owlrunkit 0.18.3 → 0.19.0

package/scripts/runkit-contract/outcome-presentation.mjs

@@ -0,0 +1,171 @@
+const RUNTIME_LEVEL_BY_DECISION = Object.freeze({
+  external_transition_passed: "reported_passed",
+  external_transition_failed_recovered: "reported_failed_recovered",
+  external_transition_failed_unrecovered: "reported_failed_unrecovered",
+  external_transition_indeterminate: "reported_indeterminate",
+  external_transition_invalidated: "reported_indeterminate",
+});
+
+function verificationLevel(result) {
+  const status = result.quickVerificationStatus ?? result.status;
+  if (status === "quick_verification_passed") return "passed";
+  if (status === "quick_verification_failed") return "failed";
+  if (status === "quick_verification_source_mutated") return "invalidated";
+  return "not_proven";
+}
+
+function workspaceLevel(result) {
+  if (result.mutationDecision === "source_unchanged") return "unchanged";
+  if (typeof result.mutationDecision === "string") return "changed";
+  return "not_proven";
+}
+
+function candidateLevel(result) {
+  if (result.attestationDecision === "NO_GO") return "not_proven";
+  const verification = verificationLevel(result);
+  if (verification === "invalidated" || workspaceLevel(result) === "changed") {
+    return "invalidated";
+  }
+  return typeof result.receiptPath === "string" && workspaceLevel(result) === "unchanged"
+    ? "bound"
+    : "not_proven";
+}
+
+function runtimeLevel(result) {
+  const transition = result.runtimeTransition;
+  if (!transition || transition.status === "runtime_transition_invalid") return "not_proven";
+  return RUNTIME_LEVEL_BY_DECISION[transition.transitionDecision] ?? "reported_indeterminate";
+}
+
+function resultDecision(result) {
+  if (candidateLevel(result) === "invalidated") return "invalidated";
+  if (result.attestationDecision === "NO_GO"
+    || [
+      "quick_verification_control_invalid",
+      "quick_verification_input_invalid",
+      "quick_verification_runtime_truth_invalid",
+    ].includes(result.status)) {
+    return "indeterminate";
+  }
+  const verification = verificationLevel(result);
+  if (verification === "passed") return "pass";
+  if (verification === "failed") return "fail";
+  return "indeterminate";
+}
+
+function headline(result, acceptanceLevels) {
+  const decision = resultDecision(result);
+  if (decision === "invalidated") {
+    return "The verification candidate was invalidated by a workspace or execution-environment change.";
+  }
+  if (decision === "fail") {
+    return "The exact verification command failed for the bound source candidate.";
+  }
+  if (decision === "indeterminate") {
+    return "RunKit did not establish a reusable verification result.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_failed_recovered") {
+    return "Verification passed, and the exact command reported a failed external transition with successful rollback.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_failed_unrecovered") {
+    return "Verification passed, but the exact command reported an unrecovered external transition failure.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_passed") {
+    return "Verification passed, and the exact command reported a successful external transition.";
+  }
+  return "The exact verification command passed for the bound source candidate.";
+}
+
+export function projectQuickOutcomeV1(result) {
+  const acceptanceLevels = {
+    candidateIdentity: candidateLevel(result),
+    workspaceAttestation: workspaceLevel(result),
+    verificationCommand: verificationLevel(result),
+    productExperience: "not_proven",
+    deploymentRuntime: runtimeLevel(result),
+    productionBusiness: "not_proven",
+  };
+  const proven = [];
+  if (acceptanceLevels.candidateIdentity === "bound") {
+    proven.push("Quick evidence binds the exact command to the captured source candidate.");
+  }
+  if (acceptanceLevels.workspaceAttestation === "unchanged") {
+    proven.push("The bound workspace state remained unchanged during the command.");
+  }
+  if (acceptanceLevels.verificationCommand === "passed") {
+    proven.push("The exact verification command exited successfully.");
+  } else if (acceptanceLevels.verificationCommand === "failed") {
+    proven.push("The exact verification command failure was preserved.");
+  }
+  if (result.attestationDecision === "GO") {
+    proven.push("The Quick receipt attestation decision is GO.");
+  }
+  if (acceptanceLevels.deploymentRuntime !== "not_proven") {
+    proven.push("The exact command supplied a bounded external-runtime transition report.");
+  }
+  const notProven = [
+    ...(result.attestationDecision === "NO_GO"
+      ? ["Quick attestation did not establish a reusable candidate binding."]
+      : []),
+    "Product or UX acceptance was not performed by Quick Verification.",
+    ...(acceptanceLevels.deploymentRuntime === "not_proven"
+      ? ["Deployment or runtime activation was not proven."]
+      : ["RunKit did not independently observe the external runtime beyond the exact command report."]),
+    "Production or business effectiveness was not proven.",
+    "No Git, release, deployment, production, or business authority was granted.",
+  ];
+  return {
+    schemaVersion: "OwlCodaRunKitOutcomeSummaryV1",
+    result: resultDecision(result),
+    headline: headline(result, acceptanceLevels),
+    proofLevel: typeof result.receiptPath === "string"
+      ? "captured_verification"
+      : "no_reusable_evidence",
+    acceptanceLevels,
+    proven,
+    notProven,
+    nextAction: typeof result.nextAllowedAction === "string"
+      ? result.nextAllowedAction
+      : "inspect_result",
+    authorizationGranted: false,
+  };
+}
+
+function display(value) {
+  return value.replaceAll("_", " ");
+}
+
+function humanNextAction(nextAction) {
+  if (nextAction.includes(" quick-attest ")) return "Attest this Quick result.";
+  const friendly = {
+    consume_attestation: "Use the attested verification evidence at the next named gate.",
+    inspect_attestation_issues: "Inspect the attestation issues before relying on this result.",
+    inspect_output_and_rerun: "Inspect the failed command output, repair the cause, and rerun.",
+    restore_source_or_run_a_new_quick_verification: "Restore or freeze the intended candidate, then run a new verification.",
+    repair_runtime_report_and_run_a_new_quick_verification: "Repair the runtime report and run a new verification.",
+  };
+  return friendly[nextAction] ?? nextAction.replaceAll("_", " ");
+}
+
+export function formatQuickOutcomeHumanV1(outcome) {
+  const label = {
+    pass: "PASS",
+    fail: "FAIL",
+    invalidated: "INVALIDATED",
+    indeterminate: "INDETERMINATE",
+  }[outcome.result];
+  const levels = outcome.acceptanceLevels;
+  return [
+    `Result: ${label} — ${outcome.headline}`,
+    `Proved: ${outcome.proven.length > 0 ? outcome.proven.join(" ") : "No reusable verification claim."}`,
+    "Acceptance: "
+      + `Candidate: ${display(levels.candidateIdentity)}; `
+      + `workspace: ${display(levels.workspaceAttestation)}; `
+      + `verification: ${display(levels.verificationCommand)}; `
+      + "Product/UX: not proven; "
+      + `Deployment/runtime: ${display(levels.deploymentRuntime)}; `
+      + "Production/business: not proven.",
+    `Next: ${humanNextAction(outcome.nextAction)}`,
+    "Authority: no Git, release, deployment, production, or business authority granted.",
+  ].join("\n");
+}

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   existsSync,
@@ -765,7 +766,7 @@ function bindCommandsToProjectTool(profiles, toolBinding) {
   }));
 }
 
-function proposedProfileDocument(candidates, inputManifest) {
+function proposedProfileDocument(candidates, inputManifest, detectedSurfacePaths = []) {
   const actionable = candidates.filter(profile => profile.commands.length > 0);
   const selectedPrimary = actionable.find(profile => profile.id === "node-quality")
     ?? actionable[0]
@@ -779,13 +780,162 @@ function proposedProfileDocument(candidates, inputManifest) {
       ...profile,
       paths: [...new Set([
         ...profile.paths,
-        ...(profile.id === selectedPrimary?.id ? rootSurfacePaths : []),
+        ...(profile.id === selectedPrimary?.id
+          ? [...rootSurfacePaths, ...detectedSurfacePaths]
+          : []),
       ])].sort(),
       primary: profile.id === selectedPrimary?.id,
     })),
   };
 }
 
+function visibleGitChangedPaths(root) {
+  try {
+    const gitRoot = realpathSync(execFileSync(
+      "git",
+      ["rev-parse", "--show-toplevel"],
+      {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      },
+    ).trim());
+    const workspacePrefix = path.relative(gitRoot, root).split(path.sep).join("/");
+    if (workspacePrefix.startsWith("../") || workspacePrefix === "..") {
+      return { paths: [], issueCodes: ["profile_git_root_unusable"] };
+    }
+    const normalizeGitPath = (filePath) => {
+      const normalized = filePath.split(path.sep).join("/");
+      if (!workspacePrefix) return normalized;
+      const prefix = `${workspacePrefix}/`;
+      return normalized.startsWith(prefix) ? normalized.slice(prefix.length) : null;
+    };
+    const raw = execFileSync(
+      "git",
+      ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."],
+      {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      },
+    );
+    const fields = raw.split("\0");
+    const paths = [];
+    for (let index = 0; index < fields.length; index += 1) {
+      const field = fields[index];
+      if (!field) continue;
+      const status = field.slice(0, 2);
+      const currentPath = normalizeGitPath(field.slice(3));
+      let priorPath = null;
+      if (status.includes("R") || status.includes("C")) {
+        const prior = fields[index + 1];
+        if (!prior) return { paths: [], issueCodes: ["profile_git_status_unusable"] };
+        priorPath = normalizeGitPath(prior);
+        index += 1;
+      }
+      if (currentPath === null || (status.includes("R") && priorPath === null)) {
+        return { paths: [], issueCodes: ["profile_git_path_outside_workspace"] };
+      }
+      const changedPaths = status.includes("R") ? [currentPath, priorPath] : [currentPath];
+      for (const filePath of changedPaths) {
+        if (!filePath
+          || filePath === ".owlcoda/runkit"
+          || filePath.startsWith(".owlcoda/runkit/")) continue;
+        try {
+          safeRelativePath(filePath, "profile changed path");
+          paths.push(filePath);
+        } catch {
+          return { paths: [], issueCodes: ["profile_changed_path_unusable"] };
+        }
+      }
+    }
+    return { paths: [...new Set(paths)].sort(), issueCodes: [] };
+  } catch {
+    return { paths: [], issueCodes: ["profile_git_status_unavailable"] };
+  }
+}
+
+function sourceCandidatePath(filePath) {
+  const segments = filePath.split("/");
+  const nonSourceSegments = new Set([
+    ".cache",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".turbo",
+    ".vite",
+    ".vitest",
+    "__pycache__",
+    "node_modules",
+  ]);
+  if (segments.some(segment => nonSourceSegments.has(segment))) return false;
+  if ([".github", ".owlcoda", "docs"].includes(segments[0])) return false;
+  return !/\.(?:md|mdx|rst|txt)$/iu.test(filePath);
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function profileCoveragePlan({ root, proposedProfiles, currentProfilesSha256 }) {
+  const changed = visibleGitChangedPaths(root);
+  const impact = resolveProfileImpactDetailed({
+    changedPaths: changed.paths,
+    profiles: proposedProfiles.profiles,
+  });
+  const uncoveredChangedPaths = [...impact.uncoveredPaths];
+  const uncoveredSourcePaths = uncoveredChangedPaths.filter(sourceCandidatePath);
+  const selectedPrimary = proposedProfiles.profiles.find(profile => profile.primary) ?? null;
+  const primaryBlockers = [];
+  if (selectedPrimary === null) primaryBlockers.push("actionable_primary_profile_missing");
+  if (uncoveredSourcePaths.length > 0) {
+    primaryBlockers.push(
+      `candidate_paths_do_not_cover_changed_source:${uncoveredSourcePaths.join(",")}`,
+    );
+  }
+  const minimalSuggestedProfile = selectedPrimary && uncoveredSourcePaths.length > 0
+    ? {
+        ...structuredClone(selectedPrimary),
+        paths: [...new Set([
+          ...selectedPrimary.paths,
+          ...uncoveredSourcePaths,
+        ])].sort(),
+        primary: true,
+      }
+    : null;
+  const repairedProfiles = minimalSuggestedProfile
+    ? {
+        ...structuredClone(proposedProfiles),
+        profiles: proposedProfiles.profiles.map(profile => (
+          profile.id === minimalSuggestedProfile.id
+            ? structuredClone(minimalSuggestedProfile)
+            : structuredClone(profile)
+        )),
+      }
+    : proposedProfiles;
+  const command = currentProfilesSha256 === null ? "detect" : "reconcile";
+  const workspace = shellQuote(root);
+  return {
+    status: primaryBlockers.length > 0 ? "profiles_insufficient" : "profiles_detected",
+    proposedProfiles: repairedProfiles,
+    changedPaths: changed.paths,
+    uncoveredChangedPaths,
+    uncoveredSourcePaths,
+    primaryBlockers: [...new Set(primaryBlockers)].sort(),
+    minimalSuggestedProfile,
+    repairCommands: {
+      preview: `npx --no-install owlrunkit profiles ${command} --workspace ${workspace} --dry-run`,
+      apply: minimalSuggestedProfile || primaryBlockers.length === 0
+        ? `npx --no-install owlrunkit profiles ${command} --workspace ${workspace} --apply`
+        : null,
+    },
+    issueCodes: changed.issueCodes,
+  };
+}
+
 function profilesFileHash(root) {
   const ref = path.join(root, ".owlcoda", "runkit", "profiles.json");
   if (!existsSync(ref)) return null;
@@ -944,10 +1094,10 @@ function recoverProfileApplyTransaction({
   return receipt;
 }
 
-export function detectProfilesV2({
+function detectProfilesVersion({
   workspaceRoot,
   projectToolResolver,
-} = {}) {
+} = {}, { schemaVersion, includeCoverage }) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   const manifest = readWorkspaceJsonBounded(root, "package.json");
   const discovered = discoverWorkspaces(root, manifest);
@@ -960,6 +1110,23 @@ export function detectProfilesV2({
     toolBinding.packageManager,
     true,
   );
+  const detectedSurfacePaths = includeCoverage
+    ? (() => {
+        const candidateSurfacePaths = new Set(
+          rawCandidates.flatMap(profile => profile.paths),
+        );
+        return profileCandidates(
+          root,
+          manifest,
+          toolBinding.executable,
+          discovered.workspaces,
+          toolBinding.packageManager,
+          true,
+          true,
+        ).flatMap(profile => profile.paths)
+          .filter(profilePath => !candidateSurfacePaths.has(profilePath));
+      })()
+    : [];
   const candidates = bindCommandsToProjectTool(rawCandidates, toolBinding);
   let inputManifest = [];
   const issueCodes = [
@@ -971,21 +1138,44 @@ export function detectProfilesV2({
   } catch (error) {
     issueCodes.push(error instanceof Error ? error.message : String(error));
   }
-  const proposedProfiles = proposedProfileDocument(candidates, inputManifest);
+  const initialProfiles = proposedProfileDocument(
+    candidates,
+    inputManifest,
+    detectedSurfacePaths,
+  );
+  const currentProfilesSha256 = profilesFileHash(root);
+  const coverage = includeCoverage
+    ? profileCoveragePlan({
+        root,
+        proposedProfiles: initialProfiles,
+        currentProfilesSha256,
+      })
+    : {
+        status: "profiles_detected",
+        proposedProfiles: initialProfiles,
+        changedPaths: [],
+        uncoveredChangedPaths: [],
+        uncoveredSourcePaths: [],
+        primaryBlockers: [],
+        minimalSuggestedProfile: null,
+        repairCommands: null,
+        issueCodes: [],
+      };
+  const proposedProfiles = coverage.proposedProfiles;
+  issueCodes.push(...coverage.issueCodes);
   issueCodes.push(...validateProfileDocument(proposedProfiles));
   const qualityIssues = [...new Set(issueCodes)].sort();
   const confidence = qualityIssues.length === 0 && toolBinding.confidence === "high"
     ? "high"
     : "review_required";
-  const currentProfilesSha256 = profilesFileHash(root);
   const applyStatus = currentProfilesSha256 !== null
     ? "profiles_already_exists"
     : confidence === "high"
       ? "ready_to_apply"
       : "review_required";
   const body = {
-    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
-    status: "profiles_detected",
+    schemaVersion,
+    status: coverage.status,
     dryRun: true,
     writesPerformed: 0,
     confidence,
@@ -1009,6 +1199,16 @@ export function detectProfilesV2({
     currentProfilesSha256,
     detectedScripts: detectedScripts(manifest),
     detectedWorkspaces: discovered.workspaces,
+    ...(includeCoverage
+      ? {
+          changedPaths: coverage.changedPaths,
+          uncoveredChangedPaths: coverage.uncoveredChangedPaths,
+          uncoveredSourcePaths: coverage.uncoveredSourcePaths,
+          primaryBlockers: coverage.primaryBlockers,
+          minimalSuggestedProfile: coverage.minimalSuggestedProfile,
+          repairCommands: coverage.repairCommands,
+        }
+      : {}),
     authorizationGranted: false,
   };
   return {
@@ -1017,6 +1217,20 @@ export function detectProfilesV2({
   };
 }
 
+export function detectProfilesV2(input = {}) {
+  return detectProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
+    includeCoverage: false,
+  });
+}
+
+export function detectProfilesV3(input = {}) {
+  return detectProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    includeCoverage: true,
+  });
+}
+
 function blockedApply(detection, issueCodes, currentProfilesSha256 = null) {
   return {
     schemaVersion: "OwlCodaRunKitProfilesApplyReceiptV1",
@@ -1032,13 +1246,19 @@ function blockedApply(detection, issueCodes, currentProfilesSha256 = null) {
 function verifyDetectionInputs(
   root,
   detection,
-  { allowedApplyStatuses = ["ready_to_apply"] } = {},
+  {
+    allowedApplyStatuses = ["ready_to_apply"],
+    schemaVersion = "OwlCodaRunKitProfileDetectionV2",
+    checkChangedPaths = false,
+  } = {},
 ) {
   const issues = [];
   const { detectionSha256, ...body } = detection;
   if (
-    detection.schemaVersion !== "OwlCodaRunKitProfileDetectionV2"
-    || detection.status !== "profiles_detected"
+    detection.schemaVersion !== schemaVersion
+    || !(schemaVersion === "OwlCodaRunKitProfileDetectionV3"
+      ? ["profiles_detected", "profiles_insufficient"].includes(detection.status)
+      : detection.status === "profiles_detected")
     || !/^[a-f0-9]{64}$/.test(detectionSha256 ?? "")
     || sha256(canonicalJson(body)) !== detectionSha256
   ) {
@@ -1073,13 +1293,22 @@ function verifyDetectionInputs(
       }
     }
   }
+  if (checkChangedPaths) {
+    const currentChangedPaths = visibleGitChangedPaths(root);
+    issues.push(...currentChangedPaths.issueCodes);
+    if (!Array.isArray(detection.changedPaths)) {
+      issues.push("profile_detection_invalid");
+    } else if (canonicalJson(currentChangedPaths.paths) !== canonicalJson(detection.changedPaths)) {
+      issues.push("profile_detection_changed_paths_drift");
+    }
+  }
   return [...new Set(issues)].sort();
 }
 
-export function applyDetectedProfilesV2({
+function applyDetectedProfilesVersion({
   workspaceRoot,
   detection,
-} = {}) {
+} = {}, { schemaVersion, checkChangedPaths }) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   let currentProfilesSha256;
   try {
@@ -1087,7 +1316,10 @@ export function applyDetectedProfilesV2({
   } catch {
     return blockedApply(detection, ["profile_apply_directory_untrusted"]);
   }
-  const issues = verifyDetectionInputs(root, detection ?? {});
+  const issues = verifyDetectionInputs(root, detection ?? {}, {
+    schemaVersion,
+    checkChangedPaths,
+  });
   if (issues.length > 0) return blockedApply(detection, issues);
 
   const receiptPath = path.join(
@@ -1194,6 +1426,20 @@ export function applyDetectedProfilesV2({
   }
 }
 
+export function applyDetectedProfilesV2(input = {}) {
+  return applyDetectedProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
+    checkChangedPaths: false,
+  });
+}
+
+export function applyDetectedProfilesV3(input = {}) {
+  return applyDetectedProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    checkChangedPaths: true,
+  });
+}
+
 function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
   const profiles = currentProfiles.profiles.map((profile) => structuredClone(profile));
   const byId = new Map(profiles.map((profile) => [profile.id, profile]));
@@ -1344,6 +1590,16 @@ function validateReconcileReceipt(receipt, reconcileSha256) {
   return receiptPath;
 }
 
+function isInitializationProfileScaffold(value) {
+  return value !== null
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && value.schemaVersion === "OwlCodaRunKitProfilesV1"
+    && Array.isArray(value.profiles)
+    && value.profiles.length === 0
+    && Object.keys(value).sort().join(",") === "profiles,schemaVersion";
+}
+
 function recoverProfileReconcileTransaction(root) {
   const runtimeRoot = path.join(root, ".owlcoda", "runkit");
   if (!existsSync(runtimeRoot)) return null;
@@ -1464,6 +1720,7 @@ export function reconcileProfilesV2({
   let currentProfilesSha256;
   let currentProfiles;
   let currentProfilesBytes;
+  let replacesInitializationScaffold = false;
   try {
     currentProfilesSha256 = profilesFileHash(root);
     if (currentProfilesSha256 === null) {
@@ -1477,8 +1734,9 @@ export function reconcileProfilesV2({
       root,
       path.join(".owlcoda", "runkit", "profiles.json"),
     );
+    replacesInitializationScaffold = isInitializationProfileScaffold(currentProfiles);
     const documentIssues = validateProfileDocument(currentProfiles);
-    if (documentIssues.length > 0) {
+    if (documentIssues.length > 0 && !replacesInitializationScaffold) {
       return blockedReconcile(null, documentIssues, currentProfilesSha256, !apply);
     }
   } catch {
@@ -1490,9 +1748,11 @@ export function reconcileProfilesV2({
     );
   }
 
-  const detection = detectProfilesV2({ workspaceRoot: root, projectToolResolver });
+  const detection = detectProfilesV3({ workspaceRoot: root, projectToolResolver });
   const detectionIssues = verifyDetectionInputs(root, detection, {
     allowedApplyStatuses: ["profiles_already_exists"],
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    checkChangedPaths: true,
   });
   if (detection.currentProfilesSha256 !== currentProfilesSha256) {
     detectionIssues.push("profile_reconcile_detection_preimage_mismatch");
@@ -1501,7 +1761,15 @@ export function reconcileProfilesV2({
     return blockedReconcile(detection, detectionIssues, currentProfilesSha256, !apply);
   }
 
-  const merged = mergeDetectedProfiles(currentProfiles, detection.proposedProfiles);
+  const merged = replacesInitializationScaffold
+    ? {
+        proposedProfiles: structuredClone(detection.proposedProfiles),
+        addedProfileIds: detection.proposedProfiles.profiles
+          .map(profile => profile.id)
+          .sort(),
+        updatedProfiles: [],
+      }
+    : mergeDetectedProfiles(currentProfiles, detection.proposedProfiles);
   const proposedIssues = validateProfileDocumentWithDetectedSurfaces(
     root,
     merged.proposedProfiles,

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,15 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.18.4", new Set([
+    "sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d",
+  ])],
+  ["0.18.3", new Set([
+    "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
+  ])],
+  ["0.18.2", new Set([
+    "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+  ])],
   ["0.18.1", new Set([
     "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
   ])],
@@ -602,20 +611,32 @@ function verifyInstalledCoreBinding(root, packageRoot, version) {
   ) {
     throw new Error("project_cli_core_config_invalid");
   }
+  const installedCore = verifyInstalledCoreClosure(packageRoot, version);
+  const actualCoreManifestSha256 = installedCore.coreManifestSha256;
+  if (actualCoreManifestSha256 !== core.coreManifestSha256) {
+    throw new Error("project_cli_installed_core_drift");
+  }
+  return {
+    schemaVersion: "OwlCodaRunKitInstalledCoreBindingV1",
+    coreVersion: version,
+    coreManifestSha256: actualCoreManifestSha256,
+    trustedIdentitySource: installedCore.trustedIdentitySource,
+    configPath: ".owlcoda/runkit/config.json",
+  };
+}
+
+function verifyInstalledCoreClosure(packageRoot, version) {
   const actualCoreManifestSha256 = installedCoreManifestSha256(packageRoot);
   const trusted = trustedCoreManifestHashes(version);
   if (!trusted.hashes.has(actualCoreManifestSha256)) {
     throw new Error("project_cli_untrusted_core_identity");
   }
-  if (actualCoreManifestSha256 !== core.coreManifestSha256) {
-    throw new Error("project_cli_installed_core_drift");
-  }
   return {
     schemaVersion: "OwlCodaRunKitInstalledCoreBindingV1",
     coreVersion: version,
     coreManifestSha256: actualCoreManifestSha256,
     trustedIdentitySource: trusted.source,
-    configPath: ".owlcoda/runkit/config.json",
+    configPath: null,
   };
 }
 
@@ -623,6 +644,7 @@ export function resolveProjectCli({
   workspaceRoot,
   expectedVersion = null,
   requireEntrypoint = true,
+  requireProjectConfig = requireEntrypoint,
 } = {}) {
   let root;
   try {
@@ -686,7 +708,9 @@ export function resolveProjectCli({
       "project_cli_symlink_rejected",
     );
     const installedCoreBinding = requireEntrypoint
-      ? verifyInstalledCoreBinding(root, installed.packageRoot, version)
+      ? requireProjectConfig
+        ? verifyInstalledCoreBinding(root, installed.packageRoot, version)
+        : verifyInstalledCoreClosure(installed.packageRoot, version)
       : null;
     return {
       schemaVersion: "OwlCodaRunKitProjectCliBindingV1",