project-tiny-context-harness 0.8.12 → 0.8.13

package/dist/lib/long-task-status-projection.js

@@ -1,3 +1,4 @@
+import { outcomeResultExternallyBlocked } from "./long-task-claims.js";
 import { progressRecordFresh } from "./long-task-progress.js";
 export function projectDeliveryStatus(input) {
     const outcomes = projectOutcomes(input);
@@ -46,7 +47,8 @@ function projectOutcomes(input) {
         });
         outcomes[outcome.key] = states.includes("progress_failing")
             ? "progress_failing"
-            : states.includes("blocked_external")
+            : outcomeResultExternallyBlocked(input.compiled, outcome.key) ||
+                states.includes("blocked_external")
                 ? "blocked_external"
                 : states.includes("progress_stale")
                     ? "progress_stale"
@@ -99,7 +101,9 @@ function projectFindings(input) {
 function readyOutcomes(compiled, outcomes, stages) {
     return compiled.outcomes
         .filter((outcome) => stages[outcome.stage] !== "locked" &&
+        stages[outcome.stage] !== "blocked_external" &&
         stages[outcome.stage] !== "progress_passing" &&
+        outcomes[outcome.key] !== "blocked_external" &&
         outcomes[outcome.key] !== "progress_passing" &&
         outcome.depends_on.every((dependency) => outcomes[dependency] === "progress_passing"))
         .map((outcome) => outcome.key);

package/dist/lib/long-task-target-policy.d.ts

@@ -1,4 +1,4 @@
-import type { CompiledClaimsV2 } from "./long-task-claims.js";
+import { type CompiledClaimsV2 } from "./long-task-claims.js";
 import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
 type Reporter = (message: string) => void;
 export declare function validateExecutionTargets(contract: DeliveryContractV2, report?: Reporter): void;

package/dist/lib/long-task-target-policy.js

@@ -1,3 +1,4 @@
+import { outcomeResultExternallyBlocked, } from "./long-task-claims.js";
 const FAMILY_CAPABILITY = {
     browser: "browser-runtime",
     native: "native-runtime",
@@ -94,6 +95,8 @@ function validateCriticalPathTargets(contract, requiredTargetRefs, report) {
         const outcome = contract.outcomes.find((candidate) => candidate.key === outcomeKey);
         if (!outcome)
             continue;
+        if (outcomeResultExternallyBlocked(contract, outcome.key))
+            continue;
         for (const targetRef of requiredTargetRefs)
             if (!outcome.acceptance.checks.some((check) => provesSuccess(check, targetRef)))
                 issue(report, "critical_path_required_target_proof_missing", `${outcome.key}:${targetRef}`);

package/dist/lib/long-task-verifier-dependency-closure.js

@@ -167,11 +167,15 @@ function localSpecifierBase(importer, specifier) {
     const base = specifier.startsWith("/")
         ? specifier.slice(1)
         : path.posix.normalize(path.posix.join(path.posix.dirname(importer), specifier));
-    return base === ".." || base.startsWith("../") ? null : base;
+    const canonicalBase = base.replace(/\/+$/u, "") || ".";
+    return canonicalBase === ".." || canonicalBase.startsWith("../")
+        ? null
+        : canonicalBase;
 }
 function runtimePatternOwns(base, pattern) {
-    return (matchesRepoPattern(base, pattern) ||
-        classifyRepositoryPatternOverlap(`${base}/**`, pattern).status ===
+    const directoryPattern = base === "." ? "**" : `${base}/**`;
+    return ((base !== "." && matchesRepoPattern(base, pattern)) ||
+        classifyRepositoryPatternOverlap(directoryPattern, pattern).status ===
             "proven_overlap");
 }
 function sortRecord(value) {

package/dist/lib/long-task-verifier-v2.js

@@ -2,6 +2,7 @@ import { deliveryCompileFreshness } from "./long-task-freshness.js";
 import { assertVerifierAuthorityCurrent } from "./long-task-freshness.js";
 import { enrichCheckResultFindings, enrichFinding, } from "./long-task-finding-context.js";
 import { executeCheckRunner } from "./long-task-check-runner.js";
+import { prepareExecutionObservationUniverse } from "./long-task-execution-observation.js";
 import { evaluateCheckEvidence, evaluateGlobalCounterfactuals, evaluateOutcomeCounterfactuals, } from "./long-task-evidence-v2.js";
 import { matchesRepoPattern } from "./long-task-paths.js";
 import { activeAuthorityIdentityMatches, loadActiveLongTaskAuthority, writeProgressRecord, } from "./long-task-state.js";
@@ -85,6 +86,12 @@ async function resolved(workdir) {
     return (await import("node:path")).default.resolve(workdir);
 }
 export async function runDeliveryChecks(compiled, snapshot, checks, includeCounterfactuals, finalGate = false) {
+    const observationAuthorityPaths = [
+        compiled.contract_file,
+        ...Object.keys(compiled.contract_files),
+        ...Object.keys(compiled.source_hashes),
+        ...compiled.context_snapshot.files,
+    ];
     const findings = await preRunFindings(compiled, snapshot.manifest);
     if (finalGate)
         findings.push(...finalPathFindings(compiled, snapshot.manifest));
@@ -95,17 +102,46 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             findings: findings.map((finding) => enrichFinding(compiled, finding)),
         };
     const rawExecutions = new Map();
+    const completeChecks = allCompiledChecks(compiled);
+    const selectedExecutionGroups = rawExecutionGroups(checks);
+    const completeExecutionGroups = selectedExecutionGroups.map((group) => completeChecks.filter((check) => check.raw_execution_identity === group[0].raw_execution_identity));
+    const preparedExecutionGroups = await prepareExecutionObservationUniverse({
+        groups: completeExecutionGroups,
+        snapshot_root: snapshot.root,
+        workspace_manifest: snapshot.manifest,
+        protected_authority_paths: observationAuthorityPaths,
+    });
+    try {
+        const pending = [];
+        for (const [index, group] of selectedExecutionGroups.entries()) {
+            const prepared = preparedExecutionGroups[index];
+            if (!prepared)
+                throw new Error("raw_execution_group_prepare_missing");
+            pending.push({
+                raw_execution_identity: group[0].raw_execution_identity,
+                raw: await executeCheckRunner(group[0], prepared.execution_root, prepared.runner_context),
+                prepared,
+            });
+        }
+        const finalized = await Promise.all(pending.map(async (entry) => ({
+            raw_execution_identity: entry.raw_execution_identity,
+            raw: await entry.prepared.finalize(entry.raw),
+        })));
+        for (const entry of finalized)
+            rawExecutions.set(entry.raw_execution_identity, entry.raw);
+    }
+    finally {
+        await Promise.all(preparedExecutionGroups.map((prepared) => prepared.dispose()));
+    }
     const mainCheckResults = [];
     for (const check of checks) {
-        let raw = rawExecutions.get(check.raw_execution_identity);
-        if (!raw) {
-            raw = await executeCheckRunner(check, snapshot.root);
-            rawExecutions.set(check.raw_execution_identity, raw);
-        }
+        const raw = rawExecutions.get(check.raw_execution_identity);
+        if (!raw)
+            throw new Error("raw_execution_group_result_missing");
         const outcome = check.outcome_key
             ? compiled.outcomes.find((item) => item.key === check.outcome_key)
             : undefined;
-        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome));
+        mainCheckResults.push(await evaluateCheckEvidence(check, raw, snapshot.root, outcome, observationAuthorityPaths));
     }
     const counterfactualFindings = [];
     if (includeCounterfactuals) {
@@ -122,7 +158,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
             passingCheckIds.has(check.internal_id))
             .map((check) => check.key));
         if (selectedGlobalCheckKeys.size)
-            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest)));
+            counterfactualFindings.push(...(await evaluateGlobalCounterfactuals(compiled, snapshot.root, selectedGlobalCheckKeys, snapshot.manifest, mainCheckResults, rawExecutions, completeChecks)));
         const outcomeKeys = new Set(checks
             .map((check) => check.outcome_key)
             .filter((key) => Boolean(key)));
@@ -137,7 +173,7 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
                     ...outcome.acceptance,
                     counterfactual_controls: outcome.acceptance.counterfactual_controls.filter((control) => selectedKeys.has(control.check_key)),
                 },
-            }, snapshot.root, snapshot.manifest, compiled.context_snapshot.files)));
+            }, snapshot.root, snapshot.manifest, observationAuthorityPaths, mainCheckResults, rawExecutions, completeChecks)));
         }
     }
     const unassignedCounterfactuals = counterfactualFindings.filter((finding) => !mainCheckResults.some((result) => findingBelongsToCheck(finding, result)));
@@ -154,6 +190,17 @@ export async function runDeliveryChecks(compiled, snapshot, checks, includeCount
         findings: findings.map((finding) => enrichFinding(compiled, finding)),
     };
 }
+function rawExecutionGroups(checks) {
+    const groups = new Map();
+    for (const check of checks) {
+        const group = groups.get(check.raw_execution_identity);
+        if (group)
+            group.push(check);
+        else
+            groups.set(check.raw_execution_identity, [check]);
+    }
+    return [...groups.values()];
+}
 function applyCounterfactualFindings(checkResults, findings, unassignedFinding) {
     return checkResults.map((result, index) => {
         const projected = findings.filter((finding) => findingBelongsToCheck(finding, result));
@@ -200,7 +247,9 @@ function finalPathFindings(compiled, manifest) {
     for (const outcome of compiled.outcomes)
         for (const binding of outcome.technical.bindings)
             if (binding.existence === "planned" &&
-                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))))
+                !plannedBindingRequiredPatterns(binding).every((pattern) => manifest.files.some((file) => matchesRepoPattern(file.path, pattern))) &&
+                !outcome.acceptance.checks.some((check) => (check.observation_authorities ?? []).some((authority) => authority.authority === "package_static_json_exact" &&
+                    authority.carrier_refs.some((carrier) => carrier.binding_ref === `${outcome.key}.${binding.key}`))))
                 findings.push({
                     code: "binding_missing",
                     outcome_key: outcome.key,
@@ -212,6 +261,18 @@ function finalPathFindings(compiled, manifest) {
                     expected: binding.carrier_paths,
                     next_action: "Implement the declared binding and rerun verification.",
                 });
+    for (const check of allCompiledChecks(compiled))
+        for (const runtimePath of check.process_runtime_closure
+            ?.allowed_runtime_files ?? [])
+            if (!manifest.files.some((file) => file.path === runtimePath))
+                findings.push({
+                    code: "process_runtime_input_missing",
+                    outcome_key: check.outcome_key,
+                    check_key: check.key,
+                    message: `Declared process runtime input did not exist in the Final Gate candidate: ${runtimePath}`,
+                    expected: runtimePath,
+                    next_action: "Materialize the Source-backed product root and every declared production runtime input, then rerun Final Gate.",
+                });
     return findings;
 }
 function plannedBindingRequiredPatterns(binding) {

package/dist/lib/long-task-workspace.d.ts

@@ -1,3 +1,4 @@
+export { resolveInsideRepository } from "./repository-path-safety.js";
 import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
 export interface WorkspaceSnapshotV2 {
     root: string;
@@ -22,5 +23,4 @@ export declare function gitPath(root: string, pathSpec: string): Promise<string>
 export declare function gitConfigGet(root: string, name: string): Promise<string | null>;
 export declare function gitConfigSet(root: string, name: string, value: string): Promise<void>;
 export declare function gitConfigUnset(root: string, name: string): Promise<void>;
-export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
 export declare function repoRelative(rootInput: string, fileInput: string): string;

package/dist/lib/long-task-workspace.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+export { resolveInsideRepository } from "./repository-path-safety.js";
 import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
 export async function repositoryRoot(start) {
     const resolved = path.resolve(start);
@@ -247,18 +248,6 @@ export async function gitConfigUnset(root, name) {
             throw error;
     }
 }
-export function resolveInsideRepository(rootInput, relativeInput, label) {
-    if (!relativeInput || path.isAbsolute(relativeInput))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    const normalized = relativeInput.replace(/\\/gu, "/");
-    if (normalized.split("/").includes(".."))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    const root = path.resolve(rootInput);
-    const resolved = path.resolve(root, ...normalized.split("/"));
-    if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
-        throw new Error(`unsafe_path:${label}:${relativeInput}`);
-    return resolved;
-}
 export function repoRelative(rootInput, fileInput) {
     const value = path
         .relative(path.resolve(rootInput), path.resolve(fileInput))

package/dist/lib/repository-path-safety.d.ts

@@ -0,0 +1,14 @@
+import type { Stats } from "node:fs";
+export interface SafeRepositoryPath {
+    repository: string;
+    absolute: string;
+    relative: string;
+}
+export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
+export declare function assertProtectedRepositoryFile(repositoryInput: string, fileInput: string, label: string): Promise<string>;
+export declare function assertSafeRepositoryFilePath(repositoryInput: string, relativeInput: string, label: string, options?: {
+    destinationMayBeAbsent?: boolean;
+}): Promise<SafeRepositoryPath & {
+    status: Stats | null;
+}>;
+export declare function ensureSafeRepositoryDirectory(repositoryInput: string, relativeInput: string, label: string): Promise<SafeRepositoryPath>;

package/dist/lib/repository-path-safety.js

@@ -0,0 +1,126 @@
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import path from "node:path";
+export function resolveInsideRepository(rootInput, relativeInput, label) {
+    if (!relativeInput || path.isAbsolute(relativeInput))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    const normalized = relativeInput.replace(/\\/gu, "/");
+    if (normalized.split("/").some((segment) => segment === "..") ||
+        normalized.startsWith("//") ||
+        /^[A-Za-z]:/u.test(normalized))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    const root = path.resolve(rootInput);
+    const resolved = path.resolve(root, ...normalized.split("/"));
+    if (!inside(root, resolved))
+        throw new Error(`unsafe_path:${label}:${relativeInput}`);
+    return resolved;
+}
+export async function assertProtectedRepositoryFile(repositoryInput, fileInput, label) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const candidate = path.resolve(fileInput);
+    assertInside(repositoryPath, candidate, label, fileInput);
+    await assertExistingParents(repositoryPath, repository, candidate, label);
+    const info = await lstatOrNull(candidate);
+    if (!info)
+        throw new Error(`protected_input_not_found:${label}:${display(fileInput)}`);
+    assertRegularNoFollow(info, label, fileInput);
+    const resolved = await realpath(candidate);
+    assertInside(repository, resolved, label, fileInput);
+    return resolved;
+}
+export async function assertSafeRepositoryFilePath(repositoryInput, relativeInput, label, options = {}) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const absolute = resolveInsideRepository(repositoryPath, relativeInput, label);
+    await assertExistingParents(repositoryPath, repository, absolute, label);
+    const status = await lstatOrNull(absolute);
+    if (!status && !options.destinationMayBeAbsent)
+        throw new Error(`protected_input_not_found:${label}:${display(relativeInput)}`);
+    if (status) {
+        assertRegularNoFollow(status, label, relativeInput);
+        assertInside(repository, await realpath(absolute), label, relativeInput);
+    }
+    return {
+        repository,
+        absolute,
+        relative: repositoryRelative(repositoryPath, absolute, label),
+        status,
+    };
+}
+export async function ensureSafeRepositoryDirectory(repositoryInput, relativeInput, label) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const absolute = resolveInsideRepository(repositoryPath, relativeInput, label);
+    const relative = repositoryRelative(repositoryPath, absolute, label);
+    let cursor = repositoryPath;
+    for (const segment of relative.split(path.sep)) {
+        cursor = path.join(cursor, segment);
+        let status = await lstatOrNull(cursor);
+        if (!status) {
+            await mkdir(cursor).catch((error) => {
+                if (error.code !== "EEXIST")
+                    throw error;
+            });
+            status = await lstatOrNull(cursor);
+        }
+        if (!status || status.isSymbolicLink() || !status.isDirectory())
+            throw new Error(`unsafe_repository_directory:${label}:${display(relativeInput)}`);
+        assertInside(repository, await realpath(cursor), label, relativeInput);
+    }
+    return { repository, absolute, relative: relative.replace(/\\/gu, "/") };
+}
+async function assertExistingParents(lexicalRepository, canonicalRepository, candidate, label) {
+    const relative = repositoryRelative(lexicalRepository, path.dirname(candidate), label);
+    if (!relative)
+        return;
+    let cursor = lexicalRepository;
+    for (const segment of relative.split(path.sep)) {
+        cursor = path.join(cursor, segment);
+        const status = await lstatOrNull(cursor);
+        if (!status)
+            throw new Error(`protected_input_parent_not_found:${label}:${display(cursor)}`);
+        if (status.isSymbolicLink())
+            throw new Error(`protected_input_parent_symlink_not_allowed:${label}:${display(cursor)}`);
+        if (!status.isDirectory())
+            throw new Error(`protected_input_parent_not_directory:${label}:${display(cursor)}`);
+        assertInside(canonicalRepository, await realpath(cursor), label, cursor);
+    }
+}
+function assertRegularNoFollow(info, label, original) {
+    if (info.isSymbolicLink())
+        throw new Error(`protected_input_symlink_not_allowed:${label}:${display(original)}`);
+    if (!info.isFile())
+        throw new Error(`protected_input_not_regular_file:${label}:${display(original)}`);
+    if (typeof info.nlink === "number" && info.nlink > 1)
+        throw new Error(`protected_input_hardlink_not_allowed:${label}:${display(original)}`);
+}
+function repositoryRelative(repository, candidate, label) {
+    const relative = path.relative(repository, candidate);
+    if (!inside(repository, candidate))
+        throw new Error(`protected_input_realpath_outside_repository:${label}:${display(candidate)}`);
+    return relative;
+}
+function assertInside(repository, candidate, label, original) {
+    if (!inside(repository, candidate))
+        throw new Error(`protected_input_realpath_outside_repository:${label}:${display(original)}`);
+}
+function inside(repository, candidate) {
+    const relative = path.relative(repository, candidate);
+    return (relative === "" ||
+        (relative !== ".." &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative)));
+}
+async function lstatOrNull(target) {
+    try {
+        return await lstat(target);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function display(file) {
+    return file.replace(/\\/gu, "/");
+}

package/dist/schemas/long-task-delivery-v2/long-task-delivery-v2.schema.json

@@ -169,15 +169,39 @@
             ],
             "properties": {
                 "claims": { "type": "integer", "minimum": 0, "maximum": 1000000 },
-                "claim_projections": { "type": "integer", "minimum": 0, "maximum": 2000000 },
-                "selector_members": { "type": "integer", "minimum": 0, "maximum": 5000000 },
-                "structure_families": { "type": "integer", "minimum": 0, "maximum": 1000000 },
-                "structure_references": { "type": "integer", "minimum": 0, "maximum": 10000000 },
-                "structure_arguments": { "type": "integer", "minimum": 0, "maximum": 50000000 },
+                "claim_projections": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 2000000
+                },
+                "selector_members": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 5000000
+                },
+                "structure_families": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 1000000
+                },
+                "structure_references": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 10000000
+                },
+                "structure_arguments": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 50000000
+                },
                 "facts": { "type": "integer", "minimum": 0, "maximum": 1000000 },
                 "obligations": { "type": "integer", "minimum": 0, "maximum": 2000000 },
                 "assertions": { "type": "integer", "minimum": 0, "maximum": 5000000 },
-                "canonical_bytes": { "type": "integer", "minimum": 0, "maximum": 268435456 }
+                "canonical_bytes": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 268435456
+                }
             }
         },
         "longTaskCompactCarrier": {
@@ -229,9 +253,18 @@
                     "items": {
                         "type": "object",
                         "additionalProperties": false,
-                        "required": ["key", "digest", "boundary", "parameter_count", "template"],
+                        "required": [
+                            "key",
+                            "digest",
+                            "boundary",
+                            "parameter_count",
+                            "template"
+                        ],
                         "properties": {
-                            "key": { "type": "string", "pattern": "^structure\\.[a-f0-9]{24}$" },
+                            "key": {
+                                "type": "string",
+                                "pattern": "^structure\\.[a-f0-9]{24}$"
+                            },
                             "digest": { "$ref": "#/$defs/sha256" },
                             "boundary": { "$ref": "#/$defs/semanticRef" },
                             "parameter_count": { "type": "integer", "minimum": 0 },
@@ -464,6 +497,10 @@
                     ]
                 },
                 "root_entrypoint": { "$ref": "#/$defs/nonEmpty" },
+                "root_argv": {
+                    "type": "array",
+                    "items": { "type": "string", "pattern": "^[^\\u0000]*$" }
+                },
                 "capabilities": {
                     "type": "array",
                     "minItems": 1,
@@ -2011,6 +2048,10 @@
                 "check_key": { "$ref": "#/$defs/key" },
                 "expected_assertion_failures": { "$ref": "#/$defs/keys" },
                 "preserved_assertions": { "$ref": "#/$defs/keys", "default": [] },
+                "allowed_fanout_assertions": {
+                    "$ref": "#/$defs/keys",
+                    "default": []
+                },
                 "mutation": {
                     "oneOf": [
                         {
@@ -2091,6 +2132,10 @@
                     "uniqueItems": true
                 },
                 "preserved_assertions": { "$ref": "#/$defs/keys", "default": [] },
+                "allowed_fanout_assertions": {
+                    "$ref": "#/$defs/keys",
+                    "default": []
+                },
                 "mutation": {
                     "oneOf": [
                         {

package/migrations/README.md

@@ -13,3 +13,80 @@ V2 file predates explicit Stage, target-profile/root-runtime, journey-scenario,
 success/degradation, evidence-capability or external-impact authority. Those
 meanings must be re-authored from Source; migration never infers them from old
 Progress or Receipts.
+
+## Admitted-observation/runtime-TCB revision
+
+The next Long-Task compatibility boundary intentionally does not provide a
+mechanical Contract rewrite. Machine evidence that depends on a custom Oracle,
+a project-submitted runtime/interaction/state/verdict row, a runner-created or
+runner-modified carrier, an indirect wrapper, an unsupported target family or
+a Counterfactual with no package-admitted actual must be re-authored explicitly.
+Migration must never silently:
+
+- replace a custom Oracle with a package Oracle;
+- turn machine proof into `external_confirmation`;
+- replace a verifier wrapper with a product root entrypoint;
+- infer a static structure carrier from `Binding`/`input_paths` alone; or
+- infer a process runtime dependency from `input_paths`, runner or verification membership;
+- invent a Source-backed execution target or production Binding for an old root; or
+- preserve a known false-acceptance path as compatibility behavior.
+
+Greenfield authoring may declare an exact process root, argv repository file
+or production carrier as `planned`. Its exact Source/Binding declaration is
+stable through Preflight/Compile and later materialization, but Final Gate
+requires every compiled closure member to exist. A glob, a manifest sibling or
+an undeclared repository-file argv token cannot substitute; migration does not
+invent these exact declarations or parse language dependencies.
+
+Preflight and doctor should report the narrow failing obligation and an
+actionable manual route through diagnostics such as
+`machine_observer_not_admitted`,
+`semantic_fact_machine_observer_not_admitted`,
+`unsupported_observer_requires_external_confirmation`,
+`custom_oracle_machine_completion_forbidden`,
+`static_observation_not_in_pre_run_snapshot`,
+`static_observation_changed_by_runner`,
+`process_observer_direct_root_required`,
+`process_observer_root_invocation_required`,
+`process_observer_root_argv_mismatch`,
+`process_observation_input_changed_by_runner`,
+`process_runtime_input_expected_authority_forbidden`,
+`process_runtime_input_verification_role_forbidden`,
+`process_runtime_input_evidence_role_forbidden`,
+`process_root_source_binding_required`,
+`process_root_production_binding_required`,
+`process_root_source_identity_mismatch`,
+`process_runtime_carrier_exact_path_required`,
+`process_runtime_input_missing`,
+`process_runtime_closure_identity_mismatch`,
+`legacy_target_runtime_non_authoritative`,
+`counterfactual_admitted_observation_required`,
+`counterfactual_runtime_reachability_unproven` and
+`project_submitted_verdict_disagrees_with_harness`. The user or Agent must then
+choose an admitted static/direct-process observation or the existing blocking
+External Confirmation. That semantic choice is `manual_required`, not ordinary
+`sync` or a migration-registry inference; release guidance must therefore use
+the `manual-required` update mode for affected consumers.
+
+When the whole affected Outcome is unsupported, re-author it explicitly as an
+external-only route: set `success_path_required: false`, remove machine Checks,
+bind every ordinary/global and Semantic Fact Claim through exact
+`impact_claims`, keep every Semantic Fact proof's explicit `confirmation_ref`,
+and ensure a `blocks_target: true` confirmation impacts each
+Stage Gate result Claim. A non-blocking confirmation or one missing gate-result
+lineage cannot replace a Stage Gate, and migration never invents these choices.
+The valid route ends as `blocked_external`, not either machine-accepted status.
+
+Changing verifier identity, Compile admission policy or the observation TCB
+invalidates the prior Active Authority. The Contract must be recompiled or
+adopted through an explicit Authority Revision; old Progress, evidence and
+Receipt are not reusable on the new boundary. Public
+`long-task-check-result-v3` remains the compatibility payload, but its
+project-authored actual/pass/verdict/runtime fields are non-authoritative. The
+Harness-owned process adapter captures the separate
+`ty-context-product-observation-v1` envelope from bounded stdout inside an
+isolated frozen runtime-closure snapshot. It exposes no output-path, challenge
+or protocol environment variable to the child; any execution nonce remains
+internal host-attestation data. No v4 is introduced by this revision; a future
+v4 requires a distinct need to carry a live browser/native session handle
+across processes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "project-tiny-context-harness",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "description": "Minimal project memory and validation harness for AI coding agents.",
   "license": "MIT",
   "author": "Seven128",