rampway 0.5.21 → 0.5.23

package/build/src/core/runtime-owner-handoff.d.ts

@@ -1,11 +1,11 @@
 /**
  * @param {import('#types').Transport} transport
  * @param {import('#types').StageConfig} stage
- * @param {import('#types').RuntimeBootState} boot
+ * @param {import('#types').ReadRuntimeBootState} boot
  * @param {import('#types').LockInfo} lock
  * @returns {Promise<import('#types').RuntimeOwnerHandoff>}
  */
-export function writeRuntimeOwnerHandoff(transport: import("#types").Transport, stage: import("#types").StageConfig, boot: import("#types").RuntimeBootState, lock: import("#types").LockInfo): Promise<import("#types").RuntimeOwnerHandoff>;
+export function writeRuntimeOwnerHandoff(transport: import("#types").Transport, stage: import("#types").StageConfig, boot: import("#types").ReadRuntimeBootState, lock: import("#types").LockInfo): Promise<import("#types").RuntimeOwnerHandoff>;
 /**
  * @param {import('#types').Transport} transport
  * @param {import('#types').StageConfig} stage

package/build/src/core/runtime-owner-handoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-owner-handoff.d.ts","sourceRoot":"","sources":["../../../src/core/runtime-owner-handoff.js"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,oDANW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,QAC5B,OAAO,QAAQ,EAAE,gBAAgB,QACjC,OAAO,QAAQ,EAAE,QAAQ,GACvB,OAAO,CAAC,OAAO,QAAQ,EAAE,mBAAmB,CAAC,CAUzD;AAED;;;;GAIG;AACH,mDAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,OAAO,QAAQ,EAAE,mBAAmB,GAAC,IAAI,CAAC,CAc9D;AAED;;;;;GAKG;AACH,qDALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,WAC5B,OAAO,QAAQ,EAAE,mBAAmB,GAClC,OAAO,CAAC,IAAI,CAAC,CAKzB"}
+{"version":3,"file":"runtime-owner-handoff.d.ts","sourceRoot":"","sources":["../../../src/core/runtime-owner-handoff.js"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,oDANW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,QAC5B,OAAO,QAAQ,EAAE,oBAAoB,QACrC,OAAO,QAAQ,EAAE,QAAQ,GACvB,OAAO,CAAC,OAAO,QAAQ,EAAE,mBAAmB,CAAC,CAUzD;AAED;;;;GAIG;AACH,mDAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,OAAO,QAAQ,EAAE,mBAAmB,GAAC,IAAI,CAAC,CAc9D;AAED;;;;;GAKG;AACH,qDALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,WAC5B,OAAO,QAAQ,EAAE,mBAAmB,GAClC,OAAO,CAAC,IAAI,CAAC,CAKzB"}

package/build/src/core/runtime-owner-handoff.js

@@ -7,7 +7,7 @@ const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 /**
  * @param {import('#types').Transport} transport
  * @param {import('#types').StageConfig} stage
- * @param {import('#types').RuntimeBootState} boot
+ * @param {import('#types').ReadRuntimeBootState} boot
  * @param {import('#types').LockInfo} lock
  * @returns {Promise<import('#types').RuntimeOwnerHandoff>}
  */

package/build/src/runtimes/rollbridge-runtime.d.ts

@@ -123,6 +123,20 @@ export class RollbridgeRuntime {
         externalOwnerVerificationRequired?: boolean;
         daemonRuntime?: any;
     }>;
+    /**
+     * Binds the exact immutable runtime reported by the accepted Rollbridge owner to
+     * Rampway's stable snapshot and stores an authenticated manifest copy beside the
+     * immutable Rollbridge config material.
+     *
+     * @param {import('#types').Transport} transport
+     * @param {{snapshot: import('#types').RuntimeSnapshot, runtimePath: string, runtimeResult: any}} opts
+     * @returns {Promise<import('#types').RuntimeSnapshot>}
+     */
+    acceptSnapshot(transport: import("#types").Transport, { snapshot, runtimePath, runtimeResult }: {
+        snapshot: import("#types").RuntimeSnapshot;
+        runtimePath: string;
+        runtimeResult: any;
+    }): Promise<import("#types").RuntimeSnapshot>;
     /**
      * Releases an exact stale foreground owner for a serial supervisor through
      * Rollbridge's authenticated owner-retirement contract, then waits for the
@@ -171,7 +185,7 @@ export class RollbridgeRuntime {
         acceptedAt: string;
     }): import("#types").RuntimeBootIdentity | undefined;
     /**
-     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, bootAttestation?: string}} identity
+     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, bootAttestation?: string, snapshot?: import('#types').RuntimeSnapshot}} identity
      * @returns {string}
      */
     foregroundBootCommand(identity: {
@@ -180,17 +194,18 @@ export class RollbridgeRuntime {
         revision: string;
         configPath: string;
         bootAttestation?: string;
+        snapshot?: import("#types").RuntimeSnapshot;
     }): string;
     /**
      * @param {import('#types').Transport} transport
-     * @param {import('#types').RuntimeBootState} state
+     * @param {import('#types').ReadRuntimeBootState} state
      * @returns {Promise<void>}
      */
-    verifyForegroundBootMaterial(transport: import("#types").Transport, state: import("#types").RuntimeBootState): Promise<void>;
+    verifyForegroundBootMaterial(transport: import("#types").Transport, state: import("#types").ReadRuntimeBootState): Promise<void>;
     /**
      * Starts Rollbridge's foreground daemon contract without supervising it.
      *
-     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, configIdentity: string, bootAttestation?: string, onStarted: () => Promise<void>}} identity
+     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, configIdentity: string, bootAttestation?: string, snapshot: import('#types').RuntimeSnapshot, onStarted: () => Promise<void>}} identity
      * @returns {Promise<{code: number}>}
      */
     foregroundBoot(identity: {
@@ -200,6 +215,7 @@ export class RollbridgeRuntime {
         configPath: string;
         configIdentity: string;
         bootAttestation?: string;
+        snapshot: import("#types").RuntimeSnapshot;
         onStarted: () => Promise<void>;
     }): Promise<{
         code: number;
@@ -234,6 +250,32 @@ export class RollbridgeRuntime {
         runtimePath: string;
         contract?: boolean;
     }): Promise<void>;
+    /**
+     * Hashes one accepted Rollbridge contract with its exact daemon runtime.
+     *
+     * @param {import('#types').RuntimeSnapshot} snapshot
+     * @param {{format: number, digest: string, path: string, version: string}} daemonRuntime
+     * @returns {string}
+     */
+    foregroundIdentityDigest(snapshot: import("#types").RuntimeSnapshot, daemonRuntime: {
+        format: number;
+        digest: string;
+        path: string;
+        version: string;
+    }): string;
+    /**
+     * Independently reproduces Rollbridge daemon-runtime format 1's content
+     * digest without executing any bytes from the accepted runtime.
+     *
+     * @param {import('#types').Transport} transport
+     * @param {{format: number, digest: string, path: string, version: string}} daemonRuntime
+     */
+    verifyReportedDaemonRuntime(transport: import("#types").Transport, daemonRuntime: {
+        format: number;
+        digest: string;
+        path: string;
+        version: string;
+    }): Promise<void>;
     /**
      * @param {import('#types').Transport} transport
      * @param {string} releasePath

package/build/src/runtimes/rollbridge-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollbridge-runtime.d.ts","sourceRoot":"","sources":["../../../src/runtimes/rollbridge-runtime.js"],"names":[],"mappings":"AAMA;IACE,2BAA2B;IAC3B,aADW,YAAY,CACG;IAU1B;;;OAGG;IACH,qBAHW,OAAO,CAAC,OAAO,QAAQ,EAAE,uBAAuB,CAAC,iBACjD;QAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAC,EAYpE;IAtBD,mBAAmB;IACnB,qBADW,IAAI,CACW;IAE1B,8BAA8B;IAC9B,YADc,YAAY,CAGzB;IAOC,uDAAuD;IACvD,QADW,OAAO,QAAQ,EAAE,uBAAuB,CAMlD;IACD,WAVsB,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAU0C;IACxF,WAX4D,MAAM,CAWjB;IAGnD;;OAEG;IACH,QAFa,MAAM,EAAE,CAQpB;IAED;;;;OAIG;IACH,oDAJW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,WAC1D,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAalB;IAED;;;OAGG;IACH,yBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,uBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,qBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,mCAHW;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAA;KAAC,GAClE,MAAM,CAMlB;IAED;;;OAGG;IACH,yBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;;;;;;;;;OAWG;IACH,uDAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAA;KAAC,GACzF,MAAM,CAMlB;IAED;;;OAGG;IACH,wBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,qCAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAUlB;IAED;;;;;OAKG;IACH,8BALW,MAAM,SACN,MAAM,EAAE,WACR,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAQlB;IAED;;;;;;;OAOG;IACH,mBAJW,OAAO,QAAQ,EAAE,SAAS,gCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GACxC,OAAO,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,CAkDrD;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,mGAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAC,GAC5M,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,GAAG,CAAA;KAAC,CAAC,CA8CvG;IAED;;;;;;;;;;;OAWG;IACH,gCAJW,OAAO,QAAQ,EAAE,SAAS,kEAC1B;QAAC,IAAI,EAAE,OAAO,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,aAAa,EAAE;YAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;YAAC,aAAa,CAAC,EAAE,GAAG,CAAA;SAAC,CAAC;QAAC,2BAA2B,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAC,GAC5O,OAAO,CAAC,IAAI,CAAC,CA4BzB;IAED;;;;;OAKG;IACH,sBALW,OAAO,QAAQ,EAAE,SAAS,eAC1B,MAAM,YACN,OAAO,QAAQ,EAAE,eAAe,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAIxC;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,gBAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;OAIG;IACH,uBAJW,OAAO,QAAQ,EAAE,eAAe,oDAChC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,GAC5E,OAAO,QAAQ,EAAE,mBAAmB,GAAC,SAAS,CAM1D;IAED;;;OAGG;IACH,gCAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAC,GACtG,MAAM,CAMlB;IAED;;;;OAIG;IACH,wCAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,gBAAgB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAMzB;IAED;;;;;OAKG;IACH,yBAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAC,GAC9J,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAoCnC;IAED;;;OAGG;IACH,2BAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,IAAI,CAyBhB;IAED;;;OAGG;IACH,iCAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,IAAI,CAQhB;IAED;;;;OAIG;IACH,2BAJW,OAAO,QAAQ,EAAE,SAAS,0CAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GACpF,OAAO,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,CAsBrD;IAED;;;;OAIG;IACH,0BAJW,OAAO,QAAQ,EAAE,SAAS,uCAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CA8BzB;IAED;;;;;OAKG;IACH,0BALW,OAAO,QAAQ,EAAE,SAAS,eAC1B,MAAM,UACN,OAAO,QAAQ,EAAE,uBAAuB,GACtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsBrC;IAED;;;OAGG;IACH,uEAHW;QAAC,MAAM,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAC,GACtH,MAAM,CAoBlB;IAED;;;;OAIG;IACH,2BAJW,MAAM,iBACN,MAAM,GACJ,MAAM,CAIlB;IAED;;;;OAIG;IACH,4CAJW,MAAM,yBACN,MAAM,GACJ,MAAM,CAIlB;IAED;;;;OAIG;IACH,uBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAIjD;IAED;;;;OAIG;IACH,gCAJW,OAAO,QAAQ,EAAE,SAAS,gCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAC,GACzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CASrC;IAED;;;OAGG;IACH,2BAHW,OAAO,QAAQ,EAAE,SAAS,GACxB,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAKrC;IAED;;;;OAIG;IACH,kCAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CAazB;IAED;;;;OAIG;IACH,mCAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAC/D,OAAO,CAAC,IAAI,CAAC,CAOzB;IAED;;;;OAIG;IACH,oBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,gBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,mBAJW,OAAO,QAAQ,EAAE,SAAS,oCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GACjF,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,gBAJW,MAAM,WACN,OAAO,QAAQ,EAAE,uBAAuB,GACtC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAC,CAW3F;IAED;;;OAGG;IACH,8BAHW,MAAM,GACJ,MAAM,CAYlB;IAED;;;OAGG;IACH,6BAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,OAAO,QAAQ,EAAE,uBAAuB,CAoBpD;CACF"}
+{"version":3,"file":"rollbridge-runtime.d.ts","sourceRoot":"","sources":["../../../src/runtimes/rollbridge-runtime.js"],"names":[],"mappings":"AAUA;IACE,2BAA2B;IAC3B,aADW,YAAY,CACG;IAU1B;;;OAGG;IACH,qBAHW,OAAO,CAAC,OAAO,QAAQ,EAAE,uBAAuB,CAAC,iBACjD;QAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAC,EAYpE;IAtBD,mBAAmB;IACnB,qBADW,IAAI,CACW;IAE1B,8BAA8B;IAC9B,YADc,YAAY,CAGzB;IAOC,uDAAuD;IACvD,QADW,OAAO,QAAQ,EAAE,uBAAuB,CAMlD;IACD,WAVsB,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAU0C;IACxF,WAX4D,MAAM,CAWjB;IAGnD;;OAEG;IACH,QAFa,MAAM,EAAE,CAQpB;IAED;;;;OAIG;IACH,oDAJW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,WAC1D,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAalB;IAED;;;OAGG;IACH,yBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,uBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,qBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,mCAHW;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAA;KAAC,GAClE,MAAM,CAMlB;IAED;;;OAGG;IACH,yBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;;;;;;;;;OAWG;IACH,uDAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAA;KAAC,GACzF,MAAM,CAMlB;IAED;;;OAGG;IACH,wBAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAIlB;IAED;;;OAGG;IACH,qCAHW,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAUlB;IAED;;;;;OAKG;IACH,8BALW,MAAM,SACN,MAAM,EAAE,WACR,OAAO,QAAQ,EAAE,uBAAuB,GACtC,MAAM,CAQlB;IAED;;;;;;;OAOG;IACH,mBAJW,OAAO,QAAQ,EAAE,SAAS,gCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GACxC,OAAO,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,CAqDrD;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,mGAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAC,GAC5M,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,GAAG,CAAA;KAAC,CAAC,CAsDvG;IAED;;;;;;;;OAQG;IACH,0BAJW,OAAO,QAAQ,EAAE,SAAS,4CAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,GAAG,CAAA;KAAC,GACnF,OAAO,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,CA2CrD;IAED;;;;;;;;;;;OAWG;IACH,gCAJW,OAAO,QAAQ,EAAE,SAAS,kEAC1B;QAAC,IAAI,EAAE,OAAO,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,aAAa,EAAE;YAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;YAAC,aAAa,CAAC,EAAE,GAAG,CAAA;SAAC,CAAC;QAAC,2BAA2B,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAC,GAC5O,OAAO,CAAC,IAAI,CAAC,CA4BzB;IAED;;;;;OAKG;IACH,sBALW,OAAO,QAAQ,EAAE,SAAS,eAC1B,MAAM,YACN,OAAO,QAAQ,EAAE,eAAe,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAIxC;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,gBAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;OAIG;IACH,uBAJW,OAAO,QAAQ,EAAE,eAAe,oDAChC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,GAC5E,OAAO,QAAQ,EAAE,mBAAmB,GAAC,SAAS,CAO1D;IAED;;;OAGG;IACH,gCAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GACnJ,MAAM,CASlB;IAED;;;;OAIG;IACH,wCAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,oBAAoB,GACnC,OAAO,CAAC,IAAI,CAAC,CAMzB;IAED;;;;;OAKG;IACH,yBAHW;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAC,GAC1M,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CA4CnC;IAED;;;OAGG;IACH,2BAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,IAAI,CA2ChB;IAED;;;OAGG;IACH,iCAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,IAAI,CAUhB;IAED;;;;OAIG;IACH,2BAJW,OAAO,QAAQ,EAAE,SAAS,0CAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GACpF,OAAO,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,CAsBrD;IAED;;;;OAIG;IACH,0BAJW,OAAO,QAAQ,EAAE,SAAS,uCAC1B;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgDzB;IAED;;;;;;OAMG;IACH,mCAJW,OAAO,QAAQ,EAAE,eAAe,iBAChC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,GAC7D,MAAM,CAIlB;IAED;;;;;;OAMG;IACH,uCAHW,OAAO,QAAQ,EAAE,SAAS,iBAC1B;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,iBA0BzE;IAED;;;;;OAKG;IACH,0BALW,OAAO,QAAQ,EAAE,SAAS,eAC1B,MAAM,UACN,OAAO,QAAQ,EAAE,uBAAuB,GACtC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAsBrC;IAED;;;OAGG;IACH,uEAHW;QAAC,MAAM,EAAE,OAAO,QAAQ,EAAE,uBAAuB,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAC,GACtH,MAAM,CAoBlB;IAED;;;;OAIG;IACH,2BAJW,MAAM,iBACN,MAAM,GACJ,MAAM,CAIlB;IAED;;;;OAIG;IACH,4CAJW,MAAM,yBACN,MAAM,GACJ,MAAM,CAIlB;IAED;;;;OAIG;IACH,uBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAIjD;IAED;;;;OAIG;IACH,gCAJW,OAAO,QAAQ,EAAE,SAAS,gCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAC,GACzC,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CASrC;IAED;;;OAGG;IACH,2BAHW,OAAO,QAAQ,EAAE,SAAS,GACxB,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAKrC;IAED;;;;OAIG;IACH,kCAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CAazB;IAED;;;;OAIG;IACH,mCAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAC/D,OAAO,CAAC,IAAI,CAAC,CAOzB;IAED;;;;OAIG;IACH,oBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,kBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,gBAJW,OAAO,QAAQ,EAAE,SAAS,6BAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GAChE,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,mBAJW,OAAO,QAAQ,EAAE,SAAS,oCAC1B;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ,EAAE,eAAe,CAAA;KAAC,GACjF,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAKjD;IAED;;;;OAIG;IACH,gBAJW,MAAM,WACN,OAAO,QAAQ,EAAE,uBAAuB,GACtC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAC,CAW3F;IAED;;;OAGG;IACH,8BAHW,MAAM,GACJ,MAAM,CAYlB;IAED;;;OAGG;IACH,6BAHW,OAAO,QAAQ,EAAE,eAAe,GAC9B,OAAO,QAAQ,EAAE,uBAAuB,CAoBpD;CACF"}

package/build/src/runtimes/rollbridge-runtime.js

@@ -2,7 +2,10 @@ import { createHash } from "node:crypto";
 import path from "node:path";
 import { shellQuote } from "../transports/ssh-transport.js";
 import { isSecretKey } from "../core/redaction.js";
+import { RuntimeIncumbentPreservedError } from "../core/runtime-errors.js";
 import { spawnOwnedProcess, withOwnedProcessTree } from "../core/owned-process-tree.js";
+const ROLLBRIDGE_ATOMIC_OWNER_REPLACEMENT_MINIMUM = "0.1.29";
+const ROLLBRIDGE_VERIFIED_DAEMON_RUNTIME_MINIMUM = "0.1.38";
 export class RollbridgeRuntime {
     /** @type {"rollbridge"} */
     static type = "rollbridge";
@@ -162,8 +165,9 @@ export class RollbridgeRuntime {
         const configContent = sourceConfigPath ? await transport.readFile(sourceConfigPath) : undefined;
         const configName = sourceConfigPath ? path.basename(sourceConfigPath) : undefined;
         const packageVersion = await this.packageVersion(transport, releasePath, this.config);
-        if (this.config.externalOwner && !supportsExternalOwner(packageVersion))
-            throw new Error("Rollbridge external foreground ownership requires Rollbridge 0.1.21 or newer in the candidate release.");
+        if (this.config.externalOwner && !supportsVerifiedDaemonRuntime(packageVersion)) {
+            throw new Error(`Rollbridge external foreground ownership requires Rollbridge ${ROLLBRIDGE_VERIFIED_DAEMON_RUNTIME_MINIMUM} or newer with an exact content-addressed daemon runtime in the candidate release.`);
+        }
         const packageIdentity = packageVersion ? `version:${packageVersion}` : `release:${releasePath}`;
         const digest = this.contractDigest({ config: this.config, configContent, configName, packageIdentity });
         const contractDigest = `sha256:${digest}`;
@@ -194,6 +198,7 @@ export class RollbridgeRuntime {
             schemaVersion: 1,
             type: "rollbridge",
             contractDigest,
+            command: this.config.command,
             materialDigest: materialDigest ? `sha256:${materialDigest}` : undefined,
             packageDir: this.config.packageDir,
             configPath,
@@ -217,6 +222,9 @@ export class RollbridgeRuntime {
      * @returns {Promise<{status: string, externalOwnerVerificationRequired?: boolean, daemonRuntime?: any}>}
      */
     async deploy(transport, { releasePath, releaseId, revision, currentPath, targetSnapshot, currentSnapshot, deferCommit = false }) {
+        if (this.config.externalOwner && targetSnapshot && !supportsVerifiedDaemonRuntime(targetSnapshot.packageVersion)) {
+            throw new Error(`Rollbridge external foreground ownership requires Rollbridge ${ROLLBRIDGE_VERIFIED_DAEMON_RUNTIME_MINIMUM} or newer with an exact content-addressed daemon runtime before deployment.`);
+        }
         if (this.config.externalOwner && targetSnapshot && currentPath && currentSnapshot &&
             currentSnapshot.contractDigest !== targetSnapshot.contractDigest && !supportsExternalOwner(currentSnapshot.packageVersion)) {
             throw unsupportedExternalOwnerUpgrade(currentSnapshot.packageVersion);
@@ -229,10 +237,12 @@ export class RollbridgeRuntime {
             throw new Error(`Rollbridge validation failed: ${ /** @type {Error} */(error).message}`);
         }
         let releaseVersion;
+        const atomicOwnerReplacement = supportsAtomicOwnerReplacement(targetSnapshot?.packageVersion);
+        const atomicIncompatibleReplacement = atomicOwnerReplacement && Boolean(currentPath && currentSnapshot?.contractDigest !== targetSnapshot?.contractDigest);
         const externalOwnerVerificationRequired = Boolean(this.config.externalOwner);
         if (targetSnapshot) {
             releaseVersion = targetSnapshot.packageVersion;
-            if (currentPath && currentSnapshot?.contractDigest !== targetSnapshot.contractDigest) {
+            if (!atomicOwnerReplacement && currentPath && currentSnapshot?.contractDigest !== targetSnapshot.contractDigest) {
                 await this.shutdownChangedVersion(transport, { currentPath, snapshot: currentSnapshot ?? targetSnapshot });
             }
         }
@@ -244,7 +254,10 @@ export class RollbridgeRuntime {
             await transport.run(deployCommand, this.runOptions(releasePath, targetConfig));
         }
         catch (error) {
-            if (!currentPath || !currentSnapshot || !isLegacyRuntimeMismatch(/** @type {Error} */ (error))) {
+            if (atomicIncompatibleReplacement) {
+                throw new RuntimeIncumbentPreservedError(`Rollbridge deploy failed: ${ /** @type {Error} */(error).message}`, { cause: error });
+            }
+            if (atomicOwnerReplacement || !currentPath || !currentSnapshot || !isLegacyRuntimeMismatch(/** @type {Error} */ (error))) {
                 throw new Error(`Rollbridge deploy failed: ${ /** @type {Error} */(error).message}`);
             }
             try {
@@ -267,6 +280,62 @@ export class RollbridgeRuntime {
         const status = externalOwnerVerificationRequired ? parseStatus(acceptedStatus.output) : {};
         return { status: "deployed", ...(externalOwnerVerificationRequired ? { externalOwnerVerificationRequired: true, daemonRuntime: status.daemonRuntime } : {}) };
     }
+    /**
+     * Binds the exact immutable runtime reported by the accepted Rollbridge owner to
+     * Rampway's stable snapshot and stores an authenticated manifest copy beside the
+     * immutable Rollbridge config material.
+     *
+     * @param {import('#types').Transport} transport
+     * @param {{snapshot: import('#types').RuntimeSnapshot, runtimePath: string, runtimeResult: any}} opts
+     * @returns {Promise<import('#types').RuntimeSnapshot>}
+     */
+    async acceptSnapshot(transport, { snapshot, runtimePath, runtimeResult }) {
+        if (!this.config.externalOwner)
+            return snapshot;
+        const daemonRuntime = parseDaemonRuntime(runtimeResult?.daemonRuntime);
+        if (daemonRuntime.version !== snapshot.packageVersion)
+            throw new Error("Rollbridge daemon runtime version does not match the accepted package identity.");
+        if (snapshot.schemaVersion === 2) {
+            const acceptedRuntime = parseDaemonRuntime(snapshot.daemonRuntime);
+            if (canonicalJson(daemonRuntime) !== canonicalJson(acceptedRuntime)) {
+                throw new Error("Rollbridge activated a daemon runtime that does not match the retained accepted runtime identity.");
+            }
+            await this.verifySnapshot(transport, { snapshot, runtimePath });
+            return snapshot;
+        }
+        const manifestRoot = path.join(runtimePath, "rollbridge-daemon", daemonRuntime.digest);
+        const manifestPath = path.join(manifestRoot, "runtime.json");
+        const manifestContent = `${JSON.stringify(daemonRuntime, null, 2)}\n`;
+        await this.verifyReportedDaemonRuntime(transport, daemonRuntime);
+        if (await transport.exists(manifestPath)) {
+            if (await transport.readFile(manifestPath) !== manifestContent)
+                throw new Error(`Stored Rollbridge daemon runtime manifest does not match its accepted identity: ${manifestPath}`);
+        }
+        else {
+            if (await transport.exists(manifestRoot))
+                throw new Error(`Stored Rollbridge daemon runtime manifest is incomplete: ${manifestRoot}`);
+            const pendingRoot = path.join(runtimePath, `.rollbridge-daemon-${daemonRuntime.digest}-${process.pid}-${Date.now()}`);
+            await transport.mkdirp(pendingRoot);
+            try {
+                await transport.writeFile(path.join(pendingRoot, "runtime.json"), manifestContent);
+                await transport.mkdirp(path.dirname(manifestRoot));
+                await transport.rename(pendingRoot, manifestRoot);
+            }
+            finally {
+                if (await transport.exists(pendingRoot))
+                    await transport.rm(pendingRoot);
+            }
+        }
+        const accepted = {
+            ...snapshot,
+            schemaVersion: 2,
+            daemonRuntime,
+            daemonRuntimeManifestPath: manifestPath,
+            foregroundIdentityDigest: this.foregroundIdentityDigest(snapshot, daemonRuntime)
+        };
+        await this.verifySnapshot(transport, { snapshot: accepted, runtimePath });
+        return accepted;
+    }
     /**
      * Releases an exact stale foreground owner for a serial supervisor through
      * Rollbridge's authenticated owner-retirement contract, then waits for the
@@ -341,21 +410,25 @@ export class RollbridgeRuntime {
         if (!snapshot.configPath || !snapshot.materialDigest || !supportsForegroundBoot(snapshot.packageVersion))
             return undefined;
         this.validateSnapshot(snapshot);
-        return { runtimeType: "rollbridge", releaseId, revision, releasePath: path.resolve(releasePath), configPath: path.resolve(/** @type {string} */ (snapshot.configPath)), configIdentity: /** @type {string} */ (snapshot.materialDigest), acceptedAt };
+        const snapshotIdentity = snapshot.schemaVersion === 2 ? snapshot.foregroundIdentityDigest : snapshot.contractDigest;
+        return { runtimeType: "rollbridge", releaseId, revision, releasePath: path.resolve(releasePath), configPath: path.resolve(/** @type {string} */ (snapshot.configPath)), configIdentity: /** @type {string} */ (snapshot.materialDigest), snapshotIdentity: /** @type {string} */ (snapshotIdentity), acceptedAt };
     }
     /**
-     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, bootAttestation?: string}} identity
+     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, bootAttestation?: string, snapshot?: import('#types').RuntimeSnapshot}} identity
      * @returns {string}
      */
     foregroundBootCommand(identity) {
         const args = ["daemon", "--config", identity.configPath, "--release-path", identity.releasePath, "--release-id", identity.releaseId, "--revision", identity.revision];
         if (this.config.externalOwner && identity.bootAttestation)
             args.push("--boot-attestation", identity.bootAttestation);
-        return `${this.config.command} ${args.map(value => shellQuote(value)).join(" ")}`;
+        const command = identity.snapshot?.schemaVersion === 2 && identity.snapshot.daemonRuntime
+            ? shellQuote(path.join(identity.snapshot.daemonRuntime.path, "bin", "rollbridge"))
+            : this.config.command;
+        return `${command} ${args.map(value => shellQuote(value)).join(" ")}`;
     }
     /**
      * @param {import('#types').Transport} transport
-     * @param {import('#types').RuntimeBootState} state
+     * @param {import('#types').ReadRuntimeBootState} state
      * @returns {Promise<void>}
      */
     async verifyForegroundBootMaterial(transport, state) {
@@ -367,13 +440,21 @@ export class RollbridgeRuntime {
     /**
      * Starts Rollbridge's foreground daemon contract without supervising it.
      *
-     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, configIdentity: string, bootAttestation?: string, onStarted: () => Promise<void>}} identity
+     * @param {{releasePath: string, releaseId: string, revision: string, configPath: string, configIdentity: string, bootAttestation?: string, snapshot: import('#types').RuntimeSnapshot, onStarted: () => Promise<void>}} identity
      * @returns {Promise<{code: number}>}
      */
     async foregroundBoot(identity) {
         return await withOwnedProcessTree(async () => {
             const command = this.foregroundBootCommand(identity);
-            const child = spawnOwnedProcess(`exec ${command}`, { cwd: identity.releasePath, env: { ...process.env, ...this.config.env }, shell: true, stdio: "inherit" });
+            const runtimeManifest = identity.snapshot?.schemaVersion === 2 && identity.snapshot.daemonRuntime
+                ? path.join(identity.snapshot.daemonRuntime.path, "runtime.json")
+                : undefined;
+            const child = spawnOwnedProcess(`exec ${command}`, {
+                cwd: identity.releasePath,
+                env: { ...process.env, ...this.config.env, ...(runtimeManifest ? { ROLLBRIDGE_DAEMON_RUNTIME_MANIFEST: runtimeManifest } : {}) },
+                shell: true,
+                stdio: "inherit"
+            });
             const signals = /** @type {const} */ (["SIGINT", "SIGTERM", "SIGHUP"]);
             const handlers = new Map(signals.map(signal => [signal, () => child.kill(signal)]));
             for (const [signal, handler] of handlers)
@@ -430,6 +511,26 @@ export class RollbridgeRuntime {
         if (!isReleaseRelativePath(snapshot.packageDir)) {
             throw new Error("Stored Rollbridge runtime state has an unsafe package directory.");
         }
+        if (snapshot.command !== undefined && (typeof snapshot.command !== "string" || !snapshot.command.trim() || snapshot.command.includes("\0"))) {
+            throw new Error("Stored Rollbridge runtime state has an invalid accepted command.");
+        }
+        if (snapshot.schemaVersion === 2) {
+            const daemonRuntime = parseDaemonRuntime(snapshot.daemonRuntime);
+            if (daemonRuntime.version !== snapshot.packageVersion)
+                throw new Error("Stored Rollbridge daemon runtime version does not match its accepted package identity.");
+            if (typeof snapshot.daemonRuntimeManifestPath !== "string" || !path.isAbsolute(snapshot.daemonRuntimeManifestPath) || path.normalize(snapshot.daemonRuntimeManifestPath) !== snapshot.daemonRuntimeManifestPath) {
+                throw new Error("Stored Rollbridge runtime state has an invalid daemon runtime manifest path.");
+            }
+            if (!/^sha256:[0-9a-f]{64}$/u.test(snapshot.foregroundIdentityDigest ?? "")) {
+                throw new Error("Stored Rollbridge runtime state has an invalid foreground runtime identity digest.");
+            }
+            if (snapshot.foregroundIdentityDigest !== this.foregroundIdentityDigest(snapshot, /** @type {any} */ (snapshot.daemonRuntime))) {
+                throw new Error("Stored Rollbridge foreground runtime identity no longer matches its known-good digest.");
+            }
+        }
+        else if (snapshot.schemaVersion !== undefined && snapshot.schemaVersion !== 1) {
+            throw new Error("Stored Rollbridge runtime state has an unsupported schema version.");
+        }
         if (snapshot.rollbackCompatibility !== undefined && (typeof snapshot.rollbackCompatibility !== "string" || snapshot.rollbackCompatibility.trim().length === 0 || snapshot.rollbackCompatibility.includes("\0"))) {
             throw new Error("Stored Rollbridge runtime state has an invalid rollback compatibility identifier.");
         }
@@ -447,8 +548,9 @@ export class RollbridgeRuntime {
      * @returns {void}
      */
     validateRollbackTarget(snapshot) {
-        if (this.config.externalOwner && !supportsExternalOwner(snapshot.packageVersion))
-            throw new Error("Rollbridge external foreground ownership requires Rollbridge 0.1.21 or newer in the retained rollback release.");
+        if (this.config.externalOwner && !supportsVerifiedDaemonRuntime(snapshot.packageVersion)) {
+            throw new Error(`Rollbridge external foreground ownership requires Rollbridge ${ROLLBRIDGE_VERIFIED_DAEMON_RUNTIME_MINIMUM} or newer with an exact content-addressed daemon runtime in the retained rollback release.`);
+        }
         if (this.config.externalOwner && (typeof snapshot.socketPath !== "string" || snapshot.socketPath.trim().length === 0 || snapshot.socketPath.includes("\0")))
             throw new Error("Rollbridge external foreground ownership requires a valid control socket path in the retained rollback release; redeploy the target release once with the current Rampway so its runtime snapshot records runtime.socketPath before rolling back to it.");
         if (snapshot.rollbackCompatibility !== this.config.rollbackCompatibility) {
@@ -505,6 +607,24 @@ export class RollbridgeRuntime {
         if (this.materialDigest(path.basename(configPath), configContent) !== materialDigest) {
             throw new Error("Stored Rollbridge config material no longer matches its content digest.");
         }
+        if (snapshot.schemaVersion === 2) {
+            const manifestPath = /** @type {string} */ (snapshot.daemonRuntimeManifestPath);
+            const daemonRuntime = parseDaemonRuntime(snapshot.daemonRuntime);
+            const trustedDaemonRoot = path.join(runtimePath, "rollbridge-daemon");
+            if (path.resolve(manifestPath) !== path.resolve(trustedDaemonRoot, daemonRuntime.digest, "runtime.json")) {
+                throw new Error("Stored Rollbridge daemon runtime manifest path is outside its known-good runtime directory.");
+            }
+            const trustedDaemonRealPath = await transport.realpath(trustedDaemonRoot);
+            const trustedIdentityRealPath = await transport.realpath(path.dirname(manifestPath));
+            const manifestRealPath = await transport.realpath(manifestPath);
+            if (path.relative(trustedDaemonRealPath, trustedIdentityRealPath) !== daemonRuntime.digest || path.dirname(manifestRealPath) !== trustedIdentityRealPath) {
+                throw new Error("Stored Rollbridge daemon runtime manifest resolves outside its known-good runtime directory.");
+            }
+            if (await transport.readFile(manifestPath) !== `${JSON.stringify(daemonRuntime, null, 2)}\n`) {
+                throw new Error("Stored Rollbridge daemon runtime manifest no longer matches its accepted identity.");
+            }
+            await this.verifyReportedDaemonRuntime(transport, daemonRuntime);
+        }
         if (!contract)
             return;
         const config = this.configForSnapshot(snapshot);
@@ -517,6 +637,54 @@ export class RollbridgeRuntime {
         if (actualDigest !== digest)
             throw new Error("Stored Rollbridge runtime contract no longer matches its known-good digest.");
     }
+    /**
+     * Hashes one accepted Rollbridge contract with its exact daemon runtime.
+     *
+     * @param {import('#types').RuntimeSnapshot} snapshot
+     * @param {{format: number, digest: string, path: string, version: string}} daemonRuntime
+     * @returns {string}
+     */
+    foregroundIdentityDigest(snapshot, daemonRuntime) {
+        return `sha256:${createHash("sha256").update(canonicalJson({ contractDigest: snapshot.contractDigest, daemonRuntime })).digest("hex")}`;
+    }
+    /**
+     * Independently reproduces Rollbridge daemon-runtime format 1's content
+     * digest without executing any bytes from the accepted runtime.
+     *
+     * @param {import('#types').Transport} transport
+     * @param {{format: number, digest: string, path: string, version: string}} daemonRuntime
+     */
+    async verifyReportedDaemonRuntime(transport, daemonRuntime) {
+        const runtimeRealPath = await transport.realpath(daemonRuntime.path);
+        if (runtimeRealPath !== daemonRuntime.path)
+            throw new Error("Accepted Rollbridge daemon runtime resolves through a mutable or redirected path.");
+        const manifestPath = path.join(daemonRuntime.path, "runtime.json");
+        const binaryPath = path.join(daemonRuntime.path, "bin", "rollbridge");
+        if (!await transport.exists(manifestPath) || await transport.isDirectory(manifestPath) || !await transport.exists(binaryPath) || await transport.isDirectory(binaryPath)) {
+            throw new Error("Accepted Rollbridge daemon runtime material is incomplete.");
+        }
+        let manifest;
+        try {
+            manifest = JSON.parse(await transport.readFile(manifestPath));
+        }
+        catch (error) {
+            throw new Error(`Accepted Rollbridge daemon runtime manifest is malformed: ${ /** @type {Error} */(error).message}`);
+        }
+        if (canonicalJson(manifest) !== canonicalJson(daemonRuntime))
+            throw new Error("Accepted Rollbridge daemon runtime manifest does not match the reported identity.");
+        let packageMetadata;
+        try {
+            packageMetadata = JSON.parse(await transport.readFile(path.join(daemonRuntime.path, "package.json")));
+        }
+        catch (error) {
+            throw new Error(`Accepted Rollbridge daemon runtime package metadata is malformed: ${ /** @type {Error} */(error).message}`);
+        }
+        if (packageMetadata?.version !== daemonRuntime.version)
+            throw new Error("Accepted Rollbridge daemon runtime package version does not match the reported identity.");
+        const actualDigest = await rollbridgeDaemonRuntimeDigest(transport, daemonRuntime.path);
+        if (actualDigest !== daemonRuntime.digest)
+            throw new Error("Accepted Rollbridge daemon runtime bytes no longer match their content digest.");
+    }
     /**
      * @param {import('#types').Transport} transport
      * @param {string} releasePath
@@ -732,7 +900,7 @@ export class RollbridgeRuntime {
         }
         return {
             type: "rollbridge",
-            command: this.config.command,
+            command: snapshot.command ?? this.config.command,
             packageDir: snapshot.packageDir,
             config: snapshot.configPath,
             daemonLogPath: snapshot.daemonLogPath,
@@ -817,22 +985,65 @@ function isLegacyRuntimeMismatch(error) {
  * @returns {boolean}
  */
 function supportsForegroundBoot(version) {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/u.exec(version ?? "");
-    if (!match)
-        return false;
-    const [major, minor, patch] = match.slice(1).map(Number);
-    return major > 0 || minor > 1 || (minor === 1 && patch >= 17);
+    return rollbridgeVersionAtLeast(version, "0.1.17");
 }
 /**
  * @param {string|undefined} version
  * @returns {boolean}
  */
 function supportsExternalOwner(version) {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/u.exec(version ?? "");
-    if (!match)
+    return rollbridgeVersionAtLeast(version, "0.1.21");
+}
+/**
+ * Exact foreground recovery requires the Rollbridge contract that reports and
+ * restores the guardian's committed content-addressed runtime authority.
+ * Earlier external owners can legitimately report a release package path.
+ *
+ * @param {string|undefined} version
+ * @returns {boolean}
+ */
+function supportsVerifiedDaemonRuntime(version) {
+    return rollbridgeVersionAtLeast(version, ROLLBRIDGE_VERIFIED_DAEMON_RUNTIME_MINIMUM);
+}
+/**
+ * Rollbridge 0.1.29 introduced authenticated, atomic replacement for an
+ * incompatible config, socket, package, or runtime owner. Capability comes
+ * only from the prepared candidate snapshot; the incumbent daemon cannot
+ * safely assert what replacement transaction the candidate implements.
+ *
+ * @param {string|undefined} version
+ * @returns {boolean}
+ */
+function supportsAtomicOwnerReplacement(version) {
+    return rollbridgeVersionAtLeast(version, ROLLBRIDGE_ATOMIC_OWNER_REPLACEMENT_MINIMUM);
+}
+/**
+ * Compares strict release versions using the adapter's established
+ * three-component Rollbridge version format. Prereleases and malformed values
+ * fail closed instead of being granted a capability.
+ *
+ * @param {string|undefined} version
+ * @param {string} minimum
+ * @returns {boolean}
+ */
+function rollbridgeVersionAtLeast(version, minimum) {
+    const candidate = parseRollbridgeVersion(version);
+    const boundary = parseRollbridgeVersion(minimum);
+    if (!candidate || !boundary)
         return false;
-    const [major, minor, patch] = match.slice(1).map(Number);
-    return major > 0 || minor > 1 || (minor === 1 && patch >= 21);
+    for (let index = 0; index < candidate.length; index += 1) {
+        if (candidate[index] !== boundary[index])
+            return candidate[index] > boundary[index];
+    }
+    return true;
+}
+/**
+ * @param {string|undefined} version
+ * @returns {[number, number, number]|undefined}
+ */
+function parseRollbridgeVersion(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/u.exec(version ?? "");
+    return match ? /** @type {[number, number, number]} */ (match.slice(1).map(Number)) : undefined;
 }
 /**
  * @param {string|undefined} output
@@ -934,6 +1145,87 @@ function canonicalJson(value) {
     }
     return JSON.stringify(value);
 }
+/**
+ * Reproduces Rollbridge daemon-runtime format 1: sorted root-relative file
+ * paths and raw bytes, each separated by NUL, with runtime.json excluded.
+ * Symbolic links and every non-file/non-directory entry fail closed exactly as
+ * they do while Rollbridge materializes its immutable runtime.
+ *
+ * @param {import('#types').Transport} transport
+ * @param {string} rootPath
+ * @returns {Promise<string>}
+ */
+async function rollbridgeDaemonRuntimeDigest(transport, rootPath) {
+    if (typeof transport.stat !== "function" || typeof transport.readFileBuffer !== "function" || typeof transport.listDirectory !== "function") {
+        throw new Error("The selected transport cannot independently verify Rollbridge daemon runtime bytes.");
+    }
+    const stat = transport.stat;
+    const readFileBuffer = transport.readFileBuffer;
+    const listDirectory = transport.listDirectory;
+    /** @type {string[]} */
+    const files = [];
+    /** @param {string} relativePath */
+    const walk = async (relativePath) => {
+        const directoryPath = path.join(rootPath, relativePath);
+        const directory = await stat(directoryPath);
+        if (!directory || directory.isSymbolicLink?.() || !directory.isDirectory?.()) {
+            throw new Error(`Unsupported entry in accepted Rollbridge daemon runtime: ${directoryPath}`);
+        }
+        const entries = await listDirectory(directoryPath);
+        const uniqueEntries = new Set(entries);
+        if (uniqueEntries.size !== entries.length)
+            throw new Error(`Duplicate entry in accepted Rollbridge daemon runtime: ${directoryPath}`);
+        for (const entry of entries.sort((left, right) => left.localeCompare(right))) {
+            if (!entry || entry === "." || entry === ".." || entry.includes("\0") || path.basename(entry) !== entry) {
+                throw new Error(`Invalid entry in accepted Rollbridge daemon runtime: ${entry}`);
+            }
+            const childRelativePath = path.join(relativePath, entry);
+            const childPath = path.join(rootPath, childRelativePath);
+            const child = await stat(childPath);
+            if (!child || child.isSymbolicLink?.())
+                throw new Error(`Unsupported entry in accepted Rollbridge daemon runtime: ${childPath}`);
+            if (child.isDirectory?.())
+                await walk(childRelativePath);
+            else if (child.isFile?.())
+                files.push(childRelativePath);
+            else
+                throw new Error(`Unsupported entry in accepted Rollbridge daemon runtime: ${childPath}`);
+        }
+    };
+    await walk("");
+    const hash = createHash("sha256");
+    for (const relativePath of files) {
+        if (relativePath === "runtime.json")
+            continue;
+        const content = await readFileBuffer(path.join(rootPath, relativePath));
+        if (!Buffer.isBuffer(content))
+            throw new Error(`Transport returned non-byte content for accepted Rollbridge daemon runtime: ${relativePath}`);
+        hash.update(relativePath);
+        hash.update("\0");
+        hash.update(content);
+        hash.update("\0");
+    }
+    return hash.digest("hex");
+}
+/**
+ * @param {unknown} value
+ * @returns {{format: number, digest: string, path: string, version: string}}
+ */
+function parseDaemonRuntime(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Accepted Rollbridge owner did not report a valid immutable daemon runtime identity.");
+    const runtime = /** @type {Record<string, unknown>} */ (value);
+    const keys = Object.keys(runtime).sort();
+    if (JSON.stringify(keys) !== JSON.stringify(["digest", "format", "path", "version"]))
+        throw new Error("Accepted Rollbridge daemon runtime identity contains unsupported material.");
+    if (runtime.format !== 1 || typeof runtime.digest !== "string" || !/^[0-9a-f]{64}$/u.test(runtime.digest) || typeof runtime.version !== "string" || !supportsForegroundBoot(runtime.version)) {
+        throw new Error("Accepted Rollbridge owner reported a malformed immutable daemon runtime identity.");
+    }
+    if (typeof runtime.path !== "string" || !path.isAbsolute(runtime.path) || path.normalize(runtime.path) !== runtime.path || path.basename(runtime.path) !== runtime.digest) {
+        throw new Error("Accepted Rollbridge daemon runtime path is not its normalized content-addressed identity.");
+    }
+    return { format: runtime.format, digest: runtime.digest, path: runtime.path, version: runtime.version };
+}
 /**
  * @param {unknown} configuredPath
  * @returns {configuredPath is string}