  const payloads = envelope.operation === 1 ? [{ argumentPath: [2], invocation: createCalldataInvocation({
+    abi: multi.fragments, method: 'multiSend', args: [
+      '0x' + plan.transactions.slice(envelope.start, envelope.start + envelope.count).map(c =>
+        solidityPacked(['uint8', 'address', 'uint256', 'uint256', 'bytes'], [0, c.to, c.value, (c.data.length - 2) / 2, c.data]).slice(2)).join(''),
+    ], data: envelope.data,
+  }) }] : [];
+  const unsignedExecReview = createCalldataInvocation({ abi: SAFE_INTERFACE.fragments, method: 'execTransaction',
+    args: [...execKeys.map(k => (envelope as any)[k]), '0x'], data: unsignedExecTransaction, payloads });
+  const model = deepFreeze({
       schema: "gate-safe-export",
       version: 1,
       status: "artifact-delivered",
       plan,
       envelope,
-      unsignedExecTransaction: encodeSafeExec(envelope, "0x"),
+      unsignedExecTransaction,
+      unsignedExecReview,
     });
   const json = canonicalJson(model);
   return deepFreeze({

package/runtime/delivery/same-fork-baseline.ts

@@ -5,12 +5,13 @@ export interface SameForkInitialPreparation { request: GateToolPreparationReques
 /** Stable initial preparation and full prior layout commitment. Auxiliary compiler randomness is excluded. */
 export function sameForkBaselineDigest(initial: SameForkInitialPreparation, oldLayoutHash: string): string {
   const request = normalizePreparationRequest(initial.request), plan = normalizePreparationPlan(initial.plan);
-  if (request.kind !== 'uups-placeholder-deploy' || plan.kind !== request.kind || plan.requestHash !== hashPreparationRequest(request)
-    || plan.target !== request.target || !/^[a-f0-9]{64}$/.test(oldLayoutHash)) throw new Error('Invalid same-fork initial preparation');
+  if ((request.kind !== 'uups-placeholder-deploy' && request.kind !== 'transparent-deploy') || plan.kind !== request.kind || plan.requestHash !== hashPreparationRequest(request)
+    || plan.proxyKind !== request.proxyKind || plan.target !== request.target || !/^[a-f0-9]{64}$/.test(oldLayoutHash)) throw new Error('Invalid same-fork initial preparation');
   return semanticHash({kind:'same-fork',request,plan,oldLayoutHash});
 }
-export function matchesSameForkInitial(initial: SameForkInitialPreparation, target: string, chainId: string, proxy: string, implementation?: string): boolean {
-  return initial.request.kind === 'uups-placeholder-deploy' && initial.request.target === target && initial.plan.target === target && initial.plan.chainId === chainId
+export function matchesSameForkInitial(initial: SameForkInitialPreparation, target: string, chainId: string, proxy: string, implementation?: string, proxyKind?: 'uups' | 'transparent'): boolean {
+  return (initial.request.kind === 'uups-placeholder-deploy' || initial.request.kind === 'transparent-deploy') && initial.request.target === target && initial.plan.target === target && initial.plan.chainId === chainId
+    && initial.plan.proxyKind === initial.request.proxyKind && (proxyKind === undefined || initial.request.proxyKind === proxyKind)
     && initial.plan.deployments.some(d => d.role === 'proxy' && d.address.toLowerCase() === proxy.toLowerCase())
     && (implementation === undefined || initial.plan.deployments.some(d => d.role === 'implementation' && d.address.toLowerCase() === implementation.toLowerCase()));
 }

package/runtime/delivery/setup.ts

@@ -4,16 +4,20 @@ import crypto from 'node:crypto';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import YAML from 'yaml';
+import { REVIEWED_DELIVERY_OVERRIDES } from './toolchain';
 import { object } from './protocol';
-import { coreMarker, projectRoot, readFile, confinedFile, stat, integratedConfig, readProjectNetworkSnapshots, projectSourcesDirectory } from './project';
-import { configDocument, validateDeliveryTarget, type DeliveryTarget } from './config';
-export { readProjectNetworkSnapshots } from './project';
+import { deliveryProjectMarker, projectRoot, readFile, confinedFile, stat, integratedConfig, readPublicProjectNetworkSnapshots, projectSourcesDirectory } from './project';
+import { configDocument, parseDeliveryPublicTargets, validateDeliveryTarget, type DeliveryTarget } from './config';
+export { readProjectNetworkSnapshots, readPublicProjectNetworkSnapshots } from './project';
 export { loadDeliveryTarget } from './config';
 export { configureDeliveryEnvironment } from './manifest';
 export type { DeliveryTarget, DeliveryTargetConfig } from './config';
 
 const TOOLCHAIN: Record<string, string> = { hardhat: '2.26.3', ethers: '6.15.0', '@nomicfoundation/hardhat-ethers': '3.1.0', typescript: '5.9.3', 'ts-node': '10.9.2' };
-const DEPENDENCIES: Record<string, string> = { 'gate-evm-tools': '1.0.29', '@openzeppelin/hardhat-upgrades': '3.9.1', '@openzeppelin/upgrades-core': '1.44.2', '@openzeppelin/contracts': '5.4.0' };
+// Resolve our identity from the executing package, including an explicitly installed tarball.
+const toolIdentity = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../package.json'), 'utf8'));
+if (toolIdentity.name !== 'gate-evm-tools' || typeof toolIdentity.version !== 'string') throw new Error('Invalid GateTool package identity');
+const DEPENDENCIES: Record<string, string> = { 'gate-evm-tools': toolIdentity.version, '@openzeppelin/hardhat-upgrades': '3.9.1', '@openzeppelin/upgrades-core': '1.44.2', '@openzeppelin/contracts': '5.4.0' };
 export interface DeliverySetupOptions {
   workspaceRoot: string;
   projectRoot: string;
@@ -65,10 +69,14 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
   const targets = input.targets.map(validateDeliveryTarget);
   if (new Set(targets.map(target => target.network)).size !== targets.length) throw new Error('Duplicate selected target');
   const root = projectRoot(input.workspaceRoot, input.projectRoot);
-  coreMarker(root);
+  deliveryProjectMarker(root);
   const before = new Map<string, string | undefined>();
   for (const file of ['.gate-template.json', 'package.json', 'hardhat.config.ts', 'config.yaml', 'contractInfo.json']) before.set(file, readFile(root, file));
   const pkg = object(JSON.parse(before.get('package.json') ?? 'null'), 'package.json');
+  const overrides = pkg.overrides === undefined ? {} : object(pkg.overrides, 'package overrides');
+  for (const [name, version] of Object.entries(REVIEWED_DELIVERY_OVERRIDES)) {
+    if (overrides[name] !== undefined && overrides[name] !== version) throw new Error(`Reviewed delivery dependency override conflict: ${name}`);
+  }
   const declarations: Record<string, unknown> = {};
   for (const section of ['dependencies', 'devDependencies']) {
     const entries = pkg[section] === undefined ? {} : object(pkg[section], section);
@@ -89,7 +97,7 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
     const localTool = name === 'gate-evm-tools' && input.toolPackage === undefined && typeof declared === 'string' && /^file:.*\.tgz$/.test(declared);
     if ((name in TOOLCHAIN && declared === undefined) || (declared !== undefined && declared !== version && !localTool)) throw new Error(`Dependency declaration conflict for ${name}: expected ${version}`);
   }
-  const networks = readProjectNetworkSnapshots(root, targets.map(target => target.network));
+  const networks = readPublicProjectNetworkSnapshots(root, targets.map(target => target.network));
   const source = before.get('hardhat.config.ts')!;
   const withPlugin = integratedConfig(source); // Check integration conflicts even when dependencies are missing.
   const doc = configDocument(root);
@@ -106,6 +114,9 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
     confinedFile(root, target.openzeppelin!.manifestDir, 'directory');
     merge([network], target);
   }
+  // Validate the same effective facilities used by input qualification, while keeping inherited
+  // addresses in their profiles so later base edits propagate to non-overridden targets.
+  parseDeliveryPublicTargets(Buffer.from(doc.toString()), Buffer.from(source), targets);
   if (before.get('contractInfo.json') !== undefined) object(JSON.parse(before.get('contractInfo.json')!), 'contractInfo.json');
   const dependencies: DeliveryInspection['dependencies'] = [];
   const projectRequire = createRequire(path.join(root, 'package.json'));
@@ -140,10 +151,11 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
   }
   const writes = new Map<string, string>();
   const missing = Object.entries(required).filter(([name]) => declarations[name] === undefined);
-  if (missing.length) {
+  const missingOverrides = Object.entries(REVIEWED_DELIVERY_OVERRIDES).some(([name]) => overrides[name] === undefined);
+  if (missing.length || missingOverrides) {
     const dev = { ...(pkg.devDependencies as Record<string, unknown> ?? {}) };
     for (const [name, version] of missing) dev[name] = version;
-    writes.set('package.json', JSON.stringify({ ...pkg, devDependencies: dev }, null, 2) + '\n');
+    writes.set('package.json', JSON.stringify({ ...pkg, devDependencies: dev, overrides: { ...overrides, ...REVIEWED_DELIVERY_OVERRIDES } }, null, 2) + '\n');
   }
   if (changedYaml) writes.set('config.yaml', doc.toString());
   if (before.get('contractInfo.json') === undefined) writes.set('contractInfo.json', '{}\n');

package/runtime/delivery/source.ts

@@ -1,7 +1,7 @@
 /** Actual-file source binding only. This API grants no host approval or execution authority. */
 import fs from 'node:fs';
 import { createHash } from 'node:crypto';
-import { coreMarker, projectRoot, confinedFile } from './project-files';
+import { deliveryProjectMarker, projectRoot, confinedFile } from './project-files';
 import { object, parseDeliveryRequest, validateDeliveryRpc, type DeliveryRequest, type ChainIdProvider, type ProjectNetworkSnapshot } from './protocol';
 import { loadPlanCodec } from './codec';
 import type { Plan, PlanTask, DefinitionSelection, DefinitionSnapshot, DeepReadonly } from '../vendor/plan-codec/index.cjs';
@@ -37,11 +37,9 @@ export function parseCanonicalPlan(text: string): Plan { return loadPlanCodec().
 export function projectCanonicalDefinitions(text: string, selection: DefinitionSelection): ReturnType<ReturnType<typeof loadPlanCodec>['projectDefinitions']> {
   return loadPlanCodec().projectDefinitions(text, selection);
 }
-const purposeSteps = {
-  'dev-execution': ['deploy', 'check-code'],
-  'prod-qualification': ['deploy-test'],
-  'prod-execution': ['release-prepare', 'release-execute', 'release-verify'],
-};
+export function deploymentPurpose(task: Pick<PlanTask, 'step' | 'scope'>) {
+  return loadPlanCodec().deploymentPurpose(task);
+}
 function sameRelease(actual: unknown, expected: DeliveryRequest['releaseRef']): boolean {
   if (expected === undefined) return actual === undefined;
   if (!actual || typeof actual !== 'object' || Array.isArray(actual)) return false;
@@ -78,7 +76,7 @@ function readSource(input: Omit<DeliverySourceOptions, 'sourceRoots'> & { source
   const request = parseDeliveryRequest(input.request);
   const workspace = projectRoot(input.workspaceRoot, '.');
   const root = projectRoot(workspace, input.projectRoot);
-  coreMarker(root);
+  deliveryProjectMarker(root);
   const bytes = actualSource(workspace, request.sourceRef.path);
   const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
   if (input.sourceRoots === undefined) (require('./input-files') as typeof import('./input-files')).assertUnambiguousHandoff(text);
@@ -89,15 +87,17 @@ function readSource(input: Omit<DeliverySourceOptions, 'sourceRoots'> & { source
   const invocation = entries.find(({ task }) => task.planKey === request.sourceRef.planKey);
   if (!invocation || invocation.task.rev !== request.sourceRef.rev) throw new Error('sourceRef planKey/rev does not match actual handoff');
   if (plan.lanes[invocation.lane].state !== 'enabled' || invocation.task.status === 'cancelled') throw new Error('Invocation task is disabled or cancelled');
+  const requirementIssue = codec.deploymentRequirementIssue(plan, invocation.task);
+  if (requirementIssue) throw new Error(requirementIssue);
   const deployment = object(invocation.task.scope?.deployment, 'invocation scope.deployment');
   if (deployment.projectRoot !== input.projectRoot) throw new Error('Invocation projectRoot mismatch');
   if (deployment.chainFamily !== 'evm' || deployment.framework !== 'hardhat2') throw new Error('Invocation requires an EVM Hardhat2 deployment');
-  if (!purposeSteps[request.purpose].includes(invocation.task.step ?? '')) throw new Error('Invocation purpose/step mismatch');
+  if (deploymentPurpose(invocation.task) !== request.purpose) throw new Error('Invocation purpose mismatch');
   if (deployment.environment !== request.environment || deployment.targetNetwork !== request.network) throw new Error('Invocation environment/targetNetwork mismatch');
   if (!Array.isArray(deployment.allowedActions) || !deployment.allowedActions.includes(request.mode)) throw new Error('Invocation mode is not in allowedActions');
   if (!sameRelease(deployment.releaseRef, request.releaseRef)) throw new Error('Invocation releaseRef mismatch');
   const sourceRoots = input.sourceRoots ?? (request.purpose === 'prod-execution'
-    ? entries.filter(({ task }) => task.step === 'deploy-test'
+    ? entries.filter(({ task }) => deploymentPurpose(task) === 'prod-qualification'
       && (task.scope?.deployment as Record<string, unknown> | undefined)?.projectRoot === input.projectRoot
       && (task.scope?.deployment as Record<string, unknown> | undefined)?.deploymentId === deployment.deploymentId).map(({ task }) => task.planKey)
     : [invocation.task.planKey]);
@@ -109,7 +109,7 @@ function readSource(input: Omit<DeliverySourceOptions, 'sourceRoots'> & { source
   }
   let production: ReturnType<typeof codec.projectDefinitions> | undefined;
   if (request.purpose === 'prod-execution') {
-    const roots = entries.filter(({ task }) => purposeSteps['prod-execution'].includes(task.step ?? '')
+    const roots = entries.filter(({ task }) => deploymentPurpose(task) === 'prod-execution'
       && task.scope?.deployment && (task.scope.deployment as Record<string, unknown>).projectRoot === input.projectRoot
       && sameRelease((task.scope.deployment as Record<string, unknown>).releaseRef, request.releaseRef)).map(({ task }) => task.planKey);
     production = codec.projectDefinitions(text, { roots, mode: 'full' });

package/runtime/delivery/task-identity.ts

@@ -0,0 +1,85 @@
+/** Allocate a round only after its concrete requirement revision is confirmed. */
+import fs from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { parseCanonicalPlan, projectCanonicalDefinitions, deploymentPurpose } from './source';
+import { projectRoot, deliveryProjectMarker, confinedFile, stat } from './project-files';
+import { readInputBytes, assertUnambiguousHandoff } from './input-files';
+import { withDevelopmentFileLock, atomicDevelopmentWrite, fileBytes } from './materialization';
+import { exactObject, semanticHash, canonicalJson } from '../workflow/lib/canonicalData';
+import { safeId, portablePath, object } from './protocol';
+
+export interface DeploymentRequirementRef { planKey: string; rev: number }
+export function parseDeploymentRequirementRef(raw: unknown): DeploymentRequirementRef {
+  const ref = exactObject(raw, ['planKey', 'rev'], 'requirementRef');
+  safeId(ref.planKey, 'requirementRef.planKey');
+  if (!Number.isSafeInteger(ref.rev) || (ref.rev as number) < 1) throw Error('Invalid requirement revision');
+  return { planKey: ref.planKey as string, rev: ref.rev as number };
+}
+export interface CreateDeliveryTaskOptions {
+  workspaceRoot: string; projectRoot: string; handoff: string; taskId: string;
+  requirementRef: DeploymentRequirementRef; businessSlug: string; referenceDeploymentId?: string;
+}
+/** A reservation creates metadata only. The deployment Agent supplies executable content afterwards. */
+export async function createDeliveryTask(input: CreateDeliveryTaskOptions) {
+  object(input, 'create deployment task', ['workspaceRoot', 'projectRoot', 'handoff', 'taskId', 'requirementRef', 'businessSlug', 'referenceDeploymentId']);
+  const root = projectRoot(input.workspaceRoot, input.projectRoot), workspace = projectRoot(input.workspaceRoot, '.');
+  deliveryProjectMarker(root);
+  portablePath(input.handoff, 'handoff'); safeId(input.taskId, 'taskId');
+  const ref = parseDeploymentRequirementRef(input.requirementRef);
+  if (typeof input.businessSlug !== 'string' || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(input.businessSlug)) throw Error('businessSlug must be a short lowercase business name');
+  if (input.referenceDeploymentId !== undefined) safeId(input.referenceDeploymentId, 'referenceDeploymentId');
+  return withDevelopmentFileLock(root, async () => {
+    const text = readInputBytes(workspace, input.handoff).toString(); assertUnambiguousHandoff(text);
+    const plan = parseCanonicalPlan(text);
+    if (plan.taskId !== input.taskId) throw Error('Requirement taskId mismatch');
+    const requirement = Object.values(plan.tasks).flat().find(t => t.planKey === ref.planKey);
+    if (!requirement || requirement.rev !== ref.rev || requirement.requirementConfirmation?.rev !== ref.rev
+      || requirement.status === 'cancelled' || deploymentPurpose(requirement) !== 'analysis'
+      || (requirement.scope?.deployment as any)?.projectRoot !== input.projectRoot) throw Error('Deployment requirement is unconfirmed or stale');
+    const d = requirement.scope!.deployment as any;
+    if (!d.requiredOperations?.length || !d.developmentNetwork || !Array.isArray(d.releaseTargetNetworks)) throw Error('Confirmed requirement scope is incomplete');
+    const identity = semanticHash({ taskId: input.taskId, projectRoot: input.projectRoot, requirementRef: ref });
+    const requirementHash = semanticHash(projectCanonicalDefinitions(text, { roots: [ref.planKey], mode: 'upstream' }).snapshot);
+    const registry = `.gate-delivery/deployment-requests/${identity}.json`;
+    const requestIdentity = { taskId: input.taskId, requirementRef: ref, requirementHash,
+      referenceDeploymentId: input.referenceDeploymentId ?? null };
+    let record: any;
+    const existing = fileBytes(root, registry);
+    if (existing !== null) {
+      record = JSON.parse(existing);
+      if (canonicalJson(record.requestIdentity) !== canonicalJson(requestIdentity)) throw Error('Confirmed requirement identity conflict');
+      safeId(record.deploymentId, 'reserved deploymentId');
+    } else {
+      const known = new Set(Object.values(plan.tasks).flat().map(t => (t.scope?.deployment as any)?.deploymentId).filter(Boolean));
+      const history = fileBytes(workspace, input.handoff.includes('/') ? `${input.handoff.slice(0, input.handoff.lastIndexOf('/'))}/handoff-ledger.jsonl` : 'handoff-ledger.jsonl');
+      if (history) for (const line of history.split('\n').filter(Boolean)) {
+        const item = JSON.parse(line);
+        for (const entry of item.tasks ?? []) { const id = entry.task?.scope?.deployment?.deploymentId; if (id) known.add(id); }
+      }
+      const date = new Date().toISOString().slice(0, 10).replaceAll('-', '');
+      let deploymentId: string;
+      do { deploymentId = `${input.businessSlug}-${date}-${randomBytes(4).toString('hex')}`; }
+      while (known.has(deploymentId) || stat(confinedFile(root, `scripts/tasks/${deploymentId}`, 'directory')));
+      record = { version: 1, deploymentId, releaseId: `${deploymentId}-release`, requestIdentity, state: 'reserved' };
+      // Publish reservation before creating the package, so a retry uses the same ID.
+      atomicDevelopmentWrite(root, registry, canonicalJson(record) + '\n');
+    }
+    const businessRoot = `scripts/tasks/${record.deploymentId}`;
+    const directory = confinedFile(root, businessRoot, 'directory');
+    const marker = `${businessRoot}/.request.json`;
+    const markerBytes = canonicalJson({ identity }) + '\n';
+    const previousMarker = fileBytes(root, marker);
+    if (stat(directory) && previousMarker !== markerBytes && fs.readdirSync(directory).length) throw Error('Reserved deployment directory is occupied; refusing to overwrite');
+    if (previousMarker !== null && previousMarker !== markerBytes) throw Error('Deployment reservation ownership mismatch');
+    if (previousMarker === null) atomicDevelopmentWrite(root, marker, markerBytes);
+    const metadata = { version: 1, id: record.deploymentId, requirementRef: ref,
+      developmentNetwork: d.developmentNetwork, releaseTargetNetworks: d.releaseTargetNetworks,
+      ...(input.referenceDeploymentId ? { referenceDeploymentId: input.referenceDeploymentId } : {}) };
+    const taskPath = `${businessRoot}/task.yaml`, bytes = canonicalJson(metadata) + '\n';
+    const previous = fileBytes(root, taskPath);
+    if (previous !== null && previous !== bytes) throw Error('Reserved task metadata changed; refusing to overwrite');
+    if (previous === null) atomicDevelopmentWrite(root, taskPath, bytes);
+    if (record.state !== 'complete') atomicDevelopmentWrite(root, registry, canonicalJson({ ...record, state: 'complete' }) + '\n');
+    return { status: 'created' as const, deploymentId: record.deploymentId as string, releaseId: record.releaseId as string, businessRoot, specPath: taskPath, requirementRef: ref };
+  });
+}

package/runtime/delivery/toolchain.ts

@@ -0,0 +1,48 @@
+import { compilerDependencyPins } from './compiler-dependency-pins';
+
+/** Reviewed compiler adapter dependency selections; payload checks remain authoritative.
+ * Range-scoped entries preserve distinct dependency majors. Setup never overrides a conflicting project choice. */
+export const REVIEWED_DELIVERY_OVERRIDES: Record<string, string> = {
+  "axios": "1.20.0",
+  "@aws-sdk/client-lambda": "3.1152.0",
+  "@aws-sdk/core": "3.978.3",
+  "@aws-sdk/credential-provider-env": "3.972.74",
+  "@aws-sdk/credential-provider-http": "3.972.76",
+  "@aws-sdk/credential-provider-ini": "3.973.19",
+  "@aws-sdk/credential-provider-login": "3.972.81",
+  "@aws-sdk/credential-provider-node": "3.972.86",
+  "@aws-sdk/credential-provider-process": "3.972.74",
+  "@aws-sdk/credential-provider-sso": "3.973.18",
+  "@aws-sdk/credential-provider-web-identity": "3.972.80",
+  "@aws-sdk/nested-clients": "3.997.48",
+  "@aws-sdk/signature-v4-multi-region": "3.996.48",
+  "@aws-sdk/token-providers": "3.1150.0",
+  "@aws-sdk/types": "3.974.6",
+  "@smithy/types": "4.19.0",
+  "@smithy/signature-v4": "5.7.4",
+  "@smithy/fetch-http-handler": "5.8.0",
+  "@smithy/credential-provider-imds": "4.5.2",
+  "@smithy/core": "3.36.0",
+  "@smithy/node-http-handler": "4.12.1",
+  "bowser": "2.14.1",
+  "follow-redirects": "1.16.1",
+  "undici@>=5 <6": "5.29.0",
+  "undici@>=6 <7": "6.29.0",
+  "tslib@>=1 <2": "1.14.1",
+  "tslib@>=2 <3": "2.7.0",
+  "semver@>=5 <6": "5.7.2",
+  "semver@>=6 <7": "6.3.1",
+  "semver@>=7 <8": "7.8.5",
+  "ansi-regex@>=6 <7": "6.4.0"
+};
+
+// OZ's compiler adapter follows floating AWS/Smithy ranges. Freeze that reviewed
+// family closure so a fresh npm resolution cannot select unqualified payloads.
+// Other project dependencies keep their original constraints and payload checks.
+for (const key of Object.keys(compilerDependencyPins)) {
+  if (!key.startsWith('@aws-sdk/') && !key.startsWith('@smithy/')) continue;
+  const at = key.lastIndexOf('@'), name = key.slice(0, at), version = key.slice(at + 1);
+  const existing = REVIEWED_DELIVERY_OVERRIDES[name];
+  if (existing && existing !== version) throw new Error('Ambiguous reviewed compiler dependency: ' + name);
+  REVIEWED_DELIVERY_OVERRIDES[name] = version;
+}

package/runtime/delivery/validation.ts

@@ -118,13 +118,16 @@ export function createDeliveryValidation(
         const args = first
           ? (first.constructorArgs ?? [])
           : step.kind === "deploy"
-            ? (step.args ?? [])
+            ? (proxy ? (proxy.constructorArgs ?? []) : (step.args ?? []))
             : (step.constructorArgs ??
               (typeof proxy === "object"
                 ? proxy?.constructorArgs
                 : undefined) ??
               []);
         await argumentsFor(name as string, null, args, true);
+        if (step.kind === "deploy" && proxy?.kind === "transparent" && proxy.initializer !== false) {
+          await argumentsFor(name as string, String(proxy.initializer), step.args ?? [], true);
+        }
         const init = (first?.call ?? step.call) as
           | Record<string, unknown>
           | undefined;
@@ -169,7 +172,9 @@ export function createDeliveryValidation(
                 true,
               )
             : declaredCreate2;
-        if (step.kind === "deploy" && create2) {
+        // Transparent proxy prediction depends on the prepared implementation salt/address.
+        // Its actual constructor and policies are independently checked by preparation semantics.
+        if (step.kind === "deploy" && create2 && proxy?.kind !== "transparent") {
           const a = await read(first ? ERC1967_PROXY : (name as string));
           const constructor = resolve(
             first