kiokuko-dsh 0.2.8 → 0.2.9

package/migrations/042_evolution_source_epochs.sql

@@ -0,0 +1,148 @@
+-- Retain each completed source epoch under its real ledger run identity.
+-- The migration runner already owns BEGIN IMMEDIATE with foreign keys enabled.
+-- Plain temporary copies avoid both parent-table rename rewriting and DROP cascades.
+CREATE TEMP TABLE migration_042_memory_episodes AS SELECT run_id,workspace,signature,evidence_digest,episode_json,overview_entry_id,created_at FROM memory_episodes;
+CREATE TEMP TABLE migration_042_memory_episode_entries AS SELECT run_id,entry_id FROM memory_episode_entries;
+CREATE TEMP TABLE migration_042_memory_evolution_jobs AS SELECT id,workspace,trigger_run,signature,kind,input_json,seen_json,input_digest,model_json,algorithm,state,attempts,claim_token,lease_until,settings_generation,reason,created_at,updated_at FROM memory_evolution_jobs;
+CREATE TEMP TABLE migration_042_memory_evolution_calls AS SELECT id,job_id,trigger_run,workspace,utc_day,input_bytes,input_tokens,output_tokens,duration_ms,outcome,created_at FROM memory_evolution_calls;
+CREATE TEMP TABLE migration_042_memory_evolution_skips AS SELECT run_id,workspace,reason FROM memory_evolution_skips;
+
+-- Remove dependent tables first; the copies have no foreign keys.
+DROP TABLE memory_episode_entries;
+DROP TABLE memory_evolution_calls;
+DROP TABLE memory_episodes;
+DROP TABLE memory_evolution_jobs;
+DROP TABLE memory_evolution_skips;
+
+CREATE TABLE memory_episodes (
+ run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+ workspace TEXT NOT NULL,
+ signature TEXT NOT NULL,
+ evidence_digest TEXT NOT NULL,
+ episode_json TEXT NOT NULL,
+ overview_entry_id TEXT,
+ created_at TEXT NOT NULL,
+ source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0),
+ PRIMARY KEY(run_id,source_epoch)
+);
+
+CREATE TABLE memory_episode_entries (
+ run_id TEXT NOT NULL,
+ entry_id TEXT NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
+ source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0),
+ PRIMARY KEY(run_id,source_epoch,entry_id),
+ FOREIGN KEY(run_id,source_epoch) REFERENCES memory_episodes(run_id,source_epoch) ON DELETE CASCADE
+);
+
+CREATE TABLE memory_evolution_jobs (
+ id TEXT PRIMARY KEY,
+ workspace TEXT NOT NULL,
+ trigger_run TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+ signature TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('positive','avoidance')),
+ input_json TEXT NOT NULL,
+ seen_json TEXT NOT NULL,
+ input_digest TEXT NOT NULL UNIQUE,
+ model_json TEXT NOT NULL,
+ algorithm TEXT NOT NULL DEFAULT 'episode-evolution-v1',
+ state TEXT NOT NULL CHECK(state IN ('pending','processing','completed','held','failed')),
+ attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts BETWEEN 0 AND 2),
+ claim_token TEXT,
+ lease_until TEXT,
+ settings_generation INTEGER,
+ reason TEXT,
+ created_at TEXT NOT NULL,
+ updated_at TEXT NOT NULL,
+ source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0),
+ UNIQUE(trigger_run,source_epoch)
+);
+
+CREATE TABLE memory_evolution_calls (
+ id TEXT PRIMARY KEY,
+ job_id TEXT REFERENCES memory_evolution_jobs(id) ON DELETE SET NULL,
+ trigger_run TEXT NOT NULL,
+ workspace TEXT NOT NULL,
+ utc_day TEXT NOT NULL,
+ input_bytes INTEGER NOT NULL,
+ input_tokens INTEGER,
+ output_tokens INTEGER,
+ duration_ms INTEGER,
+ outcome TEXT NOT NULL,
+ created_at TEXT NOT NULL,
+ source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0),
+ UNIQUE(trigger_run,source_epoch)
+);
+
+CREATE TABLE memory_evolution_skips (
+ run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+ workspace TEXT NOT NULL,
+ reason TEXT NOT NULL,
+ source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0),
+ PRIMARY KEY(run_id,source_epoch)
+);
+
+INSERT INTO memory_episodes(run_id,workspace,signature,evidence_digest,episode_json,overview_entry_id,created_at,source_epoch)
+ SELECT run_id,workspace,signature,evidence_digest,episode_json,overview_entry_id,created_at,1 FROM migration_042_memory_episodes;
+INSERT INTO memory_evolution_jobs(id,workspace,trigger_run,signature,kind,input_json,seen_json,input_digest,model_json,algorithm,state,attempts,claim_token,lease_until,settings_generation,reason,created_at,updated_at,source_epoch)
+ SELECT id,workspace,trigger_run,signature,kind,input_json,seen_json,input_digest,model_json,algorithm,state,attempts,claim_token,lease_until,settings_generation,reason,created_at,updated_at,1 FROM migration_042_memory_evolution_jobs;
+INSERT INTO memory_evolution_skips(run_id,workspace,reason,source_epoch)
+ SELECT run_id,workspace,reason,1 FROM migration_042_memory_evolution_skips;
+INSERT INTO memory_episode_entries(run_id,entry_id,source_epoch)
+ SELECT run_id,entry_id,1 FROM migration_042_memory_episode_entries;
+INSERT INTO memory_evolution_calls(id,job_id,trigger_run,workspace,utc_day,input_bytes,input_tokens,output_tokens,duration_ms,outcome,created_at,source_epoch)
+ SELECT id,job_id,trigger_run,workspace,utc_day,input_bytes,input_tokens,output_tokens,duration_ms,outcome,created_at,1 FROM migration_042_memory_evolution_calls;
+DROP TABLE migration_042_memory_episodes;
+DROP TABLE migration_042_memory_episode_entries;
+DROP TABLE migration_042_memory_evolution_jobs;
+DROP TABLE migration_042_memory_evolution_calls;
+DROP TABLE migration_042_memory_evolution_skips;
+
+CREATE INDEX memory_episodes_signature ON memory_episodes(workspace,signature,created_at);
+CREATE INDEX memory_evolution_jobs_state ON memory_evolution_jobs(state,created_at);
+CREATE INDEX memory_evolution_calls_budget ON memory_evolution_calls(workspace,utc_day);
+
+CREATE TRIGGER memory_episode_identity_immutable
+BEFORE UPDATE OF run_id,source_epoch,workspace,signature,evidence_digest,episode_json ON memory_episodes
+BEGIN SELECT RAISE(ABORT, 'episode identity is immutable'); END;
+
+CREATE TRIGGER memory_episode_overview_immutable
+BEFORE UPDATE OF overview_entry_id ON memory_episodes
+WHEN OLD.overview_entry_id IS NOT NULL AND NEW.overview_entry_id IS NOT OLD.overview_entry_id
+BEGIN SELECT RAISE(ABORT, 'episode overview identity is immutable'); END;
+
+CREATE TRIGGER memory_evolution_job_input_immutable BEFORE UPDATE OF id,workspace,trigger_run,source_epoch,signature,kind,input_json,seen_json,input_digest,model_json,algorithm ON memory_evolution_jobs
+WHEN NOT(EXISTS(SELECT 1 FROM memory_forget_jobs WHERE kind='evolution' AND id=OLD.id)
+ AND NEW.id=OLD.id AND NEW.workspace=OLD.workspace AND NEW.trigger_run=OLD.trigger_run AND NEW.source_epoch=OLD.source_epoch AND NEW.signature=OLD.signature
+ AND NEW.kind=OLD.kind AND NEW.input_digest=OLD.input_digest AND NEW.model_json=OLD.model_json AND NEW.algorithm=OLD.algorithm
+ AND NEW.input_json='[]' AND NEW.seen_json='[]')
+BEGIN SELECT RAISE(ABORT,'evolution job input is immutable'); END;
+
+CREATE TRIGGER lifecycle_reference_memory_episodes_insert AFTER INSERT ON memory_episodes BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;
+
+CREATE TRIGGER lifecycle_reference_memory_episodes_update AFTER UPDATE ON memory_episodes BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;
+
+CREATE TRIGGER lifecycle_reference_memory_episodes_delete AFTER DELETE ON memory_episodes BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;
+
+CREATE TRIGGER lifecycle_reference_memory_episode_entries_insert AFTER INSERT ON memory_episode_entries BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;
+
+CREATE TRIGGER lifecycle_reference_memory_episode_entries_update AFTER UPDATE ON memory_episode_entries BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;
+
+CREATE TRIGGER lifecycle_reference_memory_episode_entries_delete AFTER DELETE ON memory_episode_entries BEGIN
+  INSERT INTO dsh_memory_processing_state(workspace,context_revision) VALUES('global',1)
+    ON CONFLICT(workspace) DO UPDATE SET context_revision=context_revision+1;
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -45,7 +45,10 @@
     "scripts/evaluate-answer-review.mjs",
     "scripts/answer-review-evaluation.mjs",
     "scripts/answer-review-evaluation.d.mts",
-    "scripts/verification-completion.mjs"
+    "scripts/verification-completion.mjs",
+    "guardrail/",
+    "scripts/guardrail-artifacts.mjs",
+    "scripts/guardrail-artifacts.d.mts"
   ],
   "exports": {
     ".": {
@@ -93,12 +96,14 @@
       "patch": "./dsh/cordis.patch.yml"
     },
     "compatibility": {
-      "dsh": "0.2.1-alpha.2",
+      "dsh": ">=0.2.1-alpha.2",
       "dshReleases": {
-        "0.2.1-alpha.2": "compatible"
+        "0.2.1-alpha.2": "compatible",
+        "0.2.1-alpha.3": "compatible"
       },
       "profiles": [
         "web",
+        "dsh-cli",
         "dsh-tui"
       ]
     },
@@ -109,7 +114,8 @@
         "Registered project roots and their repository metadata",
         "Selected session repository status, staged and working-tree diffs, and explicitly selected untracked files for Diff review",
         "AgenticReplay traces belonging to the exact native DSH session",
-        "Stored native DSH session IDs and histories for startup validation and legacy Kiokuko compatibility"
+        "Stored native DSH session IDs and histories for startup validation and legacy Kiokuko compatibility",
+        "Bundled Rust guardrail manifests, bounded protocol and exact precompiled host artifact for explicitly enrolled TDD units"
       ],
       "writePaths": [
         "Seventeen bundled managed Skills and references under ~/.agents/skills on enabled plugin load",
@@ -124,7 +130,8 @@
       "commands": [
         "Restricted repository-relative verifier and backup subprocesses when explicitly requested",
         "Read-only fixed-argument Git commands for an explicitly captured Diff review",
-        "Owned bash/zsh, PATH commands, builds/tests and Lisp with the normal user environment; explicit protected Lisp compatibility mode remains available"
+        "Owned bash/zsh, PATH commands, builds/tests and Lisp with the normal user environment; explicit protected Lisp compatibility mode remains available",
+        "Bundled Rust guardrail check/validate and the host-owned Node test runner for explicitly enrolled bounded TDD units; no download, Cargo, SBCL or PATH engine fallback"
       ],
       "externalServices": [
         "GitHub or skills.sh for optional Skill discovery and source retrieval",
@@ -147,7 +154,8 @@
         "Repository identity, run identity, lease, revision, and integrity mismatches fail closed",
         "Remote embedding is disabled by default and unavailable services do not become normal success",
         "Ordinary memory finalization failures are retryable; uncertain Deep requests are never automatically resent. Neither can veto completion or session-log export",
-        "AgenticReplay is configured by default; capture requires a session choice or start command, adds no network transmission, and cannot veto native outcomes"
+        "AgenticReplay is configured by default; capture requires a session choice or start command, adds no network transmission, and cannot veto native outcomes",
+        "Explicitly enrolled bounded TDD units fail closed on absent/invalid guardrail artifacts or stale authority/receipt bindings; only Linux x64 has native engine verification, other bundled targets are cross-built"
       ],
       "lifecycleEvidence": [
         "prepare runs only npm run build",
@@ -158,7 +166,7 @@
   },
   "scripts": {
     "clean:dist": "node --input-type=module --eval \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true });\"",
-    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs",
+    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs && node scripts/guardrail-artifacts.mjs --verify-bundled --quiet",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node scripts/run-tests.mjs tests/dsh",
     "test:harness": "node --import tsx scripts/run-harness-evaluation.mjs",
@@ -176,6 +184,7 @@
     "test:benchmark:dsh-log": "npm run build && node scripts/run-dsh-million-event-benchmark.mjs",
     "test:efficiency": "node --import tsx scripts/run-token-efficiency-evaluation.mjs",
     "test:e2e:dsh": "npm run build && node scripts/run-enno-dsh-e2e.mjs",
+    "test:cli-profile": "node scripts/verify-cli-profile.mjs",
     "verify:prepare": "node scripts/verify-prepare-reproducibility.mjs",
     "sampledb:generate": "node --import tsx tests/fixtures/sample-database.ts tests/sampledb/kiokuko-dsh.sqlite3",
     "test:sampledb": "npm run build && node --import tsx tests/ci/verify-sample-database.ts",
@@ -249,11 +258,13 @@
     "test:code-intelligence:benchmark": "node scripts/benchmark-code-intelligence.mjs",
     "verify": "node scripts/verify.mjs",
     "verify:plan": "node scripts/verify.mjs --plan",
-    "test:verification": "node --test scripts/verification-contract.test.mjs"
+    "test:verification": "node --test scripts/verification-contract.test.mjs",
+    "verify:guardrail": "node scripts/guardrail-artifacts.mjs --verify-bundled",
+    "check:guardrail": "node scripts/guardrail-artifacts.mjs --check-host"
   },
   "dependencies": {
-    "@deepseek-ai/cosmokit": "1.8.5",
-    "@deepseek-ai/schemastery": "3.18.5-alpha.1",
+    "@deepseek-ai/cosmokit": "~1.8.6-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2",
     "agenticreplay": ">=0.1.0 <1.0.0",
     "jsonc-parser": "3.3.1",
     "semver": "7.8.5",
@@ -266,15 +277,15 @@
     "global-agent": "4.1.3"
   },
   "peerDependencies": {
-    "@ai-sdk/provider": "4.0.21",
+    "@ai-sdk/provider": "^4.0.21",
     "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
-    "@huggingface/hub": "2.16.1",
-    "@huggingface/transformers": "4.2.0",
-    "sqlite-vec": "0.1.9"
+    "@deepseek-ai/dsh-agent": ">=0.2.1-alpha.2",
+    "@deepseek-ai/dsh-attachment": ">=0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.2.1-alpha.2",
+    "@huggingface/hub": "^2.16.1",
+    "@huggingface/transformers": "^4.2.0",
+    "sqlite-vec": "^0.1.9"
   },
   "peerDependenciesMeta": {
     "@huggingface/hub": {
@@ -308,14 +319,15 @@
     "@ai-sdk/openai": "4.0.83",
     "@ai-sdk/openai-compatible": "3.0.62",
     "@ai-sdk/provider": "4.0.21",
-    "@deepseek-ai/cordis": "4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-format": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-format-v0-to-v1": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-format-v1-to-v2": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-format": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-format-v0-to-v1": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-format-v1-to-v2": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-format-v2-to-v3": "0.2.1-alpha.3",
     "@huggingface/hub": "2.16.1",
     "@huggingface/transformers": "4.2.0",
     "@types/node": "24.13.3",
@@ -326,5 +338,11 @@
     "sqlite-vec": "0.1.9",
     "tsx": "4.23.13",
     "typescript": "5.9.3"
+  },
+  "guardrail": {
+    "manifest": "guardrail/manifest.json",
+    "manifestSha256": "0a48e29154e1bf498254dbeb4073d16a6526d1e27019e3e21d490d9c179048e4",
+    "availability": "Bundled Linux x64/arm64 static musl and macOS x64/arm64; only Linux x64 native smoke verified. Missing or invalid host artifact blocks protocol enrollment.",
+    "verification": "npm run verify:guardrail validates bundled identities without executing cross-built binaries; npm run check:guardrail checks current host availability."
   }
 }

package/scripts/guardrail-artifacts.d.mts

@@ -0,0 +1,13 @@
+/** Test overrides select packaged targets; normal enrollment uses the actual host. */
+export interface GuardrailResolveOptions { platform?: string; arch?: string }
+export interface ResolvedGuardrail {
+  binary: string
+  protocol: string
+  engineDigest: string
+  protocolFileDigest: string
+  manifestDigest: string
+  version: string
+  target: string
+}
+/** Verify bundled file identities and format synchronously; no execution or network fallback. */
+export function resolveGuardrail(root: string, options?: GuardrailResolveOptions): ResolvedGuardrail

package/scripts/guardrail-artifacts.mjs

@@ -0,0 +1,136 @@
+import { constants, closeSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const targets = Object.freeze({
+  'linux:x64': 'x86_64-unknown-linux-musl',
+  'linux:arm64': 'aarch64-unknown-linux-musl',
+  'darwin:x64': 'x86_64-apple-darwin',
+  'darwin:arm64': 'aarch64-apple-darwin',
+})
+const digest = bytes => createHash('sha256').update(bytes).digest('hex')
+const fail = message => { throw new Error(`Bundled Rust guardrail: ${message}`) }
+const hex = value => typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value)
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+
+function regularBytes(root, path, maximum, executable = false) {
+  if (typeof path !== 'string' || path.startsWith('/') || path.split('/').some(part => !part || part === '.' || part === '..' || part.includes('\\'))) fail('invalid asset path')
+  let full = root
+  const parts = path.split('/')
+  for (let index = 0; index <= parts.length; index++) {
+    if (index > 0) full = join(full, parts[index - 1])
+    let stat
+    try { stat = lstatSync(full) } catch (error) { if (error.code === 'ENOENT') fail(`missing artifact ${path}; enrollment unavailable`); throw error }
+    if (stat.isSymbolicLink()) fail(`symlink asset is forbidden: ${path}`)
+    if (index < parts.length && !stat.isDirectory()) fail(`asset parent must be a directory: ${path}`)
+    if (index === parts.length && !stat.isFile()) fail(`artifact must be a regular file: ${path}`)
+  }
+  const fd = openSync(full, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
+  try {
+    const stat = fstatSync(fd)
+    if (!stat.isFile()) fail(`artifact must be a regular file: ${path}`)
+    if (stat.size <= 0 || stat.size > maximum) fail(`invalid artifact size: ${path}`)
+    if (executable && (stat.mode & 0o111) === 0) fail(`artifact is not executable: ${path}`)
+    const bytes = readFileSync(fd)
+    if (bytes.length !== stat.size) fail(`artifact size changed while reading: ${path}`)
+    return bytes
+  } finally { closeSync(fd) }
+}
+function json(bytes, label) {
+  let value
+  try { value = JSON.parse(bytes.toString('utf8')) } catch { fail(`malformed ${label}`) }
+  if (!record(value)) fail(`malformed ${label}`)
+  return value
+}
+function matches(bytes, expected, label) {
+  if (!record(expected) || !Number.isSafeInteger(expected.bytes) || expected.bytes !== bytes.length || !hex(expected.sha256) || digest(bytes) !== expected.sha256) fail(`size/digest integrity mismatch: ${label}`)
+}
+function boundedOffset(value, maximum, label) {
+  if (value > BigInt(maximum)) fail(`${label} exceeds artifact bytes`)
+  return Number(value)
+}
+function executableHeader(bytes, target) {
+  const arm = target.startsWith('aarch64-')
+  if (target.endsWith('-linux-musl')) {
+    if (bytes.length < 64 || !bytes.subarray(0, 7).equals(Buffer.from([0x7f, 69, 76, 70, 2, 1, 1])) || bytes.readUInt16LE(18) !== (arm ? 183 : 62)) fail('ELF64 architecture/header mismatch')
+    const type = bytes.readUInt16LE(16), phoff = boundedOffset(bytes.readBigUInt64LE(32), bytes.length, 'ELF header')
+    const stride = bytes.readUInt16LE(54), count = bytes.readUInt16LE(56)
+    if (![2, 3].includes(type) || bytes.readUInt32LE(20) !== 1 || bytes.readUInt16LE(52) !== 64 || stride !== 56 || !count || phoff < 64 || phoff + count * stride > bytes.length) fail('truncated or unsupported ELF executable layout')
+    let executable = false
+    for (let offset = phoff; offset < phoff + count * stride; offset += stride) {
+      const kind = bytes.readUInt32LE(offset), flags = bytes.readUInt32LE(offset + 4)
+      const start = bytes.readBigUInt64LE(offset + 8), size = bytes.readBigUInt64LE(offset + 32), memory = bytes.readBigUInt64LE(offset + 40)
+      if (size && (start > BigInt(bytes.length) || start + size > BigInt(bytes.length))) fail('ELF segment exceeds artifact bytes')
+      if (kind === 1 && size > memory) fail('ELF load segment size is invalid')
+      if (kind === 3) fail('expected static musl ELF without a dynamic interpreter')
+      executable ||= kind === 1 && Boolean(flags & 1)
+    }
+    if (!executable) fail('ELF has no executable load segment')
+  } else {
+    if (bytes.length < 32 || bytes.readUInt32LE(0) !== 0xfeedfacf || bytes.readUInt32LE(4) !== (arm ? 0x0100000c : 0x01000007)) fail('Mach-O64 architecture/header mismatch')
+    const count = bytes.readUInt32LE(16), size = bytes.readUInt32LE(20)
+    if (bytes.readUInt32LE(12) !== 2 || !count || size > bytes.length - 32) fail('truncated or non-executable Mach-O layout')
+    let offset = 32, executable = false
+    for (let index = 0; index < count; index++) {
+      if (offset + 8 > 32 + size) fail('truncated Mach-O load command')
+      const kind = bytes.readUInt32LE(offset), stride = bytes.readUInt32LE(offset + 4)
+      if (stride < 8 || stride % 8 || offset + stride > 32 + size) fail('invalid Mach-O load command size')
+      if (kind === 0x19) {
+        if (stride < 72) fail('truncated Mach-O64 segment')
+        const start = bytes.readBigUInt64LE(offset + 40), length = bytes.readBigUInt64LE(offset + 48)
+        if (start + length > BigInt(bytes.length)) fail('Mach-O segment exceeds artifact bytes')
+        executable ||= length > 0n && Boolean(bytes.readUInt32LE(offset + 60) & 4)
+      }
+      offset += stride
+    }
+    if (offset !== 32 + size || !executable) fail('Mach-O executable segment/layout mismatch')
+  }
+}
+function indexAt(root) {
+  const metadata = json(regularBytes(root, 'package.json', 1024 * 1024), 'package metadata')
+  if (!record(metadata.guardrail) || metadata.guardrail.manifest !== 'guardrail/manifest.json' || !hex(metadata.guardrail.manifestSha256)) fail('package metadata has no pinned guardrail manifest')
+  const bytes = regularBytes(root, metadata.guardrail.manifest, 1024 * 1024)
+  if (digest(bytes) !== metadata.guardrail.manifestSha256) fail('package manifest digest integrity mismatch')
+  const index = json(bytes, 'guardrail manifest')
+  if (index.schema !== 1 || index.package !== 'kiokuko-guardrail' || typeof index.version !== 'string' || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/u.test(index.version) || !record(index.targets) || !record(index.protocol) || index.protocol.path !== 'guardrail/protocols/coding-routine.lisp') fail('guardrail manifest identity/schema mismatch')
+  if (Object.keys(index.targets).length === 0) fail('guardrail manifest declares no bundled targets')
+  if (!Array.isArray(index.unavailableTargets) || Object.keys(index.targets).some(target => !Object.values(targets).includes(target)) || index.unavailableTargets.some(target => !Object.values(targets).includes(target) || target in index.targets)) fail('guardrail manifest target declaration mismatch')
+  return { index, manifestDigest: digest(bytes) }
+}
+
+/** Select already bundled bytes only. This performs no execution, compilation, download, or PATH lookup. */
+export function resolveGuardrail(root, options = {}) {
+  root = resolve(root)
+  const platform = options.platform ?? process.platform, arch = options.arch ?? process.arch
+  const target = targets[`${platform}:${arch}`]
+  if (!target) fail(`unsupported host ${platform}/${arch}; no binary fallback`)
+  const { index, manifestDigest } = indexAt(root)
+  if (!Object.hasOwn(index.targets, target)) fail(`target ${target} unavailable: not bundled; no download or compilation fallback`)
+  const entry = index.targets[target]
+  if (!record(entry) || entry.platform !== platform || entry.arch !== arch || entry.binary !== `guardrail/${target}/kiokuko-guardrail` || entry.manifest !== `guardrail/${target}/manifest.json` || !hex(entry.manifestSha256)) fail('target manifest identity/path mismatch')
+  const releaseBytes = regularBytes(root, entry.manifest, 1024 * 1024)
+  if (digest(releaseBytes) !== entry.manifestSha256) fail('target manifest digest integrity mismatch')
+  const release = json(releaseBytes, 'target manifest')
+  if (release.schema !== 1 || release.package !== index.package || release.target !== target || release.version !== index.version || release.build_inputs?.target !== target || !hex(release.source_sha256)) fail('release manifest identity mismatch')
+  const binary = regularBytes(root, entry.binary, 16 * 1024 * 1024, true)
+  matches(binary, entry, 'engine'); matches(binary, release.artifacts?.['bin/kiokuko-guardrail'], 'release engine')
+  executableHeader(binary, target)
+  const protocol = regularBytes(root, index.protocol.path, 256 * 1024)
+  matches(protocol, index.protocol, 'protocol'); matches(protocol, release.artifacts?.['protocols/coding-routine.lisp'], 'release protocol')
+  return { binary: join(root, entry.binary), protocol: join(root, index.protocol.path), engineDigest: digest(binary), protocolFileDigest: digest(protocol), manifestDigest, version: index.version, target }
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+    const quiet = process.argv[3] === '--quiet'
+    if ((process.argv.length !== 3 && !(process.argv.length === 4 && quiet && process.argv[2] === '--verify-bundled')) || !['--verify-bundled', '--check-host'].includes(process.argv[2])) fail('usage: guardrail-artifacts.mjs --verify-bundled [--quiet]|--check-host')
+    if (process.argv[2] === '--check-host') console.log(JSON.stringify(resolveGuardrail(root)))
+    else {
+      const { index } = indexAt(root)
+      for (const entry of Object.values(index.targets)) resolveGuardrail(root, { platform: entry.platform, arch: entry.arch })
+      if (!quiet) console.log(JSON.stringify({ verifiedTargets: Object.keys(index.targets), unavailableTargets: index.unavailableTargets, nativeExecutionClaim: false, verification: Object.fromEntries(Object.entries(index.targets).map(([target, entry]) => [target, entry.verification])) }))
+    }
+  } catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1 }
+}

package/skills/kiokuko-lisp/SKILL.md

@@ -16,7 +16,7 @@ Coding: coding_workflow defines Goal/items/checks before the task Lisp choice. P
 
 Persistent mode: coding choice or /kioku-lisp enable. Task mode uses /kioku-lisp enable-task with fresh workers per definition/call. Lisp and ordinary tools coexist. Coding-task startup failure blocks until recovery or explicit route change; legacy ordinary tools remain available. Never spoof host-bound session/agent/directory/generation.
 
-Use kioku_read, kioku_write, kioku_edit, kioku_remove, kioku_exec and kioku_result for observed development. PATH commands, bash/zsh, builds/tests, coding-needed external investigation and project edits need no routine confirmation. Source/data deletion and existing durable user database mutation need a concrete review; generated/temp/disposable artifacts and routine Kioku saving are authorized. Declare destructiveTargets when executing commands with destructive intent. The host does not attempt to classify every side effect of arbitrary code.
+Use kioku_read, kioku_write, kioku_edit, kioku_remove, kioku_exec and kioku_result for observed development. PATH commands, bash/zsh, builds/tests, coding-needed external investigation and project edits need no routine confirmation. Source/data deletion and existing durable user database mutation need a concrete review; generated/temp/disposable artifacts are ordinary development. Memory organization waits until task completion and user permission; saving requires approval of the exact shown content. Declare destructiveTargets when executing commands with destructive intent. The host does not attempt to classify every side effect of arbitrary code.
 
 Lisp uses the normal user environment and child processes. Prefer kioku.tools:call-tool with the owned tools or kioku.process broker APIs to obtain host receipts. Direct Lisp/FFI effects are not independently observed and cannot establish successful verification. Bind task_completion conditions/source paths before executing checks, including subdirectory checks. Collect asynchronous final receipts with kioku_result. A model/Lisp passed field is never process evidence. Plan, goal, cancellation and execution ownership remain authoritative. During Plan use read/search/status; explicit human implementation instructions or Plan approval exit at the next accepted boundary.
 

package/skills/kiokuko-soul/SKILL.md

@@ -8,18 +8,18 @@ description: Kiokuko's entry router for non-trivial DSH work. Read it before any
 <!-- kiokuko:runtime contract -->
 # SOUL router
 
-Read first. Host owns intake/session/capabilities/routing/delegation. No model task_prepare/task_answer; their absence is normal. Require ready/exhausted, permissive nextAction; invent no profile.
+Read first. Host owns intake/session/capabilities/routing/delegation; absent task_prepare/task_answer is normal. Require ready/exhausted and permissive nextAction; invent no profile.
 
-User instructions outrank Skill preferences. Preserve identity/revisions/leases/integrity and Plan/goal/cancellation/ownership. Optional enrichment never vetoes ordinary work. Resolve routine choices from authorization/evidence; clarify unclear intent/destruction. Complete work, report blockers, recheck changes; no invented budgets/effect replay.
+User instructions outrank Skills. Preserve identity/revisions/leases/integrity and Plan/goal/cancellation/ownership. Optional enrichment never vetoes work. Use authorization/evidence for routine choices; clarify unclear intent/destruction. Finish, report blockers, recheck changes; no invented budgets.
 
 **本当に、それを全部計算・保存・検索する必要があるのか？**
-Preserve required results; remove needless computation/storage/search, narrow the rest, then optimize. Exhaustive work needs evidence. Never silently approximate/delete data or waive required validation, recovery or audit. No extra approval/artifact.
+Preserve results: eliminate needless computation/storage/search, narrow scope, then optimize. Justify exhaustive work. Never silently approximate/delete data or waive validation, recovery or audit. No extra approvals/artifacts.
 
-Match Skills to the request/directive; non-code needs no coding startup. Read selected indexes and risk-selected references. Preserve roles/exclusions/recovery and host outcomes/model/effort; optional gaps never block work.
+Choose request-relevant Skills; non-code needs no coding startup. Read indexes and risk-relevant references. Preserve roles/exclusions/recovery and host outcomes/model/effort.
 
-Normal execution uses current model/memory/Skills and kioku_read/write/edit/remove/exec/result. Project work, PATH/bash/zsh, Lisp, builds/tests and routine Kioku saving need no routine approval; review source/data deletion and durable user DB changes concretely. Lisp failure needs recovery or explicit route change. Bind source/test/config checks before execution and collect final background receipts. Receipts prove observations, not generalized lessons; check recalled candidates against current sources. Report work/verification/saving separately; retry saving only. Human implementation instructions or Plan approval request exit at the next accepted boundary; a plan-only answer does not exit.
+Use current model/memory/Skills and kioku_read/write/edit/remove/exec/result. Project work, PATH/bash/zsh, Lisp and builds/tests are authorized; review source/data deletion and durable user DB changes concretely. Recover Lisp or explicitly change route. Pre-bind source/test/config checks; collect final background receipts. Receipts establish observations only; check recalled candidates against current sources. Report work, verification and memory saving separately. After completion, get permission to organize memory; show the exact proposal and save only its user-approved revision. Comments need new previews; decline saves nothing. Memory failure never blocks work. Reconcile uncertain approved saves with the original key; never replay work or invent save identities. Human implementation requests or Plan approval request exit at the next accepted boundary; plan-only answers stay in Plan.
 
-Unavailable Skills: use current evidence unless required host identity/authority/integrity prevents it. Never substitute required Skills or auto-install/execute fetched Skills. Never claim unread Skills or unrun checks. Before diagnostics check supported file types; For Markdown and unsupported documents, read and check structure, requirements and whitespace manually. Unavailable diagnostics remain unverified, not clean. After a successful edit or write, re-read before the next mutation. Serialize changes; on stale content re-read and reconcile, never force overwrite or repeat unsupported diagnostics unchanged.
+Without Skills, use current evidence within host identity/authority/integrity; never substitute required Skills or auto-install/execute fetched ones. Claim no unread Skills or unrun checks. Check supported file types before diagnostics; manually check Markdown/unsupported documents for structure, requirements and whitespace. Unavailable diagnostics stay unverified. After each successful edit/write, re-read before the next mutation; reconcile stale content and never force overwrites. Never repeat unsupported diagnostics unchanged.
 
 Select kiokuko-{investigate,architecture,review,benchmark,verification,skill-authoring,technical-writing} as needed. Coding: coding-ideal-routine-skill owns coding_workflow and fresh Goal evidence.
 <!-- /kiokuko:runtime -->