prae-cli 0.9.2 → 0.10.1

package/lib/{cli-B_B6-bUZ.js → cli-C_6dosaw.js}

@@ -1,456 +1,16 @@
-import { n as hostOf, r as withinAny, t as evaluate } from "./evaluate-BqLxhYiP.js";
-import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-D4UEfbzt.js";
-import { c as fingerprint, g as chain, m as GENESIS, n as readEntries, p as verifySignature, r as verifyEntries, s as verifyBytes, t as Ledger, v as seal } from "./src-LA7NdLKb.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
+import { c as withinAny, i as evaluate, n as FRAMEWORKS, o as hostOf, r as cite, t as parsePack } from "./src-CZYvvEn5.js";
+import { a as verifyEntries, b as seal, g as GENESIS, h as verifySignature, l as verifyBytes, n as Ledger, r as readEntries, t as verifyGrowing, u as fingerprint, v as chain } from "./src-CuiWC80o.js";
+import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-C7DD-Oif.js";
+import { createRequire } from "node:module";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
-import { parse } from "yaml";
 import { homedir } from "node:os";
+import { parse } from "yaml";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
 
-//#region ../kernel/src/pack.ts
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var Check = class {
-	errors = [];
-	fail(path, message) {
-		this.errors.push({
-			path,
-			message
-		});
-	}
-	/** Reject any key the shape does not define. */
-	keys(path, value, allowed) {
-		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
-	}
-	text(path, value) {
-		if (typeof value !== "string" || value.trim() === "") {
-			this.fail(path, "expected a non-empty string");
-			return;
-		}
-		return value;
-	}
-	/** A field that accepts one name or a list of them. */
-	names(path, value) {
-		if (typeof value === "string") return value;
-		if (Array.isArray(value)) {
-			const out = [];
-			value.forEach((entry, index) => {
-				const one = this.text(`${path}[${index}]`, entry);
-				if (one !== void 0) out.push(one);
-			});
-			return out;
-		}
-		this.fail(path, "expected a string or an array of strings");
-	}
-	globs(path, value) {
-		if (!Array.isArray(value)) {
-			this.fail(path, "expected an array of path globs");
-			return;
-		}
-		const out = [];
-		value.forEach((entry, index) => {
-			const one = this.text(`${path}[${index}]`, entry);
-			if (one !== void 0) out.push(one);
-		});
-		return out;
-	}
-	number(path, value) {
-		if (typeof value !== "number" || !Number.isFinite(value)) {
-			this.fail(path, "expected a finite number");
-			return;
-		}
-		return value;
-	}
-};
-function readCommandMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"name",
-		"token",
-		"anyToken",
-		"pipedTo",
-		"pipeline"
-	]);
-	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check$1.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
-	const out = {};
-	if (value.token !== void 0) {
-		const tokens = check$1.names(`${path}.token`, value.token);
-		if (tokens !== void 0) out.token = tokens;
-	}
-	if (value.name !== void 0) {
-		const names = check$1.names(`${path}.name`, value.name);
-		if (names !== void 0) out.name = names;
-	}
-	if (value.anyToken !== void 0) {
-		const tokens = check$1.names(`${path}.anyToken`, value.anyToken);
-		if (tokens !== void 0) out.anyToken = tokens;
-	}
-	if (value.pipedTo !== void 0) {
-		const pipes = check$1.names(`${path}.pipedTo`, value.pipedTo);
-		if (pipes !== void 0) out.pipedTo = pipes;
-	}
-	if (value.pipeline !== void 0) {
-		const shapes = check$1.names(`${path}.pipeline`, value.pipeline);
-		if (shapes !== void 0) out.pipeline = shapes;
-	}
-	return out;
-}
-function readPathMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"arg",
-		"outside",
-		"inside"
-	]);
-	if (value.outside === void 0 && value.inside === void 0) check$1.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check$1.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.outside !== void 0) {
-		const globs = check$1.globs(`${path}.outside`, value.outside);
-		if (globs !== void 0) out.outside = globs;
-	}
-	if (value.inside !== void 0) {
-		const globs = check$1.globs(`${path}.inside`, value.inside);
-		if (globs !== void 0) out.inside = globs;
-	}
-	return out;
-}
-function readHostMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"arg",
-		"in",
-		"notIn"
-	]);
-	if (value.in === void 0 && value.notIn === void 0) check$1.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check$1.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.in !== void 0) {
-		const list = check$1.globs(`${path}.in`, value.in);
-		if (list !== void 0) out.in = list;
-	}
-	if (value.notIn !== void 0) {
-		const list = check$1.globs(`${path}.notIn`, value.notIn);
-		if (list !== void 0) out.notIn = list;
-	}
-	return out;
-}
-function readArgMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"name",
-		"above",
-		"below",
-		"equals",
-		"oneOf",
-		"present"
-	]);
-	const name = check$1.text(`${path}.name`, value.name);
-	if (name === void 0) return void 0;
-	const out = { name };
-	if (value.above !== void 0) {
-		const n = check$1.number(`${path}.above`, value.above);
-		if (n !== void 0) out.above = n;
-	}
-	if (value.below !== void 0) {
-		const n = check$1.number(`${path}.below`, value.below);
-		if (n !== void 0) out.below = n;
-	}
-	if (value.equals !== void 0) out.equals = value.equals;
-	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check$1.fail(`${path}.oneOf`, "expected an array");
-	else out.oneOf = value.oneOf;
-	if (value.present !== void 0) if (typeof value.present !== "boolean") check$1.fail(`${path}.present`, "expected a boolean");
-	else out.present = value.present;
-	return out;
-}
-function readSecretsMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"types",
-		"minConfidence",
-		"atLeast"
-	]);
-	const out = {};
-	if (value.types !== void 0) {
-		const types = check$1.globs(`${path}.types`, value.types);
-		if (types !== void 0) out.types = types;
-	}
-	if (value.minConfidence !== void 0) {
-		const n = check$1.number(`${path}.minConfidence`, value.minConfidence);
-		if (n !== void 0) if (n < 0 || n > 1) check$1.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
-		else out.minConfidence = n;
-	}
-	if (value.atLeast !== void 0) {
-		const n = check$1.number(`${path}.atLeast`, value.atLeast);
-		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check$1.fail(`${path}.atLeast`, "expected an integer of at least 1");
-		else out.atLeast = n;
-	}
-	return out;
-}
-function readMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return {};
-	}
-	check$1.keys(path, value, [
-		"tool",
-		"capability",
-		"plugin",
-		"agent",
-		"command",
-		"path",
-		"host",
-		"arg",
-		"count",
-		"secrets"
-	]);
-	const out = {};
-	for (const key of [
-		"tool",
-		"capability",
-		"plugin",
-		"agent"
-	]) if (value[key] !== void 0) {
-		const names = check$1.names(`${path}.${key}`, value[key]);
-		if (names !== void 0) out[key] = names;
-	}
-	if (value.command !== void 0) {
-		const match = readCommandMatch(check$1, `${path}.command`, value.command);
-		if (match !== void 0) out.command = match;
-	}
-	if (value.path !== void 0) {
-		const match = readPathMatch(check$1, `${path}.path`, value.path);
-		if (match !== void 0) out.path = match;
-	}
-	if (value.host !== void 0) {
-		const match = readHostMatch(check$1, `${path}.host`, value.host);
-		if (match !== void 0) out.host = match;
-	}
-	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check$1.fail(`${path}.arg`, "expected an array of argument matchers");
-	else {
-		const list = [];
-		value.arg.forEach((entry, index) => {
-			const one = readArgMatch(check$1, `${path}.arg[${index}]`, entry);
-			if (one !== void 0) list.push(one);
-		});
-		out.arg = list;
-	}
-	if (value.count !== void 0) if (!isObject(value.count)) check$1.fail(`${path}.count`, "expected an object");
-	else {
-		check$1.keys(`${path}.count`, value.count, ["above"]);
-		const above = check$1.number(`${path}.count.above`, value.count.above);
-		if (above !== void 0) out.count = { above };
-	}
-	if (value.secrets !== void 0) {
-		const match = readSecretsMatch(check$1, `${path}.secrets`, value.secrets);
-		if (match !== void 0) out.secrets = match;
-	}
-	return out;
-}
-function readEffect(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	const kind = value.kind === "hold" ? "ask" : value.kind;
-	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
-		check$1.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
-		return;
-	}
-	check$1.keys(path, value, kind === "correct" ? [
-		"kind",
-		"set",
-		"because"
-	] : ["kind", "because"]);
-	const because = check$1.text(`${path}.because`, value.because);
-	if (because === void 0) return void 0;
-	if (kind === "correct") {
-		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
-			check$1.fail(`${path}.set`, "expected a non-empty object of arguments to set");
-			return;
-		}
-		return {
-			kind,
-			set: value.set,
-			because
-		};
-	}
-	return {
-		kind,
-		because
-	};
-}
-function readRule(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"id",
-		"title",
-		"description",
-		"when",
-		"effect",
-		"frameworks"
-	]);
-	const id = check$1.text(`${path}.id`, value.id);
-	const effect = readEffect(check$1, `${path}.effect`, value.effect);
-	if (value.when === void 0) check$1.fail(`${path}.when`, "expected an object");
-	const when = readMatch(check$1, `${path}.when`, value.when ?? {});
-	if (id === void 0 || effect === void 0) return void 0;
-	const rule = {
-		id,
-		when,
-		effect
-	};
-	if (value.title !== void 0) {
-		const title = check$1.text(`${path}.title`, value.title);
-		if (title !== void 0) rule.title = title;
-	}
-	if (value.description !== void 0) {
-		const description = check$1.text(`${path}.description`, value.description);
-		if (description !== void 0) rule.description = description;
-	}
-	if (value.frameworks !== void 0) {
-		const frameworks = readFrameworks(check$1, `${path}.frameworks`, value.frameworks);
-		if (frameworks !== void 0) rule.frameworks = frameworks;
-	}
-	return rule;
-}
-/**
-* A citation names a framework edition and controls the registry knows. A
-* typo here would be a rule that claims a mapping no view can render, so it
-* is a pack error rather than an ignored key — the same line the rest of the
-* parser takes.
-*/
-function readFrameworks(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object keyed by framework id");
-		return;
-	}
-	const out = {};
-	for (const [framework, controls] of Object.entries(value)) {
-		const known = FRAMEWORKS[framework];
-		if (known === void 0) {
-			check$1.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
-			continue;
-		}
-		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
-			check$1.fail(`${path}.${framework}`, "expected an array of control ids");
-			continue;
-		}
-		const ids = controls;
-		for (const control of ids) if (known.controls[control] === void 0) check$1.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
-		if (ids.length > 0) out[framework] = [...new Set(ids)];
-	}
-	return out;
-}
-/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
-function parsePack(source) {
-	let raw;
-	try {
-		raw = JSON.parse(source);
-	} catch (error) {
-		return {
-			ok: false,
-			errors: [{
-				path: "",
-				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
-			}]
-		};
-	}
-	const check$1 = new Check();
-	if (!isObject(raw)) return {
-		ok: false,
-		errors: [{
-			path: "",
-			message: "expected an object"
-		}]
-	};
-	check$1.keys("", raw, [
-		"prae",
-		"pack",
-		"version",
-		"description",
-		"owner",
-		"baseline",
-		"rules"
-	]);
-	if (raw.prae !== "0.1") check$1.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
-	const name = check$1.text(".pack", raw.pack);
-	const version = check$1.text(".version", raw.version);
-	const description = raw.description === void 0 ? void 0 : check$1.text(".description", raw.description);
-	const owner = raw.owner === void 0 ? void 0 : check$1.text(".owner", raw.owner);
-	let baseline;
-	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check$1.fail(".baseline", "expected an object");
-	else {
-		check$1.keys(".baseline", raw.baseline, ["capabilities"]);
-		const caps = check$1.globs(".baseline.capabilities", raw.baseline.capabilities);
-		if (caps !== void 0) baseline = { capabilities: caps };
-	}
-	const rules = [];
-	if (!Array.isArray(raw.rules)) check$1.fail(".rules", "expected an array");
-	else {
-		const seen = /* @__PURE__ */ new Set();
-		raw.rules.forEach((entry, index) => {
-			const rule = readRule(check$1, `rules[${index}]`, entry);
-			if (rule === void 0) return;
-			if (seen.has(rule.id)) {
-				check$1.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
-				return;
-			}
-			seen.add(rule.id);
-			rules.push(rule);
-		});
-	}
-	if (check$1.errors.length > 0) return {
-		ok: false,
-		errors: check$1.errors
-	};
-	if (name === void 0 || version === void 0) return {
-		ok: false,
-		errors: check$1.errors
-	};
-	return {
-		ok: true,
-		pack: {
-			prae: "0.1",
-			pack: name,
-			version,
-			...description === void 0 ? {} : { description },
-			...owner === void 0 ? {} : { owner },
-			...baseline === void 0 ? {} : { baseline },
-			rules
-		}
-	};
-}
-
-//#endregion
 //#region ../dsh/src/chain.ts
 const STAGES = [
 	{
@@ -707,14 +267,14 @@ function readPackFile(file, policyKey, origin = "workspace") {
 			reason: `invalid YAML: ${e instanceof Error ? e.message : String(e)}`
 		};
 	}
-	const parsed = parsePack(json);
-	if (!parsed.ok) return {
+	const parsed$1 = parsePack(json);
+	if (!parsed$1.ok) return {
 		file,
-		reason: parsed.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")
+		reason: parsed$1.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")
 	};
 	return {
 		file,
-		pack: parsed.pack,
+		pack: parsed$1.pack,
 		origin,
 		sha256,
 		...policyKey === void 0 ? {} : { signedBy: fingerprint(policyKey) }
@@ -809,6 +369,7 @@ function merge(packs, rejected) {
 	};
 	const baseline = packs.find((p) => p.pack.baseline !== void 0)?.pack.baseline;
 	const only = packs.length === 1 ? packs[0] : void 0;
+	const expires = packs.map((p) => p.pack.expires_at).filter((e) => e !== void 0).sort((a, b) => Date.parse(a) - Date.parse(b))[0];
 	return {
 		packs,
 		rejected,
@@ -818,6 +379,7 @@ function merge(packs, rejected) {
 			pack: only?.pack.pack ?? packs.map((p) => p.pack.pack).join("+"),
 			version: only?.pack.version ?? createHash("sha256").update(packs.map((p) => p.sha256).join("")).digest("hex").slice(0, 12),
 			...baseline === void 0 ? {} : { baseline },
+			...expires === void 0 ? {} : { expires_at: expires },
 			rules: packs.flatMap((p) => p.pack.rules)
 		}
 	};
@@ -843,7 +405,7 @@ function row(entry, pack) {
         <div class="call">${esc(call)}</div>
         <div class="actor">${esc(actor)}</div>
         <div class="clause">${esc(entry.rule ?? "—")}${cited}</div>
-        <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}</div>
+        <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}${entry.shadow === true ? " · SHADOW" : ""}</div>
         <div class="seal">${esc(seal(entry))}</div>
       </div>`;
 }
@@ -851,12 +413,14 @@ function renderLedgerView(entries, verification, options) {
 	const counts = {};
 	const packs = /* @__PURE__ */ new Set();
 	const sessions = /* @__PURE__ */ new Set();
+	let shadowed = 0;
 	for (const entry of entries) {
-		counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
+		if (entry.shadow === true) shadowed += 1;
+		else counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
 		packs.add(`${entry.pack.name} ${entry.pack.version}`);
 		if (entry.session !== void 0) sessions.add(entry.session);
 	}
-	const held = entries.filter((e) => e.verdict === "ask");
+	const held = entries.filter((e) => e.verdict === "ask" && e.shadow !== true);
 	const pack = [...packs][0] ?? "—";
 	const now = Date.parse(options.generatedAt);
 	const chainOk = verification.ok;
@@ -866,6 +430,7 @@ function renderLedgerView(entries, verification, options) {
         <div class="meta">${esc([
 		`${sessions.size || 1} session${sessions.size === 1 ? "" : "s"}`,
 		`${entries.length.toLocaleString("en-US")} decisions`,
+		...shadowed === 0 ? [] : [`${shadowed} in shadow mode (recorded, not enforced)`],
 		options.retention === void 0 ? "retention local" : `retention ${options.retention}`
 	].join(" · "))}</div>
       </div>
@@ -1201,16 +766,60 @@ function jsonOrNull(path) {
 		return null;
 	}
 }
-function readLedger(path) {
-	if (!existsSync(path)) return [];
-	const out = [];
-	for (const line of readFileSync(path, "utf8").split("\n")) {
+const parsed = /* @__PURE__ */ new Map();
+function parseLines(text, into) {
+	for (const line of text.split("\n")) {
 		if (line.trim() === "") continue;
 		try {
-			out.push(JSON.parse(line));
+			into.push(JSON.parse(line));
 		} catch {}
 	}
-	return out;
+}
+/**
+* The ledger's rows. A ledger is append-only, so the parse is kept and only
+* the bytes appended since are read: a long demo grows it to tens of
+* thousands of rows, and every endpoint the console polls reads it — parsed
+* whole each time, that kept the server too busy to answer anyone. A file
+* that shrank or was replaced is read again from the start. A half-written
+* last line is left unread until its newline arrives.
+*/
+function readLedger(path) {
+	if (!existsSync(path)) {
+		parsed.delete(path);
+		return [];
+	}
+	const stat$1 = statSync(path);
+	let entry = parsed.get(path);
+	if (entry === void 0 || entry.ino !== stat$1.ino || stat$1.size < entry.size) {
+		entry = {
+			ino: stat$1.ino,
+			size: 0,
+			mtimeMs: 0,
+			offset: 0,
+			rows: []
+		};
+		parsed.set(path, entry);
+	}
+	if (stat$1.size !== entry.size || stat$1.mtimeMs !== entry.mtimeMs) {
+		const length = stat$1.size - entry.offset;
+		if (length > 0) {
+			const buf = Buffer.alloc(length);
+			const fd = openSync(path, "r");
+			try {
+				readSync(fd, buf, 0, length, entry.offset);
+			} finally {
+				closeSync(fd);
+			}
+			const end = buf.lastIndexOf(10);
+			if (end >= 0) {
+				parseLines(buf.subarray(0, end).toString("utf8"), entry.rows);
+				entry.offset += end + 1;
+			}
+		}
+		entry.size = stat$1.size;
+		entry.mtimeMs = stat$1.mtimeMs;
+	}
+	return entry.rows.slice();
 }
 /** The defaults the demo writes; a caller with other names overrides them. */
 const DEFAULT_FILES = {
@@ -1229,7 +838,8 @@ function readRecord(dir, files) {
 		discovery: jsonOrNull(resolve(dir, files.discovery)),
 		report: jsonOrNull(resolve(dir, files.report)),
 		guardians: jsonOrNull(resolve(dir, files.guardians)),
-		pack: jsonOrNull(resolve(dir, files.pack))
+		pack: jsonOrNull(resolve(dir, files.pack)),
+		crownJewel: jsonOrNull(resolve(dir, "crown-jewel.json"))
 	};
 }
 /** The red-team campaign and its runs, as the runner wrote them; empty when none. */
@@ -1238,17 +848,342 @@ function readRedteam(dir, files) {
 	if (!existsSync(root)) return {
 		campaign: null,
 		runs: [],
-		steering: []
+		steering: [],
+		history: []
 	};
 	const runs = readdirSync(root).filter((n) => n.endsWith(".json")).sort().filter((n) => n !== "campaign.json").map((n) => jsonOrNull(resolve(root, n))).filter((r) => r !== null);
 	const steeringDir = resolve(root, "steering");
 	const steering = existsSync(steeringDir) ? readdirSync(steeringDir).filter((n) => n.endsWith(".json")).sort().map((n) => jsonOrNull(resolve(steeringDir, n))).filter((r) => r !== null && typeof r === "object" && "objective" in r) : [];
+	const historyDir = resolve(steeringDir, "history");
+	const history = existsSync(historyDir) ? readdirSync(historyDir).filter((n) => n.endsWith(".json")).sort().reverse().map((n) => jsonOrNull(resolve(historyDir, n))).filter((r) => r !== null) : [];
 	return {
 		campaign: jsonOrNull(resolve(root, "campaign.json")),
 		runs,
-		steering
+		steering,
+		history
+	};
+}
+
+//#endregion
+//#region ../controls/src/inspect.ts
+/**
+* How a rule is evaluated, one label per matcher field it uses. Every one
+* of them runs in the PRAE kernel's deterministic matcher; these are the
+* only engines the rule model has. There is no semantic model and no
+* syntax tree behind any rule: `command` is a lexical decomposition.
+*/
+const ENGINES = {
+	tool: "Tool / capability match",
+	capability: "Tool / capability match",
+	plugin: "Tool / capability match",
+	agent: "Agent match",
+	path: "Path glob match",
+	host: "Host list match",
+	arg: "Argument value match",
+	count: "Session call count",
+	command: "Command decomposition (lexical)",
+	secrets: "Content inspection (regex + entropy)"
+};
+function enginesOf(rule) {
+	const keys = Object.keys(rule.when);
+	if (keys.length === 0) return ["Every call (no matcher)"];
+	return [...new Set(keys.map((k) => ENGINES[k] ?? `Unknown matcher: ${k}`))];
+}
+const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
+const quoted = (v) => v.map((x) => `\`${String(x)}\``).join(", ");
+/** The plain-language reading, or undefined when it cannot be given reliably. */
+function logicOf(rule) {
+	const w = rule.when;
+	if (Object.keys(w).some((k) => ENGINES[k] === void 0)) return void 0;
+	const subjects = [];
+	if (w.capability !== void 0) subjects.push(`calls with capability ${quoted(list(w.capability))}`);
+	if (w.tool !== void 0) subjects.push(`calls to ${quoted(list(w.tool))}`);
+	if (w.plugin !== void 0) subjects.push(`tools registered by ${quoted(list(w.plugin))}`);
+	const evaluates = subjects.length === 0 ? "Every tool call" : `${subjects.join(" that are also ")}`.replace(/^./, (c$1) => c$1.toUpperCase());
+	const targets = [];
+	if (w.path !== void 0) targets.push(w.path.arg === void 0 ? "the path argument (the first conventional one present)" : `the path in argument \`${w.path.arg}\``);
+	if (w.host !== void 0) targets.push(w.host.arg === void 0 ? "the URL argument's host" : `the host of argument \`${w.host.arg}\``);
+	if (w.command !== void 0) targets.push("the shell command line, read lexically");
+	if (w.arg !== void 0) targets.push(`argument${w.arg.length === 1 ? "" : "s"} ${quoted(w.arg.map((a) => a.name))}`);
+	if (w.count !== void 0) targets.push("this session's count of calls with the same capability");
+	if (w.secrets !== void 0) targets.push("findings the content inspection attached to the call");
+	if (w.agent !== void 0) targets.push("the agent making the call");
+	const target = targets.length === 0 ? "The call as a whole" : targets.join("; ");
+	const condition = [];
+	if (w.agent !== void 0) condition.push(`the agent is ${quoted(list(w.agent))}`);
+	if (w.path?.inside !== void 0) condition.push(`the path is under ${quoted(w.path.inside)}`);
+	if (w.path?.outside !== void 0) condition.push(`the path is outside all of ${quoted(w.path.outside)}`);
+	if (w.host?.in !== void 0) condition.push(`the host is one of ${quoted(w.host.in)}`);
+	if (w.host?.notIn !== void 0) condition.push(`the host is not one of ${quoted(w.host.notIn)}`);
+	for (const a of w.arg ?? []) {
+		if (a.present !== void 0) condition.push(`\`${a.name}\` is ${a.present ? "present" : "absent"}`);
+		if (a.above !== void 0) condition.push(`\`${a.name}\` is above ${a.above}`);
+		if (a.below !== void 0) condition.push(`\`${a.name}\` is below ${a.below}`);
+		if (a.equals !== void 0) condition.push(`\`${a.name}\` equals \`${String(a.equals)}\``);
+		if (a.oneOf !== void 0) condition.push(`\`${a.name}\` is one of ${quoted(a.oneOf)}`);
+	}
+	if (w.count !== void 0) condition.push(`more than ${w.count.above} such calls have already run in this session`);
+	if (w.secrets !== void 0) {
+		const n = w.secrets.atLeast ?? 1;
+		condition.push(`${n === 1 ? "a finding" : `at least ${n} findings`}${w.secrets.types === void 0 ? "" : ` of type ${quoted(w.secrets.types)}`}${w.secrets.minConfidence === void 0 ? "" : ` with confidence ≥ ${w.secrets.minConfidence}`}`);
+	}
+	const c = w.command;
+	if (c !== void 0) {
+		if (c.name !== void 0) condition.push(`the program (or a wrapper it runs through) is ${quoted(list(c.name))}`);
+		const must = list(c.token).filter((t) => !t.startsWith("!"));
+		const never = list(c.token).filter((t) => t.startsWith("!")).map((t) => t.slice(1));
+		if (must.length > 0) condition.push(`it carries all of ${quoted(must)}`);
+		if (never.length > 0) condition.push(`it carries none of ${quoted(never)}`);
+		if (c.anyToken !== void 0) condition.push(`it carries any of ${quoted(list(c.anyToken))}`);
+		if (c.pipedTo !== void 0) condition.push(`it pipes into ${quoted(list(c.pipedTo))}`);
+		if (c.pipeline !== void 0) condition.push(`its pipeline has the shape ${quoted(list(c.pipeline))}`);
+	}
+	if (condition.length === 0) condition.push("always: no further condition");
+	const e = rule.effect;
+	return {
+		evaluates,
+		target,
+		condition,
+		action: e.kind === "deny" ? "Refuses the call before it runs." : e.kind === "ask" ? "Holds the call until a person allows or refuses it." : e.kind === "warn" ? "Lets the call run and records a warning." : e.kind === "allow" ? "Allows the call and names this rule in the evidence; an allow never overrides another rule's refusal." : `Rewrites ${quoted(Object.keys(e.set))} before the call runs.`
+	};
+}
+const isEvent = (e) => e.tool.startsWith("prae:") || e.tool === "system-prompt";
+/**
+* Per pack name, every row in which a gate showed it in force — its
+* activation or reload row, or a decision attributed to it — and its
+* removal rows, in ledger order.
+*/
+function packActivity(entries) {
+	const out = /* @__PURE__ */ new Map();
+	const add = (name, seen) => {
+		const list$1 = out.get(name);
+		if (list$1 === void 0) out.set(name, [seen]);
+		else list$1.push(seen);
+	};
+	for (const e of entries) if (e.tool === "prae:pack") {
+		if (e.rule === "pack.activated" || e.rule === "pack.reloaded") add(e.pack.name, {
+			row: e,
+			kind: "in-force"
+		});
+		else if (e.rule === "pack.removed") add(e.pack.name, {
+			row: e,
+			kind: "removed"
+		});
+	} else if (!isEvent(e) && e.pack !== void 0) add(e.pack.name, {
+		row: e,
+		kind: "in-force"
+	});
+	return out;
+}
+/** Whether a gate confirmed this exact definition of a pack in force. */
+function activityOf(pack, activity, failed) {
+	if (failed !== void 0) return {
+		state: "failed",
+		note: `A gate refused this definition: ${failed.why}`,
+		seq: failed.seq,
+		at: failed.at,
+		sessions: []
+	};
+	const rows = activity.get(pack.name) ?? [];
+	const same = (r) => r.pack.version === pack.version && (pack.sha256 === void 0 || r.pack.sha256 === void 0 || r.pack.sha256 === pack.sha256);
+	const last = rows.at(-1);
+	if (last?.kind === "removed") return {
+		state: "inactive",
+		note: `A gate sealed this pack removed (row #${last.row.seq}); its rules no longer apply there.`,
+		seq: last.row.seq,
+		at: last.row.at,
+		sessions: []
+	};
+	const confirming = rows.filter((s) => s.kind === "in-force" && same(s.row));
+	const newest = confirming.at(-1);
+	if (newest !== void 0) return {
+		state: "active",
+		note: `A gate showed ${pack.name} ${pack.version} in force at row #${newest.row.seq}. That is the last confirmation; PRAE has no heartbeat that says a gate is running now.`,
+		seq: newest.row.seq,
+		at: newest.row.at,
+		sessions: [...new Set(confirming.flatMap((s) => s.row.session === void 0 ? [] : [s.row.session]))]
+	};
+	const other = rows.at(-1);
+	return {
+		state: "unconfirmed",
+		note: other !== void 0 ? `Verification required: the gate last showed ${pack.name} ${other.row.pack.version} in force (row #${other.row.seq}); this configured definition has not been confirmed by any gate.` : "Verification required: configured, but no gate has sealed this pack in force in this record yet.",
+		sessions: []
+	};
+}
+/**
+* The rows that can be evidence: every row except the console's own
+* deployment rows. Placing a pack is an operation, not something the agent
+* did or a gate decided, so it never counts toward a control — not as a
+* recorded event, and never as a refusal.
+*/
+function evidenceRows(entries) {
+	return entries.filter((e) => e.tool !== "prae:deploy");
+}
+/** How long a written pack waits for a gate before it needs verification. */
+const CONFIRM_WINDOW_MS = 2e4;
+/**
+* Each deployment's lifecycle, read from the ledger alone: the console's
+* `deploy.requested` row, then what a gate sealed after it. ACTIVE only on
+* a gate's activation or reload row carrying the deployed file's exact
+* sha256; FAILED on the console's own failure row or a gate refusing the
+* file; INACTIVE when a gate later sealed it removed. With no gate row,
+* APPLYING for a short window and then VERIFICATION_REQUIRED — the file is
+* configured, and nothing has shown it enforced.
+*/
+function deploymentsOf(entries, now = Date.now()) {
+	const out = [];
+	const requests = entries.filter((e) => e.tool === "prae:deploy" && e.deploy?.action === "requested");
+	for (const r of requests) {
+		const d = r.deploy;
+		if (d === void 0 || r.pack.sha256 === void 0) continue;
+		const sha = r.pack.sha256;
+		const after = entries.filter((e) => e.seq > r.seq);
+		const base = {
+			operation: d.operation,
+			pack: r.pack.name,
+			version: r.pack.version,
+			sha256: sha,
+			file: d.file,
+			target: d.target,
+			environment: d.environment,
+			rules: d.rules,
+			controls: d.controls,
+			...d.operator === void 0 ? {} : { operator: d.operator },
+			requestedAt: r.at,
+			seq: r.seq
+		};
+		const failedRow = after.find((e) => e.tool === "prae:deploy" && e.deploy?.action === "failed" && e.deploy.operation === d.operation);
+		if (failedRow !== void 0) {
+			out.push({
+				...base,
+				state: "FAILED",
+				failure: "operation",
+				note: `Not deployed: ${failedRow.deploy?.error ?? "the operation failed"}. Nothing was placed where a gate reads, so coverage is unchanged.`,
+				runtime: {
+					seq: failedRow.seq,
+					at: failedRow.at
+				},
+				sessions: []
+			});
+			continue;
+		}
+		const confirms = after.filter((e) => e.tool === "prae:pack" && (e.rule === "pack.activated" || e.rule === "pack.reloaded") && e.pack.sha256 === sha);
+		const refused = after.find((e) => e.tool === "prae:pack" && e.rule === "pack.rejected" && e.subject === d.file);
+		const removed = after.find((e) => e.tool === "prae:pack" && e.rule === "pack.removed" && e.pack.sha256 === sha);
+		const sessions = [...new Set(confirms.flatMap((e) => e.session === void 0 ? [] : [e.session]))];
+		const at = (e) => ({
+			seq: e.seq,
+			at: e.at,
+			...e.session === void 0 ? {} : { session: e.session }
+		});
+		if (refused !== void 0) {
+			out.push({
+				...base,
+				state: "FAILED",
+				failure: "runtime",
+				note: `A gate refused the pack (row #${refused.seq}): ${(refused.reason ?? "").replace(/^pack rejected, not loaded: /, "")}. The gate kept the policy it had; this pack does not count toward coverage.`,
+				runtime: at(refused),
+				sessions
+			});
+			continue;
+		}
+		if (removed !== void 0) {
+			out.push({
+				...base,
+				state: "INACTIVE",
+				note: `A gate sealed the pack removed (row #${removed.seq}); its rules no longer apply there.`,
+				runtime: at(removed),
+				sessions
+			});
+			continue;
+		}
+		const first = confirms[0];
+		if (first !== void 0) {
+			out.push({
+				...base,
+				state: "ACTIVE",
+				note: `A gate sealed this exact pack (sha256 ${sha.slice(0, 12)}) in force at row #${first.seq}${sessions.length > 0 ? ` · ${sessions.length} session${sessions.length === 1 ? "" : "s"}` : ""}.`,
+				runtime: at(first),
+				sessions
+			});
+			continue;
+		}
+		const waiting = now - Date.parse(r.at) < CONFIRM_WINDOW_MS;
+		out.push({
+			...base,
+			state: waiting ? "APPLYING" : "VERIFICATION_REQUIRED",
+			note: waiting ? "Written to the workspace pack directory; waiting for a gate to seal it in force." : "Written and configured, but no gate has sealed it in force: no gate watching this workspace is running. A gate mounted with this workspace confirms it when it starts.",
+			sessions
+		});
+	}
+	return out;
+}
+function describeRule(rule) {
+	const logic = logicOf(rule);
+	return {
+		id: rule.id,
+		...rule.title === void 0 ? {} : { title: rule.title },
+		...rule.description === void 0 ? {} : { description: rule.description },
+		effect: rule.effect.kind,
+		because: rule.effect.because,
+		engines: enginesOf(rule),
+		...logic === void 0 ? {} : { logic },
+		definition: JSON.stringify({
+			when: rule.when,
+			effect: rule.effect
+		}, null, 2),
+		cites: Object.entries(rule.frameworks ?? {}).flatMap(([f, cs]) => cs.map((c) => `${f}:${c}`))
 	};
 }
+function ruleViews(pack, origins, entries, admitted, environment, failedPacks = /* @__PURE__ */ new Map()) {
+	const activity = packActivity(entries);
+	const byRule = /* @__PURE__ */ new Map();
+	for (const e of admitted) {
+		if (e.rule === void 0 || isEvent(e)) continue;
+		const rows = byRule.get(e.rule);
+		if (rows === void 0) byRule.set(e.rule, [e]);
+		else rows.push(e);
+	}
+	const out = {};
+	for (const rule of pack?.rules ?? []) {
+		const ref = origins.get(rule.id) ?? {
+			name: pack?.pack ?? "unknown",
+			version: pack?.version ?? ""
+		};
+		const rows = byRule.get(rule.id) ?? [];
+		const last = rows.at(-1);
+		out[rule.id] = {
+			...describeRule(rule),
+			pack: ref,
+			scope: {
+				agents: rule.when.agent === void 0 ? "all" : list(rule.when.agent),
+				environment
+			},
+			active: activityOf(ref, activity, ref.sha256 === void 0 ? void 0 : failedPacks.get(ref.sha256)),
+			evidence: {
+				count: rows.length,
+				...last === void 0 ? {} : { last: {
+					seq: last.seq,
+					at: last.at
+				} }
+			}
+		};
+	}
+	return out;
+}
+/**
+* Deployed packs a gate refused, by sha256 — the latest deployment of each
+* definition decides — kept out of coverage: the gate does not enforce them.
+*/
+function refusedDeployments(deployments) {
+	const latest = /* @__PURE__ */ new Map();
+	for (const d of deployments) latest.set(d.sha256, d);
+	return new Map([...latest.values()].filter((d) => d.failure === "runtime").map((d) => [d.sha256, {
+		seq: d.runtime?.seq ?? d.seq,
+		at: d.runtime?.at ?? d.requestedAt,
+		why: d.note
+	}]));
+}
 
 //#endregion
 //#region ../controls/src/scope.ts
@@ -1327,10 +1262,11 @@ function catalogOf(file) {
 			};
 			frameworks.set(framework.id, f);
 		}
+		const name = control.name ?? FRAMEWORKS[framework.id]?.controls[id]?.name;
 		f.controls.push({
 			key,
 			id,
-			...control.name === void 0 ? {} : { name: control.name },
+			...name === void 0 ? {} : { name },
 			asks: control.asks
 		});
 	};
@@ -1424,6 +1360,11 @@ function inPeriod(at, period, now) {
 	if (period.kind === "days") return t >= now - period.days * 864e5;
 	return t >= Date.parse(period.from) && t < Date.parse(period.to) + 864e5;
 }
+/** The rows a scope admits: its agents, its sessions, its period. */
+function admit(entries, scope, agent, now = Date.now()) {
+	const agentOf$1 = (e) => e.agent ?? agent;
+	return entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+}
 /**
 * Assess the scoped controls against the record. The rows are narrowed to
 * the scope's agents, sessions and period before any control reads them;
@@ -1433,7 +1374,7 @@ function inPeriod(at, period, now) {
 function assess(data, scope, catalog, options) {
 	const now = options.now ?? Date.now();
 	const agentOf$1 = (e) => e.agent ?? options.agent;
-	const admitted = data.entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+	const admitted = admit(data.entries, scope, options.agent, now);
 	const scoped = {
 		...data,
 		entries: admitted
@@ -1580,17 +1521,39 @@ function agentOf(dir) {
 	} catch {}
 	return "this agent";
 }
-function assessCompliance(record, data) {
+/** What a record's compliance is assessed against: its catalog and scope. */
+function complianceContext(record) {
 	const { catalog, catalogError } = catalogFor(record.dir);
 	return {
-		...assess(data, scopeFor(record.dir, catalog), catalog, {
+		catalog,
+		...catalogError === void 0 ? {} : { catalogError },
+		scope: scopeFor(record.dir, catalog),
+		options: {
 			agent: agentOf(record.dir),
 			environment: basename(resolve(record.dir))
-		}),
+		}
+	};
+}
+function assessCompliance(record, data) {
+	const { catalog, catalogError, scope, options } = complianceContext(record);
+	return {
+		...assess(data, scope, catalog, options),
 		saved: existsSync(resolve(record.dir, SCOPE_FILE)),
 		...catalogError === void 0 ? {} : { catalogError }
 	};
 }
+/**
+* The Rule Inspector's rules (PRA-195): every rule in force, with where it
+* came from, how it is evaluated, whether a gate confirmed its pack in
+* force, and its sealed decisions within the scope. Read-only.
+*/
+function inspectorOf(record, data, scope, origins, deployments, refused) {
+	const agent = agentOf(record.dir);
+	return {
+		rules: ruleViews(data.pack, origins, data.entries, admit(data.entries, scope, agent), basename(resolve(record.dir)), refused),
+		deployments
+	};
+}
 
 //#endregion
 //#region src/serve.ts
@@ -1647,6 +1610,23 @@ function verifyRecord(record, tamper, repair = false) {
 		repaired: false,
 		signatures: null
 	};
+	if (tamper === void 0) {
+		const keyPath$1 = resolve(dir, files.publicKey);
+		const publicKey = existsSync(keyPath$1) ? readFileSync(keyPath$1, "utf8") : void 0;
+		const v = verifyGrowing(path, publicKey);
+		return {
+			ok: v.ok,
+			entries: v.entries,
+			problems: [...v.problems],
+			tampered: null,
+			repaired: false,
+			signatures: v.signatures === null || publicKey === void 0 ? null : {
+				checked: v.signatures.checked,
+				failed: [...v.signatures.failed],
+				fingerprint: fingerprint(publicKey)
+			}
+		};
+	}
 	let text = readFileSync(path, "utf8");
 	let tampered = null;
 	if (tamper !== void 0) {
@@ -1754,23 +1734,38 @@ function packsOf(record) {
 function complianceOf(record) {
 	const { dir, files } = record;
 	const ledgerPath = resolve(dir, files.ledger);
-	const text = existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : "";
-	let entries = [];
-	try {
-		entries = readEntries(text);
-	} catch {
-		entries = [];
-	}
+	const entries = readLedger(ledgerPath);
+	const grown = existsSync(ledgerPath) ? verifyGrowing(ledgerPath) : void 0;
+	const verification = grown === void 0 ? verifyEntries("") : {
+		ok: grown.ok,
+		entries: grown.entries,
+		problems: grown.problems
+	};
 	const { set } = packSetOf(record);
-	const pack = set.packs.length > 0 ? set.effective : void 0;
+	const deployments = deploymentsOf(entries);
+	const refused = refusedDeployments(deployments);
+	const kept = set.packs.filter((p) => !refused.has(p.sha256));
+	const pack = kept.length === 0 ? void 0 : kept.length === set.packs.length ? set.effective : {
+		...set.effective,
+		rules: kept.flatMap((p) => p.pack.rules)
+	};
 	const data = {
 		...pack === void 0 ? {} : { pack },
-		entries,
-		verification: verifyEntries(text),
+		entries: evidenceRows(entries),
+		verification,
 		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
+	const assessment = assessCompliance(record, data);
+	const origins = new Map(set.packs.flatMap((p) => p.pack.rules.map((r) => [r.id, {
+		name: p.pack.pack,
+		version: p.pack.version,
+		sha256: p.sha256,
+		origin: p.origin,
+		file: p.file.split("/").at(-1) ?? p.file
+	}])));
 	return {
-		assessment: assessCompliance(record, data),
+		assessment,
+		inspector: inspectorOf(record, data, assessment.scope, origins, deployments, refused),
 		controls: CONTROLS.map((control) => {
 			const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
 			const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
@@ -1789,6 +1784,23 @@ function complianceOf(record) {
 	};
 }
 /**
+* The API's version is prae-cli's: every `/api/*` response names it in
+* `X-PRAE-API-Version`, so a client can tell which contract answered. The
+* contract follows the package's semver — a breaking change to a route bumps
+* the major — and a route on its way out carries `Deprecation` and `Sunset`
+* (RFC 9745 / RFC 8594) for at least one minor release before it goes.
+*/
+/**
+* The most rows `/api/record` sends: the newest ones. The console keeps the
+* same window (apps/console/src/data/hooks.ts); `trimmed` counts the rest.
+*/
+const RECORD_WINDOW = 25e3;
+const API_VERSION = createRequire(import.meta.url)("../package.json").version;
+/** Name the contract on an API response; call before the status is written. */
+function apiVersion(res) {
+	res.setHeader("x-prae-api-version", API_VERSION);
+}
+/**
 * The record over HTTP, for the Command Center (apps/console): the same
 * files `prae console` renders, as JSON, plus one event stream that says
 * when the ledger moved. Read-only, from files on disk, nothing computed
@@ -1801,6 +1813,7 @@ function complianceOf(record) {
 function handleApi(req, res, record) {
 	const route = (req.url ?? "").split("?")[0] ?? "";
 	if (!route.startsWith("/api/")) return false;
+	apiVersion(res);
 	const json = (body, status = 200) => {
 		res.statusCode = status;
 		res.setHeader("content-type", "application/json; charset=utf-8");
@@ -1815,19 +1828,56 @@ function handleApi(req, res, record) {
 			connection: "keep-alive"
 		});
 		res.write(": connected\n\n");
-		let sent = readRecord(dir, files).ledger.length;
+		const ledgerPath = resolve(dir, files.ledger);
+		const size = () => existsSync(ledgerPath) ? statSync(ledgerPath).size : 0;
+		let offset = (() => {
+			if (!existsSync(ledgerPath)) return 0;
+			return readFileSync(ledgerPath).lastIndexOf(10) + 1;
+		})();
 		const push = () => {
-			const rows = readRecord(dir, files).ledger;
-			if (rows.length < sent) sent = 0;
-			const fresh = rows.slice(sent);
-			sent = rows.length;
+			const end = size();
+			if (end < offset) {
+				offset = 0;
+				res.write("event: reset\ndata: {}\n\n");
+			}
+			const fresh = [];
+			if (end > offset) {
+				const bytes = Buffer.alloc(end - offset);
+				const fd = openSync(ledgerPath, "r");
+				try {
+					readSync(fd, bytes, 0, bytes.length, offset);
+				} finally {
+					closeSync(fd);
+				}
+				let at = 0;
+				for (;;) {
+					const nl = bytes.indexOf(10, at);
+					if (nl === -1) break;
+					const l = bytes.subarray(at, nl).toString("utf8");
+					if (l.trim() !== "") try {
+						fresh.push(JSON.parse(l));
+					} catch {
+						break;
+					}
+					at = nl + 1;
+				}
+				offset += at;
+			}
 			if (fresh.length > 0) res.write(`data: ${JSON.stringify(fresh)}\n\n`);
 			else res.write(": keepalive\n\n");
 		};
-		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, () => push()) : void 0;
+		let soon;
+		const schedule = () => {
+			soon ??= setTimeout(() => {
+				soon = void 0;
+				push();
+			}, 250);
+		};
+		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, schedule) : void 0;
 		const keep = setInterval(push, 2e3);
 		res.on("close", () => {
 			clearInterval(keep);
+			if (soon !== void 0) clearTimeout(soon);
 			watcher?.close();
 		});
 		return true;
@@ -1851,11 +1901,32 @@ function handleApi(req, res, record) {
 		json(readRedteam(dir, files));
 		return true;
 	}
+	if (route === "/api/status") {
+		json({
+			dir,
+			files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
+				const path = resolve(dir, file);
+				if (!existsSync(path)) return [name, null];
+				const stat$1 = statSync(path);
+				return [name, {
+					size: stat$1.size,
+					mtime: stat$1.mtimeMs
+				}];
+			}))
+		});
+		return true;
+	}
 	const snapshot = readRecord(dir, files);
 	switch (route) {
-		case "/api/record":
-			json(snapshot);
+		case "/api/record": {
+			const over = snapshot.ledger.length - RECORD_WINDOW;
+			json(over > 0 ? {
+				...snapshot,
+				ledger: snapshot.ledger.slice(over),
+				trimmed: over
+			} : snapshot);
 			break;
+		}
 		case "/api/ledger":
 			json(snapshot.ledger);
 			break;
@@ -1871,20 +1942,6 @@ function handleApi(req, res, record) {
 		case "/api/pack":
 			json(snapshot.pack);
 			break;
-		case "/api/status":
-			json({
-				dir,
-				files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
-					const path = resolve(dir, file);
-					if (!existsSync(path)) return [name, null];
-					const stat$1 = statSync(path);
-					return [name, {
-						size: stat$1.size,
-						mtime: stat$1.mtimeMs
-					}];
-				}))
-			});
-			break;
 		default: json({ error: "not found" }, 404);
 	}
 	return true;
@@ -1901,6 +1958,7 @@ function serveConsole(root, port, record) {
 			res.end();
 			return;
 		}
+		if ((req.url ?? "").startsWith("/api/")) apiVersion(res);
 		if (record !== void 0 && handleApi(req, res, record)) return;
 		const target = safePath(root, req.url ?? "/");
 		if (target === void 0) {
@@ -2052,6 +2110,21 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       --pack-dir adds the workspace's own packs (e.g. .prae/packs) beside
       that pack, loaded and watched as a set; a set that would not load is
       not mounted (see \`prae check <dir>\`).
+
+  prae init claude-code (--settings <file> | --scope user|project)
+                [--shadow | --enforce] [--pack <file>] [--ledger <file>]
+                [--dir <dir>] [--apply] [--remove]
+      Register PRAE as a Claude Code PreToolUse hook: every tool call,
+      built-in or MCP, judged by the pack and sealed in a signed ledger
+      (default ~/.prae/claude-code/). Shadow (the default) records and
+      never blocks; --enforce returns deny/ask to Claude Code. Prints the
+      settings diff; writes only with --apply. --remove takes out PRAE's
+      own entry and nothing else. See docs/pilot-claude-code.md.
+
+  prae hook claude-code [--shadow | --enforce] --pack <file> --ledger <file>
+                [--key <private.pem>] [--settings <file>]
+      The command that settings entry runs: reads one PreToolUse payload on
+      stdin and answers through the hook's output contract.
 `;
 function fail(message) {
 	console.error(`prae: ${message}`);
@@ -2151,13 +2224,13 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-BCXbpqu4.js");
+	const { serveMcp } = await import("./mcp-DdEDvTvR.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-7X6dO7gC.js");
+	const { Ledger: Ledger$1 } = await import("./src-2iJy5MZc.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -2209,7 +2282,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -2232,7 +2305,7 @@ async function keygen(dir) {
 async function keygenSealed(role, dir) {
 	if (role !== "operator" && role !== "policy" && role !== "ledger") fail("--role is operator, policy or ledger");
 	const stem = role === "ledger" ? "prae-signing" : role;
-	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = sealedKeypair(process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: "));
 	const pub = join(dir, `${stem}.pub.pem`);
@@ -2245,11 +2318,11 @@ async function keygenSealed(role, dir) {
 }
 /** A detached signature over a pack's bytes (PRA-107). */
 async function signPack(packPath, keyPath) {
-	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const bytes = readFileSync(packPath);
-	const parsed = parsePack(bytes.toString("utf8"));
-	if (!parsed.ok) fail(`${packPath} does not parse; nothing signed`);
+	const parsed$1 = parsePack(bytes.toString("utf8"));
+	if (!parsed$1.ok) fail(`${packPath} does not parse; nothing signed`);
 	const passphrase = process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: ");
 	let key;
 	try {
@@ -2262,7 +2335,7 @@ async function signPack(packPath, keyPath) {
 		type: "spki",
 		format: "pem"
 	});
-	console.log(`signed      ${packPath}.sig  (${parsed.pack.pack} ${parsed.pack.version})`);
+	console.log(`signed      ${packPath}.sig  (${parsed$1.pack.pack} ${parsed$1.pack.version})`);
 	console.log(`policy key  ${fingerprint$1(pub.toString())}`);
 }
 /** Read a line from the terminal without echoing it. */
@@ -2290,7 +2363,7 @@ function askHidden(prompt) {
 	});
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -2320,14 +2393,14 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-DQK_gVPc.js");
-	let parsed;
+	const { checkReceipt } = await import("./receipt-check-2F4zLEW5.js");
+	let parsed$1;
 	try {
-		parsed = JSON.parse(await readFile(path, "utf8"));
+		parsed$1 = JSON.parse(await readFile(path, "utf8"));
 	} catch {
 		return fail(`cannot read a receipt from ${path}`);
 	}
-	const result = checkReceipt(parsed);
+	const result = checkReceipt(parsed$1);
 	for (const line of result.lines) if (result.ok) console.log(line);
 	else console.error(line);
 	if (!result.ok) process.exit(1);
@@ -2345,14 +2418,14 @@ async function test(suitePath, packOverride, asJson) {
 	} catch {
 		return fail(`cannot read ${suitePath}`);
 	}
-	let parsed;
+	let parsed$1;
 	try {
-		parsed = JSON.parse(raw);
+		parsed$1 = JSON.parse(raw);
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-CCDgJ0Dp.js");
-	const suite = parseSuite(parsed);
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-BGsK-inZ.js");
+	const suite = parseSuite(parsed$1);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
 		for (const message of suite.errors) console.error(`  ${message}`);
@@ -2391,14 +2464,14 @@ async function verify$1(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-C_q_Rpa5.js");
+			const { checkCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
 			if (!verdict.ok) process.exitCode = 1;
 		}
 		if (keyPath !== void 0) {
-			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -2476,7 +2549,7 @@ async function report(path, out, packPath) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-d4c_n6wd.js");
+	const { ingest } = await import("./src-XukJfuml.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -2512,7 +2585,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-d4c_n6wd.js"), import("./src-CBGZVvt7.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-XukJfuml.js"), import("./src-BoBCmiwj.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -2572,9 +2645,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-d4c_n6wd.js"),
-			import("./src-CBGZVvt7.js"),
-			import("./instructions-ya0LVnZy.js")
+			import("./src-XukJfuml.js"),
+			import("./src-BoBCmiwj.js"),
+			import("./instructions-fCJ4j7ce.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -2615,15 +2688,18 @@ async function consoleOut(path, argv) {
 	console.log(`record at ${url}api/record · events at ${url}api/events`);
 	console.log("loopback only, read-only. ctrl-c to stop.");
 }
+/** The bundled baseline: beside the built code, or in examples/ in source. */
+function bundledBaseline() {
+	return [join(import.meta.dirname, "prae-baseline.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "prae-baseline.prae.json")].find((candidate) => existsSync(candidate));
+}
 async function init(argv) {
-	const bundledBaseline = [join(import.meta.dirname, "prae-baseline.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "prae-baseline.prae.json")].find((candidate) => existsSync(candidate));
-	const packPath = flag(argv, "pack") ?? bundledBaseline;
+	const packPath = flag(argv, "pack") ?? bundledBaseline();
 	if (packPath === void 0) fail("init needs --pack <file>; no bundled baseline found");
+	const pack = await loadPack(packPath);
 	if (flag(argv, "pack") === void 0) {
-		console.log("No --pack given; mounting the built-in baseline (8 rules).");
+		console.log(`No --pack given; mounting the built-in baseline (${pack.rules.length} rules).`);
 		console.log(`See it with: prae check ${packPath}\n`);
 	}
-	const pack = await loadPack(packPath);
 	const source = await readFile(packPath, "utf8");
 	const link = argv.includes("--link");
 	const builtin = link ? { packFile: resolve(packPath) } : { pack: source };
@@ -2704,7 +2780,7 @@ async function chainMatrix(path, argv) {
 	const catalogue = guardiansPath === void 0 ? [] : JSON.parse(readFileSync(guardiansPath, "utf8")).guardians;
 	const guardianOf = (rule) => rule === void 0 ? void 0 : catalogue.find((g) => g.rules.includes(rule) || (g.armed ?? []).includes(rule))?.name;
 	const keyPath = flag(argv, "key");
-	const { verifySignature: verifySignature$1 } = await import("./src-7X6dO7gC.js");
+	const { verifySignature: verifySignature$1 } = await import("./src-2iJy5MZc.js");
 	const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 	const matrix = integrityMatrix(entries, pack, guardianOf).map((m) => {
 		const entry = entries.find((e) => e.seq === m.seq);
@@ -2735,7 +2811,7 @@ async function chainMatrix(path, argv) {
 	if (!chainOk || sigFailed) process.exitCode = 1;
 }
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-C_q_Rpa5.js");
+	const { makeCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -2756,9 +2832,9 @@ async function checkpoint(path, keyPath, out) {
 	}
 }
 async function exportLedger(path, options) {
-	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DhVGbBUw.js");
-	const { createRequire } = await import("node:module");
-	const { version } = createRequire(import.meta.url)("../package.json");
+	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-BwWyM7hc.js");
+	const { createRequire: createRequire$1 } = await import("node:module");
+	const { version } = createRequire$1(import.meta.url)("../package.json");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -2885,7 +2961,26 @@ async function main(argv) {
 				...flag(rest, "out") === void 0 ? {} : { out: flag(rest, "out") }
 			});
 		}
-		case "init": return init(rest);
+		case "init":
+			if (rest[0] === "claude-code") {
+				const { initClaudeCode, stableNode } = await import("./init-BPlBJvA-.js");
+				try {
+					return initClaudeCode(rest.slice(1), {
+						cwd: process.cwd(),
+						node: stableNode(process.execPath, process.env.PATH),
+						bin: resolve(process.argv[1] ?? ""),
+						baseline: bundledBaseline()
+					});
+				} catch (error) {
+					return fail(error instanceof Error ? error.message : String(error));
+				}
+			}
+			return init(rest);
+		case "hook": {
+			if (rest[0] !== "claude-code") fail("hook takes claude-code");
+			const { runHook } = await import("./hook-DxLgNtc4.js");
+			return runHook(rest.slice(1));
+		}
 		case "--help":
 		case "-h":
 		case void 0: