release-skill 0.2.4 → 0.2.6

package/src/commands/prepare.mjs

@@ -33,6 +33,11 @@ import { runSnapshotVerificationGates } from '../core/verification-gates.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
 import { computePlanDigest, writePlanAtomic, writePlanImmutable } from '../core/plan.mjs';
 import { sha256Hex } from '../core/digest.mjs';
+import {
+  CHECKER_VERSION as SKILL_RESOURCE_CHECKER_VERSION,
+  checkSkillResourceClosure,
+  createSkillResourceClosureReceipt,
+} from '../core/skill-resource-closure.mjs';
 import { buildPublicStaging } from '../snapshot/public-map.mjs';
 import { resolveUnitScopedPath } from '../snapshot/public-path.mjs';
 import { scanSnapshot } from '../snapshot/scan.mjs';
@@ -44,7 +49,13 @@ import {
   normalizeGitTimestamp,
   sealFrozenSnapshot,
 } from '../snapshot/frozen.mjs';
-import { ReleaseError, GATE_FAILED, CONFIG_INVALID, FORBIDDEN_CONTENT_DETECTED, RELEASE_DOCS_STALE } from '../core/errors.mjs';
+import { ReleaseError, GATE_FAILED, CONFIG_INVALID, CONFIG_MISSING, FORBIDDEN_CONTENT_DETECTED, RELEASE_DOCS_STALE, DIRTY_SOURCE_INPUT } from '../core/errors.mjs';
+import {
+  SOURCE_INPUT_ALGORITHM_VERSION,
+  computeSourceInputClosure,
+  checkSourceInputDirty,
+  verifySnapshotSourcesMatchClosure,
+} from '../core/source-authority.mjs';
 import { acquireProjectLock } from '../artifacts/project-lock.mjs';
 import { assertPreviousPublicBaselineTarget, observePreviousPublicBaseline } from '../core/previous-public-baseline.mjs';
 import { verifyFrozenNpmTarballIdentity } from '../adapters/npm.mjs';
@@ -1914,6 +1925,87 @@ export async function prepareRelease(options) {
       });
     }
 
+    // --- Step 3c: Source authority content closure gate ---
+    // After hooks complete, compute the deterministic source-input closure
+    // and verify that closure inputs are clean (no staged/unstaged/untracked
+    // changes). Production configs must declare sourceRepository.
+    const sourceRepository = config.project?.sourceRepository ?? null;
+    const configDefaultBranch = config.project?.defaultBranch ?? null;
+
+    let sourceAuthority = null;
+    let sourceInputClosure = null;
+    if (production) {
+      if (!sourceRepository || typeof sourceRepository !== 'string') {
+        throw new ReleaseError(
+          CONFIG_MISSING,
+          'production prepare requires project.sourceRepository in configuration; source authority content gate needs a workspace source repository',
+          { configPath },
+        );
+      }
+
+      await evidence.append({ phase: 'source-authority', status: 'started' });
+
+      // Compute source-input closure from resolved unit configs
+      const unitConfigsForClosure = configUnits.map((unit, idx) => ({
+        ...unit,
+        version: { ...unit.version },
+      }));
+      sourceInputClosure = await computeSourceInputClosure({
+        units: unitConfigsForClosure,
+        root: realRoot,
+      });
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'closure-computed',
+        entryCount: sourceInputClosure.entries.length,
+        inputDigest: sourceInputClosure.digest,
+      });
+
+      // Check only closure inputs for dirty (not whole workspace)
+      const dirtyResult = await checkSourceInputDirty({
+        closure: sourceInputClosure,
+        root: realRoot,
+      });
+      if (dirtyResult.dirty) {
+        await evidence.append({
+          phase: 'source-authority',
+          status: 'blocking',
+          reason: 'DIRTY_SOURCE_INPUT',
+          dirtyPaths: dirtyResult.dirtyPaths,
+        });
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          `source-input closure files have uncommitted changes: ${dirtyResult.dirtyPaths.join(', ')}`,
+          { dirtyPaths: dirtyResult.dirtyPaths },
+        );
+      }
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'dirty-check',
+        status: 'clean',
+      });
+
+      // Build sourceAuthority binding for plan digest
+      sourceAuthority = {
+        sourceRepository,
+        defaultBranch: configDefaultBranch,
+        entries: sourceInputClosure.entries,
+        inputDigest: sourceInputClosure.digest,
+        algorithmVersion: SOURCE_INPUT_ALGORITHM_VERSION,
+      };
+
+      await evidence.append({
+        phase: 'source-authority',
+        status: 'completed',
+        sourceRepository,
+        defaultBranch: configDefaultBranch,
+        inputDigest: sourceInputClosure.digest,
+        remoteObservation: offline ? 'unobserved-offline' : 'deferred-to-publish',
+      });
+    }
+
     // --- Step 4: Capture Git baseline (AFTER hooks, so workspaceDigest
     //     reflects any file changes introduced by hooks) ---
     await evidence.append({ phase: 'baseline', status: 'started' });
@@ -2178,6 +2270,75 @@ export async function prepareRelease(options) {
       gateCount: snapshotGateResults.length,
     });
 
+    // Bind the remote source-authority proof to the exact bytes that entered
+    // the frozen snapshots, not merely to an earlier read of the workspace.
+    // Then re-read the complete closure and dirty state once more so version
+    // sources and non-snapshot closure entries cannot drift during prepare.
+    if (production) {
+      const snapshotSourceResult = verifySnapshotSourcesMatchClosure({
+        closure: sourceInputClosure,
+        unitResults,
+      });
+      if (!snapshotSourceResult.passed) {
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          'source inputs changed between closure calculation and frozen snapshot construction',
+          {
+            reason: 'SNAPSHOT_SOURCE_DRIFT',
+            dirtyPaths: snapshotSourceResult.error.paths,
+          },
+        );
+      }
+
+      const finalClosure = await computeSourceInputClosure({
+        units: configUnits,
+        root: realRoot,
+      });
+      if (finalClosure.digest !== sourceInputClosure.digest) {
+        const initialByPath = new Map(
+          sourceInputClosure.entries.map((entry) => [entry.path, entry]),
+        );
+        const finalByPath = new Map(
+          finalClosure.entries.map((entry) => [entry.path, entry]),
+        );
+        const changedPaths = [...new Set([
+          ...sourceInputClosure.entries.map((entry) => entry.path),
+          ...finalClosure.entries.map((entry) => entry.path),
+        ])].filter((path) => (
+          JSON.stringify(initialByPath.get(path) ?? null)
+          !== JSON.stringify(finalByPath.get(path) ?? null)
+        )).sort();
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          'source-input closure changed while preparing frozen snapshots',
+          { reason: 'SOURCE_CLOSURE_DRIFT', dirtyPaths: changedPaths },
+        );
+      }
+
+      const finalDirtyResult = await checkSourceInputDirty({
+        closure: finalClosure,
+        root: realRoot,
+      });
+      if (finalDirtyResult.dirty) {
+        throw new ReleaseError(
+          DIRTY_SOURCE_INPUT,
+          `source-input closure files have uncommitted changes after snapshot construction: ${finalDirtyResult.dirtyPaths.join(', ')}`,
+          {
+            reason: 'DIRTY_AFTER_SNAPSHOT',
+            dirtyPaths: finalDirtyResult.dirtyPaths,
+          },
+        );
+      }
+
+      await evidence.append({
+        phase: 'source-authority',
+        step: 'snapshot-binding',
+        status: 'completed',
+        inputDigest: sourceInputClosure.digest,
+        snapshotSourceCount: snapshotSourceResult.observation.snapshotSourceCount,
+      });
+    }
+
     // --- Step 6: Remote uniqueness (deferred to publish preflight) ---
     // Prepare only observes the previous public baseline (already done above).
     // Remote uniqueness checks (tag, GitHub Release, npm version) are deferred
@@ -2234,6 +2395,67 @@ export async function prepareRelease(options) {
         )
       : null;
 
+    // --- Step 7b: Skill resource closure gate ---
+    // Production snapshots are sealed inside buildProductionAssets. Scan only
+    // after that transition so the receipt binds the exact byte/mode identity
+    // publish will re-verify, rather than the writable pre-freeze staging tree.
+    // Non-production plans scan the final staging tree at the same point.
+    // This gate is built in, read-only, and cannot be disabled by overlays.
+    const skillResourceClosureResults = [];
+    for (const { unit, manifest } of unitResults) {
+      await evidence.append({
+        phase: 'skill-resource-closure',
+        status: 'started',
+        unitId: unit.id,
+      });
+
+      const closureResult = await checkSkillResourceClosure({
+        snapshotDir: manifest.outputDir,
+        host: 'root',
+      });
+
+      const receipt = createSkillResourceClosureReceipt(closureResult, { unitId: unit.id });
+      skillResourceClosureResults.push(receipt);
+
+      if (closureResult.findings.length > 0) {
+        await evidence.append({
+          phase: 'skill-resource-closure',
+          status: 'blocking',
+          unitId: unit.id,
+          findingCount: closureResult.findings.length,
+          findings: closureResult.findings.map((f) => ({
+            skill: f.skill,
+            line: f.line,
+            reference: f.reference,
+            classification: f.classification,
+            code: f.code,
+          })),
+        });
+        throw new ReleaseError(
+          GATE_FAILED,
+          `skill resource closure gate failed for unit "${unit.id}": ${closureResult.findings.length} finding(s)`,
+          {
+            unitId: unit.id,
+            findingCount: closureResult.findings.length,
+            findings: closureResult.findings,
+          },
+        );
+      }
+
+      await evidence.append({
+        phase: 'skill-resource-closure',
+        status: 'completed',
+        unitId: unit.id,
+        checkerVersion: closureResult.checkerVersion,
+        surfaceCount: receipt.surfaceCount,
+        skillCount: receipt.skillCount,
+        referenceCount: closureResult.referenceCount,
+        sourceOnlyCount: closureResult.sourceOnlyCount,
+        findingCount: 0,
+        receiptDigest: closureResult.receiptDigest,
+      });
+    }
+
     // Freeze external independent marketplace HEADs (production + online only):
     // for each claude/codex/codebuddy distribution declaring marketplaceRepo,
     // resolve the external repo's HEAD sha + default branch and validate the
@@ -2581,6 +2803,14 @@ export async function prepareRelease(options) {
         capturedAt: baseline.capturedAt,
       },
       configDigest,
+      skillResourceClosure: {
+        checkerVersion: SKILL_RESOURCE_CHECKER_VERSION,
+        unitReceipts: skillResourceClosureResults,
+        totalSkillCount: skillResourceClosureResults.reduce((sum, item) => sum + item.skillCount, 0),
+        totalReferenceCount: skillResourceClosureResults.reduce((sum, item) => sum + item.referenceCount, 0),
+        totalSourceOnlyCount: skillResourceClosureResults.reduce((sum, item) => sum + item.sourceOnlyCount, 0),
+        totalFindingCount: 0,
+      },
       verificationGates: config.verificationGates ?? [],
       snapshotDigest: overallSnapshotDigest,
       ...(production ? {
@@ -2591,6 +2821,7 @@ export async function prepareRelease(options) {
       } : {}),
       units,
       externalActions,
+      ...(sourceAuthority ? { sourceAuthority } : {}),
       createdAt: production ? createdAtTimestamp : (clock ? clock() : new Date().toISOString()),
     };
 

package/src/commands/publish.mjs

@@ -41,6 +41,12 @@ import {
   reObservePreviousPublicBaseline,
 } from '../core/previous-public-baseline.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
+import {
+  CHECKER_VERSION as SKILL_RESOURCE_CHECKER_VERSION,
+  assertSkillResourceClosureReceipt,
+  checkSkillResourceClosure,
+  createSkillResourceClosureReceipt,
+} from '../core/skill-resource-closure.mjs';
 import {
   ADAPTER_ACTION_TYPE_MAP,
   TIER_TABLE,
@@ -53,10 +59,15 @@ import { appendRunState, createProductionRunDir, writeRunAtomic, resolveDefaultR
 import {
   ReleaseError,
   GATE_FAILED,
+  CONFIG_MISSING,
   BASELINE_CHANGED,
   PARTIAL_RELEASE,
   CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
+import {
+  verifyRemoteSourceContent,
+  createSourceAuthorityReceipt,
+} from '../core/source-authority.mjs';
 import { assertTransition, PUBLISHING, PUBLISHED, PARTIAL } from '../core/state-machine.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
 import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY, isPropagatingMissing } from '../core/observe-retry.mjs';
@@ -521,6 +532,14 @@ export async function publishRelease(options) {
     if (productionMode && !isProductionPlan) {
       throw new ReleaseError(GATE_FAILED, 'production publish requires a github-npm-v1 frozen plan');
     }
+    if (isProductionPlan && !plan.sourceAuthority) {
+      throw new ReleaseError(
+        CONFIG_MISSING,
+        'production publish requires a frozen sourceAuthority binding; re-run prepare with project.sourceRepository configured',
+        { gate: 'source-authority' },
+      );
+    }
+    const verifiedFrozenSnapshots = new Map();
     if (isProductionPlan) {
       if (!plan.production.assetRoot || plan.production.assetRoot === '.') {
         throw new ReleaseError(GATE_FAILED, 'production plan requires a dedicated assetRoot');
@@ -566,6 +585,7 @@ export async function publishRelease(options) {
           snapshotPath: frozen.path,
           expectedDigest: frozen.manifestDigest,
         });
+        verifiedFrozenSnapshots.set(unit.id, snapshot.snapshotDir);
         assertInsideAssetRoot(assetRoot, snapshot.snapshotDir, 'frozen snapshot');
         const git = await verifyFrozenGitRepository({
           root,
@@ -599,6 +619,60 @@ export async function publishRelease(options) {
       await evidence.append({ phase: 'safety-gate', gate: 'frozen-artifacts', status: 'passed' });
     }
 
+    // =======================================================================
+    // Safety Gate 2c: Skill resource closure recheck
+    // Re-run the skill resource closure check on each unit's frozen snapshot.
+    // Requires findingCount=0 and receipt matches the plan.
+    // =======================================================================
+    if (plan.skillResourceClosure) {
+      await evidence.append({ phase: 'safety-gate', gate: 'skill-resource-closure', status: 'started' });
+      const expectedReceipts = plan.skillResourceClosure.unitReceipts ?? [];
+      if (plan.skillResourceClosure.checkerVersion !== SKILL_RESOURCE_CHECKER_VERSION) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `skill resource closure checker version mismatch: plan=${plan.skillResourceClosure.checkerVersion}, current=${SKILL_RESOURCE_CHECKER_VERSION}`,
+        );
+      }
+      if (expectedReceipts.length !== plan.units.length) {
+        throw new ReleaseError(GATE_FAILED, 'skill resource closure receipt set does not cover every release unit');
+      }
+
+      for (const [unitId, snapshotDir] of verifiedFrozenSnapshots) {
+        const expected = expectedReceipts.find((item) => item.unitId === unitId);
+        if (!expected) {
+          throw new ReleaseError(GATE_FAILED, `skill resource closure receipt missing for unit "${unitId}"`);
+        }
+        const closureResult = await checkSkillResourceClosure({
+          snapshotDir,
+          host: 'root',
+        });
+        if (closureResult.findings.length > 0) {
+          await evidence.append({
+            phase: 'safety-gate',
+            gate: 'skill-resource-closure',
+            status: 'failed',
+            unitId,
+            findingCount: closureResult.findings.length,
+          });
+          throw new ReleaseError(
+            GATE_FAILED,
+            `skill resource closure recheck failed for unit "${unitId}": ${closureResult.findings.length} finding(s)`,
+            { unitId, findings: closureResult.findings },
+          );
+        }
+        const observed = createSkillResourceClosureReceipt(closureResult, { unitId });
+        assertSkillResourceClosureReceipt(expected, observed, `unit "${unitId}"`);
+      }
+
+      await evidence.append({
+        phase: 'safety-gate',
+        gate: 'skill-resource-closure',
+        status: 'passed',
+        receiptCount: expectedReceipts.length,
+        recheckedReceiptCount: verifiedFrozenSnapshots.size,
+      });
+    }
+
     // =======================================================================
     // Safety Gates 3-7: Load and validate approval record (shared)
     // =======================================================================
@@ -870,6 +944,65 @@ export async function publishRelease(options) {
       }
     }
 
+    // =======================================================================
+    // Safety Gate 11: Source authority content closure verification
+    // Verifies that the frozen source-input closure content exists in the
+    // workspace's remote default branch. Must pass before ANY adapter execute.
+    // Failure => zero adapter execute calls.
+    // =======================================================================
+    let sourceAuthorityReceipt = null;
+    if (plan.sourceAuthority) {
+      await evidence.append({ phase: 'safety-gate', gate: 'source-authority', status: 'started' });
+
+      const sa = plan.sourceAuthority;
+
+      // Verify the remote source tree against the entries frozen into the
+      // digest-bound plan. Publish must never rebuild authority from the
+      // mutable workspace or current config.
+      const frozenClosure = {
+        algorithmVersion: sa.algorithmVersion,
+        digest: sa.inputDigest,
+        entries: sa.entries,
+      };
+      const remoteResult = await verifyRemoteSourceContent({
+        sourceRepository: sa.sourceRepository,
+        defaultBranch: sa.defaultBranch,
+        closure: frozenClosure,
+        readRemoteFn: options.readRemoteSourceFn,
+      });
+
+      if (!remoteResult.passed) {
+        const errorCode = remoteResult.error?.code ?? GATE_FAILED;
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'source-authority',
+          status: 'failed',
+          error: remoteResult.error,
+        });
+        throw new ReleaseError(
+          errorCode,
+          `source authority content gate failed: ${remoteResult.error?.message}`,
+          remoteResult.error,
+        );
+      }
+
+      // Create receipt for successful verification
+      sourceAuthorityReceipt = createSourceAuthorityReceipt({
+        plan,
+        result: 'CONSISTENT',
+        observation: remoteResult.observation,
+        clock: clockFn,
+      });
+
+      await evidence.append({
+        phase: 'safety-gate',
+        gate: 'source-authority',
+        status: 'passed',
+        sourceRepository: sa.sourceRepository,
+        defaultBranch: sa.defaultBranch,
+      });
+    }
+
     // =======================================================================
     // All safety gates passed -- prepare for execution
     // =======================================================================
@@ -1007,6 +1140,7 @@ export async function publishRelease(options) {
           : {}),
       })),
       startedAt,
+      ...(sourceAuthorityReceipt ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] } : {}),
       ...(finishedAt ? { finishedAt } : {}),
     });
     let stateSequence = 0;

package/src/commands/reconcile.mjs

@@ -59,6 +59,7 @@ import {
   CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
 import { assertTransition, PARTIAL, PUBLISHED, BLOCKED } from '../core/state-machine.mjs';
+import { verifySourceAuthorityReceipt } from '../core/source-authority.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
 import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY } from '../core/observe-retry.mjs';
 
@@ -233,6 +234,18 @@ export async function reconcileRelease(options) {
         `reconcile source command must be publish or reconcile, got "${sourceRun.command}"`,
       );
     }
+    let sourceAuthorityReceipt = null;
+    if (plan.sourceAuthority) {
+      const receiptResult = verifySourceAuthorityReceipt({ plan, run: sourceRun });
+      if (!receiptResult.passed) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `reconcile source run has no valid source-authority receipt: ${receiptResult.reason}`,
+          { gate: 'source-authority', sourceRunId: sourceRun.runId },
+        );
+      }
+      sourceAuthorityReceipt = receiptResult.receipt;
+    }
 
     let consumedApprovalPath = sourceRun.approvalPath;
     let consumedApprovalDigest = sourceRun.approvalDigest;
@@ -956,6 +969,9 @@ export async function reconcileRelease(options) {
       sourceRunDigest: sourceAuthorityDigest,
       sourceRunPath,
       status,
+      ...(sourceAuthorityReceipt
+        ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] }
+        : {}),
       checkpoints: planActions.map((action) => {
         const value = actionResults.get(action.id);
         const normalized = value === 'deferred' ? 'deferred'
@@ -1303,6 +1319,9 @@ export async function reconcileRelease(options) {
       sourceRunDigest,
       sourceRunPath,
       status: overallStatus,
+      ...(sourceAuthorityReceipt
+        ? { sourceAuthorityReceipts: [sourceAuthorityReceipt] }
+        : {}),
       checkpoints: planActions.map((a) => {
         const status = actionResults.get(a.id) ?? 'pending';
         const normalized = status === 'deferred' ? 'deferred'

package/src/commands/setup.mjs

@@ -976,6 +976,21 @@ function buildRecommendedProposal(facts, candidates) {
   const legacyOwner = facts.legacyReleaseConfigs
     .map((c) => c.owner)
     .find(Boolean);
+  const sourceRepositoryCandidates = [...new Set(
+    facts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+  )].sort();
+  if (sourceRepositoryCandidates.length !== 1) {
+    return {
+      answers: null,
+      conflicts: [{
+        code: sourceRepositoryCandidates.length === 0
+          ? 'SOURCE_REPOSITORY_MISSING'
+          : 'SOURCE_REPOSITORY_AMBIGUOUS',
+        candidates: sourceRepositoryCandidates,
+      }],
+      assumptions,
+    };
+  }
 
   const units = [];
   for (const unit of candidates.units) {
@@ -1156,6 +1171,7 @@ function buildRecommendedProposal(facts, candidates) {
     project: {
       name: facts.packages[0]?.name ?? 'project',
       defaultBranch: facts.legacyReleaseConfigs[0]?.defaultBranch ?? facts.git.branch ?? 'main',
+      sourceRepository: sourceRepositoryCandidates[0],
     },
     releaseUnits: units,
     ...(selectedGateIds.length > 0 ? {
@@ -1517,6 +1533,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
 
   const facts = await discoverFacts(rootReal);
   const candidates = buildCandidates(facts);
+  const sourceRepositoryCandidates = [...new Set(
+    facts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+  )].sort();
   let answers = null;
   if (answersPath) {
     const resolvedAnswers = isAbsolute(answersPath) ? answersPath : resolve(rootReal, answersPath);
@@ -1527,6 +1546,7 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
   const digestAuthority = {
     setupVersion: 1,
     facts,
+    sourceRepositoryCandidates,
     releaseUnitCandidates: candidates.units,
     gateCandidates: candidates.gates,
     selectedGateIds,
@@ -1599,6 +1619,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
       const lockedAuthority = {
         setupVersion: 1,
         facts: lockedFacts,
+        sourceRepositoryCandidates: [...new Set(
+          lockedFacts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+        )].sort(),
         releaseUnitCandidates: lockedCandidates.units,
         gateCandidates: lockedCandidates.gates,
         selectedGateIds: lockedAnswers.selectedGateIds,
@@ -1622,6 +1645,9 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
           const finalAuthority = {
             setupVersion: 1,
             facts: finalFacts,
+            sourceRepositoryCandidates: [...new Set(
+              finalFacts.git.remotes.map((remote) => remote.repo).filter(Boolean),
+            )].sort(),
             releaseUnitCandidates: finalCandidates.units,
             gateCandidates: finalCandidates.gates,
             selectedGateIds: finalAnswers.selectedGateIds,