project-tiny-context-harness 0.8.16 → 0.11.0

package/dist/lib/long-task-windows-job-supervisor-result.d.ts

@@ -0,0 +1,11 @@
+export interface WindowsJobSupervisorResult {
+    process_id: number;
+    exit_code: number;
+    timed_out: boolean;
+    output_overflow: boolean;
+    stdout_bytes: number;
+    stderr_bytes: number;
+    started_at: string;
+    completed_at: string;
+}
+export declare function parseWindowsJobSupervisorResult(line: string, requestId: string): WindowsJobSupervisorResult;

package/dist/lib/long-task-windows-job-supervisor-result.js

@@ -0,0 +1,152 @@
+import { parseStrictYaml } from "./strict-codec.js";
+const RESULT_FIELDS = [
+    "AccountingSourceKind",
+    "ActiveProcessesAtResult",
+    "CompletedUnixMs",
+    "DescendantsCleaned",
+    "Error",
+    "ExitCode",
+    "KernelCpu100Ns",
+    "MonotonicClockId",
+    "MonotonicCompletedNs",
+    "MonotonicStartedNs",
+    "OutputOverflow",
+    "ProcessId",
+    "RequestId",
+    "StartedUnixMs",
+    "StderrBytes",
+    "StdoutBytes",
+    "TimedOut",
+    "TotalCpu100Ns",
+    "TotalProcesses",
+    "TotalTerminatedProcesses",
+    "UserCpu100Ns",
+    "WallClockId",
+];
+const FAILURE_FIELDS = ["Error", "RequestId"];
+export function parseWindowsJobSupervisorResult(line, requestId) {
+    const response = parseResponse(line);
+    if (sameFields(response, FAILURE_FIELDS))
+        handleFailure(response, requestId);
+    assertFields(response, RESULT_FIELDS);
+    assertResultShape(response);
+    if (response.RequestId !== requestId)
+        invalidResult("response_identity");
+    if (response.ActiveProcessesAtResult !== 0 ||
+        response.DescendantsCleaned !== true)
+        throw new Error("process_observer_descendant_process_alive");
+    return {
+        process_id: response.ProcessId,
+        exit_code: response.ExitCode,
+        timed_out: response.TimedOut,
+        output_overflow: response.OutputOverflow,
+        stdout_bytes: response.StdoutBytes,
+        stderr_bytes: response.StderrBytes,
+        started_at: new Date(response.StartedUnixMs).toISOString(),
+        completed_at: new Date(response.CompletedUnixMs).toISOString(),
+    };
+}
+function parseResponse(line) {
+    try {
+        if (!line.startsWith("{") || !line.endsWith("}"))
+            throw new Error();
+        return record(parseStrictYaml(line));
+    }
+    catch {
+        invalidResult("response_json");
+    }
+}
+function handleFailure(response, requestId) {
+    if (response.RequestId !== requestId)
+        invalidResult("response_identity");
+    if (!validDiagnostic(response.Error))
+        invalidResult("failure_shape");
+    if (response.Error.includes("descendants_alive"))
+        throw new Error("process_observer_descendant_process_alive");
+    throw new Error(`process_observer_windows_job_unavailable:${response.Error}`);
+}
+function assertResultShape(response) {
+    assertCoreResult(response);
+    assertClockResult(response);
+    assertAccountingResult(response);
+}
+function assertCoreResult(response) {
+    if (response.Error !== null ||
+        !positiveSafeInteger(response.ProcessId) ||
+        !signedInt32(response.ExitCode) ||
+        typeof response.TimedOut !== "boolean" ||
+        typeof response.OutputOverflow !== "boolean" ||
+        typeof response.DescendantsCleaned !== "boolean" ||
+        !nonnegativeSafeInteger(response.StdoutBytes) ||
+        !nonnegativeSafeInteger(response.StderrBytes) ||
+        !Number.isSafeInteger(response.StdoutBytes + response.StderrBytes))
+        invalidResult("result_shape");
+}
+function assertClockResult(response) {
+    if (!validUnixMilliseconds(response.StartedUnixMs) ||
+        !validUnixMilliseconds(response.CompletedUnixMs) ||
+        response.CompletedUnixMs < response.StartedUnixMs ||
+        !decimalString(response.MonotonicStartedNs) ||
+        !decimalString(response.MonotonicCompletedNs) ||
+        BigInt(response.MonotonicCompletedNs) <
+            BigInt(response.MonotonicStartedNs) ||
+        response.MonotonicClockId !== "windows-stopwatch-qpc-v1" ||
+        response.WallClockId !== "unix-epoch-ms-v1")
+        invalidResult("result_shape");
+}
+function assertAccountingResult(response) {
+    if (!nonnegativeSafeInteger(response.UserCpu100Ns) ||
+        !nonnegativeSafeInteger(response.KernelCpu100Ns) ||
+        !nonnegativeSafeInteger(response.TotalCpu100Ns) ||
+        response.TotalCpu100Ns !==
+            response.UserCpu100Ns + response.KernelCpu100Ns ||
+        !positiveSafeInteger(response.TotalProcesses) ||
+        !nonnegativeSafeInteger(response.ActiveProcessesAtResult) ||
+        !nonnegativeSafeInteger(response.TotalTerminatedProcesses) ||
+        response.TotalTerminatedProcesses > response.TotalProcesses ||
+        response.AccountingSourceKind !== "windows-job-object-accounting-v1")
+        invalidResult("result_shape");
+}
+function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        invalidResult("response_shape");
+    return value;
+}
+function sameFields(value, expected) {
+    const actual = Object.keys(value).sort();
+    const sortedExpected = [...expected].sort();
+    return (actual.length === sortedExpected.length &&
+        actual.every((field, index) => field === sortedExpected[index]));
+}
+function assertFields(value, expected) {
+    if (!sameFields(value, expected))
+        invalidResult("response_fields");
+}
+function positiveSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) > 0;
+}
+function nonnegativeSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function signedInt32(value) {
+    return (Number.isSafeInteger(value) &&
+        Number(value) >= -2_147_483_648 &&
+        Number(value) <= 2_147_483_647);
+}
+function validUnixMilliseconds(value) {
+    return nonnegativeSafeInteger(value) && value <= 8_640_000_000_000_000;
+}
+function decimalString(value) {
+    return typeof value === "string" && /^[0-9]+$/u.test(value);
+}
+function validDiagnostic(value) {
+    return (typeof value === "string" &&
+        !value.includes("\u0000") &&
+        value.length > 0 &&
+        value.length <= 16_384 &&
+        !value.includes("\r") &&
+        !value.includes("\n"));
+}
+function invalidResult(detail) {
+    throw new Error(`process_observer_windows_job_result_invalid:${detail}`);
+}

package/dist/lib/long-task-windows-job-supervisor.d.ts

@@ -0,0 +1,2 @@
+import type { SpawnedCommandExecution } from "./long-task-command-process.js";
+export declare function spawnWindowsJobCommandOnce(executable: string, argv: string[], cwd: string, timeoutMs: number, environment: NodeJS.ProcessEnv, combinedOutputLimitBytes: number): Promise<SpawnedCommandExecution>;

package/dist/lib/long-task-windows-job-supervisor.js

@@ -0,0 +1,126 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdtemp, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { runOneWindowsJobHelperRequest } from "./long-task-windows-job-supervisor-helper.js";
+import { assertFreshWindowsJobStreamTarget, createWindowsJobSupervisorRequest, parseWindowsJobSupervisorResult, readWindowsJobStream, WINDOWS_JOB_SUPERVISOR_ASSET_RELATIVE_FILES, } from "./long-task-windows-job-supervisor-protocol.js";
+const HELPER_CLOSE_GRACE_MS = 10_000;
+export async function spawnWindowsJobCommandOnce(executable, argv, cwd, timeoutMs, environment, combinedOutputLimitBytes) {
+    if (process.platform !== "win32")
+        throw new Error("process_observer_windows_job_unavailable:platform");
+    const helper = await packageSupervisorHelper();
+    const powershell = await windowsPowerShellExecutable();
+    const createdTemporaryRoot = await mkdtemp(path.join(tmpdir(), "ty-context-windows-job-"));
+    const temporaryRoot = await assertPrivateTemporaryRoot(createdTemporaryRoot);
+    let execution;
+    let failure;
+    try {
+        const stdoutPath = path.join(temporaryRoot, "stdout.bin");
+        const stderrPath = path.join(temporaryRoot, "stderr.bin");
+        await Promise.all([
+            assertFreshWindowsJobStreamTarget(stdoutPath),
+            assertFreshWindowsJobStreamTarget(stderrPath),
+        ]);
+        const request = createWindowsJobSupervisorRequest({
+            requestId: randomUUID(),
+            executable,
+            argv,
+            cwd,
+            stdoutPath,
+            stderrPath,
+            timeoutMs,
+            combinedOutputLimitBytes,
+            environment,
+        });
+        const response = await runOneWindowsJobHelperRequest(powershell, helper, JSON.stringify(request), timeoutMs + HELPER_CLOSE_GRACE_MS);
+        const result = parseWindowsJobSupervisorResult(response, request.request_id);
+        const [stdout, stderr] = await Promise.all([
+            readWindowsJobStream(stdoutPath, result.stdout_bytes, combinedOutputLimitBytes),
+            readWindowsJobStream(stderrPath, result.stderr_bytes, combinedOutputLimitBytes),
+        ]);
+        if (stdout.length + stderr.length > combinedOutputLimitBytes)
+            throw new Error("process_observer_windows_job_result_invalid:stream_limit");
+        if (result.timed_out)
+            throw new Error("command_timeout");
+        if (result.output_overflow)
+            throw new Error("command_output_limit_exceeded");
+        execution = {
+            exit_code: result.exit_code,
+            stdout,
+            stderr,
+            pid: result.process_id,
+            started_at: result.started_at,
+            completed_at: result.completed_at,
+        };
+    }
+    catch (error) {
+        failure = error;
+    }
+    try {
+        await removePrivateTemporaryRoot(temporaryRoot);
+    }
+    catch (error) {
+        failure ??= new Error(`process_observer_windows_job_unavailable:cleanup:${message(error)}`);
+    }
+    if (failure)
+        throw failure;
+    return execution;
+}
+async function packageSupervisorHelper() {
+    const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
+    let helper = "";
+    try {
+        for (const relative of WINDOWS_JOB_SUPERVISOR_ASSET_RELATIVE_FILES) {
+            const file = await assertProtectedRepositoryFile(packageRoot, path.join(packageRoot, ...relative.split("/")), `windows_job_supervisor_asset:${relative}`);
+            if (relative.endsWith("/windows_job_process_supervisor.ps1"))
+                helper = file;
+        }
+    }
+    catch (error) {
+        throw new Error(`process_observer_windows_job_unavailable:assets:${message(error)}`);
+    }
+    return helper;
+}
+async function windowsPowerShellExecutable() {
+    const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
+    if (!windowsRoot || !path.isAbsolute(windowsRoot))
+        throw new Error("process_observer_windows_job_unavailable:powershell");
+    const executable = path.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    try {
+        const status = await lstat(executable);
+        if (!status.isFile() || status.isSymbolicLink())
+            throw new Error();
+        return await realpath(executable);
+    }
+    catch {
+        throw new Error("process_observer_windows_job_unavailable:powershell");
+    }
+}
+async function assertPrivateTemporaryRoot(created) {
+    const status = await lstat(created);
+    if (!status.isDirectory() || status.isSymbolicLink())
+        throw new Error("process_observer_windows_job_unavailable:temporary_root_identity");
+    return realpath(created);
+}
+async function removePrivateTemporaryRoot(target) {
+    const status = await lstat(target);
+    if (!status.isDirectory() ||
+        status.isSymbolicLink() ||
+        normalizeHostPath(await realpath(target)) !==
+            normalizeHostPath(path.resolve(target)))
+        throw new Error("temporary_root_identity");
+    await rm(target, {
+        recursive: true,
+        force: true,
+        maxRetries: 10,
+        retryDelay: 100,
+    });
+}
+function normalizeHostPath(value) {
+    return process.platform === "win32" ? value.toLowerCase() : value;
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/lib/long-task-workspace-scope.d.ts

@@ -29,6 +29,7 @@ export declare function protectedWorkspacePaths(input: {
     context_hashes?: Record<string, string> | null;
     checks?: Array<{
         verification_input_hashes: Record<string, string>;
+        protected_authority_paths?: string[];
     }>;
     additional_files?: string[];
 }): string[];

package/dist/lib/long-task-workspace-scope.js

@@ -42,7 +42,10 @@ export function protectedWorkspacePaths(input) {
         ...Object.keys(input.contract_files ?? {}),
         ...Object.keys(input.source_hashes ?? {}),
         ...Object.keys(input.context_hashes ?? {}),
-        ...(input.checks ?? []).flatMap((check) => Object.keys(check.verification_input_hashes)),
+        ...(input.checks ?? []).flatMap((check) => [
+            ...Object.keys(check.verification_input_hashes),
+            ...(check.protected_authority_paths ?? []),
+        ]),
         ...(input.additional_files ?? []),
     ]);
 }

package/dist/lib/long-task-workspace.d.ts

@@ -3,3 +3,4 @@ export { currentGitState, currentGitTree, gitCommonDir, gitConfigGet, gitConfigS
 export { captureWorkspaceFingerprint, captureWorkspaceManifest, changedWorkspacePaths, changedWorkspacePathsFromHead, } from "./long-task-workspace-manifest.js";
 export { createWorkspaceSnapshot } from "./long-task-workspace-snapshot.js";
 export type { WorkspaceSnapshotV2 } from "./long-task-workspace-snapshot.js";
+export declare function canonicalExistingLongTaskWorkdir(repository: string, workdirInput: string): Promise<string>;

package/dist/lib/long-task-workspace.js

@@ -1,4 +1,14 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+import { assertProtectedRepositoryDirectory as assertProtectedDirectory } from "./repository-path-safety.js";
 export { resolveInsideRepository } from "./repository-path-safety.js";
 export { currentGitState, currentGitTree, gitCommonDir, gitConfigGet, gitConfigSet, gitConfigUnset, gitPath, repoRelative, repositoryRoot, } from "./long-task-git.js";
 export { captureWorkspaceFingerprint, captureWorkspaceManifest, changedWorkspacePaths, changedWorkspacePathsFromHead, } from "./long-task-workspace-manifest.js";
 export { createWorkspaceSnapshot } from "./long-task-workspace-snapshot.js";
+export async function canonicalExistingLongTaskWorkdir(repository, workdirInput) {
+    const [canonicalRepository, physical] = await Promise.all([
+        realpath(path.resolve(repository)),
+        realpath(path.resolve(workdirInput)),
+    ]);
+    return assertProtectedDirectory(canonicalRepository, physical, "long_task_workdir");
+}

package/dist/lib/migrations.js

@@ -6,12 +6,15 @@ import { architectureContextTemplate, areaContextTemplate, globalContextTemplate
 import { CURRENT_SCHEMA_VERSION } from "./constants.js";
 import { defaultConfig, readConfig } from "./config.js";
 import { createDesignMdIfMissing, DESIGN_MD_PATH } from "./design-md.js";
+import { declaredDesignAuthorityFormat } from "./design-authority-format.js";
+import { DESIGN_AUTHORITY_MANIFEST_PATH } from "./design-authority-types.js";
 import { ensureDir, listFiles, pathExists, readText, writeTextIfChanged, } from "./fs.js";
 import { harnessConfigPath, harnessRoot } from "./harness-root.js";
 import { legacySdlcHarnessMigration } from "./legacy-sdlc-migration.js";
 import { modularityCapabilityWaiverMigration } from "./modularity-capability-migration.js";
 import { parseYaml, stringifyYaml } from "./yaml.js";
 import { semanticDriftMigrationFields } from "./long-task-semantic-drift-migration.js";
+import { contextUnitsMigration } from "./context-units-migration.js";
 async function verifyNoop() {
     return;
 }
@@ -25,10 +28,10 @@ export const migrations = [
     {
         id: "long-task-v2-semantic-drift-authority",
         introducedIn: "0.7.2",
-        description: "Require explicit Stage, target profile/root runtime, journey scenario and evidence-capability authority in V2 Long-Task Contracts.",
+        description: "Require explicit Stage, target profile/root runtime, journey scenario, evidence-capability authority and authenticated exact blocking External Confirmation in V2 Long-Task Contracts.",
         scope: ".long-task/delivery-contract.yaml",
         risk: "manual",
-        manualMessage: "These product and proof semantics cannot be inferred safely. Preserve Source, then explicitly author stages, vertical Outcome membership, target profile and execution targets, success/degradation requirements, Given/When scenarios, evidence capabilities and typed external-confirmation impact before recompiling. Historical Progress and Receipts remain audit-only and must not be imported as acceptance.",
+        manualMessage: "These product and proof semantics cannot be inferred safely. Preserve Source, then explicitly author stages, vertical Outcome membership, target profile and execution targets, success/degradation requirements, Given/When scenarios, evidence capabilities, exact obligation authority and authenticated blocking External Confirmation before recompiling. Missing completion_authority remains machine_only; resolve machine/external conflicts rather than synthesizing authority. Historical Progress, V1 External records and Receipts remain audit-only and must not be imported as acceptance.",
         detect: detectLongTaskSemanticDriftAuthority,
         verify: verifyNoop,
     },
@@ -98,6 +101,7 @@ export const migrations = [
         apply: migrateLegacyModulesToAreas,
         verify: verifyNoop,
     },
+    contextUnitsMigration,
     {
         id: "context-manifest-baseline",
         introducedIn: "0.2.0",
@@ -131,6 +135,16 @@ export const migrations = [
         apply: migrateDesignMd,
         verify: verifyNoop,
     },
+    {
+        id: "design-authority-bundle-marker-v1",
+        introducedIn: "0.11.0",
+        description: "Require the canonical DESIGN.md bundle-v1 marker and Design Authority manifest to be adopted or removed as one explicit Authority-format change.",
+        scope: "DESIGN.md and design_system/authority.manifest.json",
+        risk: "manual",
+        manualMessage: "Do not infer adoption or downgrade from file presence. Through explicit DSA adoption/Authority Revision, either add the canonical body-leading bundle-v1 marker and validate the manifest, or deliberately remove both marker and manifest for a true one-file Authority; then rebind affected DRA and Long-Task identities.",
+        detect: detectDesignAuthorityBundleMarker,
+        verify: verifyNoop,
+    },
     {
         id: "deprecated-skill-overrides",
         introducedIn: "0.2.0",
@@ -533,6 +547,33 @@ async function detectDesignMdBaseline(projectRoot, _root, migration) {
             item(migration, "safe_pending", DESIGN_MD_PATH, "DESIGN.md is missing and can be created with the package baseline."),
         ];
 }
+async function detectDesignAuthorityBundleMarker(projectRoot, _root, migration) {
+    const entry = path.join(projectRoot, DESIGN_MD_PATH);
+    const manifest = path.join(projectRoot, DESIGN_AUTHORITY_MANIFEST_PATH);
+    const [entryExists, manifestExists] = await Promise.all([
+        pathExists(entry),
+        pathExists(manifest),
+    ]);
+    if (!entryExists && !manifestExists)
+        return [];
+    let marked = false;
+    let markerIssue = null;
+    if (entryExists)
+        try {
+            marked =
+                declaredDesignAuthorityFormat(await readText(entry)) === "bundle-v1";
+        }
+        catch (error) {
+            markerIssue = error instanceof Error ? error.message : String(error);
+        }
+    if (markerIssue === null && entryExists && marked === manifestExists)
+        return [];
+    return [
+        item(migration, "manual_required", DESIGN_AUTHORITY_MANIFEST_PATH, markerIssue
+            ? `The Design Authority bundle declaration is invalid (${markerIssue}). Repair the canonical marker and manifest as one explicit DSA/Authority Revision.`
+            : `Design Authority bundle marker/manifest mismatch: entry=${entryExists}, marker=${marked}, manifest=${manifestExists}. Adopt or remove the pair only through explicit DSA/Authority Revision, then rebind affected identities.`),
+    ];
+}
 async function detectCompositeCodexProfile(projectRoot, _root, migration) {
     const relative = await harnessConfigPath(projectRoot);
     const file = path.join(projectRoot, relative);

package/dist/lib/repository-path-safety.d.ts

@@ -6,8 +6,11 @@ export interface SafeRepositoryPath {
 }
 export declare function resolveInsideRepository(rootInput: string, relativeInput: string, label: string): string;
 export declare function assertProtectedRepositoryFile(repositoryInput: string, fileInput: string, label: string): Promise<string>;
+export declare function assertProtectedRepositoryDirectory(repositoryInput: string, directoryInput: string, label: string): Promise<string>;
+export declare function assertProtectedRepositoryPath(repositoryInput: string, pathInput: string, label: string): Promise<string>;
 export declare function assertSafeRepositoryFilePath(repositoryInput: string, relativeInput: string, label: string, options?: {
     destinationMayBeAbsent?: boolean;
+    allowHardlinks?: boolean;
 }): Promise<SafeRepositoryPath & {
     status: Stats | null;
 }>;

package/dist/lib/repository-path-safety.js

@@ -28,6 +28,42 @@ export async function assertProtectedRepositoryFile(repositoryInput, fileInput,
     assertInside(repository, resolved, label, fileInput);
     return resolved;
 }
+export async function assertProtectedRepositoryDirectory(repositoryInput, directoryInput, label) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const candidate = path.resolve(directoryInput);
+    assertInside(repositoryPath, candidate, label, directoryInput);
+    await assertExistingParents(repositoryPath, repository, candidate, label);
+    const info = await lstatOrNull(candidate);
+    if (!info)
+        throw new Error(`protected_input_not_found:${label}:${display(directoryInput)}`);
+    if (info.isSymbolicLink())
+        throw new Error(`protected_input_symlink_not_allowed:${label}:${display(directoryInput)}`);
+    if (!info.isDirectory())
+        throw new Error(`protected_input_not_directory:${label}:${display(directoryInput)}`);
+    const resolved = await realpath(candidate);
+    assertInside(repository, resolved, label, directoryInput);
+    return resolved;
+}
+export async function assertProtectedRepositoryPath(repositoryInput, pathInput, label) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const candidate = path.resolve(pathInput);
+    assertInside(repositoryPath, candidate, label, pathInput);
+    await assertExistingParents(repositoryPath, repository, candidate, label);
+    const info = await lstatOrNull(candidate);
+    if (!info)
+        throw new Error(`protected_input_not_found:${label}:${display(pathInput)}`);
+    if (info.isSymbolicLink())
+        throw new Error(`protected_input_symlink_not_allowed:${label}:${display(pathInput)}`);
+    if (!info.isFile() && !info.isDirectory())
+        throw new Error(`protected_input_not_file_or_directory:${label}:${display(pathInput)}`);
+    if (info.isFile() && typeof info.nlink === "number" && info.nlink > 1)
+        throw new Error(`protected_input_hardlink_not_allowed:${label}:${display(pathInput)}`);
+    const resolved = await realpath(candidate);
+    assertInside(repository, resolved, label, pathInput);
+    return resolved;
+}
 export async function assertSafeRepositoryFilePath(repositoryInput, relativeInput, label, options = {}) {
     const repositoryPath = path.resolve(repositoryInput);
     const repository = await realpath(repositoryPath);
@@ -37,7 +73,7 @@ export async function assertSafeRepositoryFilePath(repositoryInput, relativeInpu
     if (!status && !options.destinationMayBeAbsent)
         throw new Error(`protected_input_not_found:${label}:${display(relativeInput)}`);
     if (status) {
-        assertRegularNoFollow(status, label, relativeInput);
+        assertRegularNoFollow(status, label, relativeInput, options.allowHardlinks === true);
         assertInside(repository, await realpath(absolute), label, relativeInput);
     }
     return {
@@ -86,12 +122,12 @@ async function assertExistingParents(lexicalRepository, canonicalRepository, can
         assertInside(canonicalRepository, await realpath(cursor), label, cursor);
     }
 }
-function assertRegularNoFollow(info, label, original) {
+function assertRegularNoFollow(info, label, original, allowHardlinks = false) {
     if (info.isSymbolicLink())
         throw new Error(`protected_input_symlink_not_allowed:${label}:${display(original)}`);
     if (!info.isFile())
         throw new Error(`protected_input_not_regular_file:${label}:${display(original)}`);
-    if (typeof info.nlink === "number" && info.nlink > 1)
+    if (!allowHardlinks && typeof info.nlink === "number" && info.nlink > 1)
         throw new Error(`protected_input_hardlink_not_allowed:${label}:${display(original)}`);
 }
 function repositoryRelative(repository, candidate, label) {

package/dist/lib/semantic-fact-input-shape.d.ts

@@ -14,13 +14,18 @@ export declare function parseSemanticFactCensus(value: unknown, label: string):
 }[];
 export declare function parseSemanticFactInputs(value: unknown, label: string): {
     key: string;
-    kind: "attachment" | "canonical_spec" | "context" | "delegated_instruction" | "design_resource" | "external_constraint" | "repository_preservation" | "source_item";
+    kind: "attachment" | "canonical_spec" | "context" | "delegated_instruction" | "design_resource" | "external_constraint" | "repository_preservation" | "semantic_anchor" | "source_fragment" | "source_item";
     source_ref: string;
     sha256: string;
-    disposition: "excluded_by_scope" | "non_ui_material" | "supporting_only" | "ui_design";
+    disposition: "decision_required" | "excluded_by_scope" | "fact_bearing" | "non_ui_material" | "scope_excluded" | "superseded" | "supporting_basis" | "supporting_only" | "ui_design";
     fact_refs: string[];
     basis_refs: string[];
     rationale: string;
+    supporting_relation?: {
+        kind: "same_semantic_cell_non_normative";
+        fact_ref: string;
+        fact_cell_ref: string;
+    } | undefined;
 }[];
 export declare function parseSemanticFactFamilyDispositions(value: unknown, label: string): {
     key: string;

package/dist/lib/semantic-fact-input-shape.js

@@ -57,7 +57,7 @@ export function parseSemanticFactInputs(value, label) {
             "fact_refs",
             "basis_refs",
             "rationale",
-        ]);
+        ], ["supporting_relation"]);
         return {
             key: semanticStableRef(row.key, `${itemLabel}.key`),
             kind: semanticLiteral(row.kind, [
@@ -69,6 +69,8 @@ export function parseSemanticFactInputs(value, label) {
                 "external_constraint",
                 "delegated_instruction",
                 "design_resource",
+                "source_fragment",
+                "semantic_anchor",
             ], `${itemLabel}.kind`),
             source_ref: semanticString(row.source_ref, `${itemLabel}.source_ref`),
             sha256: semanticSha256(row.sha256, `${itemLabel}.sha256`),
@@ -77,13 +79,35 @@ export function parseSemanticFactInputs(value, label) {
                 "ui_design",
                 "supporting_only",
                 "excluded_by_scope",
+                "fact_bearing",
+                "supporting_basis",
+                "superseded",
+                "decision_required",
+                "scope_excluded",
             ], `${itemLabel}.disposition`),
             fact_refs: semanticStableRefs(row.fact_refs, `${itemLabel}.fact_refs`),
             basis_refs: semanticStableRefs(row.basis_refs, `${itemLabel}.basis_refs`),
             rationale: semanticString(row.rationale, `${itemLabel}.rationale`),
+            ...(row.supporting_relation === undefined
+                ? {}
+                : {
+                    supporting_relation: parseSupportingRelation(row.supporting_relation, `${itemLabel}.supporting_relation`),
+                }),
         };
     });
 }
+function parseSupportingRelation(value, label) {
+    const row = semanticObject(value, label, [
+        "kind",
+        "fact_ref",
+        "fact_cell_ref",
+    ]);
+    return {
+        kind: semanticLiteral(row.kind, ["same_semantic_cell_non_normative"], `${label}.kind`),
+        fact_ref: semanticStableRef(row.fact_ref, `${label}.fact_ref`),
+        fact_cell_ref: semanticStableRef(row.fact_cell_ref, `${label}.fact_cell_ref`),
+    };
+}
 export function parseSemanticFactFamilyDispositions(value, label) {
     return semanticArray(value, label).map((item, index) => {
         const itemLabel = `${label}[${index}]`;

package/dist/lib/semantic-fact-inventory-types.d.ts

@@ -2,13 +2,19 @@ import type { EvidenceCapabilityV2 } from "./long-task-delivery-types.js";
 import type { SemanticFactDisposition, SemanticFactLocatedValueV1, SemanticFactLocatorKind, SemanticFactValueKind } from "./semantic-fact-base-types.js";
 export interface SemanticFactInputV1 {
     key: string;
-    kind: "source_item" | "context" | "attachment" | "canonical_spec" | "repository_preservation" | "external_constraint" | "delegated_instruction" | "design_resource";
+    kind: "source_item" | "context" | "attachment" | "canonical_spec" | "repository_preservation" | "external_constraint" | "delegated_instruction" | "design_resource" | "source_fragment" | "semantic_anchor";
     source_ref: string;
     sha256: string;
-    disposition: "non_ui_material" | "ui_design" | "supporting_only" | "excluded_by_scope";
+    disposition: "non_ui_material" | "ui_design" | "supporting_only" | "excluded_by_scope" | "fact_bearing" | "supporting_basis" | "superseded" | "decision_required" | "scope_excluded";
     fact_refs: string[];
     basis_refs: string[];
     rationale: string;
+    supporting_relation?: SemanticFactSupportingRelationV1;
+}
+export interface SemanticFactSupportingRelationV1 {
+    kind: "same_semantic_cell_non_normative";
+    fact_ref: string;
+    fact_cell_ref: string;
 }
 export interface SemanticFactCensusEntryV1 {
     key: string;

package/dist/lib/semantic-fact-policy-census.d.ts

@@ -1,3 +1,3 @@
 import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
-export declare function validateSemanticFactInspectorCensus(manifest: SemanticFactManifestV1): void;
+export declare function validateSemanticFactInspectorCensus(manifest: SemanticFactManifestV1, externalFactRefs?: ReadonlySet<string>): void;
 export declare function buildSemanticFactInspectorCensus(manifest: SemanticFactManifestV1): SemanticFactManifestV1["inspector"]["census"];

package/dist/lib/semantic-fact-policy-census.js

@@ -1,7 +1,10 @@
 import { assertSameSemanticFactSet, requireSemanticFactBasis, semanticFactInvalid, validateSemanticFactLocator, } from "./semantic-fact-policy-primitives.js";
 import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-export function validateSemanticFactInspectorCensus(manifest) {
-    const factRefs = new Set(manifest.facts.map((item) => item.key));
+export function validateSemanticFactInspectorCensus(manifest, externalFactRefs = new Set()) {
+    const factRefs = new Set([
+        ...manifest.facts.map((item) => item.key),
+        ...externalFactRefs,
+    ]);
     const factsFor = (predicate) => manifest.facts.filter(predicate).map((item) => item.key);
     const expected = expectedCensusRows(manifest, factsFor);
     const actual = new Set();

package/dist/lib/semantic-fact-policy.d.ts

@@ -10,7 +10,7 @@ export interface SemanticFactManifestIndexV1 {
     oracle_by_ref: Map<string, SemanticFactManifestV1["oracles"][number]>;
     environment_by_ref: Map<string, SemanticFactManifestV1["environments"][number]>;
 }
-export declare function validateSemanticFactManifestPolicy(manifest: SemanticFactManifestV1): SemanticFactManifestIndexV1;
+export declare function validateSemanticFactManifestPolicy(manifest: SemanticFactManifestV1, externalFactRefs?: ReadonlySet<string>): SemanticFactManifestIndexV1;
 export declare const complete_non_ui_semantic_fact_delivery = "expected=source=contract;proofs=current";
 export declare const NO_UI_CONTROL_RELATIONS = true;
 export declare const NO_SEMANTIC_FACT_SHORTCUTS = true;

package/dist/lib/semantic-fact-policy.js

@@ -7,7 +7,7 @@ import { validateSemanticFactProofClosure } from "./semantic-fact-policy-proofs.
 import { validateSemanticFactPropertyClosure } from "./semantic-fact-policy-properties.js";
 import { validateSemanticFactFamilyClosure, validateSemanticFactUnits, } from "./semantic-fact-policy-units.js";
 export { semanticFactCollectionIdentity } from "./semantic-fact-policy-authority.js";
-export function validateSemanticFactManifestPolicy(manifest) {
+export function validateSemanticFactManifestPolicy(manifest, externalFactRefs = new Set()) {
     validateSemanticFactUniqueIdentities(manifest);
     validateSemanticFactGeneration(manifest);
     validateSemanticFactInspector(manifest);
@@ -18,7 +18,7 @@ export function validateSemanticFactManifestPolicy(manifest) {
     validateSemanticFactPropertyClosure(manifest, units);
     validateSemanticFactClosure(manifest, units);
     validateSemanticFactProofClosure(manifest);
-    validateSemanticFactInspectorCensus(manifest);
+    validateSemanticFactInspectorCensus(manifest, externalFactRefs);
     if (manifest.blockers.length)
         semanticFactInvalid("blockers_present", manifest.blockers
             .map((item) => item.key)