project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/long-task-ui-surface-shape.js

@@ -1,6 +1,7 @@
 import { DESIGN_RESOURCE_VERIFICATION_METHODS } from "./design-resource-handoff-types.js";
 import { DESIGN_RESOURCE_COMPARATORS } from "./design-resource-fact-manifest-types.js";
 import { parseDesignResourceLocatedDigest } from "./design-resource-fact-shape-primitives.js";
+import { nonnegativeInteger } from "./design-resource-handoff-shape-primitives.js";
 import { EXECUTION_TARGET_CAPABILITIES } from "./execution-target-capabilities.js";
 import { array, fail, key, literal, nullable, object, repositoryFile, repositoryFiles, string, strings, } from "./long-task-shape-primitives.js";
 export function parseSurfaceBindings(value, label) {
@@ -46,9 +47,17 @@ function parseDesignTargets(value, label) {
             "verification_method_bindings",
             "actual_artifact_path",
             "comparison_artifact_path",
+        ], [
+            "fact_model",
+            "symbolic_method_bindings",
+            "symbolic_certificate_binding",
         ]);
+        const factModel = row.fact_model === undefined
+            ? undefined
+            : literal(row.fact_model, ["symbolic_rules_v2"], `${itemLabel}.fact_model`);
         return {
             key: key(row.key, `${itemLabel}.key`),
+            ...(factModel ? { fact_model: factModel } : {}),
             interpretation: literal(row.interpretation, ["exact_target", "constraint"], `${itemLabel}.interpretation`),
             source_paths: repositoryFiles(row.source_paths, `${itemLabel}.source_paths`),
             condition_keys: keys(row.condition_keys, `${itemLabel}.condition_keys`),
@@ -56,11 +65,197 @@ function parseDesignTargets(value, label) {
             conformance_check_ref: key(row.conformance_check_ref, `${itemLabel}.conformance_check_ref`),
             conformance_assertion_ref: key(row.conformance_assertion_ref, `${itemLabel}.conformance_assertion_ref`),
             verification_method_bindings: parseVerificationMethodBindings(row.verification_method_bindings, `${itemLabel}.verification_method_bindings`),
+            ...(row.symbolic_method_bindings === undefined
+                ? {}
+                : {
+                    symbolic_method_bindings: parseSymbolicMethodBindings(row.symbolic_method_bindings, `${itemLabel}.symbolic_method_bindings`),
+                }),
+            ...(row.symbolic_certificate_binding === undefined
+                ? {}
+                : {
+                    symbolic_certificate_binding: parseSymbolicCertificateBinding(row.symbolic_certificate_binding, `${itemLabel}.symbolic_certificate_binding`),
+                }),
             actual_artifact_path: repositoryFile(row.actual_artifact_path, `${itemLabel}.actual_artifact_path`),
             comparison_artifact_path: repositoryFile(row.comparison_artifact_path, `${itemLabel}.comparison_artifact_path`),
         };
     });
 }
+function parseSymbolicMethodBindings(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "method",
+            "assertion_ref",
+            "artifact_path",
+            "observation_path",
+            "rule_expectations",
+        ]);
+        return {
+            method: literal(row.method, DESIGN_RESOURCE_VERIFICATION_METHODS, `${itemLabel}.method`),
+            assertion_ref: key(row.assertion_ref, `${itemLabel}.assertion_ref`),
+            artifact_path: repositoryFile(row.artifact_path, `${itemLabel}.artifact_path`),
+            observation_path: repositoryFile(row.observation_path, `${itemLabel}.observation_path`),
+            rule_expectations: array(row.rule_expectations, `${itemLabel}.rule_expectations`).map((expectation, expectationIndex) => parseSymbolicRuleExpectation(expectation, `${itemLabel}.rule_expectations[${expectationIndex}]`)),
+        };
+    });
+}
+function parseSymbolicRuleExpectation(value, label) {
+    const row = object(value, label, [
+        "obligation_ref",
+        "fact_rule_ref",
+        "region_sha256",
+        "subject_or_relation_ref",
+        "property_ref",
+        "population_ref",
+        "quantifier",
+        "observation_sensitivity",
+        "expected",
+        "proof_surface",
+        "observation_boundary",
+        "comparison",
+        "oracle",
+        "environment",
+        "protected_value_policy",
+        "completion_effect",
+    ]);
+    const comparison = object(row.comparison, `${label}.comparison`, [
+        "comparator",
+        "mode",
+        "parameters",
+        "tolerance",
+        "mask",
+    ]);
+    const comparator = string(comparison.comparator, `${label}.comparison.comparator`);
+    if (!DESIGN_RESOURCE_COMPARATORS.includes(comparator) &&
+        !/^custom\.[a-z0-9][a-z0-9._-]*$/u.test(comparator))
+        fail(`${label}.comparison.comparator`, "must be a standard comparator or custom.*");
+    const oracle = object(row.oracle, `${label}.oracle`, [
+        "key",
+        "trust",
+        "identity",
+        "version",
+        "sha256",
+    ]);
+    const environment = object(row.environment, `${label}.environment`, [
+        "key",
+        "identity",
+        "definition",
+    ]);
+    const quantifier = object(row.quantifier, `${label}.quantifier`, [
+        "kind",
+        "minimum",
+        "maximum",
+    ]);
+    return {
+        obligation_ref: designFactRef(row.obligation_ref, `${label}.obligation_ref`),
+        fact_rule_ref: designFactRef(row.fact_rule_ref, `${label}.fact_rule_ref`),
+        region_sha256: digest(row.region_sha256, `${label}.region_sha256`),
+        subject_or_relation_ref: designFactRef(row.subject_or_relation_ref, `${label}.subject_or_relation_ref`),
+        property_ref: designFactRef(row.property_ref, `${label}.property_ref`),
+        population_ref: nullable(row.population_ref, (entry) => designFactRef(entry, `${label}.population_ref`)),
+        quantifier: {
+            kind: literal(quantifier.kind, [
+                "one",
+                "all",
+                "any",
+                "none",
+                "exactly",
+                "at_least",
+                "at_most",
+                "range",
+            ], `${label}.quantifier.kind`),
+            minimum: nullable(quantifier.minimum, (entry) => nonnegativeInteger(entry, `${label}.quantifier.minimum`)),
+            maximum: nullable(quantifier.maximum, (entry) => nonnegativeInteger(entry, `${label}.quantifier.maximum`)),
+        },
+        observation_sensitivity: literal(row.observation_sensitivity, ["plain", "protected"], `${label}.observation_sensitivity`),
+        expected: parseDesignResourceLocatedDigest(row.expected, `${label}.expected`),
+        proof_surface: string(row.proof_surface, `${label}.proof_surface`),
+        observation_boundary: string(row.observation_boundary, `${label}.observation_boundary`),
+        comparison: {
+            comparator,
+            mode: literal(comparison.mode, ["exact", "tolerance"], `${label}.comparison.mode`),
+            parameters: parseDesignResourceLocatedDigest(comparison.parameters, `${label}.comparison.parameters`),
+            tolerance: nullable(comparison.tolerance, (entry) => parseDesignResourceLocatedDigest(entry, `${label}.comparison.tolerance`)),
+            mask: nullable(comparison.mask, (entry) => parseDesignResourceLocatedDigest(entry, `${label}.comparison.mask`)),
+        },
+        oracle: {
+            key: designFactRef(oracle.key, `${label}.oracle.key`),
+            trust: literal(oracle.trust, ["frozen_executable", "named_external_tcb"], `${label}.oracle.trust`),
+            identity: string(oracle.identity, `${label}.oracle.identity`),
+            version: string(oracle.version, `${label}.oracle.version`),
+            sha256: nullable(oracle.sha256, (entry) => digest(entry, `${label}.oracle.sha256`)),
+        },
+        environment: {
+            key: designFactRef(environment.key, `${label}.environment.key`),
+            identity: string(environment.identity, `${label}.environment.identity`),
+            definition: parseDesignResourceLocatedDigest(environment.definition, `${label}.environment.definition`),
+        },
+        protected_value_policy: string(row.protected_value_policy, `${label}.protected_value_policy`),
+        completion_effect: string(row.completion_effect, `${label}.completion_effect`),
+    };
+}
+function parseSymbolicCertificateBinding(value, label) {
+    const row = object(value, label, [
+        "assertion_ref",
+        "artifact_path",
+        "expectations",
+        "metrics",
+    ]);
+    const metrics = object(row.metrics, `${label}.metrics`, [
+        "semantic_obligations",
+        "certificate_obligations",
+        "certificate_covered_omitted_axes",
+        "certificate_covered_dependency_edges",
+        "canonical_dag_nodes",
+        "canonical_partition_edges",
+        "canonical_bytes",
+        "theoretical_ground_cardinality",
+    ]);
+    return {
+        assertion_ref: key(row.assertion_ref, `${label}.assertion_ref`),
+        artifact_path: repositoryFile(row.artifact_path, `${label}.artifact_path`),
+        expectations: array(row.expectations, `${label}.expectations`).map((item, index) => {
+            const itemLabel = `${label}.expectations[${index}]`;
+            const expectation = object(item, itemLabel, [
+                "certificate_ref",
+                "fact_rule_refs",
+                "omitted_axis_refs",
+                "dependency_edge_refs",
+                "canonical_rule_dag_sha256",
+            ], [
+                "source_noninterference_proof_sha256",
+                "production_noninterference_proof_sha256",
+            ]);
+            return {
+                certificate_ref: designFactRef(expectation.certificate_ref, `${itemLabel}.certificate_ref`),
+                fact_rule_refs: designFactRefs(expectation.fact_rule_refs, `${itemLabel}.fact_rule_refs`),
+                omitted_axis_refs: designFactRefs(expectation.omitted_axis_refs, `${itemLabel}.omitted_axis_refs`),
+                dependency_edge_refs: designFactRefs(expectation.dependency_edge_refs, `${itemLabel}.dependency_edge_refs`),
+                canonical_rule_dag_sha256: digest(expectation.canonical_rule_dag_sha256, `${itemLabel}.canonical_rule_dag_sha256`),
+                ...(expectation.source_noninterference_proof_sha256 === undefined
+                    ? {}
+                    : {
+                        source_noninterference_proof_sha256: digest(expectation.source_noninterference_proof_sha256, `${itemLabel}.source_noninterference_proof_sha256`),
+                    }),
+                ...(expectation.production_noninterference_proof_sha256 === undefined
+                    ? {}
+                    : {
+                        production_noninterference_proof_sha256: digest(expectation.production_noninterference_proof_sha256, `${itemLabel}.production_noninterference_proof_sha256`),
+                    }),
+            };
+        }),
+        metrics: {
+            semantic_obligations: nonnegativeInteger(metrics.semantic_obligations, `${label}.metrics.semantic_obligations`),
+            certificate_obligations: nonnegativeInteger(metrics.certificate_obligations, `${label}.metrics.certificate_obligations`),
+            certificate_covered_omitted_axes: nonnegativeInteger(metrics.certificate_covered_omitted_axes, `${label}.metrics.certificate_covered_omitted_axes`),
+            certificate_covered_dependency_edges: nonnegativeInteger(metrics.certificate_covered_dependency_edges, `${label}.metrics.certificate_covered_dependency_edges`),
+            canonical_dag_nodes: nonnegativeInteger(metrics.canonical_dag_nodes, `${label}.metrics.canonical_dag_nodes`),
+            canonical_partition_edges: nonnegativeInteger(metrics.canonical_partition_edges, `${label}.metrics.canonical_partition_edges`),
+            canonical_bytes: nonnegativeInteger(metrics.canonical_bytes, `${label}.metrics.canonical_bytes`),
+            theoretical_ground_cardinality: string(metrics.theoretical_ground_cardinality, `${label}.metrics.theoretical_ground_cardinality`),
+        },
+    };
+}
 function parseAcceptanceBlockers(value, label) {
     return array(value, label).map((item, index) => {
         const itemLabel = `${label}[${index}]`;

package/dist/lib/long-task-ui-surface-types.d.ts

@@ -1,6 +1,7 @@
 import type { DesignResourceVerificationMethod } from "./design-resource-handoff-types.js";
 import type { DesignResourceComparator, DesignResourceLocatedDigestV1 } from "./design-resource-fact-manifest-types.js";
 import type { ExecutionTargetCapabilityV2 } from "./execution-target-capabilities.js";
+import type { SymbolicExtensionalPointV1 } from "./symbolic-denotation-types.js";
 export type DesignTargetInterpretationV2 = "exact_target" | "constraint";
 export interface DeliveryDesignFactExpectationV2 {
     fact_ref: string;
@@ -40,8 +41,58 @@ export interface DeliveryDesignVerificationBindingV2 {
         fact_expectations: DeliveryDesignFactExpectationV2[];
     }>;
 }
+export interface DeliveryDesignSymbolicRuleExpectationV2 {
+    obligation_ref: string;
+    fact_rule_ref: string;
+    region_sha256: string;
+    subject_or_relation_ref: string;
+    property_ref: string;
+    population_ref: string | null;
+    quantifier: SymbolicExtensionalPointV1["quantifier"];
+    observation_sensitivity: "plain" | "protected";
+    expected: DesignResourceLocatedDigestV1;
+    proof_surface: string;
+    observation_boundary: string;
+    comparison: DeliveryDesignFactExpectationV2["comparison"];
+    oracle: DeliveryDesignFactExpectationV2["oracle"];
+    environment: DeliveryDesignFactExpectationV2["environment"];
+    protected_value_policy: string;
+    completion_effect: string;
+}
+export interface DeliveryDesignSymbolicVerificationBindingV2 {
+    method: DesignResourceVerificationMethod;
+    assertion_ref: string;
+    artifact_path: string;
+    observation_path: string;
+    rule_expectations: DeliveryDesignSymbolicRuleExpectationV2[];
+}
+export interface DeliveryDesignSymbolicCertificateExpectationV2 {
+    certificate_ref: string;
+    fact_rule_refs: string[];
+    omitted_axis_refs: string[];
+    dependency_edge_refs: string[];
+    canonical_rule_dag_sha256: string;
+    source_noninterference_proof_sha256?: string;
+    production_noninterference_proof_sha256?: string;
+}
+export interface DeliveryDesignSymbolicCertificateBindingV2 {
+    assertion_ref: string;
+    artifact_path: string;
+    expectations: DeliveryDesignSymbolicCertificateExpectationV2[];
+    metrics: {
+        semantic_obligations: number;
+        certificate_obligations: number;
+        certificate_covered_omitted_axes: number;
+        certificate_covered_dependency_edges: number;
+        canonical_dag_nodes: number;
+        canonical_partition_edges: number;
+        canonical_bytes: number;
+        theoretical_ground_cardinality: string;
+    };
+}
 export interface DeliveryDesignTargetV2 {
     key: string;
+    fact_model?: "symbolic_rules_v2";
     interpretation: DesignTargetInterpretationV2;
     source_paths: string[];
     condition_keys: string[];
@@ -49,6 +100,8 @@ export interface DeliveryDesignTargetV2 {
     conformance_check_ref: string;
     conformance_assertion_ref: string;
     verification_method_bindings: DeliveryDesignVerificationBindingV2[];
+    symbolic_method_bindings?: DeliveryDesignSymbolicVerificationBindingV2[];
+    symbolic_certificate_binding?: DeliveryDesignSymbolicCertificateBindingV2;
     actual_artifact_path: string;
     comparison_artifact_path: string;
 }

package/dist/lib/long-task-verifier-dependency-closure.js

@@ -167,11 +167,15 @@ function localSpecifierBase(importer, specifier) {
     const base = specifier.startsWith("/")
         ? specifier.slice(1)
         : path.posix.normalize(path.posix.join(path.posix.dirname(importer), specifier));
-    return base === ".." || base.startsWith("../") ? null : base;
+    const canonicalBase = base.replace(/\/+$/u, "") || ".";
+    return canonicalBase === ".." || canonicalBase.startsWith("../")
+        ? null
+        : canonicalBase;
 }
 function runtimePatternOwns(base, pattern) {
-    return (matchesRepoPattern(base, pattern) ||
-        classifyRepositoryPatternOverlap(`${base}/**`, pattern).status ===
+    const directoryPattern = base === "." ? "**" : `${base}/**`;
+    return ((base !== "." && matchesRepoPattern(base, pattern)) ||
+        classifyRepositoryPatternOverlap(directoryPattern, pattern).status ===
             "proven_overlap");
 }
 function sortRecord(value) {

package/dist/lib/long-task-verifier-v2.js

@@ -2,6 +2,7 @@ import { deliveryCompileFreshness } from "./long-task-freshness.js";
 import { assertVerifierAuthorityCurrent } from "./long-task-freshness.js";
 import { enrichCheckResultFindings, enrichFinding, } from "./long-task-finding-context.js";
 import { executeCheckRunner } from "./long-task-check-runner.js";
+import { prepareExecutionObservationUniverse } from "./long-task-execution-observation.js";
 import { evaluateCheckEvidence, evaluateGlobalCounterfactuals, evaluateOutcomeCounterfactuals, } from "./long-task-evidence-v2.js";
 import { matchesRepoPattern } from "./long-task-paths.js";
 import { activeAuthorityIdentityMatches, loadActiveLongTaskAuthority, writeProgressRecord, } from "./long-task-state.js";
@@ -85,6 +86,12 @@ async function resolved(workdir) {
     return (await import("node:path")).default.resolve(workdir);
 }
 export async function runDeliveryChecks(compiled, snapshot, checks, includeCounterfactuals, finalGate = false) {
+    const observationAuthorityPaths = [
+        compiled.contract_file,
+        ...Object.keys(compiled.contract_files),
+        ...Object.keys(compiled.source_hashes),
+        ...compiled.context_snapshot.files,
+    ];
     const findings = await preRunFindings(compiled, snapshot.manifest);
     if (finalGate)
         findings.push(...finalPathFindings(compiled, snapshot.manifest));
@@ -95,17 +102,46 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             findings: findings.map((finding) => enrichFinding(compiled, finding)),
         };
     const rawExecutions = new Map();
+    const completeChecks = allCompiledChecks(compiled);
+    const selectedExecutionGroups = rawExecutionGroups(checks);
+    const completeExecutionGroups = selectedExecutionGroups.map((group) => completeChecks.filter((check) => check.raw_execution_identity === group[0].raw_execution_identity));
+    const preparedExecutionGroups = await prepareExecutionObservationUniverse({
+        groups: completeExecutionGroups,
+        snapshot_root: snapshot.root,
+        workspace_manifest: snapshot.manifest,
+        protected_authority_paths: observationAuthorityPaths,
+    });
+    try {
+        const pending = [];
+        for (const [index, group] of selectedExecutionGroups.entries()) {
+            const prepared = preparedExecutionGroups[index];
+            if (!prepared)
+                throw new Error("raw_execution_group_prepare_missing");
+            pending.push({
+                raw_execution_identity: group[0].raw_execution_identity,
+                raw: await executeCheckRunner(group[0], prepared.execution_root, prepared.runner_context),
+                prepared,
+            });
+        }
+        const finalized = await Promise.all(pending.map(async (entry) => ({
+            raw_execution_identity: entry.raw_execution_identity,
+            raw: await entry.prepared.finalize(entry.raw),
+        })));
+        for (const entry of finalized)
+            rawExecutions.set(entry.raw_execution_identity, entry.raw);
+    }
+    finally {
+        await Promise.all(preparedExecutionGroups.map((prepared) => prepared.dispose()));
+    }
     const mainCheckResults = [];
     for (const check of checks) {
-        let raw = rawExecutions.get(check.raw_execution_identity);
-        if (!raw) {
-            raw = await executeCheckRunner(check, snapshot.root);
-            rawExecutions.set(check.raw_execution_identity, raw);
-        }
+        const raw = rawExecutions.get(check.raw_execution_identity);
+        if (!raw)
+            throw new Error("raw_execution_group_result_missing");
         const outcome = check.outcome_key
             ? compiled.outcomes.find((item) => item.key === check.outcome_key)
             : undefined;
-        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome));
+        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome, observationAuthorityPaths));
     }
     const counterfactualFindings = [];
     if (includeCounterfactuals) {
@@ -122,7 +158,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             passingCheckIds.has(check.internal_id))
             .map((check) => check.key));
         if (selectedGlobalCheckKeys.size)
-            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest)));
+            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest, mainCheckResults, rawExecutions, completeChecks)));
         const outcomeKeys = new Set(checks
             .map((check) => check.outcome_key)
             .filter((key) => Boolean(key)));
@@ -137,7 +173,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
                     ...outcome.acceptance,
                     counterfactual_controls: outcome.acceptance.counterfactual_controls.filter((control) => selectedKeys.has(control.check_key)),
                 },
-            }, snapshot.root, snapshot.manifest)));
+            }, snapshot.root, snapshot.manifest, observationAuthorityPaths, mainCheckResults, rawExecutions, completeChecks)));
         }
     }
     const unassignedCounterfactuals = counterfactualFindings.filter((finding) => !mainCheckResults.some((result) => findingBelongsToCheck(finding, result)));
@@ -154,6 +190,17 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
         findings: findings.map((finding) => enrichFinding(compiled, finding)),
     };
 }
+function rawExecutionGroups(checks) {
+    const groups = new Map();
+    for (const check of checks) {
+        const group = groups.get(check.raw_execution_identity);
+        if (group)
+            group.push(check);
+        else
+            groups.set(check.raw_execution_identity, [check]);
+    }
+    return [...groups.values()];
+}
 function applyCounterfactualFindings(checkResults, findings, unassignedFinding) {
     return checkResults.map((result, index) => {
         const projected = findings.filter((finding) => findingBelongsToCheck(finding, result));
@@ -200,7 +247,9 @@ function finalPathFindings(compiled, manifest) {
     for (const outcome of compiled.outcomes)
         for (const binding of outcome.technical.bindings)
             if (binding.existence === "planned" &&
-                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))))
+                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))) &&
+                !outcome.acceptance.checks.some((check) => (check.observation_authorities ?? []).some((authority) => authority.authority === "package_static_json_exact" &&
+                    authority.carrier_refs.some((carrier) => carrier.binding_ref === `${outcome.key}.${binding.key}`))))
                 findings.push({
                     code: "binding_missing",
                     outcome_key: outcome.key,
@@ -212,6 +261,18 @@ function finalPathFindings(compiled, manifest) {
                     expected: binding.carrier_paths,
                     next_action: "Implement the declared binding and rerun verification.",
                 });
+    for (const check of allCompiledChecks(compiled))
+        for (const runtimePath of check.process_runtime_closure
+            ?.allowed_runtime_files ?? [])
+            if (!manifest.files.some((file) => file.path === runtimePath))
+                findings.push({
+                    code: "process_runtime_input_missing",
+                    outcome_key: check.outcome_key,
+                    check_key: check.key,
+                    message: `Declared process runtime input did not exist in the Final Gate candidate: ${runtimePath}`,
+                    expected: runtimePath,
+                    next_action: "Materialize the Source-backed product root and every declared production runtime input, then rerun Final Gate.",
+                });
     return findings;
 }
 function plannedBindingRequiredPatterns(binding) {

package/dist/lib/long-task-worker-selection.d.ts

@@ -0,0 +1,2 @@
+export declare const LONG_TASK_IMPLEMENTATION_AGENT = "long_task_implementation";
+export declare function selectedAgentType(toolInput: unknown): string | null;

package/dist/lib/long-task-worker-selection.js

@@ -0,0 +1,7 @@
+export const LONG_TASK_IMPLEMENTATION_AGENT = "long_task_implementation";
+export function selectedAgentType(toolInput) {
+    if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput))
+        return null;
+    const value = toolInput.agent_type;
+    return typeof value === "string" && value.length > 0 ? value : null;
+}

package/dist/lib/long-task-workspace-scope.js

@@ -3,8 +3,9 @@ import { readConfig } from "./config.js";
 import { harnessConfigPath, harnessPath, harnessRoot } from "./harness-root.js";
 import { listFiles, pathExists } from "./fs.js";
 import { matchesRepoPattern, normalizeRepositoryFile, } from "./long-task-paths.js";
+import { longTaskCodexAgentProfileBootstrapPaths } from "./long-task-codex-agent-profile.js";
 import { packageAssetPath } from "./paths.js";
-import { enabledManagedSkillNames } from "./profiles.js";
+import { enabledManagedSkillNames, isProfileEnabled } from "./profiles.js";
 export function classifyWorkspaceScope(authority, changedPaths, protectedPaths) {
     const protectedSet = new Set(normalizeFiles(protectedPaths));
     const expectedPatterns = authority.outcomes.flatMap((outcome) => outcome.technical.expected_change_paths);
@@ -51,6 +52,7 @@ export async function firstLockManagedWorkspacePaths(repository, changedPaths) {
     const managedFiles = new Set([
         await harnessConfigPath(repository),
         ".codex/hooks.json",
+        ...(await longTaskCodexAgentProfileBootstrapPaths(repository, root, isProfileEnabled(config, "long-task"))),
         ...(await packageManagedBootstrapFiles(root, config)),
     ].map(normalizeManagedRoot));
     return normalizeFiles(changedPaths).filter((file) => managedFiles.has(file));

package/dist/lib/long-task-workspace.d.ts

@@ -1,3 +1,4 @@
+export { resolveInsideRepository } from "./repository-path-safety.js";
 import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
 export interface WorkspaceSnapshotV2 {
     root: string;
@@ -22,5 +23,4 @@ export declare function gitPath(root: string, pathSpec: string): Promise<string>
 export declare function gitConfigGet(root: string, name: string): Promise<string | null>;
 export declare function gitConfigSet(root: string, name: string, value: string): Promise<void>;
 export declare function gitConfigUnset(root: string, name: string): Promise<void>;
-export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
 export declare function repoRelative(rootInput: string, fileInput: string): string;

package/dist/lib/long-task-workspace.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+export { resolveInsideRepository } from "./repository-path-safety.js";
 import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
 export async function repositoryRoot(start) {
     const resolved = path.resolve(start);
@@ -247,18 +248,6 @@ export async function gitConfigUnset(root, name) {
             throw error;
     }
 }
-export function resolveInsideRepository(rootInput, relativeInput, label) {
-    if (!relativeInput || path.isAbsolute(relativeInput))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    const normalized = relativeInput.replace(/\\/gu, "/");
-    if (normalized.split("/").includes(".."))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    const root = path.resolve(rootInput);
-    const resolved = path.resolve(root, ...normalized.split("/"));
-    if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    return resolved;
-}
 export function repoRelative(rootInput, fileInput) {
     const value = path
         .relative(path.resolve(rootInput), path.resolve(fileInput))
@@ -317,7 +306,7 @@ async function removeExcludedSnapshotPaths(snapshotRoot, excluded) {
 async function overlayTrackedEolDifferences(sourceRoot, snapshotRoot) {
     const [raw, autocrlf] = await Promise.all([
         gitBuffer(sourceRoot, ["ls-files", "--eol", "-z"]),
-        gitConfigGet(sourceRoot, "core.autocrlf"),
+        gitEffectiveConfigGet(sourceRoot, "core.autocrlf"),
     ]);
     for (const record of splitZero(raw)) {
         const tab = record.indexOf("\t");
@@ -341,6 +330,16 @@ async function overlayTrackedEolDifferences(sourceRoot, snapshotRoot) {
         await copyFile(source, target);
     }
 }
+async function gitEffectiveConfigGet(root, name) {
+    try {
+        return await gitOutput(root, ["config", "--get", name]);
+    }
+    catch (error) {
+        if (message(error).includes("git_exit:1"))
+            return null;
+        throw error;
+    }
+}
 function checkoutEol(indexEol, attributes, autocrlf) {
     const explicit = attributes.match(/(?:^|\s)eol=(lf|crlf)(?:\s|$)/u)?.[1];
     if (explicit)

package/dist/lib/migrations.js

@@ -17,6 +17,8 @@ async function verifyNoop() {
 }
 const REMOVED_NORMAL_LONG_TASK_SKILL = "normal-long-task";
 const REMOVED_NORMAL_LONG_TASK_SKILL_SHA256 = "7a4f755da9a32e07f258d6c7fc5e5c70395257c72efb8a9ad4995cddcc4c73ba";
+const REMOVED_SOURCE_PLAN_SKILL = "source-plan-authoring";
+const REMOVED_SOURCE_PLAN_SKILL_SHA256 = "902de1cca912a8c4a0f26461d0271f5fb87b970316b58efe1c06418f4531f10f";
 export const migrations = [
     legacySdlcHarnessMigration,
     modularityCapabilityWaiverMigration,
@@ -41,6 +43,17 @@ export const migrations = [
         apply: migrateRemovedNormalLongTaskSkill,
         verify: verifyRemovedNormalLongTaskSkill,
     },
+    {
+        id: "remove-source-plan-authoring-skill",
+        introducedIn: "0.8.12",
+        description: "Remove the retired source-plan-authoring compatibility pointer; long-task-workflow owns machine-assurance Source authoring and legacy Source Plans remain ordinary Source.",
+        scope: "<harnessRoot>/skills/source-plan-authoring",
+        risk: "safe",
+        manualMessage: "The same-name directory differs from the former package-owned compatibility pointer. Preserve the user-authored Skill or move its content explicitly; Tiny Context will not delete it.",
+        detect: detectRemovedSourcePlanSkill,
+        apply: migrateRemovedSourcePlanSkill,
+        verify: verifyRemovedSourcePlanSkill,
+    },
     {
         id: "long-task-v1-retirement",
         introducedIn: "0.6.0",
@@ -178,6 +191,51 @@ async function verifyRemovedNormalLongTaskSkill(projectRoot, root) {
         throw new Error("remove-normal-long-task-skill migration verification failed");
     }
 }
+async function detectRemovedSourcePlanSkill(projectRoot, root, migration) {
+    const skill = removedSourcePlanSkillPath(projectRoot, root);
+    const state = await removedSourcePlanSkillState(skill);
+    if (state === "absent")
+        return [];
+    const relative = path.relative(projectRoot, skill).split(path.sep).join("/");
+    return [
+        item(migration, state === "package-owned" ? "safe_pending" : "manual_required", relative, state === "package-owned"
+            ? "Remove the exact retired package-owned Source Plan compatibility pointer."
+            : "The retired same-name Skill contains modified or additional content; preserve it and resolve removal manually."),
+    ];
+}
+async function migrateRemovedSourcePlanSkill(projectRoot, root, report) {
+    const skill = removedSourcePlanSkillPath(projectRoot, root);
+    const state = await removedSourcePlanSkillState(skill);
+    const relative = path.relative(projectRoot, skill).split(path.sep).join("/");
+    if (state === "absent") {
+        report.skipped.push("remove-source-plan-authoring-skill");
+        return;
+    }
+    if (state !== "package-owned")
+        throw new Error(`${relative} changed after upgrade planning; rerun upgrade and resolve the manual_required item`);
+    await fs.rm(skill, { recursive: true, force: true });
+    report.changed.push(relative);
+}
+async function verifyRemovedSourcePlanSkill(projectRoot, root) {
+    if (await pathExists(removedSourcePlanSkillPath(projectRoot, root)))
+        throw new Error("remove-source-plan-authoring-skill migration verification failed");
+}
+function removedSourcePlanSkillPath(projectRoot, root) {
+    return path.join(projectRoot, root, "skills", REMOVED_SOURCE_PLAN_SKILL);
+}
+async function removedSourcePlanSkillState(skill) {
+    if (!(await pathExists(skill)))
+        return "absent";
+    const files = await listFiles(skill);
+    if (files.length !== 1 ||
+        path.relative(skill, files[0]).split(path.sep).join("/") !== "SKILL.md")
+        return "modified";
+    const normalized = (await readText(files[0])).replace(/\r\n/g, "\n");
+    const digest = createHash("sha256").update(normalized).digest("hex");
+    return digest === REMOVED_SOURCE_PLAN_SKILL_SHA256
+        ? "package-owned"
+        : "modified";
+}
 function removedNormalLongTaskSkillPath(projectRoot, root) {
     return path.join(projectRoot, root, "skills", REMOVED_NORMAL_LONG_TASK_SKILL);
 }

package/dist/lib/profiles.js

@@ -60,7 +60,6 @@ export function enabledManagedSkillNames(config) {
     ]);
     if (isProfileEnabled(config, "long-task")) {
         names.add("long-task-workflow");
-        names.add("source-plan-authoring");
     }
     return names;
 }

package/dist/lib/repository-path-safety.d.ts

@@ -0,0 +1,14 @@
+import type { Stats } from "node:fs";
+export interface SafeRepositoryPath {
+    repository: string;
+    absolute: string;
+    relative: string;
+}
+export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
+export declare function assertProtectedRepositoryFile(repositoryInput: string, fileInput: string, label: string): Promise<string>;
+export declare function assertSafeRepositoryFilePath(repositoryInput: string, relativeInput: string, label: string, options?: {
+    destinationMayBeAbsent?: boolean;
+}): Promise<SafeRepositoryPath & {
+    status: Stats | null;
+}>;
+export declare function ensureSafeRepositoryDirectory(repositoryInput: string, relativeInput: string, label: string): Promise<SafeRepositoryPath>;