tracegrove 0.0.0-stage → 0.3.0

package/docs/replay-assessment.md

@@ -0,0 +1,17 @@
+# Replay assessment
+
+`assessScenarioReplay(ports, token)` derives read-only readiness from the complete registered scenario history and authenticated raw bundle snapshots. It never accepts caller-provided passing assessments and never activates coverage. A host must still perform explicit authenticated activation with an atomic comparison against the returned scenario revision token, chosen rounds and exact definition bindings.
+
+The immutable, scoped `workflow.qualification-policy/v1` selects environment or revision proof and requires between two and twenty independent rounds. Two is the minimum; there is no mock-only or single-run activation policy. Source-derived scenarios additionally require revision proof even when the policy requests environment proof.
+
+Every current-epoch round retains its exact scenario/replay/policy/matrix/target-profile/strata bindings. Registration history is complete, monotonic and checked before any results are filtered. Reused campaign, execution, attempt or leased-state identities are refused. An incomplete history or unknown issuer is an error, never an empty passing report. Old epochs remain in the host's history but cannot count toward current qualification.
+
+Each terminal round is re-derived through the same authenticated snapshot reader used by `reduceQualificationRound`; the trusted result index must match that derived round reference. Required cell coverage, assertions, capture, observed identity and cleanup guards therefore run again. Mock, replayed, intercepted, fault-injected or stubbed claimed boundaries cannot count as live proof. Required target identities must be nonempty and observed; the full observed tuple must match the expected tuple. A failed, cancelled, blocked or inconclusive campaign cannot qualify even when some cells passed.
+
+Revision proof additionally binds every resolved repository role, URL, commit, origin, object reference and lockfile digest to the observed target and requires a registered resolver reference. Generic environment proof cannot satisfy a revision-specific policy or waive missing/mismatched source identity when source bindings or expected repository identities exist. Source-bound requests must retain the scenario's reviewed source plan. These comparisons do not authenticate observations by themselves: `authenticateEvidence` must establish issuer authority, real state leases, the reviewed source/replay/policy/matrix/target closure, required capture and independently observed target fields against the captured manifest digest. Copying requested identities into an observation is insufficient. The prototype does not install that host adapter or a source resolver.
+
+The latest admitted current-epoch round must be terminal and qualify. Two older passes do not hide a newer pending or nonqualifying campaign. All current-epoch rounds, including nonqualifying ones, appear in the report. Version, definition, epoch and latest sequence are rechecked after reading evidence; a concurrent registration or semantic edit makes the report stale. A subsequent activation must repeat its atomic comparison because an edit can still arrive after this read-only report returns.
+
+Reports contain sealed `workflow.replay-assessment/v1` documents and their resolvable `workflow.replay-finding/v1` reason documents. Proof levels are structural, mock, environment or revision. These are observations, not permissions. The report contains its exact revision token and qualifying round refs for a future activation owner; the schema's `qualifies` boolean alone grants no authority.
+
+Tests run real local native application observations and genuine mock observations with explicitly simulated catalog registration and issuer ports. They prove consumer reduction and race handling. Synthetic resolved-source fixtures exercise classifier guards only. The [local result index](qualification-results.md#durable-local-terminal-results) supplies retained terminal evidence, and [explicit activation](scenario-activation.md#local-atomic-storage) has a durable journal adapter. [Structural validation](scenario-structure.md) shares the executor preflight and supports proposed/degraded transitions. [Source-plan promotion](source-promotion.md) binds current approved storage to proposed scenarios. Additional integration tests use actual registration and native execution with simulated external authority. Hosted registration/issuer authority, live staging qualification and activated regression execution remain open.

package/docs/result-sink.md

@@ -0,0 +1,87 @@
+# Independent local result retention
+
+The result sink retains complete verified bundles independently of the producer's
+run directory. It reuses the existing fenced `LocalLedger` for its index; there is
+no second database, mutable status file, or hosted service in this implementation.
+
+```sh
+tracegrove result-ingest --bundle ./run/bundle --sink ./retained-results --json
+tracegrove results --sink ./retained-results --limit 20 --json
+tracegrove results --sink ./retained-results --id <result-id> --json
+```
+
+`result-ingest` captures a bounded verified snapshot, checks the selected consumer
+scope, copies only sealed files, reads the completed archive back, and publishes
+an immutable `workflow.result-ingest/v1` receipt. Manifest and payload bytes come
+from the same snapshot that passed complete evidence reduction; the source is
+not reopened during copy. Binary artifacts retain their exact bytes. Unsealed
+files, including accidental scratch files, are not imported.
+
+SDK consumers that authenticated an earlier snapshot can pass
+`sink.ingest(bundleDir, { expectedManifestDigest })`. A mismatch is refused before
+archiving or publishing a campaign receipt. This binds retention to the authenticated
+bytes without treating the digest itself as issuer authentication.
+
+The receipt records the actual retained outcome, exact campaign/request/selection
+and fidelity-plan refs, planned fidelity lanes, manifest digest, receipt count,
+and acceptance time. A failed, cancelled, blocked, or mocked result never becomes
+a passing live result through storage. Every receipt explicitly says:
+
+```json
+{"evidenceClass":"integrity_checked_local_bundle","issuerStatus":"unverified","qualificationStatus":"not_evaluated"}
+```
+
+Exit 0 from ingestion means durable retention succeeded, including retention of
+an honestly failed attempt. Check `receipt.retainedOutcome` for the result's
+verdict. The ordinary CLI error convention remains stderr plus a nonzero exit;
+invalid or inconsistent evidence is a conflict (exit 2).
+
+## Reading and replaying deliveries
+
+Listing returns stored receipt metadata with `archiveStatus: not_checked`. It
+does not renew an earlier integrity check. Inspecting a result by ID captures and
+re-verifies the retained archive against its exact indexed manifest and refs.
+Missing or corrupted archives fail rather than echoing the recorded verdict as a
+fresh verification. Inspection keeps working when the original run is removed.
+
+Delivering the identical campaign and manifest again returns the original receipt
+with `replayed: true`; it does not append another result. Reusing that scoped
+`campaignId` with different evidence is a conflict, including renaming its result
+document reference. Even a differently serialized
+manifest is different evidence. Preserve the original manifest bytes for retries.
+
+List pages are bounded to 100 records. An opaque cursor binds the selected scope,
+index version, and offset; later deliveries do not change that page sequence.
+Cursors are pagination positions, not access grants. An exhausted 10,000-record
+prototype index blocks new admissions until an authoritative archival index is
+provided. Entries are never silently evicted.
+
+## Durability and scope
+
+Archive files and directories are synced before their immutable content-addressed
+directory is published. The archive namespace is synced before the ledger receipt
+is appended and synced. A crash between those operations can leave an unindexed
+complete object, but cannot publish an accepted receipt for an incomplete copy.
+A retry verifies that object and syncs its namespace again before publishing one receipt. Partial
+staging directories are not indexed; only a staging directory created by the
+current operation is removed on an ordinary write failure. Existing content is
+not replaced or silently repaired. The test suite includes an actual SIGKILL at
+the archive/index boundary, reopen/retry, and injected sync failure.
+
+The SDK exports `ResultSink`, `ResultSinkAuthority`, `LocalResultSink`, and
+`VerifiedBundleSnapshot`. A host supplies consumer authorization; ingestion
+rechecks it after capture and commits without an asynchronous gap. The CLI uses
+the same local operator scope as ordinary runs, with no producer-supplied scope
+override. The journal and objects are namespaced by that complete scope.
+
+The operator must provide protected, quiescent source and storage directories
+and authorize the source location before calling the SDK. The existing local
+ledger supplies one writer and stale-process recovery; this is not distributed
+fencing or a filesystem ACL against a hostile same-user process. Local owner
+labels, including `WORKFLOW_VERIFY_OWNER`, do not authenticate a remote tenant.
+
+This sink verifies integrity and record consistency. It does not authenticate an
+issuer, approve a source plan, provision qualification leases, activate coverage,
+or publish an OrgX AWR record. Hosted receiver authentication, tenant delivery,
+and scoped OrgX projection require their own trusted adapters. A storage receipt
+cannot stand in for those acceptance gates.

package/docs/scenario-activation.md

@@ -0,0 +1,54 @@
+# Explicit scenario activation
+
+`activateScenario(ports, intent)` consumes an exact scenario revision token, replay/policy/matrix/target references, an explicit selection of terminal round references and a scoped idempotency key. It returns a sealed `workflow.scenario-activation/v1` receipt. Actor identity and the authorization policy come from the authenticated host's `authorizeActivation(scope, intentDigest)`; callers cannot submit an actor, approval flag or readiness result.
+
+The operation requires a validating scenario, checks all expected definition bindings and re-derives replay qualification from authenticated complete evidence. The selected set must satisfy the policy's independent-round minimum and include the latest admitted qualifying round. Duplicate or foreign rounds, mock-only proof, a newer pending round and stale scope/version/epoch are refused. Existing matrix, history, issuer and bundle guards are shared with replay assessment.
+
+`compareAndSwapActivation` is an atomic authority boundary. In one transaction, the host must compare validating state, aggregate version, definition and replay/policy/matrix/target digests, epoch, latest admitted sequence, exact immutable selected result refs and current activation authorization. It must enforce the scoped idempotency key and publish the assessment/finding records, activation receipt and active projection together, or publish none. The selected-result check still matters when a result index changes without advancing the scenario version. A registered newer round or semantic invalidation must conflict with an older activation attempt. The local adapter below uses the existing journal; hosted transaction storage remains a separate host integration.
+
+Repeated round order is normalized. An already committed identical intent returns its original receipt without another write, including after a lost commit acknowledgement or concurrent identical delivery. Reusing the key for a different intent conflicts. Authorization runs before historical receipt lookup too. Returning an earlier activation receipt does not assert that coverage remains active now: a later semantic invalidation or retirement remains in effect, and retries cannot resurrect it. Read the current projection to establish current state.
+
+This API cannot activate proposed, degraded, active or retired projections through a fresh intent. Promotion and successful structural validation must first establish validating state through their own authority. Product regressions remain visible through qualification/release evidence; they do not implicitly call semantic invalidation or remove the detecting case.
+
+## Local atomic storage
+
+`LocalScenarioStore.activationPorts(results, authority)` connects explicit activation
+to the scenario registry and `LocalQualificationResults` on the same `LocalLedger`.
+It reuses the public decision validator and independently rederives replay assessment
+inside the commit boundary. Submitted readiness flags, actors, reports and projections
+are compared with freshly derived values; they cannot grant authority.
+
+```ts
+const ports = store.activationPorts(results, {
+  resolvePolicy,
+  authorizeActivation, // Current authenticated owner and policy for this exact intent digest.
+});
+const activation = await activateScenario(ports, intent);
+```
+
+The adapter checks the scenario registry version, complete result-index version and
+captured archive manifest digests after its final activation authorization await.
+There is no await between those checks and the single synced append containing the
+active projection, receipt and full assessment/finding records. An unrelated change
+to the scope's registry or result index can conflict conservatively; retry from a
+fresh snapshot. Revocation and physical/provider fencing outside this local writer
+still require the host to synchronize its authority checks with its controller.
+
+Idempotency keys are unique across scenarios in the scope. Reopen reads the complete
+activation and projection from the same journal entry. A write failure publishes
+neither; a committed entry with a lost acknowledgement returns its original receipt
+on retry. Historical retrieval requires current activation authorization and never
+reverses a later invalidation. Existing registration-only journals read with empty
+activation history; an active projection without its persisted receipt is refused.
+The scope permits 500 retained activations before explicit archival indexing is needed.
+
+Tests use actual registered native/mock execution, the immutable result sink and
+durable scenario journal, alongside the earlier in-memory consumer tests. They cover
+concurrency, lost acknowledgement with reopen, pre-write failure, forged submissions,
+registration/invalidation/revocation/archive/index races and corrupt persisted reports.
+Host, reviewed-source, physical-lease and issuer authority are explicitly simulated.
+These proofs do not establish hosted activation, deployed staging qualification or
+live regression admission. [Structural transitions](scenario-structure.md) have a local
+adapter. [Source-plan promotion](source-promotion.md) has a local approved-review bridge.
+Hosted persistence and
+activated regression execution remain open.

package/docs/scenario-structure.md

@@ -0,0 +1,58 @@
+# Structural validation before qualification
+
+`LocalScenarioStore.propose(definition, selections)` stores an authorized immutable
+scenario in `proposed` state. Qualification registration refuses that state.
+`validateScenarioStructure(ports, token, frozenPlan)` performs static checks and
+records the transition to `validating`. It can also revalidate a `degraded` revision
+after semantic invalidation. It does not run the candidate or claim functional PASS.
+
+```ts
+await store.propose(definition, [qualificationMatrix, selectedRound]);
+const validation = await validateScenarioStructure(
+  store.structuralPorts({ authorizeValidation }),
+  exactScenarioRevisionToken,
+  frozenTrialPlan,
+);
+```
+
+The plan must be a sealed trial/work-proof request without lifecycle refs or plan
+blockers. Its cases, personas, target cells and exclusions must exactly match the
+scenario matrix. The implementation shares the executor's actual document resolution,
+capability reproduction, fixture/fidelity checks and case compiler. Missing fixture
+plans, changed fidelity, unsupported capabilities and unresolved/modified documents
+fail before a host, fixture operation or provider starts. Matrix policy is taken from
+the scenario's reviewed definition; this operation cannot change that matrix.
+
+The authenticated host supplies `authorizeValidation(scope, intentDigest)`, returning
+the current actor and authorization policy for the exact token, frozen request and
+executable-closure digest. Source/review/definition checking remains the store's
+required `validateDefinition` responsibility. No permission or independent source
+validation is inferred from a caller's success flag. Proposed storage is not itself
+the source-plan promotion manifest; [source promotion](source-promotion.md) supplies
+that separate approved-review operation.
+
+The local adapter recompiles the supplied closure and rechecks definition and actor
+authority before publishing the sealed `workflow.scenario-structure/v1` receipt and
+validating projection in one synced registry entry. A competing edit, invalidation or
+authorization change publishes no validation. The receipt records the exact scenario
+token, request, qualification matrix, executable closure, actor, policy and timestamp.
+It clears current qualification/activation refs without deleting historical evidence.
+
+Repeated identical deliveries recover one receipt, including after lost acknowledgement
+or journal reopen. Historical receipt retrieval requires current validation permission;
+it does not reverse later invalidation or prove that coverage remains validating now.
+Revalidation of a replacement definition uses a new token and preserves its advanced
+invalidation epoch. Keep the original frozen plan alongside the receipt: the digest
+binds that plan but does not make the receipt an executable bundle.
+
+The index is bounded to 500 structural records per scope and refuses exhaustion rather
+than dropping history. Existing journals read with empty structural history. The earlier
+`initialize` API remains a trusted-host import of an already structurally validated
+scenario; it does not produce this receipt and requires the host to establish both
+promotion and validation authority before calling it.
+
+This is protected local single-writer storage. It does not install hosted IAM, physical
+state leases, hosted source promotion, CLI lifecycle commands, live qualification or
+activation. Tests use real journal bytes and static compilation; one positive test then
+executes two newly admitted native cells. Host/source/review/effect authority is explicitly
+simulated, and structural success alone is never reported as application success.

package/docs/source-promotion.md

@@ -0,0 +1,104 @@
+# Promoting an approved source plan
+
+`promoteScenario(ports, intent, definition, selections)` registers an approved source
+scenario as `proposed`. It returns a sealed `workflow.scenario-promotion/v1` manifest.
+It creates no plan approval, structural validation, runtime PASS or active coverage.
+
+The intent names the scenario, immutable definition and selection refs, exact editable
+plan revision token, and scoped idempotency key. The definition binds the source plan
+and current review. Promotion requires the stored review to be approved for that exact
+plan/edit revision and to retain its atomically stored source validation. Each promoted
+case must belong to approved runnable candidates whose source elements were independently
+validated. Blocked/excluded candidates and non-scenario plan dispositions cannot become
+promoted cases. The matrix and every supplied selection retain the exact case/persona/
+target strata and policy.
+
+```ts
+const ports = scenarios.promotionPorts(reviews, { authorizePromotion });
+const manifest = await promoteScenario(ports, {
+  scenarioId,
+  definitionRef: definition.ref,
+  reviewToken,
+  selectionManifestRefs: selections.map(selection => selection.ref),
+  idempotencyKey,
+}, definition, selections);
+```
+
+`LocalReviewStore.approvedSnapshot(ledger, token, reviewRef)` resolves actual approved
+storage on the same writer. It requires current review authority without writing a
+review or approving anything. Its documents are copies; its runtime `assertCurrent`
+checks the review aggregate version. The local promotion adapter resolves that snapshot
+again inside its commit, compares the submitted context, rechecks creation/promotion
+authority and verifies both review and scenario versions after the final await.
+One synced scenario-registry entry contains the proposed definition, selections,
+manifest, full reviewed plan, review and source-validation snapshot. Gaps, withheld
+flows, excluded candidates and diagnostics remain in that immutable snapshot.
+
+The manifest binds the review/source-validation refs and storage version as well as
+the authenticated promoter and policy. Selection order is normalized. Repeated or
+concurrent identical intent returns one manifest; a changed scoped key binding or an
+attempt to overwrite an existing scenario conflicts. A pre-write failure publishes
+nothing; a lost acknowledgement recovers the committed manifest after reopen. The
+registry's existing 100-scenario bound applies. Older journals have no promotion record.
+
+## Current review checks after promotion
+
+Bind the current review owner once when constructing a source-backed local scenario store:
+
+```ts
+const scenarios = new LocalScenarioStore(ledger, scenarioId, scope, {
+  reviewStore: reviews,
+  authorize,
+  validateDefinition: validateReplayPolicyAndTarget,
+  validateStateLeases,
+});
+```
+
+`reviewStore` is required when a definition names a source plan. It must own the same
+ledger. The store checks its exact current approved review and independently validated
+runnable cases in addition to the host's replay/target/policy checks. Initialize,
+structural validation, round registration and activation hold its synchronous version
+fence through their last awaited authorization and assert it immediately before the
+registry write. An edit during that await publishes no transition.
+
+An edit clears the current plan review. These guards then refuse later structural,
+qualification and activation admission against the old review. Use `invalidateScenario`
+with a replacement definition to advance its epoch and clear activation. Historical
+promotion retries return the original receipt without renewing approval or altering
+the scenario. Promotion registers new entries; replacing an existing scenario remains
+an explicit semantic edit and review flow.
+
+All ports belong to the trusted host. A saved source plan or producer-supplied approval
+object cannot supply them. Protect the state directory and synchronize external IAM,
+revocation and provider fencing with the controller. Local hashes and receipts do not
+establish a hosted issuer or deployed revision. Source-bound activation still requires
+independent runtime revision proof; source inspection alone cannot grant it.
+
+## Execute the reviewed revision
+
+Use the compiler's `--source-snapshot` and `--source-repository-role` options to bind
+the complete resolver-head snapshot before selecting, reviewing and promoting cases.
+The approved source plan must name that exact resolver matrix. A different matrix
+ref is rejected even when its commits happen to match. Component-only source runs
+can still execute, but cannot establish revision qualification.
+
+`prepareQualificationExecution` reads current source review evidence through the
+scenario owner and carries copies of the sealed plan, approved review and source
+validation into the frozen execution documents. It leaves the original trial plan
+unchanged. Each effect authorization resolves current owner state again, including
+after awaited effect permission. The controller never obtains approval from the
+copied documents.
+
+Preflight and saved-bundle checks use `validateReviewedSourceDocuments` to check seals,
+scope, plan/review/validation links and the selected matrix. The same pure schema is
+shared with promotion. Saved evidence proves the recorded relationships; the owning
+review store determines current approval. Historical bundles remain readable after
+an edit, while new execution and activation require current authority.
+
+Tests compose immutable Git reads, an actual bounded TypeScript AST predicate, source
+validation, durable review, promotion, structural validation, two independently admitted
+native revision rounds and atomic activation, including reopen recovery and source-edit
+races at the final structural, registration and activation boundaries.
+Authentication, coverage policy, physical leases and issuer authority are explicitly
+simulated. The AST oracle proves a declared POST branch only. These proofs do not
+establish full semantic coverage, a deployed source tuple or hosted qualification.

package/docs/source-review.md

@@ -0,0 +1,21 @@
+# Source-backed plan review
+
+`validatePlanSources` checks a sealed source plan against its exact change model and revision matrix. It authorizes each repository, hashes the fetched full diff, resolves citations only at selected immutable commits, and reuses `verifySourceCitation` for file/excerpt checks. A modified working checkout cannot substitute for unavailable selected source.
+
+Runnable derivations need confirmed metadata, citations, and nonempty evidence from a registered independent AST/schema/route oracle. Confidence and a proposed `confirmed` label do not establish that evidence. Failed/partial/unsupported extraction retains diagnostic refs as plan gaps. The trusted coverage policy checks frozen requirements, unresolved questions, excluded material and no-E2E reasoning. Source checks never produce runtime PASS, qualification or activation.
+
+Trusted host integration:
+
+```ts
+const reviewPorts: PlanReviewPorts = {
+  ...authenticatedReviewAndStorage,
+  validateSources: (plan, policyRef) => validatePlanSources(sourcePorts, plan, policyRef),
+};
+const reviewed = await reviewPlan(reviewPorts, revisionToken, 'approved', reasonRefs);
+```
+
+All ports belong to the authenticated host. A candidate, plugin or authoring model cannot supply its own source checker, oracle or coverage policy. Revision policy must explicitly admit a missing merge base and its alternative diff method. A full diff over 4 MiB, over 500 distinct runnable citations, unavailable objects, mismatched refs or denied authority block validation rather than truncate source.
+
+Approval requires a sealed `workflow.source-validation/v1` result binding the same plan, change model, matrix, scope and admitted review policy. Its ref is included in the immutable review's reason refs. The host's `compareAndSwap` must publish that validation record, review and projection in one atomic write. A losing write publishes none of them. Rejection requires no fabricated successful source check. An edit still clears the current review; historical validation records remain evidence of their original source digests.
+
+This changes the experimental `PlanReviewPorts` contract: approved reviews require `validateSources`, and `compareAndSwap` receives a fourth validation argument. Persist it atomically; ignoring it is not a conforming host. [Local review storage](local-review-store.md) persists its records and [source promotion](source-promotion.md) binds current approved storage to a proposed scenario. This review API installs no hosted source registry or production oracle. Qualification execution requires a separately registered runtime owner; activated regression execution remains blocked.

package/docs/verified-bundles.md

@@ -0,0 +1,175 @@
+# Verified bundle snapshots
+
+`verifyBundle(directory)` retains its summary response shape; invalid bundles report a null outcome instead of echoing a producer's PASS label. `readVerifiedBundle(directory)` returns the checked request, selection, campaign, per-cell receipts, frozen document map and manifest byte digest; it throws instead of returning records for an invalid bundle. These records prepare whole-round qualification evaluation but do not themselves qualify or activate a scenario.
+
+Both paths use one `BundleSnapshot`. Each listed payload is read once, checked against its sealed byte count/hash and retained privately. JSON decoding, assertion checks and campaign reduction consume those captured bytes. Mutating the directory after capture does not change that snapshot. Buffers returned by the snapshot are copies. A later verification call takes a fresh snapshot rather than caching a former success.
+
+`VerifiedBundleSnapshot.open(directory)` exposes the exact verified manifest and
+payload bytes as defensive copies for storage adapters. Its records and manifest
+digest are copies too. The [local result sink](result-sink.md) writes those
+captured bytes, verifies the completed archive, and publishes a scoped receipt
+through the existing ledger. It does not re-open producer files during copying
+or promote a storage receipt into qualification authority.
+
+The reader refuses traversal, duplicate paths, symlinks and nonregular files. Reads are bounded to the expected size plus one byte so growth is detected without loading an arbitrarily larger file. Current prototype bounds are 1 MiB for the manifest, 16 MiB per file, 64 MiB of payload and 10,000 files. Oversize bundles fail verification; files are never truncated or silently omitted. Larger media packs need an explicitly supported bounded reader.
+
+Campaign verification rechecks complete receipt bindings, missing cells, coverage and proof eligibility, as well as full request/selection/campaign scope and reference identity. Per-cell checks bind exact case/persona/surface/variant and qualification-admission refs. The outcome label alone cannot cover inconsistent campaign metadata.
+
+Target comparison checks every target metadata field and each required component's
+kind and identity. Current hosts supply component attestations and, when explicitly
+bound, verified pinned Git-object repository observations. Remote ownership,
+release, schema, flag, browser, container and model metadata remain unobserved.
+Requesting those fields cannot fill their observations; a required mismatch blocks
+the run before fixtures or steps. The saved-bundle reader reconstructs the observed
+tuple from the captured host attestations too, so inventing matching expected and
+observed metadata and recomputing all file/document hashes cannot create passing
+source or deployment evidence. Unsupported target observations need a real host
+contract before they can qualify. Honest blocked attempts retain their evidence.
+
+An optional source-snapshot binding covers local launch content. Its frozen
+manifest must match the admitted scope and supervisor observation; every attested
+identity file must belong to that manifest with the same bytes. The reader also
+recomputes the source digest from those file observations. This binds captured
+local content. The [Git proof guide](git-object-proof.md) describes the separate
+actual-file object check and opt-in repository role. Neither establishes remote
+ownership, deployment identity or hosted issuer trust.
+
+This is integrity and record-consistency verification. A passing mocked bundle retains its mocked proof boundary. It is not live qualification, trusted issuer identity, tenant authorization or production acceptance. The host must authorize a quiescent artifact directory and apply its own issuer/admission policy. The snapshot API is not a remote filesystem ACL or a defense against a hostile process replacing parent directories during capture.
+
+## Atomic local export
+
+`exportVerifiedBundle(source, output)` captures and reduces one bounded snapshot, writes only its sealed bytes into a private sibling staging directory, verifies the staged copy, and renames it into a fresh output directory. The manifest comes from that same snapshot; unlisted host/private files are excluded. The CLI `export` and authoring `test` use this path. CLI JSON includes `published`; invalid source evidence publishes no output. Existing outputs are never merged or overwritten, including an empty directory.
+
+Files and directory entries are synced before acknowledgement, including newly created ancestor entries. Content-addressed object publication uses an exclusive hard link, unique temporary storage, bounded no-follow readback and a single digest-checked read. A preexisting corrupt object is retained and reported, never silently replaced. Preexisting symlink ancestors are rejected before directory creation. These operations require a supported owned local filesystem with directory fsync and hard links; unsupported filesystem behavior fails rather than claiming durability.
+
+Cooperating exporters share an exclusive sibling publication lock. A writer crash can leave its private staging directory and lock; the destination is absent or contains the complete verified bundle. Locks are never automatically broken. The operator must establish that the writer is gone and inspect the owned staging/output state before a separately authorized cleanup/retry; do not blindly remove a lock belonging to another writer. If final parent sync fails after rename, the command reports that publication durability is unconfirmed: the complete output may exist, so verify it before retrying and do not overwrite it.
+
+Tests include concurrent independent publishers, actual writer SIGKILL during a payload write, source mutation after snapshot capture, corrupt objects, symlink/no-effect refusal and injected write/sync failures. This establishes local process-crash behavior and fsync ordering, not physical power-loss qualification, arbitrary hostile-parent confinement, distributed fencing, automatic recovery or provider attestation.
+
+## Durable original execution seal
+
+`writeExecutionBundle` now persists the original execution records before acknowledging the
+source seal, rather than relying on a later exported copy. Cell and final payload files are created
+exclusively and fsynced. Existing cell payloads are re-read through the bounded no-follow reader,
+synced as regular files, and their directories are synced before final publication. Existing
+payloads or manifests are never overwritten, including corrupt bytes left by an interrupted write.
+
+The writer builds the existing v1 manifest in a unique private `.bundle-pending-*` directory.
+An internal candidate snapshot checks its bounded payload hashes and performs the same complete
+frozen-record, assertion and campaign reduction as the public verifier. The verified receipt set
+must also match the final records supplied by the executor. Only then does an exclusive hard link
+publish `manifest.json`, followed by directory fsync. The executor's ledger finalization follows
+the returned source seal. The bundle format and public reader contract are unchanged: a candidate
+without a published manifest is never a valid public bundle.
+
+The caller must own a quiescent local execution tree and retain its existing ledger writer.
+An exclusive `.bundle-write.lock` serializes cooperating source writers. A write/sync/candidate
+failure or process death retains its incomplete records, lock and any manifest staging for explicit
+reconciliation; no stale lock is automatically removed and no assertion is retried. A manifest
+that became visible before a later directory sync failure is reported as published with durability
+unconfirmed, rather than removed or overwritten. Verify that existing bundle before any retry.
+
+Tests cover actual SIGKILL before the manifest link and after its first directory fsync, injected
+payload write/fsync failures, corruption during manifest staging, a hash-consistent candidate
+whose campaign disagrees with reduction, existing corrupt payload preservation, linked-parent
+refusal and post-publication sync uncertainty. A process crash can leave an invalid incomplete
+source or a complete verifiable source with reconciliation remnants. These bounded local tests
+do not simulate physical power loss, establish hostile-writer confinement, distributed fencing,
+provider/host qualification, or transactional recovery across the separate ledger and bundle seal.
+
+## Local commit-window readback
+
+If a controller dies after the original manifest commits but before ledger finalization, local
+redelivery first requires the existing durable ownership inventory to show acknowledged removal
+of every resource. It then verifies and reduces the entire committed bundle and binds its exact
+request/selection, scope, execution/attempt/generation, attempt number, idempotency key and
+per-cell receipt references to the trusted ledger. Only a matching commit can reconstruct the
+original summary, sync the manifest's directory and append the missing `finalized` transition.
+A failed recovery directory sync leaves finalization blocked with durability unconfirmed.
+It returns checked receipts and
+starts no second host or fixture. A manifest's mere presence or a producer PASS label is insufficient.
+
+Finalized redelivery also reads this bound committed evidence instead of trusting the cached
+summary containing an empty receipt list. Missing, corrupt or foreign finalized evidence fails
+closed without acquisition. Interrupted attempts without a committed manifest retain the existing
+retry policy and ownership gate; this readback does not repair incomplete files or invent cleanup.
+Actual controller SIGKILL immediately before the ledger finalization write, zero-launch readback,
+unknown ownership, corrupt/foreign/missing evidence and false cached summary are regression-tested.
+This is local reconciliation under one ledger writer, not a distributed transaction or a claim that
+physical power loss was simulated.
+
+## Inspect and hand off a frozen run
+
+```sh
+tracegrove inspect --request ./frozen.json --json
+tracegrove rerun --request ./frozen.json --output ./next-attempt.json
+tracegrove run --request ./next-attempt.json --state-dir ./state
+tracegrove inspect --execution <id> --state-dir ./state --json
+tracegrove inspect --bundle ./exported-evidence --failed-step --json
+tracegrove export --execution <id> --state-dir ./state --output ./new-export
+```
+
+`inspect --request` uses the typed frozen transport envelope and static executable
+closure checks. It reports requested refs, selected cells, a closure digest, blockers
+and whether a qualification owner is required. `executionAuthority: not_checked`
+means exactly that: inspection does not query an approval owner, probe a runtime,
+start an application, provision state or grant effects. It needs no mutable project
+YAML. A blocked structure exits 2; a valid structure exits 0.
+
+The CLI reads frozen envelopes from bounded regular files (96 MiB maximum), rejects
+unknown envelope fields and checks document keys and seals before rerun. A trial or
+work-proof rerun retains the exact frozen case/persona/target selection, assigns fresh
+campaign/request identities and records `replayOf`. Its documents are independent
+copies of the original. Qualification/lifecycle requests cannot use `rerun` to erase
+registration; use the current owning registry to admit a new independent round and
+`prepareQualificationExecution` to bind it.
+
+Execution inspection first captures and independently verifies the complete evidence
+bundle. It never reports an unverified producer PASS. `--bundle` supports evidence
+outside the original state directory; `--execution` requires one safe path segment
+and a state directory. `--failed-step` is the explicit path for failed observation
+payloads. Ordinary summaries retain compact step/assertion labels. Successful
+inspection exits 0 even when the verified product outcome is a failure; read `outcome`.
+Invalid evidence exits 2 and reports no success summary.
+
+The CLI `export` uses the atomic local export described above. The library also exports
+`exportCapturedBundle(snapshot, output)`, which writes a `VerifiedBundleSnapshot`'s captured
+sealed bytes through the same file writer as the result archive. It never rereads the producer directory or copies
+unlisted scratch files or workspaces. The output must be a new directory. Files are
+exclusive, the manifest is written last, and completed output is reverified. Failed
+writes remove only the newly allocated output; existing destinations and links are
+left intact. Capturing before the producer disappears still permits export afterward.
+
+The library exports the `FrozenBundle`, `FrozenPlanInspection`, `ExecutionInspection`
+and `FailedStepInspection` Zod schemas with the corresponding reader/inspection
+functions. These local projections are not new execution authority or outcome records.
+
+
+## Runner compatibility
+
+A frozen runner profile is evidence of the selected configuration, not permission to
+substitute the verifier's current runner identity. `verify-bundle --json` and failed verified
+exports may include `diagnostics` with schema `tracegrove.runner-compatibility/v1`:
+
+- `runner_profile_missing`: no valid, self-digest-checked profile reproduces the requested runner kind.
+- `runner_capability_revision_unsupported`: a valid matching profile is present, but this verifier
+  cannot reproduce the requested capability revision.
+- `runner_capability_digest_mismatch`: the kind and revision are supported, but the exact capability
+  digest cannot be reproduced from the frozen profiles. Investigate the producer/profile mismatch.
+
+The diagnostic includes the exact `requestedRunner` ref and up to 32 matching valid profiles with
+`reproducedRunner` refs. It always says `verification: "not_completed"`; it never grants a historical
+outcome. Unsupported evidence still returns `ok: false`, `outcome: null`, and CLI exit 2. Other
+integrity failures retain their own errors and need not produce a compatibility diagnostic.
+
+Preserve the original bytes and manifest. Do not edit or reseal references, choose a runner by
+step names, or replace a requested revision merely because the case uses a subset of its operations.
+For historical inspection, use the producer's recorded compatible verifier and pinned dependency
+closure. An npm version alone may be insufficient for an unpublished build; retain its source commit
+and package integrity too. To qualify a current runtime, perform a new authorized execution, preserving
+both attempts and their distinct identities. This is a new qualification, not a migration of old proof.
+
+For example, a valid browser profile captured by an unreleased verifier with capability revision
+`0.3.0` cannot be reproduced by a verifier that implements only `0.1.0`. That is an unsupported reader
+boundary, not proof that the profile is absent or that either workflow passed now. These diagnostics
+do not add historical runner implementations, alter accepted evidence, or grant replay authority.