owlrunkit 0.15.0 → 0.16.0

package/scripts/runkit-contract/core-contract.mjs

@@ -4,33 +4,45 @@ import {
   lstatSync,
   mkdirSync,
   readFileSync,
-  readdirSync,
   realpathSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { isAbsolute, relative, resolve, win32 } from "node:path";
+import { isAbsolute, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
+import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.15.0";
+export const CORE_VERSION = "0.16.0";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
   "acceptance-evidence.mjs",
+  "assurance-router.mjs",
+  "core-successor.mjs",
   "coverage-adoption.mjs",
   "core-contract.mjs",
   "delivery-create.mjs",
   "delivery-selection.mjs",
+  "deployment-workflow.mjs",
+  "fleet-discovery.mjs",
   "finalize.mjs",
+  "formal-workflow.mjs",
+  "human-status.mjs",
   "inspect-presentation.mjs",
+  "install-codex-skill.mjs",
   "lease-lifecycle.mjs",
   "lifecycle-orchestration.mjs",
   "offline-store.mjs",
   "onboarding-doctor.mjs",
+  "owner-authority-trust.mjs",
+  "owner-deployment-decision.mjs",
   "profile-impact.mjs",
   "profile-onboarding.mjs",
+  "project-cli-resolver.mjs",
+  "project-control-parser.mjs",
+  "project-control-state.mjs",
   "provenance-common.mjs",
   "quick-attest.mjs",
   "quick-canonical.mjs",
@@ -45,24 +57,53 @@ const CORE_FILES = [
   "repair-execution.mjs",
   "resume-execution.mjs",
   "resource-preflight.mjs",
+  "remote-deployment.mjs",
+  "remote-process-adapter.mjs",
+  "ssh-remote-adapter.mjs",
+  "runkit-bootstrap.mjs",
   "runkit-cli.mjs",
   "snapshot.mjs",
+  "source-candidate.mjs",
   "source-fingerprint.mjs",
+  "sync-core016-release-identity.mjs",
   "verification-receipt-gate.mjs",
   "verification-context.mjs",
   "verification-plan.mjs",
   "visual-smoke.mjs",
+  "schemas/assurance-route-v1.schema.json",
   "schemas/closeout-receipt-v2.schema.json",
   "schemas/adoption-evidence-v1.schema.json",
   "schemas/coverage-adopt-request-v1.schema.json",
   "schemas/core-artifact.schema.json",
   "schemas/core-artifact-v2.schema.json",
+  "schemas/core-successor-batch-receipt-v1.schema.json",
+  "schemas/core-successor-plan-v1.schema.json",
+  "schemas/core-successor-project-success-receipt-v1.schema.json",
+  "schemas/deployment-execute-request-v1.schema.json",
+  "schemas/deployment-lineage-v1.schema.json",
+  "schemas/deployment-prepare-receipt-v1.schema.json",
   "schemas/engine-pin.schema.json",
   "schemas/engine-pin-v2.schema.json",
   "schemas/evidence-coverage-index-v1.schema.json",
+  "schemas/fleet-discovery-v1.schema.json",
+  "schemas/fleet-manifest-v1.schema.json",
+  "schemas/fleet-root-registry-v1.schema.json",
+  "schemas/human-status-v1.schema.json",
+  "schemas/owner-authority-trust-v1.schema.json",
+  "schemas/owner-migration-authority-v1.schema.json",
+  "schemas/owner-migration-authority-v2.schema.json",
+  "schemas/owner-deployment-authority-v1.schema.json",
+  "schemas/owner-deployment-authority-v2.schema.json",
+  "schemas/owner-deployment-decision-v1.schema.json",
+  "schemas/profile-apply-receipt-v1.schema.json",
+  "schemas/profile-detection-v2.schema.json",
   "schemas/project-config.schema.json",
   "schemas/project-config-v2.schema.json",
   "schemas/profiles.schema.json",
+  "schemas/remote-deployment-manifest-v1.schema.json",
+  "schemas/remote-deployment-result-v1.schema.json",
+  "schemas/remote-deployment-stage-journal-v1.schema.json",
+  "schemas/remote-target-v1.schema.json",
   "schemas/resume-attempt-v1.schema.json",
   "schemas/resume-request-v1.schema.json",
   "schemas/resource-preflight-request-v1.schema.json",
@@ -70,7 +111,9 @@ const CORE_FILES = [
   "schemas/replayable-evidence-v1.schema.json",
   "schemas/finalize-request-v1.schema.json",
   "schemas/ready-for-commit-v1.schema.json",
+  "schemas/ready-for-commit-v2.schema.json",
   "schemas/snapshot-v1.schema.json",
+  "schemas/source-candidate-v2.schema.json",
   "schemas/visual-smoke-request-v1.schema.json",
   "schemas/visual-smoke-result-v1.schema.json",
   "schemas/verification-context-v1.schema.json",
@@ -80,11 +123,20 @@ const CORE_FILES = [
   "schemas/verification-receipt-v2.schema.json",
   "schemas/verify-plan-request-v1.schema.json",
   "templates/goal-contract.json",
+  "templates/assurance-request.json",
+  "templates/core-successor-owner-authority.json",
+  "templates/owner-authority-trust.json",
   "templates/coverage-adopt-request.json",
+  "templates/deployment-execute-request.json",
+  "templates/deployment-owner-authority.json",
+  "templates/deployment-owner-decision.json",
+  "templates/fleet-manifest.json",
+  "templates/fleet-root-registry.json",
   "templates/finalize-request.json",
   "templates/ready-for-commit-request.json",
   "templates/resume-request.json",
   "templates/resource-preflight-request.json",
+  "templates/remote-deployment-manifest.json",
   "templates/snapshot-request.json",
   "templates/visual-smoke-request.json",
   "templates/verify-plan-request.json",
@@ -125,6 +177,80 @@ function atomicWriteJson(filePath, value) {
   renameSync(temporaryPath, filePath);
 }
 
+function pathEntryExists(filePath) {
+  try {
+    lstatSync(filePath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function canonicalWorkspaceRoot(workspaceRoot) {
+  const requested = resolve(workspaceRoot);
+  const stat = lstatSync(requested);
+  if (
+    stat.isSymbolicLink()
+    || !stat.isDirectory()
+  ) {
+    throw new Error("workspaceRoot must be a real directory.");
+  }
+  return realpathSync(requested);
+}
+
+function ensureRealDirectory(root, target, label) {
+  const remainder = relative(root, target);
+  if (
+    remainder === ""
+    || remainder === ".."
+    || remainder.startsWith(`..${sep}`)
+    || isAbsolute(remainder)
+  ) {
+    throw new Error(`${label} escapes the workspace.`);
+  }
+  let current = root;
+  for (const segment of remainder.split(/[\\/]/u)) {
+    current = resolve(current, segment);
+    if (!pathEntryExists(current)) {
+      try {
+        mkdirSync(current);
+      } catch (error) {
+        if (error?.code !== "EEXIST") throw error;
+      }
+    }
+    const stat = lstatSync(current);
+    if (
+      stat.isSymbolicLink()
+      || !stat.isDirectory()
+      || realpathSync(current) !== current
+    ) {
+      throw new Error(`${label} must be a real directory without symlink ancestors.`);
+    }
+  }
+  return target;
+}
+
+function assertRegularRuntimeFile(root, filePath, label) {
+  const remainder = relative(root, filePath);
+  if (
+    remainder === ""
+    || remainder === ".."
+    || remainder.startsWith(`..${sep}`)
+    || isAbsolute(remainder)
+  ) {
+    throw new Error(`${label} escapes the workspace.`);
+  }
+  const stat = lstatSync(filePath);
+  if (
+    stat.isSymbolicLink()
+    || !stat.isFile()
+    || realpathSync(filePath) !== filePath
+  ) {
+    throw new Error(`${label} must be a regular file without symlink ancestors.`);
+  }
+}
+
 function projectConfig(core = currentCoreIdentity()) {
   return {
     schemaVersion: "OwlCodaRunKitConfigV2",
@@ -169,7 +295,11 @@ function migrateProjectConfig({ runtimeRoot, configPath, config, migration }) {
     authorizationGranted: false,
   };
   const receiptsRoot = resolve(runtimeRoot, "config-migration-receipts");
-  mkdirSync(receiptsRoot, { recursive: true });
+  ensureRealDirectory(
+    runtimeRoot,
+    receiptsRoot,
+    "Config migration receipt directory",
+  );
   const receiptName = writeMigrationReceiptAppendOnly(
     receiptsRoot,
     migrationReceiptName(migration, config.core, next.core),
@@ -183,17 +313,17 @@ function coreDirectory() {
   return resolve(fileURLToPath(new URL(".", import.meta.url)));
 }
 
-function coreManifestStream() {
-  const coreRoot = coreDirectory();
-  const projectRoot = resolve(coreRoot, "../..");
+function coreManifestStreamFromRoots(coreRoot, projectRoot) {
   return [
     ...CORE_FILES.map((name) => `${name}\tsha256:${sha256(readFileSync(resolve(coreRoot, name)))}\n`),
     ...CORE_DEPENDENCY_FILES.map((name) => `${name}\tsha256:${sha256(readFileSync(resolve(projectRoot, name)))}\n`),
   ].join("");
 }
 
-export function currentCoreIdentity() {
-  const manifestSha256 = sha256(coreManifestStream());
+export function coreIdentityFromSourceRoot(sourceRoot) {
+  const projectRoot = realpathSync(sourceRoot);
+  const coreRoot = resolve(projectRoot, "scripts/runkit-contract");
+  const manifestSha256 = sha256(coreManifestStreamFromRoots(coreRoot, projectRoot));
   return {
     contractVersion: CONTRACT_VERSION,
     coreVersion: CORE_VERSION,
@@ -202,6 +332,10 @@ export function currentCoreIdentity() {
   };
 }
 
+export function currentCoreIdentity() {
+  return coreIdentityFromSourceRoot(resolve(coreDirectory(), "../.."));
+}
+
 export function isDirectExecution(moduleUrl, argvPath = process.argv[1]) {
   if (!argvPath) return false;
   try {
@@ -234,9 +368,15 @@ export function validateLeaseOwnedPaths(paths) {
 
 export function validateExecutionPin({ expected, actual } = {}) {
   const fields = ["contractVersion", "coreVersion", "coreManifestSha256", "coreSourceRef"];
-  const malformed = fields.filter((field) => typeof expected?.[field] !== "string" || typeof actual?.[field] !== "string");
-  if (malformed.length > 0) {
-    return { status: "invalid_input", exitCode: 3, issues: malformed.map((field) => `missing engine pin field: ${field}`) };
+  try {
+    validateCoreIdentity(expected, { requireSourceBinding: false });
+    validateCoreIdentity(actual, { requireSourceBinding: false });
+  } catch (error) {
+    return {
+      status: "invalid_input",
+      exitCode: 3,
+      issues: [error instanceof Error ? `invalid engine pin: ${error.message}` : String(error)],
+    };
   }
   const issues = fields.filter((field) => expected[field] !== actual[field]).map((field) => `${field} changed during execution`);
   return issues.length === 0
@@ -244,11 +384,27 @@ export function validateExecutionPin({ expected, actual } = {}) {
     : { status: "engine_changed_during_execution", exitCode: 2, issues };
 }
 
-function validateCoreIdentity(core) {
+function validateCoreIdentity(core, { requireSourceBinding = true } = {}) {
   if (!isRecord(core)) throw new Error("Core identity must be an object.");
+  const coreKeys = ["contractVersion", "coreManifestSha256", "coreSourceRef", "coreVersion"];
+  const unsupportedCoreKeys = Object.keys(core).filter(key => !coreKeys.includes(key));
+  if (unsupportedCoreKeys.length > 0) {
+    throw new Error(`Core identity contains unsupported field: ${unsupportedCoreKeys[0]}`);
+  }
   if (typeof core.contractVersion !== "string" || typeof core.coreVersion !== "string") throw new Error("Core identity requires contractVersion and coreVersion.");
+  if (!new Set(["0.1", CONTRACT_VERSION]).has(core.contractVersion)) {
+    throw new Error("Core identity contractVersion must be a supported RunKit contract version.");
+  }
+  if (!/^\d+\.\d+\.\d+$/u.test(core.coreVersion)) {
+    throw new Error("Core identity coreVersion must be a three-part semantic version.");
+  }
   if (!isSha256Ref(core.coreManifestSha256)) throw new Error("Core identity requires coreManifestSha256.");
-  if (typeof core.coreSourceRef !== "string" || core.coreSourceRef.length === 0) throw new Error("Core identity requires coreSourceRef.");
+  if (typeof core.coreSourceRef !== "string" || core.coreSourceRef.length === 0) {
+    throw new Error("Core identity coreSourceRef must be a non-empty string.");
+  }
+  if (requireSourceBinding && core.coreSourceRef !== `artifact:${core.coreManifestSha256}`) {
+    throw new Error("Core identity coreSourceRef must bind coreManifestSha256.");
+  }
 }
 
 export function validateProjectConfigV2(config) {
@@ -281,102 +437,36 @@ export function validateProjectConfigV2(config) {
   }
 }
 
-export function inspectProjectUpgradeSafety({ workspaceRoot } = {}) {
-  if (typeof workspaceRoot !== "string" || workspaceRoot.length === 0) {
-    throw new Error("workspaceRoot is required.");
-  }
-  const root = realpathSync(workspaceRoot);
-  const executionsRoot = resolve(root, RUNTIME_ROOT, "executions");
-  if (!existsSync(executionsRoot)) {
-    return {
-      status: "safe",
-      activeRunIds: [],
-      activeLeaseIds: [],
-      issues: [],
-    };
-  }
-  const executionsStat = lstatSync(executionsRoot);
-  if (executionsStat.isSymbolicLink() || !executionsStat.isDirectory()) {
-    return {
-      status: "unsafe",
-      activeRunIds: [],
-      activeLeaseIds: [],
-      issues: ["RunKit executions root must be a regular directory."],
-    };
-  }
-  const activeRunIds = [];
-  const activeLeaseIds = [];
-  const issues = [];
-  const entries = readdirSync(executionsRoot, { withFileTypes: true })
-    .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-  for (const entry of entries) {
-    if (entry.isSymbolicLink()) {
-      issues.push(`Execution directory must not be a symlink: ${entry.name}`);
-      continue;
-    }
-    if (!entry.isDirectory()) continue;
-    const executionRoot = resolve(executionsRoot, entry.name);
-    const closeoutPath = resolve(executionRoot, "closeout-receipt.json");
-    if (!existsSync(closeoutPath)) {
-      activeRunIds.push(entry.name);
-    } else {
-      const closeoutStat = lstatSync(closeoutPath);
-      if (closeoutStat.isSymbolicLink() || !closeoutStat.isFile()) {
-        issues.push(`Closeout receipt must be a regular file: ${entry.name}`);
-      } else {
-        try {
-          const closeout = JSON.parse(readFileSync(closeoutPath, "utf8"));
-          if (closeout?.artifact?.payload?.runId !== entry.name) {
-            issues.push(`Closeout receipt runId mismatch: ${entry.name}`);
-          }
-        } catch {
-          issues.push(`Closeout receipt is invalid JSON: ${entry.name}`);
-        }
-      }
-    }
-    const leasesRoot = resolve(executionRoot, "leases");
-    if (!existsSync(leasesRoot)) continue;
-    const leasesStat = lstatSync(leasesRoot);
-    if (leasesStat.isSymbolicLink() || !leasesStat.isDirectory()) {
-      issues.push(`Lease directory must be a regular directory: ${entry.name}`);
-      continue;
-    }
-    const leaseEntries = readdirSync(leasesRoot, { withFileTypes: true })
-      .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-    for (const leaseEntry of leaseEntries) {
-      if (!leaseEntry.name.endsWith(".json")) continue;
-      if (leaseEntry.isSymbolicLink() || !leaseEntry.isFile()) {
-        issues.push(`Lease artifact must be a regular file: ${entry.name}/${leaseEntry.name}`);
-        continue;
-      }
-      try {
-        const lease = JSON.parse(readFileSync(resolve(leasesRoot, leaseEntry.name), "utf8"));
-        if (lease.state === "active") {
-          activeLeaseIds.push(`${entry.name}:${lease.workItemId ?? leaseEntry.name}`);
-        } else if (lease.state !== "released") {
-          issues.push(`Lease state is invalid: ${entry.name}/${leaseEntry.name}`);
-        }
-      } catch {
-        issues.push(`Lease artifact is invalid JSON: ${entry.name}/${leaseEntry.name}`);
-      }
-    }
-  }
+function projectControlParserContract() {
   return {
-    status: activeRunIds.length === 0
-      && activeLeaseIds.length === 0
-      && issues.length === 0
-      ? "safe"
-      : "unsafe",
-    activeRunIds,
-    activeLeaseIds,
-    issues,
+    runtimeRoot: RUNTIME_ROOT,
+    acceptedCloseoutVerificationIssues,
+    validateCoreArtifact,
+    validateExecutionPin,
+    validateLeaseOwnedPaths,
   };
 }
 
+export function inspectProjectUpgradeSafety({ workspaceRoot } = {}) {
+  return parseProjectControlState({
+    workspaceRoot,
+    currentCore: currentCoreIdentity(),
+    contract: projectControlParserContract(),
+  }).upgradeSafety;
+}
+
 function validateProducer(producer) {
   if (!isRecord(producer) || typeof producer.adapterKind !== "string" || typeof producer.adapterVersion !== "string") {
     throw new Error("Producer requires adapterKind and adapterVersion.");
   }
+  if (producer.adapterKind.length === 0 || producer.adapterVersion.length === 0) {
+    throw new Error("Producer adapterKind and adapterVersion must be non-empty strings.");
+  }
+  const producerKeys = ["adapterKind", "adapterVersion"];
+  const unsupportedProducerKeys = Object.keys(producer).filter(key => !producerKeys.includes(key));
+  if (unsupportedProducerKeys.length > 0) {
+    throw new Error(`Producer contains unsupported field: ${unsupportedProducerKeys[0]}`);
+  }
 }
 
 function validateExtensions(extensions) {
@@ -416,7 +506,18 @@ export function createCoreArtifact({ core = currentCoreIdentity(), producer, pay
 export function validateCoreArtifact(artifact) {
   try {
     if (!isRecord(artifact) || !new Set(["RunKitCoreArtifactV1", "RunKitCoreArtifactV2"]).has(artifact.schemaVersion)) throw new Error("Unsupported core artifact schemaVersion.");
+    const artifactKeys = ["core", "extensions", "payload", "producer", "schemaVersion"];
+    const unsupportedArtifactKeys = Object.keys(artifact).filter(key => !artifactKeys.includes(key));
+    if (unsupportedArtifactKeys.length > 0) {
+      throw new Error(`Core artifact contains unsupported field: ${unsupportedArtifactKeys[0]}`);
+    }
     validateCoreIdentity(artifact.core);
+    const expectedContractVersion = artifact.schemaVersion === "RunKitCoreArtifactV1"
+      ? "0.1"
+      : CONTRACT_VERSION;
+    if (artifact.core.contractVersion !== expectedContractVersion) {
+      throw new Error(`Core artifact ${artifact.schemaVersion} requires contractVersion ${expectedContractVersion}.`);
+    }
     validateProducer(artifact.producer);
     if (!isRecord(artifact.payload)) throw new Error("Core artifact payload must be an object.");
     validateExtensions(artifact.extensions);
@@ -429,12 +530,26 @@ export function validateCoreArtifact(artifact) {
 export function acceptedCloseoutVerificationIssues(artifact) {
   if (artifact?.core?.contractVersion !== "0.2" || artifact?.payload?.decision !== "accepted") return [];
   const verification = artifact.payload.verification;
+  const sourceArtifactValid = verification?.sourceArtifact === undefined
+    || (
+      isRecord(verification.sourceArtifact)
+      && new Set(["delivery_packet_v1", "source_candidate_v2"])
+        .has(verification.sourceArtifact.kind)
+      && verification.sourceArtifact.runId === artifact.payload.runId
+      && typeof verification.sourceArtifact.path === "string"
+      && verification.sourceArtifact.path.length > 0
+      && typeof verification.sourceArtifact.sha256 === "string"
+      && /^[a-f0-9]{64}$/.test(verification.sourceArtifact.sha256)
+      && verification.sourceArtifact.sourceFingerprint
+        === verification.sourceFingerprint
+    );
   const validFields = [
     verification?.contractVersion === "0.2",
     verification?.gateDecision === "accepted_passed",
     typeof verification?.gateInputSha256 === "string" && /^[a-f0-9]{64}$/.test(verification.gateInputSha256),
     typeof verification?.activeReceiptSha256 === "string" && /^[a-f0-9]{64}$/.test(verification.activeReceiptSha256),
     typeof verification?.sourceFingerprint === "string" && /^[a-f0-9]{64}$/.test(verification.sourceFingerprint),
+    sourceArtifactValid,
     typeof verification?.verificationContextFingerprint === "string" && /^[a-f0-9]{64}$/.test(verification.verificationContextFingerprint),
     verification?.leaseState === "released",
     Array.isArray(verification?.selectedProfileIds)
@@ -450,15 +565,27 @@ export function acceptedCloseoutVerificationIssues(artifact) {
 
 export async function initializeProjectRunKit({ workspaceRoot } = {}) {
   if (typeof workspaceRoot !== "string" || workspaceRoot.length === 0) throw new Error("workspaceRoot is required.");
-  const root = realpathSync(workspaceRoot);
-  if (existsSync(resolve(root, ".owlrunkit"))) throw new Error("Legacy .owlrunkit exists; explicit migration is required before initialization.");
+  const root = canonicalWorkspaceRoot(workspaceRoot);
+  if (pathEntryExists(resolve(root, ".owlrunkit"))) throw new Error("Legacy .owlrunkit exists; explicit migration is required before initialization.");
   const runtimeRoot = resolve(root, RUNTIME_ROOT);
-  const remainder = relative(root, runtimeRoot);
-  if (remainder.startsWith("..") || isAbsolute(remainder)) throw new Error("Runtime root escapes the workspace.");
+  ensureRealDirectory(root, resolve(root, ".owlcoda"), "OwlCoda control directory");
+  ensureRealDirectory(root, runtimeRoot, "RunKit runtime directory");
+  ensureRealDirectory(
+    runtimeRoot,
+    resolve(runtimeRoot, "executions"),
+    "RunKit executions directory",
+  );
   const configPath = resolve(runtimeRoot, "config.json");
   const profilesPath = resolve(runtimeRoot, "profiles.json");
-  if (!existsSync(configPath)) {
-    mkdirSync(resolve(runtimeRoot, "executions"), { recursive: true });
+  const configExists = pathEntryExists(configPath);
+  const profilesExist = pathEntryExists(profilesPath);
+  if (configExists) {
+    assertRegularRuntimeFile(runtimeRoot, configPath, "Project config");
+  }
+  if (profilesExist) {
+    assertRegularRuntimeFile(runtimeRoot, profilesPath, "Project profiles");
+  }
+  if (!configExists) {
     atomicWriteJson(configPath, projectConfig());
   } else {
     const config = JSON.parse(readFileSync(configPath, "utf8"));
@@ -486,8 +613,11 @@ export async function initializeProjectRunKit({ workspaceRoot } = {}) {
         config,
         migration: "config-v01-to-v02",
       });
-      if (!existsSync(profilesPath)) {
-        writeFileSync(profilesPath, `${JSON.stringify({ schemaVersion: "OwlCodaRunKitProfilesV1", profiles: [] }, null, 2)}\n`);
+      if (!profilesExist) {
+        atomicWriteJson(profilesPath, {
+          schemaVersion: "OwlCodaRunKitProfilesV1",
+          profiles: [],
+        });
       }
       return { status: "upgraded", exitCode: 0, runtimeRoot: RUNTIME_ROOT, core: current, migrationReceipt };
     } else if (config.schemaVersion === "OwlCodaRunKitConfigV2" && config.core?.contractVersion === CONTRACT_VERSION) {
@@ -507,17 +637,22 @@ export async function initializeProjectRunKit({ workspaceRoot } = {}) {
         config,
         migration: "config-v02-core-refresh",
       });
-      if (!existsSync(profilesPath)) {
-        writeFileSync(profilesPath, `${JSON.stringify({ schemaVersion: "OwlCodaRunKitProfilesV1", profiles: [] }, null, 2)}\n`);
+      if (!profilesExist) {
+        atomicWriteJson(profilesPath, {
+          schemaVersion: "OwlCodaRunKitProfilesV1",
+          profiles: [],
+        });
       }
       return { status: "upgraded", exitCode: 0, runtimeRoot: RUNTIME_ROOT, core: current, migrationReceipt };
     } else {
       throw new Error(`Unsupported project config migration: ${config.schemaVersion ?? "missing schemaVersion"}.`);
     }
   }
-  mkdirSync(resolve(runtimeRoot, "executions"), { recursive: true });
-  if (!existsSync(profilesPath)) {
-    writeFileSync(profilesPath, `${JSON.stringify({ schemaVersion: "OwlCodaRunKitProfilesV1", profiles: [] }, null, 2)}\n`);
+  if (!profilesExist) {
+    atomicWriteJson(profilesPath, {
+      schemaVersion: "OwlCodaRunKitProfilesV1",
+      profiles: [],
+    });
   }
   return { status: "initialized", exitCode: 0, runtimeRoot: RUNTIME_ROOT, core: currentCoreIdentity() };
 }