kiokuko-dsh 0.2.21 → 0.2.23

package/guardrail/manifest.json

@@ -2,6 +2,7 @@
   "schema": 1,
   "package": "kiokuko-guardrail",
   "version": "0.1.0",
+  "sourceSha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
   "protocol": {
     "path": "guardrail/protocols/coding-routine.lisp",
     "bytes": 948,
@@ -13,14 +14,15 @@
       "arch": "x64",
       "binary": "guardrail/x86_64-unknown-linux-musl/kiokuko-guardrail",
       "manifest": "guardrail/x86_64-unknown-linux-musl/manifest.json",
-      "manifestSha256": "00e2c0ebf29867ff87e5c6e47c25e4c65d8884f70a8ace85f63717932356197c",
-      "bytes": 516792,
-      "sha256": "d262a712893945a1525dc9c8f19c806a44a832747879c1af8f6e33634b15636b",
+      "manifestSha256": "8e44a29510df7c251f2649fbc356ec52c2a32a83e024082111af67a9784086f9",
+      "bytes": 549560,
+      "sha256": "828126da26891c8afa4cab9a8446fb6ff4a1883fd45a4556626942f0535b1f5d",
       "verification": {
         "independent_builds_equal": true,
         "native_smoke": "passed",
-        "package_sha256": "27273d1914e0c406425722973dec110da019c37ca6dd43afdff8f8c86013b868",
-        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+        "package_sha256": "ec5f9b19deb93b4ce6530081efba7db209296965633feae6942482ab808dacc9",
+        "status": "host smoke executed",
         "static_no_pt_interp": true
       }
     },
@@ -29,16 +31,16 @@
       "arch": "arm64",
       "binary": "guardrail/aarch64-unknown-linux-musl/kiokuko-guardrail",
       "manifest": "guardrail/aarch64-unknown-linux-musl/manifest.json",
-      "manifestSha256": "2f1560bb9aa7b12ecba9000f0ae540598e433a06869138c861a68ecc26fd2787",
-      "bytes": 445888,
-      "sha256": "62b8f751d99e24c71d4223037221207ecd7877ddbf0ac3784e31df26c8af0beb",
+      "manifestSha256": "ae288c94f96eec22bdaa28ece87a97d7ca86209072fc825d510394b9b0e1b7f8",
+      "bytes": 468824,
+      "sha256": "9b2fa78a3f13fbb4efd2dd5cf3f80892bf70ad30ee26c9b995ab2d2ebb203cf3",
       "verification": {
         "independent_builds_equal": true,
         "native_smoke": "not run",
-        "package_sha256": "9db094881a6fb18c3457f46e1c285dffe223414c982b2b4f5071babe182c5c02",
-        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
-        "static_no_pt_interp": true,
-        "status": "cross-built; not executed on ARM64 Linux"
+        "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+        "package_sha256": "bba8060d03dc3759acbdff31f480b031a63c0596a66df6c435b9211eaebda9bf",
+        "status": "cross-built; native execution not run",
+        "static_no_pt_interp": true
       }
     },
     "aarch64-apple-darwin": {
@@ -46,137 +48,23 @@
       "arch": "arm64",
       "binary": "guardrail/aarch64-apple-darwin/kiokuko-guardrail",
       "manifest": "guardrail/aarch64-apple-darwin/manifest.json",
-      "manifestSha256": "4e5e9e56dbfc3de7d70a703da3ec69c2ec4600cc9b5ae728606fe1ea47e85440",
-      "bytes": 384672,
-      "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
+      "manifestSha256": "a810c8372c875efb7435931122aa3aa8a6afd556df61d9bf29d3b43656e44f29",
+      "bytes": 417712,
+      "sha256": "5e08acf36e6648c34f1fe317ff9806a76cbddd37434b41db5395e95dee0571fc",
       "verification": {
-        "imports": [
-          "/usr/lib/libSystem.B.dylib"
-        ],
         "independent_builds_equal": true,
-        "interpreter": "/usr/lib/dyld",
-        "linker_ad_hoc_signature": true,
-        "minimum_os": "13.0.0",
         "native_smoke": "not run",
-        "package_sha256": "9ba9b967e8eae733972ce01d5841ddb432f1c863dd5f86792527266ddeb73530",
-        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
-        "status": "cross-built; not executed on macOS"
+        "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+        "package_sha256": "267f330c690afc47b023fcd0fdbd68618e4c4fd77b8fdfccf68b13348888f551",
+        "status": "cross-built; native execution not run"
       }
     }
   },
   "unavailableTargets": [],
-  "scope": "Bundled artifact identity and declared build provenance only. Cross-built targets are not native execution evidence. No OS sandbox, signatures, deterministic inference, or restored Common Lisp heap is claimed.",
-  "toolchainProvenance": {
-    "toolchain-inputs": {
-      "cc_binary_sha256": "a23ecab8ff08f09ad8c80602c2c5df7f49e09c25905cb8975902e101bf72635f",
-      "cc_version": "cc (Debian 14.2.0-19) 14.2.0",
-      "components": [
-        {
-          "sha256": "77171ba2a0345fdf2abc4fedda55d6de078dae7a68527c28be8c77dcc9604bd5",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rustc-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
-        },
-        {
-          "sha256": "3e58dff2d0b72196b5ea4e90536e174d400de88564a52694686b81e091169933",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
-        },
-        {
-          "sha256": "d7674918d28093097614cd9728b6ca60db9ea3038f640f0bd1e9a4188c7568ce",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/cargo-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
-        },
-        {
-          "sha256": "b22c09ab9e258ec5571da170d88bd1624a4ea602e6d70d95720c5b47494cadce",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rustfmt-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
-        },
-        {
-          "sha256": "b106b0aa4565cc3525fd3161c69203a9e39044e6e6b4d618f261c3eeda14ad50",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-unknown-linux-musl.tar.xz"
-        }
-      ],
-      "ld_binary_sha256": "d2766988b6a1b1d1518cdc09242e726d1f24e151e16410ada3092b11ffd9081b",
-      "ld_version": "GNU ld (GNU Binutils for Debian) 2.44",
-      "official_manifest_sha256": "ce6dddc886364f8d786514771212cebe9b731ba82d6b859951c6b0ccc516b6a2",
-      "scope": "Recorded cloud toolchain inputs. This is not a fully isolated Guix derivation or a cross-platform deterministic inference claim."
-    },
-    "macos-cross-verification": {
-      "components": [
-        {
-          "sha256": "1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026",
-          "url": "https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz"
-        },
-        {
-          "sha256": "a7c6de8aa21e7c31163a7656295b321bb85f5dce55ed8ea95ac9ac561202bb5b",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-aarch64-apple-darwin.tar.xz"
-        },
-        {
-          "sha256": "18ee81961a73c3ae966ecb1e8f6096438c90aeefece8856201a6ecc17f5bc850",
-          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-apple-darwin.tar.xz"
-        }
-      ],
-      "macos": [
-        {
-          "binary_bytes": 384672,
-          "binary_sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
-          "imports": [
-            "/usr/lib/libSystem.B.dylib"
-          ],
-          "independent_builds_equal": true,
-          "interpreter": "/usr/lib/dyld",
-          "linker_ad_hoc_signature": true,
-          "minimum_os": "13.0.0",
-          "native_smoke": "not run",
-          "package_sha256": "9ba9b967e8eae733972ce01d5841ddb432f1c863dd5f86792527266ddeb73530",
-          "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
-          "status": "cross-built; not executed on macOS",
-          "target": "aarch64-apple-darwin"
-        },
-        {
-          "binary_bytes": 414856,
-          "binary_sha256": "673e9b26eda59ba18e217034c6502daa65a2ab10f22403685c4aaf42181631f0",
-          "imports": [
-            "/usr/lib/libSystem.B.dylib"
-          ],
-          "independent_builds_equal": true,
-          "interpreter": "/usr/lib/dyld",
-          "linker_ad_hoc_signature": false,
-          "minimum_os": "13.0.0",
-          "native_smoke": "not run",
-          "package_sha256": "fb3a2c767f2a077dbe86af44814b93ae9ef81722359423882c029db0f5afdcb3",
-          "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
-          "status": "cross-built; not executed on macOS",
-          "target": "x86_64-apple-darwin"
-        }
-      ],
-      "scope": "Cloud cross-build and Mach-O structural/import/reproducibility checks only. No native macOS execution, notarization, or external-effect determinism claim.",
-      "zig_binary_sha256": "7c61539af19fa4082c94848f1c2b57b89e76dc6cfd5bd4c57764c3caf8f82272",
-      "zig_version": "0.17.0"
-    },
-    "arm-cross-verification": {
-      "component": {
-        "sha256": "ea8fd309578a09c9e12401621a470e6d6b1047f25933207fb8a39d66647d4561",
-        "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-aarch64-unknown-linux-musl.tar.xz"
-      },
-      "linker_binary_sha256": "4739514e3484915747c34b35007cd990235cc6b490b2d0525a61ac402ca16af9",
-      "linker_version": "LLD 23.1.1 (/checkout/src/llvm-project/llvm 1b9c0d5ff9bbe7634aead059efe6b11a7eeba145) (compatible with GNU linkers)",
-      "linux_arm64": {
-        "binary_bytes": 445888,
-        "binary_sha256": "62b8f751d99e24c71d4223037221207ecd7877ddbf0ac3784e31df26c8af0beb",
-        "independent_builds_equal": true,
-        "native_smoke": "not run",
-        "package_sha256": "9db094881a6fb18c3457f46e1c285dffe223414c982b2b4f5071babe182c5c02",
-        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
-        "static_no_pt_interp": true,
-        "status": "cross-built; not executed on ARM64 Linux",
-        "target": "aarch64-unknown-linux-musl"
-      },
-      "macos_ad_hoc_signature_checks": [
-        {
-          "native_execution": "not run",
-          "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
-          "sha256_code_pages_verified": true,
-          "target": "aarch64-apple-darwin"
-        }
-      ],
-      "scope": "Cross-build and ELF/Mach-O structural/hash verification only; ARM64 Linux and macOS native execution not run."
-    }
+  "scope": "Current-source distribution integrity and observed unsigned build processes. Cross-built ARM64 targets have no native execution claim.",
+  "buildRecords": {
+    "path": "guardrail/build-records.json",
+    "sha256": "eed06a954d2ec6e26bfc3bf5ce1135715916b5a7301ed5b511a7590370bce61d",
+    "bytes": 8574
   }
 }

package/guardrail/x86_64-unknown-linux-musl/manifest.json

@@ -1,12 +1,12 @@
 {
   "artifacts": {
     "README.md": {
-      "bytes": 10748,
-      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+      "bytes": 12849,
+      "sha256": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb"
     },
     "bin/kiokuko-guardrail": {
-      "bytes": 516792,
-      "sha256": "d262a712893945a1525dc9c8f19c806a44a832747879c1af8f6e33634b15636b"
+      "bytes": 549560,
+      "sha256": "828126da26891c8afa4cab9a8446fb6ff4a1883fd45a4556626942f0535b1f5d"
     },
     "protocols/coding-routine.lisp": {
       "bytes": 948,
@@ -14,12 +14,9 @@
     }
   },
   "build_inputs": {
-    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
-    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "cargo_sha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+    "cargo_version": "cargo 1.99.1 (5f94df478 2026-08-27)",
     "command": [
-      "env",
-      "SOURCE_DATE_EPOCH=0",
-      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build",
       "cargo",
       "build",
       "--manifest-path",
@@ -30,34 +27,36 @@
       "--target",
       "x86_64-unknown-linux-musl"
     ],
-    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
-    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "rustc_sha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+    "rustc_version": "rustc 1.99.1 (58cf8f9c3 2026-10-13)\nbinary: rustc\ncommit-hash: 58cf8f9c35b355199727627d07ae34a4e2846d67\ncommit-date: 2026-10-13\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.1\nLLVM version: 23.1.1",
     "source_date_epoch": 0,
     "target": "x86_64-unknown-linux-musl"
   },
   "package": "kiokuko-guardrail",
   "schema": 1,
   "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
-  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
   "sources": {
     "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
     "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
     "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
-    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "README.md": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb",
     "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
     "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
     "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
     "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
     "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
-    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/host.rs": "a8a850ff7b41bd6169ed79bf745fe0b1d8854545ceb6a745cb96428472489eac",
     "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
     "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
     "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
     "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
-    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/cli.rs": "d07df01919bdbcc78f6960ace69b3df38cb90bd4a28fb51de1d004382ac2cec9",
     "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
     "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
     "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/evidence_schema.rs": "4f8e24d88c5148b6782edb06977d6ffa352fa27bd51a53589e92360ffa7013bc",
+    "tests/fixtures/schema2-green.lisp": "ce937e565ccb9c6c7d5e00afe516f222a226e2a2b8152e41e1d8776f89602745",
     "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
     "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
     "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",

package/migrations/047_managed_operation_journal.sql

@@ -0,0 +1,21 @@
+-- Separate from owned execution: covers only plugin-observed managed boundaries.
+CREATE TABLE dsh_managed_journal_keys (id INTEGER PRIMARY KEY CHECK(id=1), secret TEXT NOT NULL);
+CREATE TABLE dsh_managed_scopes (
+ scope_id TEXT PRIMARY KEY, scope_json TEXT NOT NULL, sealed INTEGER NOT NULL DEFAULT 0,
+ collector_complete INTEGER NOT NULL DEFAULT 1, created_at INTEGER NOT NULL
+);
+CREATE TABLE dsh_managed_operations (
+ operation_id TEXT PRIMARY KEY, scope_id TEXT NOT NULL REFERENCES dsh_managed_scopes(scope_id),
+ sequence INTEGER NOT NULL, state TEXT NOT NULL, operation_json TEXT NOT NULL,
+ UNIQUE(scope_id,sequence)
+);
+CREATE TABLE dsh_managed_transitions (
+ operation_id TEXT NOT NULL REFERENCES dsh_managed_operations(operation_id),
+ sequence INTEGER NOT NULL, transition_json TEXT NOT NULL, PRIMARY KEY(operation_id,sequence)
+);
+CREATE TABLE dsh_managed_snapshots (
+ snapshot_id TEXT PRIMARY KEY, scope_id TEXT NOT NULL REFERENCES dsh_managed_scopes(scope_id),
+ snapshot_json TEXT NOT NULL, created_at INTEGER NOT NULL, retained INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX dsh_managed_operations_scope ON dsh_managed_operations(scope_id);
+CREATE UNIQUE INDEX dsh_managed_operations_original ON dsh_managed_operations(json_extract(operation_json,'$.originalRef')) WHERE json_extract(operation_json,'$.originalRef') IS NOT NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -290,7 +290,8 @@
     "@deepseek-ai/dsh-llm-pi-ai": "*",
     "@huggingface/hub": "^2.16.1",
     "@huggingface/transformers": "^4.2.0",
-    "sqlite-vec": "^0.1.9"
+    "sqlite-vec": "^0.1.9",
+    "@deepseek-ai/dsh-tools": "*"
   },
   "peerDependenciesMeta": {
     "@huggingface/hub": {
@@ -316,6 +317,9 @@
     },
     "@ai-sdk/provider": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -346,7 +350,7 @@
   },
   "guardrail": {
     "manifest": "guardrail/manifest.json",
-    "manifestSha256": "8da49d55f6bb7b8ccf2717f6680e439adda3d7347fb77de39f77566dd6a6d2b1",
+    "manifestSha256": "d001ddccda7a8c47abcb6ea2f5b67c1fd4452593e3750c3bd20ffa087a773297",
     "availability": "Bundled Linux x64/arm64 static musl and macOS Apple Silicon (ARM64). Intel Mac is unsupported. Only Linux x64 native smoke was recorded for the bundled release. Missing or invalid host artifact blocks protocol enrollment.",
     "verification": "npm run verify:guardrail validates bundled identities without executing cross-built binaries; npm run check:guardrail checks current host availability."
   }

package/scripts/guardrail-artifacts.d.mts

@@ -11,3 +11,6 @@ export interface ResolvedGuardrail {
 }
 /** Verify bundled file identities and format synchronously; no execution or network fallback. */
 export function resolveGuardrail(root: string, options?: GuardrailResolveOptions): ResolvedGuardrail
+
+/** Verify the frozen source and release provenance in a repository checkout. */
+export function verifyGuardrailSource(root: string): string

package/scripts/guardrail-artifacts.mjs

@@ -1,4 +1,4 @@
-import { constants, closeSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from 'node:fs'
+import { constants, closeSync, fstatSync, lstatSync, openSync, readFileSync, readdirSync, existsSync, realpathSync } from 'node:fs'
 import { createHash } from 'node:crypto'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -93,6 +93,7 @@ function indexAt(root) {
   if (digest(bytes) !== metadata.guardrail.manifestSha256) fail('package manifest digest integrity mismatch')
   const index = json(bytes, 'guardrail manifest')
   if (index.schema !== 1 || index.package !== 'kiokuko-guardrail' || typeof index.version !== 'string' || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/u.test(index.version) || !record(index.targets) || !record(index.protocol) || index.protocol.path !== 'guardrail/protocols/coding-routine.lisp') fail('guardrail manifest identity/schema mismatch')
+  if (!hex(index.sourceSha256) || !record(index.buildRecords) || index.buildRecords.path !== 'guardrail/build-records.json' || !hex(index.buildRecords.sha256)) fail('missing release source/build record identity')
   if (Object.keys(index.targets).length === 0) fail('guardrail manifest declares no bundled targets')
   if (!Array.isArray(index.unavailableTargets) || Object.keys(index.targets).some(target => !Object.values(targets).includes(target)) || index.unavailableTargets.some(target => !Object.values(targets).includes(target) || target in index.targets)) fail('guardrail manifest target declaration mismatch')
   return { index, manifestDigest: digest(bytes) }
@@ -111,15 +112,45 @@ export function resolveGuardrail(root, options = {}) {
   const releaseBytes = regularBytes(root, entry.manifest, 1024 * 1024)
   if (digest(releaseBytes) !== entry.manifestSha256) fail('target manifest digest integrity mismatch')
   const release = json(releaseBytes, 'target manifest')
-  if (release.schema !== 1 || release.package !== index.package || release.target !== target || release.version !== index.version || release.build_inputs?.target !== target || !hex(release.source_sha256)) fail('release manifest identity mismatch')
+  if (release.schema !== 1 || release.package !== index.package || release.target !== target || release.version !== index.version || release.build_inputs?.target !== target || release.source_sha256 !== index.sourceSha256) fail('release manifest identity mismatch')
   const binary = regularBytes(root, entry.binary, 16 * 1024 * 1024, true)
   matches(binary, entry, 'engine'); matches(binary, release.artifacts?.['bin/kiokuko-guardrail'], 'release engine')
   executableHeader(binary, target)
+  const recordsBytes = regularBytes(root, index.buildRecords.path, 1024 * 1024)
+  matches(recordsBytes, index.buildRecords, 'build records')
+  const records = json(recordsBytes, 'build records'), build = records.targets?.[target]
+  if (records.schema !== 1 || records.sourceSha256 !== index.sourceSha256 || !record(build) || build.sourceSha256 !== index.sourceSha256 || build.target !== target || build.binarySha256 !== digest(binary) || build.packageSha256 !== entry.verification?.package_sha256 || build.independentBuildsEqual !== true || !Array.isArray(build.builds) || build.builds.length !== 2 || build.builds.some(run => !record(run) || run.exitCode !== 0 || run.binarySha256 !== digest(binary) || !hex(run.stdoutSha256) || !hex(run.stderrSha256)) || build.nativeSmoke !== entry.verification?.native_smoke || entry.verification?.source_sha256 !== index.sourceSha256 || !hex(build.builderSha256) || !hex(build.linkerSha256) || build.cargoSha256 !== release.build_inputs.cargo_sha256 || build.rustcSha256 !== release.build_inputs.rustc_sha256) fail('build record/source/output integrity mismatch')
   const protocol = regularBytes(root, index.protocol.path, 256 * 1024)
   matches(protocol, index.protocol, 'protocol'); matches(protocol, release.artifacts?.['protocols/coding-routine.lisp'], 'release protocol')
   return { binary: join(root, entry.binary), protocol: join(root, index.protocol.path), engineDigest: digest(binary), protocolFileDigest: digest(protocol), manifestDigest, version: index.version, target }
 }
 
+/** Repository-only source check. Packaged consumers deliberately do not carry Rust source. */
+export function verifyGuardrailSource(root) {
+  root = resolve(root)
+  const { index } = indexAt(root)
+  const crate = join(root, 'crates/guardrail')
+  if (!existsSync(crate)) fail('source verification requires the repository crate')
+  function walk(prefix = '') {
+    return readdirSync(join(crate, prefix), { withFileTypes: true }).flatMap(entry => {
+      const path = prefix ? `${prefix}/${entry.name}` : entry.name
+      if (entry.isSymbolicLink()) fail(`source symlink is forbidden: ${path}`)
+      return entry.isDirectory() ? walk(path) : [path]
+    }).sort()
+  }
+  const source = json(regularBytes(root, 'crates/guardrail-release/source-manifest.json', 1024 * 1024), 'source manifest')
+  const files = Object.fromEntries(walk().map(path => [path, digest(regularBytes(crate, path, 1024 * 1024))]))
+  if (JSON.stringify(files) !== JSON.stringify(source.files) || digest(JSON.stringify(files)) !== source.sourceSha256 || source.sourceSha256 !== index.sourceSha256) fail('current source identity mismatch')
+  const provenance = json(regularBytes(root, 'crates/guardrail-release/release-provenance.json', 1024 * 1024), 'release provenance')
+  if (provenance.source_sha256 !== source.sourceSha256 || provenance.build_records_sha256 !== index.buildRecords.sha256) fail('release provenance source/build record mismatch')
+  if (provenance.build_runner_sha256 !== digest(regularBytes(root, 'crates/guardrail-release/release.py', 1024 * 1024))) fail('build runner identity mismatch')
+  for (const [target, entry] of Object.entries(index.targets)) {
+    const releaseBytes = regularBytes(root, entry.manifest, 1024 * 1024), release = json(releaseBytes, 'target manifest')
+    if (JSON.stringify(release.sources) !== JSON.stringify(files) || release.source_sha256 !== source.sourceSha256 || provenance.package_manifests?.[target]?.sha256 !== digest(releaseBytes)) fail('target current source/provenance mismatch')
+  }
+  return source.sourceSha256
+}
+
 if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
   try {
     const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
@@ -128,6 +159,7 @@ if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.me
     if (process.argv[2] === '--check-host') console.log(JSON.stringify(resolveGuardrail(root)))
     else {
       const { index } = indexAt(root)
+      if (existsSync(join(root, 'crates/guardrail'))) verifyGuardrailSource(root)
       for (const entry of Object.values(index.targets)) resolveGuardrail(root, { platform: entry.platform, arch: entry.arch })
       if (!quiet) console.log(JSON.stringify({ verifiedTargets: Object.keys(index.targets), unavailableTargets: index.unavailableTargets, nativeExecutionClaim: false, verification: Object.fromEntries(Object.entries(index.targets).map(([target, entry]) => [target, entry.verification])) }))
     }

package/scripts/repair-continuation-source.mjs

@@ -55,19 +55,15 @@ function catalogCandidates(configured) {
     )
     return [...new Set(candidates)]
   }
-  const packageRoot = process.env.KIOKUKO_DSH_PACKAGE_ROOT
-  if (packageRoot !== undefined) {
-    candidates.push(join(resolve(packageRoot), '@deepseek-ai/dsh-session-format-catalog/lib/index.js'))
-  }
-  const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
-  candidates.push(resolve(repositoryRoot, 'tests/fixtures/dsh-runtime/node_modules/@deepseek-ai/dsh-session-format-catalog/lib/index.js'))
-  return [...new Set(candidates)]
+  return []
 }
 
-async function loadCatalog(configured) {
-  const errors = []
+export async function loadCatalog(configured) {
   // An explicit catalog must not be silently replaced by another installation.
   const explicit = configured ?? process.env.KIOKUKO_SESSION_FORMAT_CATALOG
+    ?? (process.env.KIOKUKO_DSH_PACKAGE_ROOT !== undefined
+      ? join(resolve(process.env.KIOKUKO_DSH_PACKAGE_ROOT), '@deepseek-ai/dsh-session-format-catalog/lib/index.js')
+      : undefined)
   if (explicit !== undefined) {
     const candidate = catalogCandidates(explicit).find(path => existsSync(path))
     if (!candidate) throw new Error('configured session-format catalog does not exist')
@@ -75,25 +71,15 @@ async function loadCatalog(configured) {
     if (!module.sessionFormatCatalog) throw new Error('catalog module has no sessionFormatCatalog export')
     return { catalog: module.sessionFormatCatalog, createCatalogWithChildren: module.createSessionFormatCatalogWithChildren }
   }
+  // Production repair resolves the installed host package only. A test fixture
+  // is never an implicit substitute for a missing or broken host installation.
   try {
     const module = await import('@deepseek-ai/dsh-session-format-catalog')
-    if (module.sessionFormatCatalog) return { catalog: module.sessionFormatCatalog, createCatalogWithChildren: module.createSessionFormatCatalogWithChildren }
-  } catch (error) { errors.push(error) }
-  for (const candidate of catalogCandidates()) {
-    if (!existsSync(candidate)) continue
-    try {
-      const module = await import(pathToFileURL(candidate).href)
-      if (module.sessionFormatCatalog !== undefined) return { catalog: module.sessionFormatCatalog, createCatalogWithChildren: module.createSessionFormatCatalogWithChildren }
-      errors.push(new Error(`catalog module has no sessionFormatCatalog export: ${candidate}`))
-    } catch (error) {
-      errors.push(error)
-    }
+    if (!module.sessionFormatCatalog) throw new Error('catalog module has no sessionFormatCatalog export')
+    return { catalog: module.sessionFormatCatalog, createCatalogWithChildren: module.createSessionFormatCatalogWithChildren }
+  } catch (cause) {
+    throw new Error('Unable to load installed @deepseek-ai/dsh-session-format-catalog; set KIOKUKO_SESSION_FORMAT_CATALOG or --catalog to the intended built catalog module', { cause })
   }
-  const reason = errors.at(-1)
-  throw new Error(
-    'Unable to load @deepseek-ai/dsh-session-format-catalog; set KIOKUKO_SESSION_FORMAT_CATALOG or --catalog to a built catalog module',
-    { cause: reason },
-  )
 }
 
 function requireRegularFile(path, label) {