gate-evm-tools 1.2.1 → 1.2.2

package/runtime/delivery/production.ts

@@ -39,13 +39,14 @@ function inspect(raw: ProductionOptions, command: ProductionCommand) {
     const input = deepFreeze(strictData(raw));
     exactObject(input, keys, 'production options');
     safeId(input.executionId, 'executionId');
-    const mode = command === 'prepare' ? 'simulate' : command;
-    const request = parseDeliveryRequest({ version: 1, environment: 'prod', purpose: 'prod-execution', mode, network: input.target, operator: input.operator, releaseRef: input.releaseRef, sourceRef: { path: input.handoff, taskId: input.taskId, planKey: input.planKey, rev: input.rev } });
     const release = inspectDeliveryRelease(input);
     if (release.status === 'pending')
         return { status: 'pending' as const, input };
+    const mode = command === 'prepare' ? 'simulate' : command;
+    const native= (require('./release-graph') as typeof import('./release-graph')).standaloneReleaseDefinition(input);
+    const request = parseDeliveryRequest({ version: native?2:1, environment: 'prod', purpose: 'prod-execution', mode, network: input.target, operator: input.operator, releaseRef: input.releaseRef, sourceRef: native?{kind:'standalone',path:input.handoff,deploymentId:input.deploymentId}:{ path: input.handoff, taskId: input.taskId, planKey: input.planKey, rev: input.rev } });
     const source = readOwnedDeliverySource({ workspaceRoot: input.workspaceRoot, projectRoot: input.projectRoot, request });
-    if ((source.invocation.task.scope!.deployment as any).deploymentId !== input.deploymentId)
+    if ((source.scope as any).deploymentId !== input.deploymentId)
         throw Error('Production deployment mismatch');
     const target = release.release.targets.find((t: any) => t.id === input.target);
     if (!target)
@@ -69,7 +70,7 @@ export function inspectDeliveryProduction(raw: ProductionOptions, command: Produ
     if(canonicalJson(deliveryCalls)!==canonicalJson(record.deliveryCalls))throw Error('Frozen production public projection mismatch');
     if (record.releaseHash !== current.releaseHash || plan.inputsHash !== current.release.inputsHash || plan.sourceDefinitionHash !== current.release.sourceDefinitionHash || plan.executionId !== current.input.executionId || plan.target !== current.input.target || plan.operator !== current.input.operator.toLowerCase() || plan.environment !== 'prod' || plan.chainId !== String(current.target.chainId))
         throw Error('Production artifact context mismatch');
-    return deepFreeze({ status: 'ready' as const, plan, collection: record.collection as DeliveryCollection, deliveryCalls, operations: current.release.operations as any[], finalization: record.finalization, releaseHash: current.releaseHash, artifactHash, sha256: byteHash(bytes), path: artifactPath(current.input.executionId), ...(current.target.safe ? { safeTarget: current.target.safe } : {}) });
+    return deepFreeze({ status: 'ready' as const, plan, collection: record.collection as DeliveryCollection, deliveryCalls, parameters:current.release.parameters.find((p:any)=>p.target===current.input.target)?.resolved.values, operations: current.release.operations as any[], finalization: record.finalization, releaseHash: current.releaseHash, artifactHash, sha256: byteHash(bytes), path: artifactPath(current.input.executionId), ...(current.target.safe ? { safeTarget: current.target.safe } : {}) });
 }
 /** Instantiate the delivered business operations, never accept replacement operations or parameters. */
 export async function prepareDeliveryProduction(raw: ProductionOptions) {

package/runtime/delivery/project-files.ts

@@ -35,7 +35,10 @@ export function readFile(root: string, relative: string): string | undefined {
   return stat(file) ? fs.readFileSync(file, 'utf8') : undefined;
 }
 export function deliveryProjectMarker(root: string): void {
-  parseDeliveryProjectMarker(readFile(root, '.gate-template.json') ?? 'null');
+  const marker = readFile(root, '.gate-template.json');
+  // Existing Hardhat projects have no generator provenance. Setup validates their
+  // real configuration and local capabilities without inventing a template identity.
+  if (marker !== undefined) parseDeliveryProjectMarker(marker);
 }
 /** Validate the same captured marker bytes whose digest is bound to current inputs. */
 export function parseDeliveryProjectMarker(bytes: string | Buffer): void {
@@ -52,6 +55,7 @@ export function parseDeliveryProjectMarker(bytes: string | Buffer): void {
   const optional = ['README.md', 'AGENTS.md', '.gitignore'];
   const assets = ['package.json', 'package-lock.json', 'hardhat.config.ts', 'rpc.env', '.env.example', 'tsconfig.json', ...optional, 'contracts/.gitkeep', 'test/.gitkeep',
     'foundry.toml', 'config.yaml',
+    ...(Object.hasOwn(files, 'hardhat.zk.config.ts') ? ['hardhat.zk.config.ts'] : []),
     ...(Object.hasOwn(files, 'vendor/gate-evm-tools-1.2.0.tgz') ? ['vendor/gate-evm-tools-1.2.0.tgz'] : []),
     ...(inputs.examples === true ? ['contracts/Counter.sol', 'test/Counter.ts', 'test/Counter.t.sol'] : [])];
   if (typeof inputs.projectName !== 'string' || !inputs.projectName || !Array.isArray(inputs.networks)

package/runtime/delivery/project-rpc.ts

@@ -10,7 +10,7 @@ export const PROJECT_ENV_BOOTSTRAP = `for (const file of ["rpc.env", ".env"]) {
       process.loadEnvFile(envFile);
     } catch (error) {
       if (file !== ".env" || !["ENOENT", "EPERM", "EACCES"].includes((error as NodeJS.ErrnoException).code ?? "")) throw error;
-      console.warn("Project credentials are unavailable; compilation and public checks can continue. Use the application host for credential-bearing delivery operations.");
+      console.warn("Project credentials are unavailable; compilation and public checks can continue. Use the terminal or App delivery host for credential-bearing operations.");
     }
   }
 }`;
@@ -30,7 +30,11 @@ function statement(source: string): string {
   const file = ts.createSourceFile('rpc.ts', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
   return syntax(file.statements[0], file);
 }
-const bootstrapSyntax = statement(PROJECT_ENV_BOOTSTRAP), helperSyntax = statement(PROJECT_RPC_HELPER);
+// Retain the previous public diagnostic spelling used by migrated projects;
+// the loader's file access, precedence and error handling remain exact.
+const bootstrapSyntax = new Set([PROJECT_ENV_BOOTSTRAP,
+  PROJECT_ENV_BOOTSTRAP.replace('the terminal or App delivery host for credential-bearing operations', 'the application host for credential-bearing delivery operations'),
+].map(statement)), helperSyntax = statement(PROJECT_RPC_HELPER);
 
 export function projectRpcSyntax(file: ts.SourceFile): { statements: Set<ts.Statement>; bootstrap: boolean; helper: boolean } {
   const statements = new Set<ts.Statement>();
@@ -46,7 +50,7 @@ export function projectRpcSyntax(file: ts.SourceFile): { statements: Set<ts.Stat
         || clause.namedBindings.elements.length !== 1 || clause.namedBindings.elements[0].name.text !== wanted
         || clause.namedBindings.elements[0].propertyName) throw Error('Unsupported project RPC import');
       imports.add(name); statements.add(node);
-    } else if (ts.isForOfStatement(node) && syntax(node, file) === bootstrapSyntax) {
+    } else if (ts.isForOfStatement(node) && bootstrapSyntax.has(syntax(node, file))) {
       if (bootstrap) throw Error('Duplicate project RPC loader');
       bootstrap = true; statements.add(node);
     } else if (ts.isFunctionDeclaration(node) && node.name?.text === 'rpcUrl') {
@@ -97,7 +101,9 @@ function projectEnvironment(root: string, source: string, env: NodeJS.ProcessEnv
       for (const [key, value] of Object.entries(parseEnv(contents))) if (effective[key] === undefined) effective[key] = value;
     } catch (error) {
       if (name === '.env' && ['EPERM', 'EACCES'].includes((error as NodeJS.ErrnoException).code ?? '')) {
-        throw Error('Project credential environment is protected; run credential-bearing delivery operations through the trusted application host. Configure public RPCs in rpc.env.');
+        // Match the canonical Hardhat bootstrap: public RPC configuration can proceed
+        // without a protected credential file. Signing hosts load credentials separately.
+        continue;
       }
       throw Error(`Cannot read local project RPC environment (${name})`);
     }

package/runtime/delivery/protocol.ts

@@ -3,12 +3,12 @@ import { validateNetworkAlias } from './policy';
 export type DeliveryEnvironment = 'dev' | 'prod';
 export type DeliveryMode = 'simulate' | 'execute' | 'export-calldata' | 'reconcile' | 'verify';
 export interface DeliveryRequest {
-  version: 1;
+  version: 1 | 2;
   environment: DeliveryEnvironment;
   purpose: 'dev-execution' | 'prod-qualification' | 'prod-execution';
   mode: DeliveryMode;
   network: string;
-  sourceRef: { path: string; taskId: string; planKey: string; rev: number };
+  sourceRef: { kind?: 'gateflow' | 'standalone'; path: string; taskId?: string; planKey?: string; rev?: number; deploymentId?: string };
   releaseRef?: { path: string; releaseId: string; inputsHash: string };
   fork?: { blockNumber: number; blockHash: string; readOnly: true };
   devSigner?: string;
@@ -43,7 +43,7 @@ export function positiveInteger(value: unknown, label: string): number {
 }
 export function parseDeliveryRequest(input: unknown): DeliveryRequest {
   const value = object(input, 'delivery request', ['version', 'environment', 'purpose', 'mode', 'network', 'sourceRef', 'releaseRef', 'fork', 'devSigner', 'operator']);
-  if (value.version !== 1) throw new Error('Unsupported delivery request version');
+  if (value.version !== 1 && value.version !== 2) throw new Error('Unsupported delivery request version');
   if (typeof value.environment !== 'string' || !['dev', 'prod'].includes(value.environment)) throw new Error('environment must be dev or prod');
   if (typeof value.purpose !== 'string' || !['dev-execution', 'prod-qualification', 'prod-execution'].includes(value.purpose)) throw new Error('Invalid purpose');
   const dev = value.purpose === 'dev-execution';
@@ -51,8 +51,16 @@ export function parseDeliveryRequest(input: unknown): DeliveryRequest {
   const modes = dev ? ['simulate', 'execute', 'reconcile', 'verify'] : value.purpose === 'prod-qualification' ? ['simulate', 'verify'] : ['simulate', 'execute', 'export-calldata', 'reconcile', 'verify'];
   if (typeof value.mode !== 'string' || !modes.includes(value.mode)) throw new Error('Explicit valid mode is required for purpose');
   validateNetworkAlias(value.network, 'network', false);
-  const source = object(value.sourceRef, 'sourceRef', ['path', 'taskId', 'planKey', 'rev']);
-  portablePath(source.path, 'sourceRef.path'); safeId(source.taskId, 'taskId'); safeId(source.planKey, 'planKey'); positiveInteger(source.rev, 'rev');
+  const source = object(value.sourceRef, 'sourceRef', ['kind', 'path', 'taskId', 'planKey', 'rev', 'deploymentId']);
+  portablePath(source.path, 'sourceRef.path');
+  if (value.version === 2 && !['standalone','gateflow'].includes(String(source.kind))) throw Error('v2 requires explicit source kind');
+  if (source.kind === 'standalone') {
+    if (value.version !== 2 || Object.keys(source).some(k=>!['kind','path','deploymentId'].includes(k))) throw Error('Invalid standalone source reference');
+    safeId(source.deploymentId, 'source deploymentId');
+  } else {
+    if (source.kind !== undefined && source.kind !== 'gateflow' || source.deploymentId !== undefined) throw Error('Invalid GateFlow source reference');
+    safeId(source.taskId, 'taskId'); safeId(source.planKey, 'planKey'); positiveInteger(source.rev, 'rev');
+  }
   if (dev) {
     address(value.devSigner, 'devSigner');
     if ('operator' in value) throw new Error('devSigner and prod operator are separate roles');

package/runtime/delivery/query.ts

@@ -0,0 +1,34 @@
+/** Bounded read-only ABI query; no provider or signer is exposed to a business module. */
+import { Interface } from 'ethers';
+import { address, object } from './protocol';
+import { validateAbiArguments, validateAbiValue, normalizeRuntimeValue, compareAbiResults } from './abi';
+import { strictData } from './data';
+import { deepFreeze } from '../workflow/lib/canonicalData';
+import type { ContractQuery } from './scripts';
+export function parseContractQueryEvidence(raw:unknown){
+  const e=object(strictData(raw),'contract query evidence',['chainId','block','source','address','abi','method','args','caller','result','returnTypes']);
+  if(typeof e.chainId!=='string'||!(/^[1-9][0-9]*$/).test(e.chainId))throw Error('Invalid query chain');
+  const block=object(e.block,'query block',['number','hash']),source=object(e.source,'query source',['blockNumber','blockHash']);
+  if(typeof block.number!=='string'||!/^0x[\da-f]+$/i.test(block.number)||typeof block.hash!=='string'||!/^0x[\da-f]{64}$/i.test(block.hash)
+    ||!Number.isSafeInteger(source.blockNumber)||Number(source.blockNumber)<0||typeof source.blockHash!=='string'||!/^0x[\da-f]{64}$/i.test(source.blockHash))throw Error('Invalid query block identity');
+  address(e.address,'query');address(e.caller,'query caller');
+  if(!Array.isArray(e.abi)||e.abi.length!==1||typeof e.abi[0]!=='string')throw Error('Invalid query ABI');
+  const fn=new Interface(e.abi).getFunction(e.method as string);
+  if(!fn||!['view','pure'].includes(fn.stateMutability)||fn.format('sighash')!==e.method)throw Error('Invalid read-only query method');
+  validateAbiArguments(e.abi,fn.format('sighash'),e.args);
+  if(JSON.stringify(fn.outputs.map(p=>p.format('full')))!==JSON.stringify(e.returnTypes))throw Error('Query return types mismatch');
+  if(fn.outputs.length===1)validateAbiValue(fn.outputs[0],e.result,'query result');
+  else {if(!Array.isArray(e.result)||e.result.length!==fn.outputs.length)throw Error('Invalid query result count');fn.outputs.forEach((p,i)=>validateAbiValue(p,(e.result as unknown[])[i],'query result'));}
+  return deepFreeze(e);
+}
+export async function readScriptContract(query: ContractQuery, input:{request(method:string,params:unknown[]):Promise<any>;chainId:string;block:{number:string;hash:string};caller:string;source:{blockNumber:number;blockHash:string}}){
+  const q=object(strictData(query),'contract query',['address','abi','method','args','caller']);
+  address(q.address,'query');if(!Array.isArray(q.abi)||q.abi.some(x=>typeof x!=='string'))throw Error('Query ABI must use function strings');
+  const iface=new Interface(q.abi),fn=iface.getFunction(q.method as string);if(!fn||!['view','pure'].includes(fn.stateMutability))throw Error('readContract requires a view/pure function ABI');
+  const caller=address(q.caller??input.caller,'query caller'),args=q.args??[];validateAbiArguments(q.abi,fn.format('sighash'),args);
+  const data=iface.encodeFunctionData(fn,args as any[]),raw=await input.request('eth_call',[{to:q.address,from:caller,data},input.block.number]);
+  const decoded=iface.decodeFunctionResult(fn,raw),value=normalizeRuntimeValue(fn.outputs.length===1?decoded[0]:decoded);
+  const block=await input.request('eth_getBlockByNumber',[input.block.number,false]);if(block?.hash!==input.block.hash)throw Error('Query block changed');
+  return deepFreeze({value,evidence:parseContractQueryEvidence({chainId:input.chainId,block:input.block,source:input.source,address:(q.address as string).toLowerCase(),abi:[fn.format('full')],method:fn.format('sighash'),args,caller:caller.toLowerCase(),result:value,returnTypes:fn.outputs.map(p=>p.format('full'))})});
+}
+export function requireQueryResult(query:ContractQuery & {expect:unknown},actual:unknown){const c=compareAbiResults(query.abi,query.method,actual,query.expect);if(c.actual!==c.expected)throw Error(`Unmet live dependency ${query.method}: expected ${c.expected}, got ${c.actual}`);}

package/runtime/delivery/release-graph.ts

@@ -1,3 +1,4 @@
+import {readStandaloneTask} from './standalone-source';
 /** Actual-file release graph classification. No caller-selected roots or target subsets. */
 import {parseCanonicalPlan,projectCanonicalDefinitions,deploymentPurpose} from './source';
 import {projectRoot} from './project-files';
@@ -31,7 +32,23 @@ export function readReleaseUniverse(input:Omit<ReleaseGraphOptions,'releaseRef'>
  const upstream=projectCanonicalDefinitions(text,{roots:qualifications.map(t=>t.planKey),mode:'upstream'});
  return {workspace,root,text,plan,entries,relevant,targets,qualifications,upstream,developmentNetwork:task.developmentNetwork as string};
 }
+export function standaloneReleaseDefinition(input:Omit<ReleaseGraphOptions,'releaseRef'>){
+ const root=projectRoot(input.workspaceRoot,input.projectRoot),relative=`scripts/tasks/${safeId(input.deploymentId,'deploymentId')}/task.yaml`;
+ if(input.handoff!==relative)return undefined;
+ const task=object(parseInputDocument(readInputBytes(root,relative),'yaml'),'task');
+ if(task.source!=='standalone')return undefined;
+ if(input.handoff!==relative||input.taskId!==input.deploymentId)throw Error('Native release source mismatch');
+ return readStandaloneTask(root,relative);
+}
+export function selectedReleaseTargets(input:Omit<ReleaseGraphOptions,'releaseRef'>){return standaloneReleaseDefinition(input)?.releaseTargetNetworks??readReleaseUniverse(input).targets;}
 export function readReleaseGraph(input:ReleaseGraphOptions){
+ const native=standaloneReleaseDefinition(input);
+ if(native){
+  safeId(input.releaseRef.releaseId,'releaseId');if(input.releaseRef.path!==`scripts/tasks/${input.deploymentId}/releases/${input.releaseRef.releaseId}/release.json`||!/^[a-f0-9]{64}$/.test(input.releaseRef.inputsHash))throw Error('Invalid native release reference');
+  const graph={schema:'gate-delivery-standalone-release',version:1,definition:native,releaseRef:input.releaseRef,targets:native.releaseTargetNetworks,stages:['qualify','prepare','execute-or-export','reconcile','verify']};
+  return deepFreeze({targets:native.releaseTargetNetworks,graph,prodTaskGraphHash:semanticHash(graph)});
+ }
+
  const u=readReleaseUniverse(input);safeId(input.releaseRef.releaseId,'releaseId');portablePath(input.releaseRef.path,'releaseRef.path');if(!/^[a-f0-9]{64}$/.test(input.releaseRef.inputsHash))throw Error('Invalid release input hash');
  // Classify ALL relevant production tasks first. Filtering a good ref first conceals split/wrong bindings.
  const groups=new Map<string,typeof u.relevant>();

package/runtime/delivery/release-history-capture.ts

@@ -36,7 +36,8 @@ export function captureDevelopmentReleaseHistory(input:{root:string;source:Deliv
  const {sourcePath:sourceFile,aggregatePath:aggregateFile}=persistDevelopmentInputs(input);
  const descriptor:HistoricalDevelopmentFiles={version:2,aggregateFile,sourceFile,acceptanceFile,readyFile,inputsRoot:`${base}/inputs`,archiveFile};
  for(const relative of [sourceFile,aggregateFile,acceptanceFile])saved.push({path:relative,sha256:byteHash(readInputBytes(root,relative))});
- for(const name of [`${a.inputs.business.businessRoot}/task.yaml`,`${a.inputs.business.businessRoot}/parameters.yaml`,`${a.inputs.business.businessRoot}/parameters.provenance.json`,'config.yaml','hardhat.config.ts','package-lock.json','contractInfo.json','deploymentInfo.json'])write(`${base}/inputs/${name}`,readInputBytes(root,name));
+ const snapshot=JSON.parse(readInputBytes(root,`.gate-delivery/development/${plan.executionId}.inputs.snapshot.json`).toString());
+ for(const name of [`${a.inputs.business.businessRoot}/task.yaml`,`${a.inputs.business.businessRoot}/parameters.yaml`,`${a.inputs.business.businessRoot}/parameters.provenance.json`,'config.yaml','hardhat.config.ts','package-lock.json','contractInfo.json','deploymentInfo.json']){const original=snapshot.files.find((f:any)=>f.path===name);write(`${base}/inputs/${name}`,original?Buffer.from(original.base64,'base64'):readInputBytes(root,name));}
  write(archiveFile,archive);
  writeImmutableDeliveryFile(root,readyFile,Buffer.from(canonicalJson({schema:'gate-delivery-history-ready',version:2,generation:'complete',planHash:plan.planHash,aggregateHash:semanticHash(a),sourceHash:semanticHash(input.source),descriptor,files:saved})+'\n'));return descriptor;
 }

package/runtime/delivery/release-history.ts

@@ -1,5 +1,5 @@
 /** Read-only consumption of R1 evidence. Historical runtime is verified, never executed or relabelled. */
-import {existingCodeCoverage,requiredExistingAddresses} from './existing-code';
+import {existingCodeCoverage,requiredExistingAddresses,interactionCoverageRegistry} from './existing-code';
 import fs from 'node:fs';
 import {aggregateInputHash} from './execution-identity';
 export {aggregateInputHash} from './execution-identity';
@@ -110,10 +110,15 @@ export function validateHistoricalDevelopmentFiles(input:{root:string;workspaceR
  // A custom script reading a whole changed container makes the relaxed projection unsafe.
  const dependencyFiles=[...aggregate.inputs.targets.flatMap(t=>t.custom?.files??[]),...aggregate.inputs.business.parameters.flatMap(p=>p.closure?.files??[])];
  for(const file of dependencyFiles)if(inputDigest(now(file.path))!==file.digest)throw Error('Historical custom/producer dependency changed');
+ if(source.targets[0].request.sourceRef.kind==='standalone'){
+  const native=require('./standalone-source').readStandaloneTask(root,source.targets[0].request.sourceRef.path);
+  const historical=(aggregate.inputs.sourceDefinitions as any[]);same({...native,releaseTargetNetworks:oldTask.releaseTargetNetworks},historical[0]?.definition,'Historical native scope with bounded prod expansion');
+ } else {
  const handoff=source.targets[0].request.sourceRef.path,text=readInputBytes(workspace,handoff).toString(),actual=parseCanonicalPlan(text);if(actual.taskId!==source.targets[0].request.sourceRef.taskId)throw Error('Historical task source identity mismatch');
- const projection=projectCanonicalDefinitions(text,{roots:[source.targets[0].request.sourceRef.planKey],mode:'upstream'}).snapshot;
+ const projection=projectCanonicalDefinitions(text,{roots:[source.targets[0].request.sourceRef.planKey!],mode:'upstream'}).snapshot;
  const normalize=(v:any)=>{const copy=JSON.parse(canonicalJson(v));for(const t of copy.tasks)if(t.scope?.deployment&&Object.hasOwn(t.scope.deployment,'releaseTargetNetworks'))t.scope.deployment.releaseTargetNetworks=oldTask.releaseTargetNetworks;return copy;};
  const historical=(aggregate.inputs.sourceDefinitions as any[]);if(historical.length!==1||historical[0].path!==handoff)throw Error('Historical source document mismatch');same(normalize(projection),historical[0].definition,'Historical upstream definition with bounded prod expansion');
+ }
  const expected=expectedDevelopmentAssertions(collection,aggregate.inputs.business.steps);
  if(!Array.isArray(acceptance.assertions)||acceptance.assertions.length!==expected.length)throw Error('Missing development business assertions');
  for(const [index,raw] of acceptance.assertions.entries()){const assertion=parseVerificationObservation(raw);same({...assertion,actual:expected[index].actual},expected[index],'Historical complete typed assertion');const comparable=compareAbiResults(assertion.abi,assertion.method,decode(assertion.actual),decode(assertion.expected));if(comparable.actual!==comparable.expected)throw Error('Historical business assertion failed');}
@@ -136,7 +141,7 @@ export function validateHistoricalDevelopmentFiles(input:{root:string;workspaceR
  if(!Array.isArray(record.changes))throw Error('Missing development registry changes');
  const expectedCode:ExpectedDevelopmentCode[]=[],effective:any={[plan.target]:{}};
  for(const change of record.changes){effective[plan.target][change.contractInfoKey]=change.address;const key=change.contractInfoKey.split(':')[0];expectedCode.push({key,contract:change.actualContract,address:change.implementationAddress??change.address});if(change.proxyKind)expectedCode.push({key:`${key}_Proxy`,contract:change.proxyKind==='transparent'?'TransparentUpgradeableProxy':'ERC1967Proxy',address:change.address});if(change.proxyKind==='transparent')expectedCode.push({key:`${key}_ProxyAdmin`,contract:'ProxyAdmin',address:change.proxyAdminAddress});}
- const pure=!preparations.length?existingCodeCoverage({target:plan.target,addresses:requiredExistingAddresses(collection),registry:JSON.parse(historicalRegistration('contractInfo.json').toString()),metadata:JSON.parse(historicalRegistration('deploymentInfo.json').toString()),compiler:aggregate.inputs.targets.find(t=>t.target===plan.target)!.compiler,manifests:(acceptance.materialization.manifests??[]).map((m:any)=>({path:m.file,contents:now(m.file).toString()}))}):null;
+ const pure=!preparations.length?existingCodeCoverage({target:plan.target,addresses:requiredExistingAddresses(collection),registry:interactionCoverageRegistry(collection,JSON.parse(historicalRegistration('contractInfo.json').toString()),plan.target),metadata:JSON.parse(historicalRegistration('deploymentInfo.json').toString()),compiler:aggregate.inputs.targets.find(t=>t.target===plan.target)!.compiler,manifests:(acceptance.materialization.manifests??[]).map((m:any)=>({path:m.file,contents:now(m.file).toString()}))}):null;
  if(pure){if(record.changes.length)throw Error('Pure-call history cannot invent deployment changes');Object.assign(effective,pure.effective);expectedCode.push(...pure.expected);same(acceptance.materialization.manifests,pure.manifests,'Historical existing manifests');}
  const code=acceptance.checkCode;if(code?.version!==1||code.executionId!==plan.executionId||code.planHash!==plan.planHash||code.target!==plan.target||typeof code.rawFile!=='string'||!code.rawFile.startsWith(`.gate-delivery/check-code/${plan.executionId}/`))throw Error('Missing real CheckCode identity');
  same(byteHash(historicalRegistration('contractInfo.json')),code.registryHash,'Historical registry');same(byteHash(historicalRegistration('deploymentInfo.json')),code.metadataHash,'Historical deployment metadata');same(byteHash(canonicalJson(effective)+'\n'),code.effectiveHash,'Historical CheckCode effective registry');

package/runtime/delivery/release.ts

@@ -13,7 +13,7 @@ import {parsePreparationJournal} from './journal';
 import {expectedDevelopmentAssertions} from './development';
 import {verifyCapturedForkAudit} from './forkAudit';
 import {parseCanonicalPlan,projectCanonicalDefinitions} from './source';
-import {readReleaseUniverse,currentReleasePrerequisites,readReleaseGraph,isDevelopmentAcceptancePrerequisite,sameReleaseData as same,type ReleaseGraphOptions} from './release-graph';
+import {readReleaseUniverse,standaloneReleaseDefinition,selectedReleaseTargets,currentReleasePrerequisites,readReleaseGraph,isDevelopmentAcceptancePrerequisite,sameReleaseData as same,type ReleaseGraphOptions} from './release-graph';
 import {aggregateInputHash,validateHistoricalDevelopmentFiles,verifyHistoricalDevelopmentChain,type HistoricalDevelopmentFiles} from './release-history';
 import {atomicDevelopmentWrite,fileBytes,withDevelopmentFileLock,byteHash} from './materialization';
 import {canonicalJson,deepFreeze,semanticHash,exactObject} from '../workflow/lib/canonicalData';
@@ -49,6 +49,8 @@ function taskEvidence(input:Scope&{planKey:string}){
 export function recordDeliveryPrerequisite(input:Scope&{planKey:string}){const {root,envelope}=taskEvidence(input);atomicDevelopmentWrite(root,prerequisitePath(input.taskId,input.planKey),encode(envelope));return deepFreeze(envelope);}
 export function validateDeliveryPrerequisite(input:Scope&{planKey:string}){const {root,envelope}=taskEvidence(input),actual=JSON.parse(readInputBytes(root,prerequisitePath(input.taskId,input.planKey)).toString());same(actual,envelope,'Current prerequisite report/artifact binding');return deepFreeze(actual);}
 function prerequisites(scope:Scope,history:ReturnType<typeof validateHistoricalDevelopmentFiles>){
+ const native=standaloneReleaseDefinition(scope);
+ if(native){if(history.source.targets[0].request.sourceRef.kind!=='standalone'||history.plan.deploymentId!==native.deploymentId||history.plan.target!==native.developmentNetwork)throw Error('Native release requires its own real accepted development');return [{source:'standalone',executionId:history.plan.executionId,planHash:history.plan.planHash,acceptanceHash:semanticHash(history.acceptance)}];}
  const current=currentReleasePrerequisites(scope),receipts=[];
  for(const {task} of current.required){if(isDevelopmentAcceptancePrerequisite(task)){const d=task.scope?.deployment as any;if(d?.environment!=='dev'||d.targetNetwork!==history.plan.target||d.deploymentId!==history.plan.deploymentId)throw Error('Development prerequisite scope mismatch');if(!verificationOnly(task)&&(task.planKey!==history.source.targets[0].request.sourceRef.planKey||task.rev!==history.source.targets[0].request.sourceRef.rev))throw Error('Stale development prerequisite revision');const evidence=task.result?.evidence;if(!Array.isArray(evidence)||!evidence.some((e:any)=>e.ref===scopePath(history,verificationOnly(task))))throw Error('Development prerequisite must reference actual acceptance/CheckCode');receipts.push({planKey:task.planKey,rev:task.rev,definitionHash:semanticHash(projectCanonicalDefinitions(current.text,{roots:[task.planKey],mode:'full'}).snapshot),evidenceHash:semanticHash(verificationOnly(task)?history.acceptance.checkCode:history.acceptance)});}
   else receipts.push(validateDeliveryPrerequisite({...scope,planKey:task.planKey}));}
@@ -83,16 +85,17 @@ function currentCandidate(scope:Scope,c:any,requireCommittedSources=false){
  same(openAggregateSources({workspaceRoot:scope.workspaceRoot,projectRoot:scope.projectRoot,requests:c.targets.map((t:any)=>t.request)}).definitions,c.aggregate.inputs.sourceDefinitions,'Current full upstream source');
  const h=validateHistoricalDevelopmentFiles({root,workspaceRoot:scope.workspaceRoot,projectRoot:scope.projectRoot,history:c.development});same(h.association,c.historical.association,'Historical development association');same(prerequisites(scope,h),c.prerequisites,'Current prerequisite evidence');
  same(h.files.filter(f=>historicalRegistrationFile(f.path)),c.historical.files.filter((f:any)=>historicalRegistrationFile(f.path)),'Original historical registry baseline');
- same(readReleaseUniverse(scope).targets,c.aggregate.inputs.business.targets.map((t:any)=>t.id),'Current full selected target set');
+ same(selectedReleaseTargets(scope),c.aggregate.inputs.business.targets.map((t:any)=>t.id),'Current full selected target set');
  return {root,source,history:h};
 }
 /** Qualification is generated by the actual owned aggregate, never accepted from caller JSON. */
 export async function prepareDeliveryRelease(raw:ReleasePreparationOptions){
  const input=strictData(raw);exactObject(input,['workspaceRoot','projectRoot','handoff','taskId','deploymentId','releaseId','targets','development'],'release preparation');safeId(input.releaseId,'releaseId');
- const {workspaceRoot,projectRoot:relative,handoff,taskId,deploymentId}=input,scope={workspaceRoot,projectRoot:relative,handoff,taskId,deploymentId},u=readReleaseUniverse(scope),root=u.root;
+ const {workspaceRoot,projectRoot:relative,handoff,taskId,deploymentId}=input,scope={workspaceRoot,projectRoot:relative,handoff,taskId,deploymentId},native=standaloneReleaseDefinition(scope),u=native?undefined:readReleaseUniverse(scope),root=projectRoot(workspaceRoot,relative);
  if(path.resolve(process.cwd())!==root)throw Error('Release preparation must run from actual project root');
  if(fileBytes(root,`scripts/tasks/${deploymentId}/releases/${input.releaseId}/release.json`)!==null)throw Error('Release already has a ready marker');
- same(input.targets.map(t=>({network:t.request.network,sourceRef:t.request.sourceRef,purpose:t.request.purpose,environment:t.request.environment,mode:t.request.mode})),u.qualifications.map(t=>({network:(t.scope!.deployment as any).targetNetwork,sourceRef:{path:handoff,taskId,planKey:t.planKey,rev:t.rev},purpose:'prod-qualification',environment:'prod',mode:'simulate'})),'Exact current qualification tasks');
+ if(native){same(input.targets.map(t=>({network:t.request.network,kind:t.request.sourceRef.kind,path:t.request.sourceRef.path,deploymentId:t.request.sourceRef.deploymentId,purpose:t.request.purpose})),native.releaseTargetNetworks.map(network=>({network,kind:'standalone',path:handoff,deploymentId,purpose:'prod-qualification'})),'Native exact qualification targets');}
+ else same(input.targets.map(t=>({network:t.request.network,sourceRef:t.request.sourceRef,purpose:t.request.purpose,environment:t.request.environment,mode:t.request.mode})),u!.qualifications.map(t=>({network:(t.scope!.deployment as any).targetNetwork,sourceRef:{path:handoff,taskId,planKey:t.planKey,rev:t.rev},purpose:'prod-qualification',environment:'prod',mode:'simulate'})),'Exact current qualification tasks');
  const history=validateHistoricalDevelopmentFiles({root,workspaceRoot,projectRoot:relative,history:input.development}),prerequisiteEvidence=prerequisites(scope,history);
  const committedBefore=captureCommittedContractSource(root,history.aggregate);
  await verifyHistoricalDevelopmentChain(history,root);

package/runtime/delivery/scripts.ts

@@ -0,0 +1,162 @@
+/** Public script protocol and preparation API shared by CLI and application hosts. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import YAML from 'yaml';
+import Ajv from 'ajv';
+import { CustomModuleClosure } from './custom-closure';
+import { strictData, pointerPart } from './data';
+import { readInputBytes, parseInputDocument } from './input-files';
+import { object, safeId, portablePath } from './protocol';
+import { deepFreeze, semanticHash, canonicalJson } from '../workflow/lib/canonicalData';
+import { writeImmutableDeliveryFile } from './development-inputs';
+import { loadDeliveryPublicTarget } from './config';
+export interface ContractQuery { address: string; abi: string[]; method: string; args?: unknown[]; caller?: string }
+export interface ScriptStep {
+  id: string; dependsOn?: string[];
+  /** Explicit live evidence for omitted prerequisites, evaluated before the selected step. */
+  satisfiedBy?: Record<string, ContractQuery & { expect: unknown }>;
+  reads?: { files?: string[]; params?: string[]; state?: string[]; target?: string[]; chain?: boolean };
+}
+export interface DeliveryScript {
+  version: 1; description: string; inputSchema: Record<string, any>;
+  defaults?: Record<string, unknown>; steps: ScriptStep[];
+}
+export interface ScriptPorts {
+  resolve(key: string): unknown;
+  readJson(file: string): Promise<unknown>;
+  readBytes(file: string): Promise<unknown>;
+  readContract(query: ContractQuery): Promise<unknown>;
+}
+export interface ScriptInvocation { stepId: string; prerequisites: Array<ContractQuery & { expect: unknown }> }
+export function inspectDeliveryScript(root: string, script: string) {
+  portablePath(script,'business script');
+  if(!script.startsWith('scripts/operations/')&&!/^scripts\/tasks\/[^/]+\//.test(script))throw Error('Script must be under scripts/operations or the task directory');
+  const closure=new CustomModuleClosure(root),loaded=closure.load(script),d=closure.normalize(loaded.module.delivery) as DeliveryScript;
+  object(d,'delivery script',['version','description','inputSchema','defaults','steps']);
+  if(d.version!==1||typeof d.description!=='string'||!d.description.trim()||!Array.isArray(d.steps)||!d.steps.length||typeof loaded.module.planOperations!=='function')throw Error('Script requires delivery v1 and planOperations(ports,input)');
+  object(d.inputSchema,'inputSchema');
+  if(d.inputSchema.type!=='object'||d.inputSchema.additionalProperties!==false)throw Error('Input schema requires object with additionalProperties:false');
+  const names=d.steps.map(step=>{object(step,'script step',['id','dependsOn','satisfiedBy','reads']);return safeId(step.id,'business step');});
+  if(new Set(names).size!==names.length)throw Error('Duplicate script step');
+  d.steps.forEach((s,i)=>{if(s.dependsOn!==undefined&&(!Array.isArray(s.dependsOn)||new Set(s.dependsOn).size!==s.dependsOn.length))throw Error('Invalid dependencies');for(const dep of s.dependsOn??[])if(!names.slice(0,i).includes(dep))throw Error(`Dependency ${dep} must precede ${s.id}`);});
+  return {definition:deepFreeze(d),closure:closure.seal()};
+}
+const isObject=(v:unknown):v is Record<string,any>=>!!v&&typeof v==='object'&&!Array.isArray(v);
+export function mergeScriptInputs(base:Record<string,any>,over:Record<string,any>):Record<string,any>{
+  return Object.fromEntries([...new Set([...Object.keys(base),...Object.keys(over)])].map(k=>[k,Object.hasOwn(over,k)?isObject(base[k])&&isObject(over[k])?mergeScriptInputs(base[k],over[k]):over[k]:base[k]]));
+}
+function schemaDefaults(s:any):any{
+  if(Object.hasOwn(s,'default'))return strictData(s.default);
+  if(s.type==='object'){const entries=Object.entries(s.properties??{}).filter(([k])=>!(s.required??[]).includes(k)).map(([k,v])=>[k,schemaDefaults(v)]).filter(([,v])=>v!==undefined);return Object.fromEntries(entries);}
+  return undefined;
+}
+function parameterFile(root:string,file:string){portablePath(file,'parameter file');if(!/\.(json|ya?ml)$/.test(file)||file.split('/').some(p=>/^(?:\.env|rpc\.env|node_modules|\.git|\.gate-delivery|keys?|secrets?|credentials?)(?:\.|$)/i.test(p)))throw Error('Parameter file must be a public JSON/YAML business input');return readInputBytes(root,file);}
+function inputSchema(raw:any):any {const s=JSON.parse(canonicalJson(raw));const visit=(v:any)=>{delete v.default;delete v['x-derived'];if(v.properties)Object.values(v.properties).forEach(visit);if(v.items)visit(v.items);};visit(s);return s;}
+export function resolveScriptInputs(definition:DeliveryScript,file:unknown={},sets:string[]=[]){
+  object(file,'input parameters');
+  let values=mergeScriptInputs(mergeScriptInputs(schemaDefaults(definition.inputSchema)??{},definition.defaults??{}),strictData(file) as Record<string,any>);
+  const seen=new Set<string>();
+  for(const set of sets){const eq=set.indexOf('=');if(eq<1)throw Error('--set expects path=value');const key=set.slice(0,eq),parts=key.split('.');if(seen.has(key)||[...seen].some(p=>p.startsWith(key+'.')||key.startsWith(p+'.')))throw Error(`Conflicting --set ${key}`);seen.add(key);
+    let s=definition.inputSchema,v=values;
+    for(const [i,p]of parts.entries()){if(['__proto__','constructor','prototype'].includes(p)||s.type!=='object'||!s.properties?.[p])throw Error(`Unknown parameter ${key}`);s=s.properties[p];if(s['x-derived'])throw Error(`Derived parameter cannot be overridden: ${key}`);if(i<parts.length-1){v[p]??={};if(!isObject(v[p]))throw Error(`Non-object parameter ${p}`);v=v[p];}else{const text=set.slice(eq+1);let value:any;if(s.type==='string')value=text;else{try{value=JSON.parse(text);}catch{throw Error(`Invalid ${s.type} at ${key}`);}}v[p]=value;}}
+  }
+  const checkDerived=(s:any,v:any,p='')=>{if(s['x-derived']&&v!==undefined)throw Error(`Derived value ${p} belongs in planOperations, not input parameters`);if(isObject(v))for(const [k,x]of Object.entries(v))checkDerived(s.properties?.[k]??{},x,p+'/'+k);};checkDerived(definition.inputSchema,values);
+  const ajv=new Ajv({allErrors:true,strict:true});ajv.addKeyword({keyword:'x-policy',valid:true});const validate=ajv.compile(inputSchema(definition.inputSchema));
+  if(!validate(values))throw Error(`Script inputs: ${ajv.errorsText(validate.errors)}`);
+  strictData(values);return deepFreeze(values);
+}
+export function scriptManifest(root:string,script:string,selected?:string[]) {
+  const {definition,closure}=inspectDeliveryScript(root,script),ids=selected?.length?selected:definition.steps.map(s=>s.id);
+  if(new Set(ids).size!==ids.length||ids.some(id=>!definition.steps.some(s=>s.id===id)))throw Error('Unknown or duplicate selected step');
+  const steps=definition.steps.filter(s=>ids.includes(s.id)).map(s=>{
+    const missing=(s.dependsOn??[]).filter(dep=>!ids.includes(dep));
+    for(const dep of missing)if(!s.satisfiedBy?.[dep])throw Error(`Step ${s.id} requires ${dep}; explicitly select it or declare live satisfiedBy evidence`);
+    const reads=s.reads??{};
+    return {id:s.id,kind:'custom',script,input:{stepId:s.id,prerequisites:missing.map(dep=>s.satisfiedBy![dep])},reads:{files:reads.files??[],params:reads.params??Object.keys(definition.inputSchema.properties??{}),state:reads.state??[],target:reads.target??[],...(reads.chain||missing.length?{chain:true}:{})}};
+  });
+  return {definition,closure,steps,selectedSteps:steps.map(s=>s.id)};
+}
+/** Creates a fresh business round; no signature/approval and no GateFlow state involved. */
+export function prepareStandaloneTask(input:{root:string;script:string;network:string;paramsFile?:string;sets?:string[];steps?:string[];description?:string;releaseNetworks?:string[];referenceDeploymentId?:string}){
+ return writeStandaloneTask(input);
+}
+function writeStandaloneTask(input:{root:string;script:string;network:string;paramsFile?:string;sets?:string[];steps?:string[];description?:string;releaseNetworks?:string[];referenceDeploymentId?:string;values?:Record<string,unknown>;networkOverrides?:Record<string,Record<string,unknown>>;reuseId?:string}){
+  const root=fs.realpathSync(input.root),script=portablePath(input.script,'script'),selected=scriptManifest(root,script,input.steps);
+  loadDeliveryPublicTarget(root,input.network,'dev');
+  for(const n of input.releaseNetworks??[])loadDeliveryPublicTarget(root,n,'prod');
+  const bytes=input.paramsFile?parameterFile(root,input.paramsFile):undefined;
+  const values=resolveScriptInputs(selected.definition,mergeScriptInputs(input.values??{},bytes?parseInputDocument(bytes,/\.ya?ml$/.test(input.paramsFile!)?'yaml':'json') as Record<string,any>:{}),input.sets);
+  const overrides=input.networkOverrides??{};
+  for(const [network,v]of Object.entries(overrides)){if(!(input.releaseNetworks??[]).includes(network))throw Error('Parameter override outside release scope');resolveScriptInputs(selected.definition,mergeScriptInputs(values,v));}
+  const id=input.reuseId??`${path.basename(script).replace(/\.[^.]+$/,'').replace(/[^a-zA-Z0-9_-]/g,'-').slice(0,60)}-${randomUUID()}`,base=`scripts/tasks/${id}`;
+  const task={version:2,id,source:'standalone',description:input.description??selected.definition.description,developmentNetwork:input.network,releaseTargetNetworks:input.releaseNetworks??[],script,selectedSteps:selected.selectedSteps,...(input.referenceDeploymentId?{referenceDeploymentId:safeId(input.referenceDeploymentId,'referenceDeploymentId')}:{})};
+  const schema=inputSchema(selected.definition.inputSchema);schema.$schema='http://json-schema.org/draft-07/schema#';schema['x-policy']={kind:'manual'};
+  const manual:Record<string,unknown>={};const leaves=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)manual[p]={source:'standalone-input',value:v};else for(const[k,x]of entries)leaves(x,p+'/'+pointerPart(k));};leaves(values);
+  const write=(file:string,data:unknown,yaml=false)=>{const bytes=yaml?YAML.stringify(data):canonicalJson(data)+'\n';if(input.reuseId)require('./materialization').atomicDevelopmentWrite(root,`${base}/${file}`,bytes);else writeImmutableDeliveryFile(root,`${base}/${file}`,Buffer.from(bytes));};
+  write('task.yaml',task,true);write('manifest.yaml',{id,description:task.description,steps:selected.steps},true);write('parameters.schema.json',schema);
+  const targets=Object.fromEntries(Object.entries(overrides).map(([network,v])=>{const entries:Record<string,unknown>={};const visit=(value:any,p='')=>{const fields=value&&typeof value==='object'?Object.entries(value):[];if(!fields.length)entries[p]={source:'standalone-input',value};else for(const[k,x]of fields)visit(x,p+'/'+pointerPart(k));};visit(v);return [network,{manual:entries,computed:{}}];}));
+  write('parameters.yaml',{defaults:values,params:{[input.network]:{},...overrides}},true);write('parameters.provenance.json',{version:1,producers:{},defaults:{manual,computed:{}},targets});
+  const captured=selected.closure.files.map(f=>({path:f.path,digest:f.digest,base64:readInputBytes(root,f.path).toString('base64')}));
+  if(bytes)captured.push({path:input.paramsFile!,digest:require('./input-files').inputDigest(bytes),base64:bytes.toString('base64')});
+  write('inputs/preparation.snapshot.json',{schema:'gate-delivery-script-inputs',version:1,selectedSteps:selected.selectedSteps,closure:selected.closure,files:captured});
+  return deepFreeze({deploymentId:id,taskPath:`${base}/task.yaml`,values,steps:selected.selectedSteps});
+}
+
+/** Re-prepare the same native round before signing; historical preparations stay immutable and revoked. */
+export async function reprepareStandaloneTask(input:{root:string;executionId:string;store:import('./execution-store').ExecutionStore;paramsFile?:string;sets?:string[];steps?:string[]}){
+ const source=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${safeId(input.executionId,'executionId')}.source.json`).toString());
+ const ref=source.targets?.[0]?.request?.sourceRef;if(ref?.kind!=='standalone')throw Error('Native reprepare requires a standalone source; managed rounds must use their owning host');
+ const task=require('./standalone-source').readStandaloneTask(input.root,ref.path) as import('./standalone-source').StandaloneDefinition;
+ const aggregate=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${input.executionId}.aggregate.json`).toString());
+ const previous=aggregate.inputs.sourceDefinitions[0].definition;
+ const withoutSelection=({selectedSteps,...rest}:any)=>rest;
+ if(canonicalJson(withoutSelection(task))!==canonicalJson(withoutSelection(previous)))throw Error('Reprepare cannot change the original task scope; create a new round');
+ const parameters=YAML.parse(readInputBytes(input.root,`scripts/tasks/${task.deploymentId}/parameters.yaml`).toString());
+ const networkOverrides=Object.fromEntries(Object.entries(parameters.params??{}).filter(([network])=>network!==task.developmentNetwork)) as Record<string,Record<string,unknown>>;
+ // Validate prospective inputs before revoking a usable preparation.
+ const selected=scriptManifest(input.root,task.script,input.steps??task.selectedSteps);
+ const file=input.paramsFile?parseInputDocument(parameterFile(input.root,input.paramsFile),/\.ya?ml$/.test(input.paramsFile)?'yaml':'json'):{};
+ const values=resolveScriptInputs(selected.definition,mergeScriptInputs(aggregate.inputs.business.parameters[0].resolved.values,file as Record<string,any>),input.sets);
+ for(const v of Object.values(networkOverrides))resolveScriptInputs(selected.definition,mergeScriptInputs(values,v));
+ const records=path.join(input.root,'.gate-delivery/executions');
+ if(fs.existsSync(records))for(const file of fs.readdirSync(records).filter(f=>f.endsWith('.json'))){const r=JSON.parse(readInputBytes(input.root,`.gate-delivery/executions/${file}`).toString());if(r.kind==='development'&&r.deploymentId===task.deploymentId&&r.executionId!==input.executionId&&!fs.existsSync(path.join(input.root,`.gate-delivery/development/${r.executionId}.superseded.json`)))throw Error(`Round already has replacement execution ${r.executionId}; resume it`);}
+ const original=await require('./development-inputs').invalidateDevelopmentPreparation(input);
+ return require('./materialization').withDevelopmentFileLock(input.root,async()=>{
+  const marker=`.gate-delivery/development/${input.executionId}.replacement.json`;
+  const intentHash=semanticHash({values,networkOverrides,steps:selected.selectedSteps,closure:selected.closure});
+  let executionId:string;
+  if(fs.existsSync(path.join(input.root,marker))){const prior=JSON.parse(readInputBytes(input.root,marker).toString());if(prior.intentHash!==intentHash)throw Error('Replacement preparation already reserved with different inputs; finish or resume that replacement');executionId=safeId(prior.executionId,'replacement executionId');}
+  else{executionId=randomUUID();writeImmutableDeliveryFile(input.root,marker,Buffer.from(canonicalJson({version:1,executionId,intentHash})+'\n'));}
+  return {...writeStandaloneTask({root:input.root,script:task.script,network:task.developmentNetwork,releaseNetworks:task.releaseTargetNetworks,referenceDeploymentId:task.referenceDeploymentId,description:task.description,steps:selected.selectedSteps,values,networkOverrides,reuseId:original.deploymentId}),executionId};
+ });
+}
+
+/** Prepare a reusable script inside an existing, genuinely confirmed GateFlow round. */
+export async function prepareGateFlowScriptTask(input:{root:string;request:import('./protocol').DeliveryRequest;script:string;steps?:string[];values:Record<string,unknown>;sets?:string[];paramsFile?:string;networkInputs?:Record<string,{values:Record<string,unknown>;sets?:string[]}>}){
+ const source=require('./source').readOwnedDeliverySource({workspaceRoot:input.root,projectRoot:'.',request:input.request}) as import('./source').DeliverySourceBinding;
+ if(source.kind!=='gateflow')throw Error('GateFlow preparation requires its real source adapter');
+ const deploymentId=safeId(source.scope.deploymentId,'deploymentId'),base=`scripts/tasks/${deploymentId}`,definition=scriptManifest(input.root,input.script,input.steps);
+ const file=input.paramsFile?parseInputDocument(parameterFile(input.root,input.paramsFile),/\.ya?ml$/.test(input.paramsFile)?'yaml':'json'):{};
+ const values=resolveScriptInputs(definition.definition,mergeScriptInputs(file as Record<string,any>,input.values),input.sets);
+ for(const network of Object.keys(input.networkInputs??{}))if(!(source.scope.releaseTargetNetworks as string[]).includes(network))throw Error('Network inputs outside confirmed release scope');
+ const networkValues=Object.fromEntries(Object.entries(input.networkInputs??{}).map(([network,v])=>[network,resolveScriptInputs(definition.definition,mergeScriptInputs(file as Record<string,any>,v.values),v.sets)]));
+ const schema=inputSchema(definition.definition.inputSchema);schema.$schema='http://json-schema.org/draft-07/schema#';schema['x-policy']={kind:'manual'};
+ const manual:Record<string,unknown>={};const leaves=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)manual[p]={source:'confirmed-requirement',value:v};else for(const[k,x]of entries)leaves(x,p+'/'+pointerPart(k));};leaves(values);
+ // Refuse replacing the inputs of any already prepared execution, even before the first signature.
+ const dir=path.join(input.root,'.gate-delivery/development');if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).filter(f=>f.endsWith('.aggregate.json'))){const a=JSON.parse(fs.readFileSync(path.join(dir,f),'utf8'));if(a.inputs?.business?.deploymentId===deploymentId&&!fs.existsSync(path.join(dir,f.replace('.aggregate.json','.superseded.json'))))throw Error('Round already prepared; invalidate through the owning host or create a new round');}
+ const targets:Record<string,unknown>={};for(const [network,value]of Object.entries(networkValues)){const observations:Record<string,unknown>={};const visit=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)observations[p]={source:'confirmed-requirement',value:v};else for(const[k,x]of entries)visit(x,p+'/'+pointerPart(k));};visit(value);targets[network]={manual:observations,computed:{}};}
+ const writes:{[file:string]:string}={
+  'manifest.yaml':YAML.stringify({id:deploymentId,description:definition.definition.description,steps:definition.steps}),
+  'parameters.schema.json':canonicalJson(schema)+'\n',
+  'parameters.yaml':YAML.stringify({defaults:values,params:{[input.request.network]:{},...networkValues}}),
+  'parameters.provenance.json':canonicalJson({version:1,producers:{},defaults:{manual,computed:{}},targets})+'\n',
+ };
+ await require('./materialization').withDevelopmentFileLock(input.root,async()=>{
+  const current=require('./source').readOwnedDeliverySource({workspaceRoot:input.root,projectRoot:'.',request:input.request});
+  if(current.sourceDefinitionHash!==source.sourceDefinitionHash)throw Error('Confirmed source changed while preparing');
+  if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).filter(f=>f.endsWith('.aggregate.json'))){const a=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${f}`).toString());if(a.inputs?.business?.deploymentId===deploymentId&&!fs.existsSync(path.join(dir,f.replace('.aggregate.json','.superseded.json'))))throw Error('Round already prepared; original execution is immutable');}
+  for(const[file,bytes]of Object.entries(writes))require('./materialization').atomicDevelopmentWrite(input.root,`${base}/${file}`,bytes);
+ });
+ return {deploymentId,script:input.script,selectedSteps:definition.selectedSteps,values,files:Object.keys(writes).map(f=>`${base}/${f}`)};
+}