githolon 0.108.7 → 0.110.0

package/dist/compile-entry.mjs

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// src/compile_command.ts
+import { join as join5 } from "node:path";
+
 // src/compile.ts
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
@@ -56,12 +59,74 @@ ${INIT_EDITOR_HINT}
   return status;
 }
 
+// src/mountability_proof.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// src/runtime_selection.ts
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+var runtimeDirectory = () => process.env.NOMOS_CANDIDATE_RUNTIME ?? process.env.NOMOS_OFFLINE_RUNTIME ?? join3(homedir(), ".holon", "runtime");
+function selectedKernelSha256() {
+  try {
+    return createHash("sha256").update(readFileSync2(join3(runtimeDirectory(), "holon.wasm"))).digest("hex");
+  } catch {
+    return void 0;
+  }
+}
+
+// src/mountability_proof.ts
+var PROOF_FORMAT = "nomos.mountability-proof.v1";
+function compiledLawPackages(buildDir) {
+  if (!existsSync2(buildDir)) return [];
+  return readdirSync(buildDir).filter((file) => file.endsWith(".law.usdz")).map((law) => {
+    const name = law.replace(/\.law\.usdz$/, "");
+    return {
+      name,
+      lawPath: join4(buildDir, law),
+      identityPath: join4(buildDir, `${name}.law.sha256`),
+      proofPath: join4(buildDir, `.nomos-mountability-proof.${name}.usda`)
+    };
+  });
+}
+function mountabilityProofIdentity(lawUsdz, claimedIdentity, kernelSha256) {
+  return createHash2("sha256").update(`${PROOF_FORMAT}\0`).update(kernelSha256).update("\0").update(claimedIdentity).update("\0").update(lawUsdz).digest("hex");
+}
+function mountabilityProofCurrent(pkg) {
+  const kernelSha256 = selectedKernelSha256();
+  if (kernelSha256 === void 0) return false;
+  let text;
+  let claimedIdentity;
+  let lawUsdz;
+  try {
+    text = readFileSync3(pkg.proofPath, "utf8");
+    claimedIdentity = readFileSync3(pkg.identityPath, "utf8").trim();
+    lawUsdz = readFileSync3(pkg.lawPath);
+  } catch {
+    return false;
+  }
+  if (!text.includes(`string "nomos:format" = "${PROOF_FORMAT}"`)) return false;
+  const recorded = /string "nomos:proofIdentity" = "([0-9a-f]{64})"/u.exec(text)?.[1];
+  return recorded !== void 0 && recorded === mountabilityProofIdentity(lawUsdz, claimedIdentity, kernelSha256);
+}
+
 // src/compile_command.ts
 async function runCompileCommand(args) {
   const skipMountCheck = args.includes("--no-mount-check");
   const preflightOnly = args.includes("--preflight");
   const status = runCompile(args.filter((arg) => arg !== "--no-mount-check"));
   if (status !== 0 || skipMountCheck || preflightOnly) return status;
+  const packages = compiledLawPackages(join5(process.cwd(), "build"));
+  if (packages.length > 0 && packages.every(mountabilityProofCurrent)) {
+    process.stderr.write(
+      `note: ${packages.map((pkg) => pkg.name).join(", ")} passed canonical kernel package admission (content-addressed proof reused); whole-workspace install and client-compatibility proof awaits its typed Peer Office command
+`
+    );
+    return status;
+  }
   try {
     const { assertPublicCompileMountable } = await import("./compile_mountability_entry.js");
     const verdict = await assertPublicCompileMountable(process.cwd());
@@ -76,8 +141,9 @@ async function runCompileCommand(args) {
       );
       return 1;
     } else if (verdict.checked.length > 0) {
+      const kernel = verdict.kernelSha256 === void 0 ? "" : ` [${verdict.kernelSource ?? "selected"} kernel ${verdict.kernelSha256.slice(0, 12)}]`;
       process.stdout.write(
-        `  mountable  \u2713 ${verdict.checked.join(", ")} mount on the real read router${verdict.cached ? " (content-addressed proof reused)" : ""}
+        `  mountable  \u2713 ${verdict.checked.join(", ")} mount on the real read router${kernel}${verdict.cached ? " (content-addressed proof reused)" : ""}
 `
       );
     }