githolon 0.108.3 → 0.108.6

package/dist/compile_mountability_entry.js

@@ -394,6 +394,16 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       error: `the package-wide report does not cover the generated business area '${domain}'`
     };
   }
+  const dispositions = report.dispositions;
+  const changesStableIdentity = dispositions !== void 0 && (dispositions.retired.length > 0 || Object.keys(dispositions.retyped).length > 0 || Object.keys(dispositions.rebinds).length > 0);
+  if (changesStableIdentity && !acceptanceReason) {
+    return {
+      ok: false,
+      stage: "acceptance",
+      report,
+      error: "the current-frontier transition changes stable business identities and needs an attributed acceptance reason"
+    };
+  }
   const preflight = {
     candidateHash,
     // A package may be reached through any one of its generated domain clients. The
@@ -1548,7 +1558,7 @@ var init_lifecycle_calls = __esm({
 
 // vendor/engine/proto/nomos/kernel/v1/kernel_pb.js
 import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
-var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema, InitializeWorkspaceRequestSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, PageQuerySchema, ByIdQuerySchema, ByTypeQuerySchema, TallyQuerySchema, SpatialQuerySchema, PendingConflictsQuerySchema, PendingConflictSummaryQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, AuthorizationObjectSchema, AuthorizationSubjectSchema, AuthorizationConsistencySchema, AuthorizationCheckRequestSchema, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, CheckpointExportRequestSchema, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema, CapacityReserveRequestSchema, RestoreMainRequestSchema, ResolveStatePositionRequestSchema, NomosValueSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema, IntentTransportRequirement, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
+var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, ApplyWorkspaceEffectRequestSchema, ApplyWorkspaceEffectResponseSchema, WorkspaceTargetSchema, InitializeWorkspaceRequestSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, ModelLifecycleIntentSchema, OfferRequestSchema, QueryRequestSchema, QueryAuthoritySchema, InjectedKeySchema, RowsQuerySchema, PageQuerySchema, ByIdQuerySchema, ByTypeQuerySchema, TallyQuerySchema, SpatialQuerySchema, PendingConflictsQuerySchema, PendingConflictSummaryQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, FrontierTransitionDispositionMapEntrySchema, FrontierTransitionDispositionsSchema, FrontierTransitionViolationSchema, FrontierTransitionResponseSchema, AuthorizationObjectSchema, AuthorizationSubjectSchema, AuthorizationConsistencySchema, AuthorizationCheckRequestSchema, AuthorizationExpandRequestSchema, OutboxRequestSchema, SyncRequestSchema, TestRequestSchema, SetTestRootRequestSchema, CustodyRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, InspectChangeRequestSchema, RefusalVerdictSchema, EncodeRefusalVerdictRequestSchema, InspectRefusalVerdictRequestSchema, ProveCompactionEquivalenceRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, WriteMetaCommitRequestSchema, LawClosureInfoRequestSchema, CheckpointExportRequestSchema, VerifiedFrontierReceiptSchema, StoredCheckpointManifestSchema, CheckpointImportRequestSchema, CapacityReserveRequestSchema, RestoreMainRequestSchema, ResolveStatePositionRequestSchema, NomosValueSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, ModelLifecycleOperationSchema, ModelLifecycleOperation, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, CheckpointCompressionSchema, CheckpointCompression, CheckpointVerificationPolicySchema, CheckpointVerificationPolicy, CheckpointAssuranceSchema, CheckpointAssurance, IntentTransportRequirementSchema, IntentTransportRequirement, LifecycleInstallPhaseSchema, LifecycleInstallPhase;
 var init_kernel_pb = __esm({
   "vendor/engine/proto/nomos/kernel/v1/kernel_pb.js"() {
     "use strict";
@@ -1566,6 +1576,7 @@ var init_kernel_pb = __esm({
     CapturedClockSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 49);
     BirthCertificateSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 50);
     SignBirthCertificateRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 51);
+    ModelLifecycleIntentSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 53);
     OfferRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 54);
     QueryRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 57);
     QueryAuthoritySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
@@ -1580,6 +1591,10 @@ var init_kernel_pb = __esm({
     PendingConflictSummaryQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 77);
     NamedQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 78);
     FrontierTransitionRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 79);
+    FrontierTransitionDispositionMapEntrySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
+    FrontierTransitionDispositionsSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 81);
+    FrontierTransitionViolationSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 82);
+    FrontierTransitionResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 83);
     AuthorizationObjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
     AuthorizationSubjectSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 85);
     AuthorizationConsistencySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 87);
@@ -1618,6 +1633,8 @@ var init_kernel_pb = __esm({
     NomosStructSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 166);
     BirthOutcomeStatusSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 0);
     BirthOutcomeStatus = /* @__PURE__ */ tsEnum(BirthOutcomeStatusSchema);
+    ModelLifecycleOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 3);
+    ModelLifecycleOperation = /* @__PURE__ */ tsEnum(ModelLifecycleOperationSchema);
     QueryResultFormatSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 5);
     QueryResultFormat = /* @__PURE__ */ tsEnum(QueryResultFormatSchema);
     QueryOperationSchema = /* @__PURE__ */ enumDesc(file_nomos_kernel_v1_kernel, 6);
@@ -1712,6 +1729,17 @@ var init_offer_result = __esm({
   }
 });
 
+// vendor/engine/proto/nomos/custody/v1/snapshot_pb.js
+import { fileDesc as fileDesc2, messageDesc as messageDesc2 } from "@bufbuild/protobuf/codegenv2";
+var file_nomos_custody_v1_snapshot, LocalCustodySnapshotSchema;
+var init_snapshot_pb = __esm({
+  "vendor/engine/proto/nomos/custody/v1/snapshot_pb.js"() {
+    "use strict";
+    file_nomos_custody_v1_snapshot = /* @__PURE__ */ fileDesc2("Ch9ub21vcy9jdXN0b2R5L3YxL3NuYXBzaG90LnByb3RvEhBub21vcy5jdXN0b2R5LnYxIqACChRMb2NhbEN1c3RvZHlTbmFwc2hvdBIWCg5mb3JtYXRfdmVyc2lvbhgBIAEoDRIWCgl3b3Jrc3BhY2UYAiABKAlIAIgBARIMCgR0cmVlGAMgASgMEhcKCmNoZWNrcG9pbnQYBCABKAxIAYgBARIVCghmcm9udGllchgFIAEoDEgCiAEBEhMKBmN1cnNvchgGIAEoCUgDiAEBEhcKCnN0YXRlX3Jvb3QYByABKAlIBIgBARIYCgtzeW5jZWRfYmFzZRgIIAEoCUgFiAEBQgwKCl93b3Jrc3BhY2VCDQoLX2NoZWNrcG9pbnRCCwoJX2Zyb250aWVyQgkKB19jdXJzb3JCDQoLX3N0YXRlX3Jvb3RCDgoMX3N5bmNlZF9iYXNlYgZwcm90bzM");
+    LocalCustodySnapshotSchema = /* @__PURE__ */ messageDesc2(file_nomos_custody_v1_snapshot, 0);
+  }
+});
+
 // vendor/engine/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
@@ -1727,6 +1755,8 @@ __export(engine_exports, {
   author: () => author,
   authorEphemeral: () => authorEphemeral,
   authorKeygen: () => authorKeygen,
+  authorModelLifecyclePromotion: () => authorModelLifecyclePromotion,
+  authorModelLifecycleStage: () => authorModelLifecycleStage,
   authorOn: () => authorOn,
   authorOperatorCall: () => authorOperatorCall,
   backupHead: () => backupHead,
@@ -1799,6 +1829,7 @@ __export(engine_exports, {
   lawParity: () => lawParity,
   ledgerStats: () => ledgerStats,
   listRefusedRefs: () => listRefusedRefs,
+  localCustodySnapshot: () => localCustodySnapshot,
   materializeRefused: () => materializeRefused,
   memoryDropProbe: () => memoryDropProbe,
   migrateHomes: () => migrateHomes,
@@ -2179,6 +2210,100 @@ function workspaceGenesis(eng, ws) {
 function authorOperatorCall(eng, ws, call, controllerHash, opts = {}) {
   return author(eng, ws, call.domain, call.directive, call.canonicalUsda, controllerHash, opts);
 }
+function authorModelLifecycleStage(eng, ws, lawUsdz, installedBy, supersedes, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const response = offerRequestResponse(eng, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.STAGE,
+        installedBy,
+        supersedes
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    }),
+    lawUsdz
+  }));
+  return offerResult(response);
+}
+function authorModelLifecyclePromotion(eng, ws, transition, replaces, acceptanceReason, opts = {}) {
+  const sequence = eng.seq++;
+  const captured = {
+    physical: Date.now(),
+    logical: 0,
+    replica: eng.replica
+  };
+  const dispositions = transition.dispositions === void 0 ? void 0 : create(FrontierTransitionDispositionsSchema, {
+    retired: [...transition.dispositions.retired],
+    retyped: Object.entries(transition.dispositions.retyped).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    rebinds: Object.entries(transition.dispositions.rebinds).map(
+      ([sourceStableId, acknowledgement]) => create(FrontierTransitionDispositionMapEntrySchema, { sourceStableId, acknowledgement })
+    ),
+    acknowledgedBy: transition.dispositions.ackBy
+  });
+  const response = offerRequestResponse(eng, create(OfferRequestSchema, {
+    target: protoTarget(ws),
+    intent: {
+      case: "modelLifecycle",
+      value: create(ModelLifecycleIntentSchema, {
+        operation: ModelLifecycleOperation.PROMOTE,
+        replaces,
+        acceptanceReason,
+        transition: create(FrontierTransitionResponseSchema, {
+          atHash: transition.atHash,
+          currentHash: transition.currentHash,
+          atStateRoot: transition.atStateRoot ?? "",
+          candidateHash: transition.candidateHash,
+          domain: transition.domain,
+          domains: [...transition.domains ?? []],
+          ready: transition.ready,
+          violations: transition.evolve.violations.map(
+            ({ domain, detail }) => create(FrontierTransitionViolationSchema, { domain, detail })
+          ),
+          dispositions
+        })
+      })
+    },
+    authoring: create(AuthoringOptionsSchema, {
+      actor: opts.actor ?? "",
+      authToken: opts.authToken ? enc3.encode(opts.authToken) : new Uint8Array(),
+      authorSecret: opts.authorSecret ? bytesFromB64(opts.authorSecret) : new Uint8Array(),
+      validFromEpoch: opts.validFromEpoch === void 0 ? void 0 : BigInt(opts.validFromEpoch),
+      rng: osEntropyBuffer(opts.rngDraws ?? 64),
+      deferProjection: opts.deferProjection !== false,
+      spans: opts.spans ?? false,
+      sequence: BigInt(sequence),
+      clock: create(CapturedClockSchema, {
+        physicalMillis: BigInt(captured.physical),
+        logical: captured.logical,
+        replica: BigInt(captured.replica)
+      })
+    })
+  }));
+  return offerResult(response);
+}
 function initializeWorkspace(eng, ws, installedBy = eng.installedBy) {
   const sequence = eng.seq++;
   const captured = {
@@ -3279,8 +3404,11 @@ async function reconcileRequiredCustodyHead(eng, ws, ledger, requiredCustodyHead
   if (!/^[0-9a-f]{40}$/.test(requiredCustodyHead)) {
     throw new Error("required custody head must be a lowercase 40-hex git object id");
   }
-  const current = eng.mounted.has(ws) ? kgit.resolveRef(eng, gitdirOf(ws), BRANCH) : "";
-  if (current === requiredCustodyHead) return eng.mounted.get(ws);
+  const resident = eng.mounted.get(ws);
+  const current = resident ? kgit.resolveRef(eng, gitdirOf(ws), BRANCH) : "";
+  if (current === requiredCustodyHead && resident?.remoteMain === requiredCustodyHead && !resident.restoreError) {
+    return resident;
+  }
   if (current && isDirty(eng, ws)) {
     throw new Error(
       `workspace '${ws}' has verified but unsealed resident work; refusing to discard it while reconciling custody`
@@ -3293,6 +3421,12 @@ async function reconcileRequiredCustodyHead(eng, ws, ledger, requiredCustodyHead
       `workspace '${ws}' could not reconcile required custody ${requiredCustodyHead}: ${mounted.restoreError || "custody has no verified main"}`
     );
   }
+  const reconciled = kgit.resolveRef(eng, gitdirOf(ws), BRANCH);
+  if (reconciled !== requiredCustodyHead || mounted.remoteMain !== requiredCustodyHead) {
+    throw new Error(
+      `workspace '${ws}' restored custody ${mounted.remoteMain || reconciled || "none"}, not required custody ${requiredCustodyHead}`
+    );
+  }
   return mounted;
 }
 function assertAuthored(res, what) {
@@ -3430,7 +3564,10 @@ async function applyWorkspaceEffect(eng, ws, ledger, requestBytes, admissionChec
   const result = response.outcome.value.result;
   if (!result || result.outcome.case !== "admitted") {
     const outcome = result?.outcome.case || "empty";
-    throw new Error(`target kernel ${outcome} the workspace effect`);
+    const detail = result?.outcome.case === "refused" ? result.outcome.value.refusal?.message : void 0;
+    throw new Error(
+      `target kernel ${outcome} the workspace effect${detail ? `: ${detail}` : ""}`
+    );
   }
   await custodyPush(eng, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   return toBinary(ApplyWorkspaceEffectResponseSchema, response.outcome.value);
@@ -3541,8 +3678,8 @@ function prepareRemoteOffer(eng, ws, requestBytes) {
   if (authoring.authorSecret.byteLength !== 0) {
     throw new Error("remote offer preparation refuses client signing secrets");
   }
-  if (request.intent.case !== "call") {
-    throw new Error("remote offer preparation requires a typed directive call");
+  if (request.intent.case !== "call" && request.intent.case !== "modelLifecycle") {
+    throw new Error("remote offer preparation requires a typed directive or model-lifecycle call");
   }
   const response = callProto(eng.ex, {
     case: "prepareRemoteOffer",
@@ -4008,7 +4145,13 @@ function packDelta(eng, ws, base, head) {
       case: "packDelta",
       value: create(PackDeltaRequestSchema, { repo: repoArgOf(ws), base: base || void 0, head })
     }, "packDelta").pack;
-  } catch {
+  } catch (error) {
+    console.error("[nomos-custody-pack] packDelta refused", {
+      workspace: ws,
+      base: base || "<full>",
+      head,
+      error: String(error)
+    });
     return null;
   }
 }
@@ -4690,11 +4833,12 @@ function promotePreflighted(eng, ws, domain, candidateHash, opts = {}) {
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;
-  const result = authorOperatorCall(
+  const result = authorModelLifecyclePromotion(
     eng,
     ws,
-    promoteDomainCall(ws, prepared.payload),
-    requireCurrentControllerLawHash(eng, ws),
+    report,
+    prepared.payload.replaces,
+    prepared.payload.preflight.acceptanceReason,
     {
       ...authorOpts,
       ...actingPrincipal ? { actor: actingPrincipal } : {}
@@ -5184,7 +5328,10 @@ async function emitOutbox(eng, ws, ledger, workspaceEffectBase = "", admissionCh
           const targetResult = response.result;
           if (!targetResult || targetResult.outcome.case !== "admitted") {
             const outcome = targetResult?.outcome.case || "empty";
-            throw new Error(`target kernel ${outcome} the workspace effect`);
+            const detail = targetResult?.outcome.case === "refused" ? targetResult.outcome.value.refusal?.message : void 0;
+            throw new Error(
+              `target kernel ${outcome} the workspace effect${detail ? `: ${detail}` : ""}`
+            );
           }
           break;
         }
@@ -5216,7 +5363,7 @@ async function emitOutbox(eng, ws, ledger, workspaceEffectBase = "", admissionCh
     } catch (e) {
       errors++;
       const destination = offer.route.case === "httpsRoute" ? offer.route.value.url : offer.route.case === "workspaceRoute" ? offer.route.value.workspace : offer.destination;
-      log("outbox-deliver-failed", { ws, offerId: offer.id, destination, error: String(e).slice(0, 200) });
+      log("outbox-deliver-failed", { ws, offerId: offer.id, destination, error: String(e).slice(0, 2e3) });
     }
   }
   if (delivered.length || errors) log("outbox", { ws, delivered: delivered.length, errors });
@@ -5247,6 +5394,26 @@ function snapshot(eng, ws) {
   const wsDir = dirOf(eng.preopen.dir.contents.get("ws")).contents.get(ws);
   return serializeTree(wsDir);
 }
+function localCustodySnapshot(eng, ws) {
+  const checkpoint = exportCheckpoint(eng, ws);
+  const tree = snapshot(eng, ws);
+  const head = headOf(eng, ws);
+  const body = toBinary(LocalCustodySnapshotSchema, create(LocalCustodySnapshotSchema, {
+    formatVersion: 3,
+    workspace: ws,
+    tree,
+    checkpoint: checkpoint.blob ? bytesFromB64(checkpoint.blob) : void 0,
+    frontier: checkpoint.frontier ? bytesFromB64(checkpoint.frontier) : void 0,
+    cursor: checkpoint.cursor === void 0 ? void 0 : String(checkpoint.cursor),
+    stateRoot: checkpoint.stateRoot,
+    syncedBase: head || void 0
+  }));
+  const prefix = enc3.encode("NOMOS-CUSTODY-PB3\n");
+  const framed = new Uint8Array(prefix.byteLength + body.byteLength);
+  framed.set(prefix);
+  framed.set(body, prefix.byteLength);
+  return framed;
+}
 function stats(eng) {
   return {
     mounted: eng.mounted.size,
@@ -5323,6 +5490,7 @@ var init_engine = __esm({
     init_lifecycle_calls();
     init_offer_result();
     init_kernel_pb();
+    init_snapshot_pb();
     enc3 = new TextEncoder();
     dec3 = new TextDecoder();
     BRANCH = "main";