instar 1.3.18 → 1.3.19

package/dist/core/FencedLease.d.ts

@@ -0,0 +1,126 @@
+/**
+ * FencedLease — the single coordination primitive for cross-machine
+ * seamlessness: "exactly one holder, safe under clock skew and partition."
+ *
+ * Spec: docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §6.
+ *
+ * This module is the PURE LOGIC of the lease — epoch arithmetic, signing,
+ * expiry, the fencing check, tunnel-message acceptance, and the acquisition
+ * decision. The transport (git push-or-reject-reread, tunnel broadcast) is
+ * driven by a higher-level coordinator that calls these methods; keeping the
+ * logic pure makes the dangerous parts (CAS, fencing, clock-skew) unit-testable
+ * with in-memory fakes.
+ *
+ * Authority is the EPOCH (a monotonically increasing integer advanced once per
+ * acquisition), never wall-clock time. A machine with a fast clock cannot win
+ * anything — it has no way to advance the epoch without a valid CAS. `lastSeen`
+ * is retained only for the liveness heuristic (presumed-dead), and that
+ * threshold must exceed worst-case NTP drift by ≥2× (enforced by the caller).
+ */
+import type { LeaseRecord } from './types.js';
+/** Crypto seam — injected so the logic is testable without real key files. */
+export interface LeaseCrypto {
+    /** This machine's id (the only id we may name as `holder` when signing). */
+    selfMachineId: string;
+    /** Sign canonical bytes with this machine's Ed25519 private key → base64. */
+    sign(canonical: string): string;
+    /**
+     * Verify a signature attributed to `holderMachineId` against that machine's
+     * REGISTERED public key (looked up from the SAS-verified pairing registry).
+     * Returns false if the holder is unknown or the signature is invalid — so a
+     * forged lease naming an unknown/foreign holder never verifies.
+     */
+    verify(canonical: string, signature: string, holderMachineId: string): boolean;
+}
+export interface FencedLeaseConfig {
+    leaseTtlMs: number;
+    failoverThresholdMs: number;
+    /** Bounded CAS retry before the livelock backoff kicks in. Default 5. */
+    casMaxRetries?: number;
+}
+export interface AcquireDecision {
+    can: boolean;
+    reason: string;
+}
+export interface TunnelAcceptDecision {
+    accept: boolean;
+    reason: string;
+}
+export declare class FencedLease {
+    private readonly crypto;
+    private readonly leaseTtlMs;
+    private readonly failoverThresholdMs;
+    private readonly casMaxRetries;
+    constructor(crypto: LeaseCrypto, config: FencedLeaseConfig);
+    get selfMachineId(): string;
+    /**
+     * Stable, field-ordered serialization of the signable lease fields. The
+     * signature covers exactly these so a holder cannot later be impersonated
+     * by re-ordering fields or smuggling extra keys.
+     */
+    static canonicalize(lease: Pick<LeaseRecord, 'holder' | 'epoch' | 'acquiredAt' | 'expiresAt' | 'nonce'>): string;
+    /** Build + sign a lease record naming THIS machine as holder. */
+    signLease(epoch: number, acquiredAtIso: string, expiresAtIso: string, nonce: number): LeaseRecord;
+    /** Verify a lease's signature against its claimed holder's registered key. */
+    verifyLease(lease: LeaseRecord): boolean;
+    /** True if the lease's holder-local expiry has passed. */
+    isExpired(lease: LeaseRecord | undefined | null, nowMs: number): boolean;
+    /**
+     * The epoch the fencing check uses: max(tunnel-observed, git-committed).
+     * A fast tunnel copy can ACCELERATE acquisition but can never lower the
+     * observed epoch below what git has already committed (spec §6).
+     */
+    static effectiveEpoch(tunnelEpoch: number, gitEpoch: number): number;
+    /**
+     * Does THIS machine hold the lease at the current effective epoch? Used to
+     * gate ingress polls, scheduler ticks, outbound sends, and authority-bearing
+     * registry writes. A wedged old-awake whose lease moved on fails this and is
+     * fenced out (spec §6 "Fencing check").
+     */
+    holdsValidLease(lease: LeaseRecord | undefined | null, effectiveEpoch: number, nowMs: number): boolean;
+    /**
+     * Should an action stamped with `stampedEpoch` be honored, given the current
+     * effective epoch? Any consumer (registry, outbox, channel-send) rejects
+     * actions stamped with a stale epoch (spec §6). Late writes/sends from a
+     * fenced old-awake carry an old epoch and are dropped.
+     */
+    static isStampCurrent(stampedEpoch: number, effectiveEpoch: number): boolean;
+    /**
+     * Decide whether to accept a lease record observed over the tunnel. Accept
+     * ONLY if: the signature verifies, the epoch is ≥ the git-committed floor
+     * (a below-floor message can neither trick a standby into believing a stale
+     * lease is current nor suppress a legitimate acquisition), AND the per-holder
+     * nonce is strictly greater than the last seen for that holder (replay guard).
+     */
+    acceptTunnelLease(msg: LeaseRecord, gitCommittedEpoch: number, lastNonceByHolder: Record<string, number>): TunnelAcceptDecision;
+    /**
+     * May this machine attempt to acquire the lease right now? True when:
+     *  - there is no current lease, OR
+     *  - the current lease is expired, OR
+     *  - the current holder is presumed dead (caller passes the set, derived
+     *    from lastSeen > failoverThresholdMs — never from a raw clock compare).
+     * A genuinely-live contended lease is resolved by the CAS itself (only one
+     * epoch advance wins); this method only decides whether to try.
+     */
+    canAcquire(currentLease: LeaseRecord | undefined | null, presumedDeadHolders: ReadonlySet<string>, nowMs: number): AcquireDecision;
+    /**
+     * Build the CAS candidate that advances the epoch by exactly one. Acquisition
+     * may only ever write `epoch = currentEpoch + 1`; epoch GAPS are explicitly
+     * safe (a higher epoch observed on re-read always wins). The expiry is
+     * holder-local (now + TTL), used for liveness/display, never for authority.
+     */
+    buildAcquisition(currentLease: LeaseRecord | undefined | null, nowMs: number, nonce: number): LeaseRecord;
+    /**
+     * After CAS exhaustion (bounded retry), should THIS machine back off to let
+     * the other side land (livelock prevention, spec §6)? The deterministic rule:
+     * the higher unforgeable machineId backs off for one lease-TTL, guaranteeing
+     * one side wins. Below the retry cap, no backoff (keep contending).
+     */
+    shouldBackoffAfterContention(retryCount: number, contenderMachineId: string): boolean;
+    /** Backoff duration after losing CAS contention. */
+    get backoffMs(): number;
+    /** Expose config for callers that derive timers from it. */
+    get ttlMs(): number;
+    get presumedDeadThresholdMs(): number;
+}
+//# sourceMappingURL=FencedLease.d.ts.map

package/dist/core/FencedLease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FencedLease.d.ts","sourceRoot":"","sources":["../../src/core/FencedLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC;;;;;OAKG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;CAChF;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB;IAO1D,IAAI,aAAa,IAAI,MAAM,CAE1B;IAID;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG,MAAM;IAIhH,iEAAiE;IACjE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW;IAYjG,8EAA8E;IAC9E,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO;IAOxC,0DAA0D;IAC1D,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAOxE;;;;OAIG;IACH,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMpE;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAUtG;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO;IAM5E;;;;;;OAMG;IACH,iBAAiB,CACf,GAAG,EAAE,WAAW,EAChB,iBAAiB,EAAE,MAAM,EACzB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,oBAAoB;IAgBvB;;;;;;;;OAQG;IACH,UAAU,CACR,YAAY,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EAC5C,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,EACxC,KAAK,EAAE,MAAM,GACZ,eAAe;IAYlB;;;;;OAKG;IACH,gBAAgB,CAAC,YAAY,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW;IAOzG;;;;;OAKG;IACH,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO;IAMrF,oDAAoD;IACpD,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,4DAA4D;IAC5D,IAAI,KAAK,IAAI,MAAM,CAElB;IACD,IAAI,uBAAuB,IAAI,MAAM,CAEpC;CACF"}

package/dist/core/FencedLease.js

@@ -0,0 +1,189 @@
+/**
+ * FencedLease — the single coordination primitive for cross-machine
+ * seamlessness: "exactly one holder, safe under clock skew and partition."
+ *
+ * Spec: docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §6.
+ *
+ * This module is the PURE LOGIC of the lease — epoch arithmetic, signing,
+ * expiry, the fencing check, tunnel-message acceptance, and the acquisition
+ * decision. The transport (git push-or-reject-reread, tunnel broadcast) is
+ * driven by a higher-level coordinator that calls these methods; keeping the
+ * logic pure makes the dangerous parts (CAS, fencing, clock-skew) unit-testable
+ * with in-memory fakes.
+ *
+ * Authority is the EPOCH (a monotonically increasing integer advanced once per
+ * acquisition), never wall-clock time. A machine with a fast clock cannot win
+ * anything — it has no way to advance the epoch without a valid CAS. `lastSeen`
+ * is retained only for the liveness heuristic (presumed-dead), and that
+ * threshold must exceed worst-case NTP drift by ≥2× (enforced by the caller).
+ */
+const DEFAULT_CAS_MAX_RETRIES = 5;
+export class FencedLease {
+    crypto;
+    leaseTtlMs;
+    failoverThresholdMs;
+    casMaxRetries;
+    constructor(crypto, config) {
+        this.crypto = crypto;
+        this.leaseTtlMs = config.leaseTtlMs;
+        this.failoverThresholdMs = config.failoverThresholdMs;
+        this.casMaxRetries = config.casMaxRetries ?? DEFAULT_CAS_MAX_RETRIES;
+    }
+    get selfMachineId() {
+        return this.crypto.selfMachineId;
+    }
+    // ── Canonical serialization + signing ─────────────────────────────
+    /**
+     * Stable, field-ordered serialization of the signable lease fields. The
+     * signature covers exactly these so a holder cannot later be impersonated
+     * by re-ordering fields or smuggling extra keys.
+     */
+    static canonicalize(lease) {
+        return JSON.stringify([lease.holder, lease.epoch, lease.acquiredAt, lease.expiresAt, lease.nonce]);
+    }
+    /** Build + sign a lease record naming THIS machine as holder. */
+    signLease(epoch, acquiredAtIso, expiresAtIso, nonce) {
+        const base = {
+            holder: this.crypto.selfMachineId,
+            epoch,
+            acquiredAt: acquiredAtIso,
+            expiresAt: expiresAtIso,
+            nonce,
+        };
+        const signature = this.crypto.sign(FencedLease.canonicalize(base));
+        return { ...base, signature };
+    }
+    /** Verify a lease's signature against its claimed holder's registered key. */
+    verifyLease(lease) {
+        if (!lease || typeof lease.holder !== 'string' || typeof lease.epoch !== 'number')
+            return false;
+        return this.crypto.verify(FencedLease.canonicalize(lease), lease.signature, lease.holder);
+    }
+    // ── Expiry + epoch ────────────────────────────────────────────────
+    /** True if the lease's holder-local expiry has passed. */
+    isExpired(lease, nowMs) {
+        if (!lease)
+            return true;
+        const expMs = Date.parse(lease.expiresAt);
+        if (Number.isNaN(expMs))
+            return true;
+        return nowMs >= expMs;
+    }
+    /**
+     * The epoch the fencing check uses: max(tunnel-observed, git-committed).
+     * A fast tunnel copy can ACCELERATE acquisition but can never lower the
+     * observed epoch below what git has already committed (spec §6).
+     */
+    static effectiveEpoch(tunnelEpoch, gitEpoch) {
+        return Math.max(tunnelEpoch | 0, gitEpoch | 0);
+    }
+    // ── Fencing check (before EVERY awake-only action) ────────────────
+    /**
+     * Does THIS machine hold the lease at the current effective epoch? Used to
+     * gate ingress polls, scheduler ticks, outbound sends, and authority-bearing
+     * registry writes. A wedged old-awake whose lease moved on fails this and is
+     * fenced out (spec §6 "Fencing check").
+     */
+    holdsValidLease(lease, effectiveEpoch, nowMs) {
+        if (!lease)
+            return false;
+        if (lease.holder !== this.crypto.selfMachineId)
+            return false;
+        // The lease we hold must be AT the current effective epoch — a stale-epoch
+        // lease (someone advanced past us) does not grant authority.
+        if (lease.epoch !== effectiveEpoch)
+            return false;
+        if (this.isExpired(lease, nowMs))
+            return false;
+        return this.verifyLease(lease);
+    }
+    /**
+     * Should an action stamped with `stampedEpoch` be honored, given the current
+     * effective epoch? Any consumer (registry, outbox, channel-send) rejects
+     * actions stamped with a stale epoch (spec §6). Late writes/sends from a
+     * fenced old-awake carry an old epoch and are dropped.
+     */
+    static isStampCurrent(stampedEpoch, effectiveEpoch) {
+        return stampedEpoch === effectiveEpoch;
+    }
+    // ── Tunnel lease acceptance (replay + floor guard) ────────────────
+    /**
+     * Decide whether to accept a lease record observed over the tunnel. Accept
+     * ONLY if: the signature verifies, the epoch is ≥ the git-committed floor
+     * (a below-floor message can neither trick a standby into believing a stale
+     * lease is current nor suppress a legitimate acquisition), AND the per-holder
+     * nonce is strictly greater than the last seen for that holder (replay guard).
+     */
+    acceptTunnelLease(msg, gitCommittedEpoch, lastNonceByHolder) {
+        if (!this.verifyLease(msg)) {
+            return { accept: false, reason: 'signature-invalid-or-unknown-holder' };
+        }
+        if (msg.epoch < gitCommittedEpoch) {
+            return { accept: false, reason: `below-git-floor (msg epoch ${msg.epoch} < committed ${gitCommittedEpoch})` };
+        }
+        const lastNonce = lastNonceByHolder[msg.holder] ?? -1;
+        if (msg.nonce <= lastNonce) {
+            return { accept: false, reason: `replayed-or-stale-nonce (${msg.nonce} <= ${lastNonce})` };
+        }
+        return { accept: true, reason: 'accepted' };
+    }
+    // ── Acquisition decision (CAS candidate) ──────────────────────────
+    /**
+     * May this machine attempt to acquire the lease right now? True when:
+     *  - there is no current lease, OR
+     *  - the current lease is expired, OR
+     *  - the current holder is presumed dead (caller passes the set, derived
+     *    from lastSeen > failoverThresholdMs — never from a raw clock compare).
+     * A genuinely-live contended lease is resolved by the CAS itself (only one
+     * epoch advance wins); this method only decides whether to try.
+     */
+    canAcquire(currentLease, presumedDeadHolders, nowMs) {
+        if (!currentLease)
+            return { can: true, reason: 'no-current-lease' };
+        if (this.isExpired(currentLease, nowMs))
+            return { can: true, reason: 'current-lease-expired' };
+        if (currentLease.holder === this.crypto.selfMachineId) {
+            return { can: true, reason: 'self-renew' };
+        }
+        if (presumedDeadHolders.has(currentLease.holder)) {
+            return { can: true, reason: `holder-presumed-dead (${currentLease.holder})` };
+        }
+        return { can: false, reason: `held-by-live-peer (${currentLease.holder})` };
+    }
+    /**
+     * Build the CAS candidate that advances the epoch by exactly one. Acquisition
+     * may only ever write `epoch = currentEpoch + 1`; epoch GAPS are explicitly
+     * safe (a higher epoch observed on re-read always wins). The expiry is
+     * holder-local (now + TTL), used for liveness/display, never for authority.
+     */
+    buildAcquisition(currentLease, nowMs, nonce) {
+        const currentEpoch = currentLease?.epoch ?? 0;
+        const acquiredAt = new Date(nowMs).toISOString();
+        const expiresAt = new Date(nowMs + this.leaseTtlMs).toISOString();
+        return this.signLease(currentEpoch + 1, acquiredAt, expiresAt, nonce);
+    }
+    /**
+     * After CAS exhaustion (bounded retry), should THIS machine back off to let
+     * the other side land (livelock prevention, spec §6)? The deterministic rule:
+     * the higher unforgeable machineId backs off for one lease-TTL, guaranteeing
+     * one side wins. Below the retry cap, no backoff (keep contending).
+     */
+    shouldBackoffAfterContention(retryCount, contenderMachineId) {
+        if (retryCount < this.casMaxRetries)
+            return false;
+        // Higher machineId yields; lower machineId keeps trying → exactly one lands.
+        return this.crypto.selfMachineId > contenderMachineId;
+    }
+    /** Backoff duration after losing CAS contention. */
+    get backoffMs() {
+        return this.leaseTtlMs;
+    }
+    /** Expose config for callers that derive timers from it. */
+    get ttlMs() {
+        return this.leaseTtlMs;
+    }
+    get presumedDeadThresholdMs() {
+        return this.failoverThresholdMs;
+    }
+}
+//# sourceMappingURL=FencedLease.js.map

package/dist/core/FencedLease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FencedLease.js","sourceRoot":"","sources":["../../src/core/FencedLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoCH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,MAAM,OAAO,WAAW;IACL,MAAM,CAAc;IACpB,UAAU,CAAS;IACnB,mBAAmB,CAAS;IAC5B,aAAa,CAAS;IAEvC,YAAY,MAAmB,EAAE,MAAyB;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,qEAAqE;IAErE;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,KAAmF;QACrG,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,iEAAiE;IACjE,SAAS,CAAC,KAAa,EAAE,aAAqB,EAAE,YAAoB,EAAE,KAAa;QACjF,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACjC,KAAK;YACL,UAAU,EAAE,aAAa;YACzB,SAAS,EAAE,YAAY;YACvB,KAAK;SACN,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,WAAW,CAAC,KAAkB;QAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;IAED,qEAAqE;IAErE,0DAA0D;IAC1D,SAAS,CAAC,KAAqC,EAAE,KAAa;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,KAAK,IAAI,KAAK,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,cAAc,CAAC,WAAmB,EAAE,QAAgB;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,qEAAqE;IAErE;;;;;OAKG;IACH,eAAe,CAAC,KAAqC,EAAE,cAAsB,EAAE,KAAa;QAC1F,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAC7D,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB,EAAE,cAAsB;QAChE,OAAO,YAAY,KAAK,cAAc,CAAC;IACzC,CAAC;IAED,qEAAqE;IAErE;;;;;;OAMG;IACH,iBAAiB,CACf,GAAgB,EAChB,iBAAyB,EACzB,iBAAyC;QAEzC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,CAAC,KAAK,gBAAgB,iBAAiB,GAAG,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,GAAG,CAAC,KAAK,OAAO,SAAS,GAAG,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,qEAAqE;IAErE;;;;;;;;OAQG;IACH,UAAU,CACR,YAA4C,EAC5C,mBAAwC,EACxC,KAAa;QAEb,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC/F,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,YAA4C,EAAE,KAAa,EAAE,KAAa;QACzF,MAAM,YAAY,GAAG,YAAY,EAAE,KAAK,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,4BAA4B,CAAC,UAAkB,EAAE,kBAA0B;QACzE,IAAI,UAAU,GAAG,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAClD,6EAA6E;QAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,kBAAkB,CAAC;IACxD,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,4DAA4D;IAC5D,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/core/GitLeaseStore.d.ts

@@ -0,0 +1,46 @@
+/**
+ * GitLeaseStore — the durable (git-backed) LeaseStore for LeaseCoordinator.
+ *
+ * Implements the lease CAS over git: git has no native compare-and-swap, so we
+ * do optimistic concurrency — pull-rebase to minimize the reject window, re-read
+ * the committed epoch, refuse to write unless our candidate strictly advances
+ * it, then commit+push. A non-fast-forward push (a peer advanced first) returns
+ * ok:false with the freshly-observed lease so LeaseCoordinator re-evaluates and
+ * either yields or retries with a higher epoch. We NEVER force-push.
+ *
+ * The write also bumps the holder's own registry entry (syncSequence +
+ * authoredUnderEpoch) so the lease commit passes peers' registryReplayGuard.
+ */
+import type { LeaseStore } from './LeaseCoordinator.js';
+import type { LeaseRecord, MachineRegistry } from './types.js';
+export interface GitLeaseStoreDeps {
+    /** This machine's id (the only entry we bump syncSequence on). */
+    machineId: string;
+    loadRegistry: () => MachineRegistry;
+    saveRegistry: (r: MachineRegistry) => void;
+    /** Absolute path of the registry file to stage. */
+    registryAbsPath: string;
+    /** Pull-rebase (best-effort) before reading/writing. */
+    pullRebase: () => boolean;
+    /** Commit + push the registry; false on non-ff/no-op. */
+    commitAndPush: (message: string, paths: string[]) => boolean;
+    logger?: (msg: string) => void;
+}
+export declare class GitLeaseStore implements LeaseStore {
+    private readonly d;
+    constructor(deps: GitLeaseStoreDeps);
+    private log;
+    read(): {
+        lease: LeaseRecord | null;
+        epoch: number;
+    };
+    casWrite(candidate: LeaseRecord): {
+        ok: boolean;
+        observed: {
+            lease: LeaseRecord | null;
+            epoch: number;
+        };
+    };
+    refresh(lease: LeaseRecord): boolean;
+}
+//# sourceMappingURL=GitLeaseStore.d.ts.map

package/dist/core/GitLeaseStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitLeaseStore.d.ts","sourceRoot":"","sources":["../../src/core/GitLeaseStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,eAAe,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,yDAAyD;IACzD,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC7D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAoB;gBAE1B,IAAI,EAAE,iBAAiB;IAInC,OAAO,CAAC,GAAG;IAIX,IAAI,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAKpD,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;IAyCzG,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO;CAmBrC"}

package/dist/core/GitLeaseStore.js

@@ -0,0 +1,79 @@
+/**
+ * GitLeaseStore — the durable (git-backed) LeaseStore for LeaseCoordinator.
+ *
+ * Implements the lease CAS over git: git has no native compare-and-swap, so we
+ * do optimistic concurrency — pull-rebase to minimize the reject window, re-read
+ * the committed epoch, refuse to write unless our candidate strictly advances
+ * it, then commit+push. A non-fast-forward push (a peer advanced first) returns
+ * ok:false with the freshly-observed lease so LeaseCoordinator re-evaluates and
+ * either yields or retries with a higher epoch. We NEVER force-push.
+ *
+ * The write also bumps the holder's own registry entry (syncSequence +
+ * authoredUnderEpoch) so the lease commit passes peers' registryReplayGuard.
+ */
+export class GitLeaseStore {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    log(m) {
+        this.d.logger?.(`[git-lease] ${m}`);
+    }
+    read() {
+        const reg = this.d.loadRegistry();
+        return { lease: reg.lease ?? null, epoch: reg.lease?.epoch ?? 0 };
+    }
+    casWrite(candidate) {
+        // 1. Pull-rebase to shrink the reject window, then re-read the committed epoch.
+        this.d.pullRebase();
+        let reg = this.d.loadRegistry();
+        const committedEpoch = reg.lease?.epoch ?? 0;
+        // 2. CAS pre-check: only a strict +1 advance over the committed epoch is valid.
+        if (candidate.epoch <= committedEpoch) {
+            this.log(`CAS pre-check failed: candidate epoch ${candidate.epoch} <= committed ${committedEpoch}`);
+            return { ok: false, observed: { lease: reg.lease ?? null, epoch: committedEpoch } };
+        }
+        // 3. Write the lease + bump the holder's own freshness fields so peers'
+        //    replay guard accepts it.
+        reg.lease = candidate;
+        const entry = reg.machines[this.d.machineId];
+        if (entry) {
+            entry.syncSequence = (entry.syncSequence ?? 0) + 1;
+            entry.authoredUnderEpoch = candidate.epoch;
+        }
+        this.d.saveRegistry(reg);
+        // 4. Commit + push. On success the CAS landed.
+        const pushed = this.d.commitAndPush(`chore(mesh): lease epoch ${candidate.epoch} → ${candidate.holder}`, [this.d.registryAbsPath]);
+        if (pushed) {
+            this.log(`lease epoch ${candidate.epoch} committed + pushed`);
+            return { ok: true, observed: { lease: candidate, epoch: candidate.epoch } };
+        }
+        // 5. Push rejected (a peer advanced) or no-op. Re-read after a pull and
+        //    report the observed state so the caller re-evaluates / retries.
+        this.d.pullRebase();
+        reg = this.d.loadRegistry();
+        const observedEpoch = reg.lease?.epoch ?? 0;
+        this.log(`push rejected/no-op; observed epoch now ${observedEpoch}`);
+        return { ok: false, observed: { lease: reg.lease ?? null, epoch: observedEpoch } };
+    }
+    refresh(lease) {
+        // Pull first; if a peer has advanced past our epoch we've been superseded —
+        // do NOT overwrite a higher epoch with a same-epoch refresh.
+        this.d.pullRebase();
+        const reg = this.d.loadRegistry();
+        const committedEpoch = reg.lease?.epoch ?? 0;
+        if (committedEpoch > lease.epoch) {
+            this.log(`refresh declined: superseded (committed ${committedEpoch} > ${lease.epoch})`);
+            return false;
+        }
+        reg.lease = lease; // same epoch, fresh expiry + nonce
+        const entry = reg.machines[this.d.machineId];
+        if (entry) {
+            entry.syncSequence = (entry.syncSequence ?? 0) + 1;
+            entry.authoredUnderEpoch = lease.epoch;
+        }
+        this.d.saveRegistry(reg);
+        return this.d.commitAndPush(`chore(mesh): lease renew epoch ${lease.epoch}`, [this.d.registryAbsPath]);
+    }
+}
+//# sourceMappingURL=GitLeaseStore.js.map

package/dist/core/GitLeaseStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitLeaseStore.js","sourceRoot":"","sources":["../../src/core/GitLeaseStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmBH,MAAM,OAAO,aAAa;IACP,CAAC,CAAoB;IAEtC,YAAY,IAAuB;QACjC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,QAAQ,CAAC,SAAsB;QAC7B,gFAAgF;QAChF,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;QAE7C,gFAAgF;QAChF,IAAI,SAAS,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,yCAAyC,SAAS,CAAC,KAAK,iBAAiB,cAAc,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QACtF,CAAC;QAED,wEAAwE;QACxE,8BAA8B;QAC9B,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,KAAK,CAAC,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAEzB,+CAA+C;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CACjC,4BAA4B,SAAS,CAAC,KAAK,MAAM,SAAS,CAAC,MAAM,EAAE,EACnE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CACzB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,CAAC,KAAK,qBAAqB,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9E,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,2CAA2C,aAAa,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,KAAkB;QACxB,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;QAC7C,IAAI,cAAc,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2CAA2C,cAAc,MAAM,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,mCAAmC;QACtD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,KAAK,CAAC,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,kCAAkC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,CAAC;CACF"}

package/dist/core/GitSync.d.ts

@@ -13,6 +13,7 @@
 import type { MachineIdentityManager } from './MachineIdentity.js';
 import type { SecurityLog } from './SecurityLog.js';
 import type { IntelligenceProvider } from './types.js';
+import type { MachineRegistry } from './types.js';
 export interface GitSyncConfig {
     /** Project directory (repo root). */
     projectDir: string;
@@ -103,6 +104,24 @@ export declare class GitSyncManager {
      * Full sync: pull → verify → resolve → push.
      */
     sync(): Promise<SyncResult>;
+    /**
+     * §8 G2 — reconcile a freshly-pulled registry against the pre-pull snapshot,
+     * scrubbing any entry that fails the replay/freshness or unknown-key guard.
+     * Signed-commit verification (verifyPulledCommits) already rejected unsigned
+     * or revoked COMMITS; this rejects stale/unauthorized registry ENTRIES that a
+     * valid signature alone would let through (e.g. a re-keyed machine whose
+     * per-author sequence reset, or an unknown key asserting an awake role). The
+     * lease object itself is reconciled by the FencedLease layer (epoch CAS), not
+     * here. Returns the rejected machineIds (for the caller's diagnostics/tests).
+     */
+    reconcilePulledRegistry(registryBefore: MachineRegistry): string[];
+    /**
+     * Targeted pull-rebase (no auto-commit). Used by the lease CAS to minimize
+     * the push-reject window before writing a lease candidate. Returns true if
+     * the pull succeeded (HEAD may or may not have moved). Best-effort: returns
+     * false on any error rather than throwing.
+     */
+    pullRebase(): boolean;
     /**
      * Stage files and commit with machine signing.
      */

package/dist/core/GitSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitSync.d.ts","sourceRoot":"","sources":["../../src/core/GitSync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAYvD,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,oBAAoB;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACzE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,cAAc,CAAiB;gBAE3B,MAAM,EAAE,aAAa;IAuBjC;;;;;OAKG;IACH,SAAS,IAAI,OAAO;IAUpB;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,oBAAoB,GAAG,IAAI;IAYzD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAY9B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAa9B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IA6PjC;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO;IAyBzD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgBvC;;OAEG;IACH,eAAe,IAAI,IAAI;IAgBvB;;OAEG;IACH,IAAI,IAAI,IAAI;IAMZ;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAO/B;;OAEG;IACH,wBAAwB,IAAI,IAAI;IAUhC;;;OAGG;IACH,oBAAoB,IAAI,IAAI;IAyB5B;;OAEG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;OAQG;YACW,gBAAgB;IAgG9B;;OAEG;YACW,mBAAmB;IAqFjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAuBnC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkCxB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,OAAO;CAQhB;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,kBAAkB,GACzB,kBAAkB,CA2CpB"}
+{"version":3,"file":"GitSync.d.ts","sourceRoot":"","sources":["../../src/core/GitSync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,oBAAoB;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACzE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,cAAc,CAAiB;gBAE3B,MAAM,EAAE,aAAa;IAuBjC;;;;;OAKG;IACH,SAAS,IAAI,OAAO;IAUpB;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,oBAAoB,GAAG,IAAI;IAYzD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAY9B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAa9B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IA+QjC;;;;;;;;;OASG;IACH,uBAAuB,CAAC,cAAc,EAAE,eAAe,GAAG,MAAM,EAAE;IA8BlE;;;;;OAKG;IACH,UAAU,IAAI,OAAO;IAWrB;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO;IAyBzD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgBvC;;OAEG;IACH,eAAe,IAAI,IAAI;IAgBvB;;OAEG;IACH,IAAI,IAAI,IAAI;IAMZ;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAO/B;;OAEG;IACH,wBAAwB,IAAI,IAAI;IAUhC;;;OAGG;IACH,oBAAoB,IAAI,IAAI;IAyB5B;;OAEG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;OAQG;YACW,gBAAgB;IAgG9B;;OAEG;YACW,mBAAmB;IAqFjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAuBnC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkCxB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,OAAO;CAQhB;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,kBAAkB,GACzB,kBAAkB,CA2CpB"}

package/dist/core/GitSync.js

@@ -17,6 +17,7 @@ import { LLMConflictResolver } from './LLMConflictResolver.js';
 import { FileClassifier } from './FileClassifier.js';
 import { DegradationReporter } from '../monitoring/DegradationReporter.js';
 import { assertNotInstarSourceTree } from './SourceTreeGuard.js';
+import { reconcileRegistryEntries } from './registryReplayGuard.js';
 import { SafeFsExecutor } from './SafeFsExecutor.js';
 import { SafeGitExecutor } from './SafeGitExecutor.js';
 // ── Git Sync Manager ─────────────────────────────────────────────────
@@ -127,6 +128,15 @@ export class GitSyncManager {
         // No git repo — return clean no-op (standalone agent without git backup)
         if (!this.isGitRepo())
             return result;
+        // Cross-Machine Seamlessness §8 G2 — snapshot the registry BEFORE the pull
+        // so we can apply the replay/freshness + unknown-key guard to whatever the
+        // pull brings in (a clean fast-forward can still deliver a stale or
+        // unknown-key registry that signed-commit verification alone won't catch).
+        let registryBefore = null;
+        try {
+            registryBefore = this.identityManager.loadRegistry();
+        }
+        catch { /* @silent-fallback-ok — reconcile skipped if snapshot unreadable */ }
         // 0. Pre-flight: detect and fix stuck rebase / detached HEAD before attempting pull
         let rebaseJustAborted = false;
         try {
@@ -353,6 +363,16 @@ export class GitSyncManager {
         // 2. Verify pulled commits
         if (result.pulled) {
             result.rejectedCommits = this.verifyPulledCommits();
+            // §8 G2 — apply the replay/freshness + unknown-key guard to the pulled
+            // registry, scrubbing any stale or unauthorized entries before we trust it.
+            if (registryBefore) {
+                try {
+                    this.reconcilePulledRegistry(registryBefore);
+                }
+                catch (err) {
+                    console.warn(`[GitSync] registry reconcile warning: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
         }
         // 3. Push pending changes
         if (this.autoPush) {
@@ -377,6 +397,63 @@ export class GitSyncManager {
         });
         return result;
     }
+    /**
+     * §8 G2 — reconcile a freshly-pulled registry against the pre-pull snapshot,
+     * scrubbing any entry that fails the replay/freshness or unknown-key guard.
+     * Signed-commit verification (verifyPulledCommits) already rejected unsigned
+     * or revoked COMMITS; this rejects stale/unauthorized registry ENTRIES that a
+     * valid signature alone would let through (e.g. a re-keyed machine whose
+     * per-author sequence reset, or an unknown key asserting an awake role). The
+     * lease object itself is reconciled by the FencedLease layer (epoch CAS), not
+     * here. Returns the rejected machineIds (for the caller's diagnostics/tests).
+     */
+    reconcilePulledRegistry(registryBefore) {
+        const afterPull = this.identityManager.loadRegistry();
+        const committedEpoch = registryBefore.lease?.epoch ?? 0;
+        const { accepted, rejected } = reconcileRegistryEntries({
+            localEntries: registryBefore.machines ?? {},
+            incomingEntries: afterPull.machines ?? {},
+            currentCommittedEpoch: committedEpoch,
+        });
+        if (rejected.length === 0)
+            return [];
+        // Rebuild a clean registry: start from the trusted pre-pull entries, then
+        // overlay the accepted incoming entries. Rejected entries fall back to the
+        // pre-pull value (or are omitted if they were never known locally).
+        const merged = { ...(registryBefore.machines ?? {}) };
+        for (const [id, entry] of Object.entries(accepted))
+            merged[id] = entry;
+        afterPull.machines = merged;
+        this.identityManager.saveRegistry(afterPull);
+        for (const r of rejected) {
+            this.securityLog.append({
+                event: 'registry_entry_rejected',
+                machineId: this.machineId,
+                rejectedMachine: r.machineId,
+                reason: r.reason,
+            });
+            console.warn(`[GitSync] Rejected pulled registry entry for ${r.machineId}: ${r.reason}`);
+        }
+        return rejected.map((r) => r.machineId);
+    }
+    /**
+     * Targeted pull-rebase (no auto-commit). Used by the lease CAS to minimize
+     * the push-reject window before writing a lease candidate. Returns true if
+     * the pull succeeded (HEAD may or may not have moved). Best-effort: returns
+     * false on any error rather than throwing.
+     */
+    pullRebase() {
+        if (!this.isGitRepo())
+            return false;
+        try {
+            this.gitExec(['pull', '--rebase', '--autostash']);
+            return true;
+        }
+        catch {
+            // @silent-fallback-ok — lease CAS re-reads and retries on failure
+            return false;
+        }
+    }
     /**
      * Stage files and commit with machine signing.
      */