wendkeep 0.87.0 → 0.89.0

package/src/ecosystem-bridge-baseline.mjs

@@ -0,0 +1,58 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { getLocale } from '../hooks/locale.mjs';
+import { writeVaultFileAtomic } from '../packages/vault/src/vault-path-safety.mjs';
+import { validateBridgeProjection } from '../packages/integrations/src/bridge-contract.mjs';
+
+const BASELINE_FILE = 'spec-kit-baseline.v1.json';
+
+function safeChangeSlug(value) {
+  const slug = String(value || '').trim();
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(slug) || slug.includes('..')) {
+    throw Object.assign(new Error('a safe change slug is required for the Spec Kit baseline'), {
+      code: 'BRIDGE_BASELINE_CONTEXT_INVALID',
+    });
+  }
+  return slug;
+}
+
+export function specKitBaselinePath(vaultBase, changeSlug) {
+  return join(vaultBase, getLocale(vaultBase).folders.changes, safeChangeSlug(changeSlug), BASELINE_FILE);
+}
+
+export function readSpecKitBaseline(vaultBase, changeSlug) {
+  const path = specKitBaselinePath(vaultBase, changeSlug);
+  if (!existsSync(path)) return null;
+  let projection;
+  try { projection = JSON.parse(readFileSync(path, 'utf8')); } catch {
+    throw Object.assign(new Error('canonical Spec Kit baseline is invalid JSON'), { code: 'BRIDGE_BASELINE_INVALID' });
+  }
+  const validation = validateBridgeProjection(projection);
+  if (!validation.valid || projection.ok !== true || projection.adapter !== 'spec-kit') {
+    throw Object.assign(new Error('canonical Spec Kit baseline is invalid or blocked'), {
+      code: 'BRIDGE_BASELINE_INVALID', diagnostics: validation.diagnostics,
+    });
+  }
+  return projection;
+}
+
+export function writeSpecKitBaseline(vaultBase, changeSlug, projection) {
+  const validation = validateBridgeProjection(projection);
+  if (!validation.valid || projection.ok !== true || projection.adapter !== 'spec-kit') {
+    throw Object.assign(new Error('only a valid green Spec Kit projection can become baseline'), {
+      code: 'BRIDGE_BASELINE_INVALID', diagnostics: validation.diagnostics,
+    });
+  }
+  const path = specKitBaselinePath(vaultBase, changeSlug);
+  const changeDir = join(vaultBase, getLocale(vaultBase).folders.changes, safeChangeSlug(changeSlug));
+  if (!existsSync(changeDir)) {
+    throw Object.assign(new Error(`change not found for Spec Kit baseline: ${changeSlug}`), {
+      code: 'BRIDGE_BASELINE_CONTEXT_INVALID',
+    });
+  }
+  writeVaultFileAtomic(vaultBase, path, `${JSON.stringify(projection, null, 2)}\n`, 'utf8', {
+    scopeRoot: changeDir, label: 'baseline canônico Spec Kit', code: 'BRIDGE_BASELINE_PATH_UNSAFE',
+  });
+  return projection;
+}

package/src/ecosystem-bridge-proof.mjs

@@ -0,0 +1,97 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+import { getLocale } from '../hooks/locale.mjs';
+import { parseTasks } from '../hooks/change-core.mjs';
+import { buildEffectiveRequirementPackage, tasksHashOf } from '../hooks/spec-core.mjs';
+import { loadSensorsDetailed, requiredSensors } from '../hooks/sensors-core.mjs';
+import { evaluateEvidenceBinding } from '../packages/vault/src/evidence-envelope.mjs';
+import { bridgeSha256, canonicalBridgeJson } from '../packages/integrations/src/index.mjs';
+import { issueCanonicalArtifactProof } from '../packages/integrations/src/canonical-bridge-authority.mjs';
+import { captureGitSnapshot, resolveEvidenceIdentity, sensorConfigSha256 } from './evidence-envelope.mjs';
+import { collectBridgeArtifactEvidence } from './ecosystem-bridge-artifact-collector.mjs';
+
+function safeSlug(value) {
+  const slug = String(value || '').trim();
+  return /^[a-z0-9][a-z0-9._-]*$/i.test(slug) && !slug.includes('..') ? slug : '';
+}
+
+export function deriveCanonicalArtifactProof({
+  artifact, proof, projectRoot, vaultBase, changeSlug, sessionId = '', spawn = spawnSync,
+} = {}) {
+  try {
+    const slug = safeSlug(changeSlug);
+    if (!slug || proof?.type !== 'evidence-envelope'
+      || String(proof?.external_id || '') !== String(artifact?.external_id || '')) return null;
+
+    const root = realpathSync(resolve(projectRoot));
+
+    const evidencePath = join(vaultBase, getLocale(vaultBase).folders.changes, slug, 'evidencia.json');
+    if (!existsSync(evidencePath) || !lstatSync(evidencePath).isFile()) return null;
+    const evidence = JSON.parse(readFileSync(evidencePath, 'utf8'));
+    const changeDir = join(vaultBase, getLocale(vaultBase).folders.changes, slug);
+    const tarefas = readFileSync(join(changeDir, 'tarefas.md'), 'utf8');
+    const tasks = parseTasks(tarefas);
+    const sensorIds = requiredSensors(tasks);
+    const loaded = loadSensorsDetailed(root);
+    if (loaded.error || loaded.missing) return null;
+    const reqIds = [...new Set(tasks.flatMap((task) => task.reqs ?? []))];
+    const effective = buildEffectiveRequirementPackage(vaultBase, changeDir, reqIds);
+    const identity = resolveEvidenceIdentity({
+      vaultBase, projectRoot: root, changeSlug: slug, sessionId, spawn,
+    });
+    const snapshot = captureGitSnapshot(root, { spawn });
+    const binding = evaluateEvidenceBinding(evidence, {
+      change_slug: slug,
+      identity,
+      snapshot,
+      tasks_sha256: tasksHashOf(tarefas),
+      effective_spec_sha256: `sha256:${effective.hash}`,
+      sensor_config_sha256: sensorConfigSha256(loaded.sensors, sensorIds),
+    });
+    if (binding.state !== 'bound') return null;
+    const envelopeArtifact = (evidence.external_artifacts || []).find((item) => (
+      item.source === 'superpowers'
+      && item.external_id === artifact.external_id
+      && item.kind === artifact.kind
+      && item.sha256 === artifact.sha256
+      && item.authority === 'verified'
+    ));
+    if (!envelopeArtifact) return null;
+    const currentArtifacts = collectBridgeArtifactEvidence({
+      projectRoot: root, tasks, sensors: evidence.sensors || [], spawn,
+    });
+    const currentArtifact = currentArtifacts.find((item) => item.external_id === artifact.external_id);
+    if (!currentArtifact || currentArtifact.authority !== 'verified'
+      || canonicalBridgeJson(currentArtifact) !== canonicalBridgeJson(envelopeArtifact)) return null;
+    const sensor = (evidence.sensors || []).find((item) => item.id === envelopeArtifact.sensor_id);
+    const artifactResult = (sensor?.artifact_results || []).find((item) => (
+      item.external_id === artifact.external_id && item.path === envelopeArtifact.path
+      && item.algorithm === 'sha256' && item.digest === artifact.sha256
+    ));
+    if (!sensor || sensor.status !== 'green' || sensor.exit_code !== 0 || !artifactResult) return null;
+
+    const canonical = {
+      schema_version: 1,
+      contract_kind: 'proof',
+      type: 'evidence-envelope',
+      authority: 'verified',
+      external_id: artifact.external_id,
+      artifact_sha256: artifact.sha256,
+      origin: { tool: 'wendkeep', evidence_envelope_id: evidence.envelope_id },
+      provenance: { state: 'verified', source: 'wendkeep-evidence-envelope' },
+      evidence_envelope_id: evidence.envelope_id,
+      sensor_id: envelopeArtifact.sensor_id,
+      task_id: envelopeArtifact.task_id,
+      path: envelopeArtifact.path,
+      head_sha: evidence.head_sha,
+      git_blob: envelopeArtifact.git_blob,
+      manifest_git_blob: envelopeArtifact.manifest_git_blob,
+    };
+    canonical.proof_id = bridgeSha256(canonicalBridgeJson(canonical));
+    return issueCanonicalArtifactProof(canonical);
+  } catch {
+    return null;
+  }
+}

package/src/ecosystem-bridges.mjs

@@ -0,0 +1,227 @@
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import * as bridgeFs from 'node:fs';
+import { resolve } from 'node:path';
+
+import {
+  importSpecKitProjection,
+  buildSpecKitStatusProjection,
+  ingestSuperpowersArtifacts,
+  inspectEcosystemBridges,
+  inspectBridgeAdapterRoot,
+  readBridgeConfig,
+  verifyExternalArtifact,
+  isProjectContainedPath,
+  sealBridgeProjection,
+  bridgeDiagnostic,
+} from '../packages/integrations/src/index.mjs';
+import { buildCanonicalExternalTaskDispatch } from './task.mjs';
+import { resolveProjectVault } from './project-vault.mjs';
+import { readSpecKitBaseline, writeSpecKitBaseline } from './ecosystem-bridge-baseline.mjs';
+import { deriveCanonicalArtifactProof } from './ecosystem-bridge-proof.mjs';
+
+export const BRIDGE_HELP = `wendkeep bridge <status|import-spec-kit|export-status|dispatch-superpowers|verify-artifacts>
+
+  --project <path>          consumer project (default: current directory)
+  --config <path>           config path (default: .wendkeep/ecosystem-bridges.json)
+  --task-id <id>            canonical WendKeep task selected from the active context
+  --task-contract <path>    optional submitted copy; rejected when it differs from canonical state
+  --spec-projection <path>  optional read-only Spec Kit projection
+  --change <slug>           causal change holding the canonical Spec Kit baseline/evidence
+  --accept-baseline         anchor the first green Spec Kit projection in the bound Vault
+  --input <path>            external artifacts JSON for verify-artifacts
+  --proofs <path>           artifact IDs to resolve from the canonical Evidence Envelope
+  --json                    emit typed JSON
+`;
+
+function opt(argv, name) {
+  const index = argv.indexOf(name);
+  if (index >= 0) return argv[index + 1] || '';
+  return argv.find((item) => item.startsWith(`${name}=`))?.slice(name.length + 1) || '';
+}
+
+function inside(root, target) {
+  return isProjectContainedPath(root, target);
+}
+
+function readProjectJson(projectRoot, pathValue, label, optional = false) {
+  if (!pathValue && optional) return null;
+  if (!pathValue) throw Object.assign(new Error(`${label} path is required`), { code: 'BRIDGE_ARGUMENT_INVALID' });
+  const rootReal = realpathSync(projectRoot);
+  const path = resolve(projectRoot, pathValue);
+  if (!inside(rootReal, path)) throw Object.assign(new Error(`${label} escapes the project`), { code: 'BRIDGE_INPUT_ESCAPE' });
+  if (!existsSync(path) || !lstatSync(path).isFile()) {
+    throw Object.assign(new Error(`${label} file not found`), { code: 'BRIDGE_INPUT_MISSING' });
+  }
+  const pathReal = realpathSync(path);
+  if (!inside(rootReal, pathReal)) throw Object.assign(new Error(`${label} escapes the project`), { code: 'BRIDGE_INPUT_ESCAPE' });
+  if (lstatSync(pathReal).size > 1024 * 1024) throw Object.assign(new Error(`${label} exceeds 1 MiB`), { code: 'BRIDGE_INPUT_LIMIT' });
+  try {
+    return JSON.parse(readFileSync(pathReal, 'utf8'));
+  } catch (error) {
+    throw Object.assign(new Error(`${label} is not valid JSON: ${error.message}`), { code: 'BRIDGE_INPUT_INVALID' });
+  }
+}
+
+function write(value, json) {
+  process.stdout.write(json ? `${JSON.stringify(value)}\n` : `${JSON.stringify(value, null, 2)}\n`);
+}
+
+export function runEcosystemBridge(argv = []) {
+  const sub = argv[0];
+  if (!sub || ['help', '--help', '-h'].includes(sub)) {
+    process.stdout.write(BRIDGE_HELP);
+    return 0;
+  }
+  const json = argv.includes('--json');
+  const projectRoot = resolve(opt(argv, '--project') || process.cwd());
+  try {
+    if (sub === 'status') {
+      const result = inspectEcosystemBridges({ projectRoot, configPath: opt(argv, '--config'), fs: bridgeFs });
+      write(result, json);
+      return result.ok ? 0 : 1;
+    }
+    const loaded = readBridgeConfig(projectRoot, opt(argv, '--config'), { fs: bridgeFs });
+    if (sub === 'import-spec-kit') {
+      if (opt(argv, '--previous')) {
+        throw Object.assign(new Error('--previous cannot replace the canonical Vault baseline'), { code: 'BRIDGE_ARGUMENT_INVALID' });
+      }
+      const adapter = loaded.config.adapters['spec-kit'];
+      if (!adapter.enabled) {
+        const result = importSpecKitProjection({ projectRoot, config: loaded.config, fs: bridgeFs });
+        write(result, json);
+        return result.ok ? 0 : 1;
+      }
+      const changeSlug = opt(argv, '--change');
+      if (!changeSlug) throw Object.assign(new Error('--change is required for the canonical Spec Kit baseline'), { code: 'BRIDGE_BASELINE_CONTEXT_INVALID' });
+      const vault = resolveProjectVault({ startDir: projectRoot, explicitVault: opt(argv, '--vault') || '' }).base;
+      const baseline = readSpecKitBaseline(vault, changeSlug);
+      const current = importSpecKitProjection({ projectRoot, config: loaded.config, previousProjection: baseline, fs: bridgeFs });
+      let result = current;
+      if (argv.includes('--accept-baseline')) {
+        if (baseline && baseline.projection_id !== current.projection_id) {
+          result = sealBridgeProjection({
+            ...current, ok: false,
+            diagnostics: [...current.diagnostics, bridgeDiagnostic('BRIDGE_BASELINE_STALE', {
+              adapter: 'spec-kit', message: 'canonical Spec Kit baseline already exists and cannot be replaced implicitly',
+            })],
+          });
+        } else if (!baseline && current.ok) writeSpecKitBaseline(vault, changeSlug, current);
+      } else if (!baseline) {
+        result = sealBridgeProjection({
+          ...current, ok: false,
+          diagnostics: [...current.diagnostics, bridgeDiagnostic('BRIDGE_BASELINE_MISSING', {
+            adapter: 'spec-kit', message: 'anchor the first projection with --accept-baseline',
+          })],
+        });
+      }
+      write(result, json);
+      return result.ok ? 0 : 1;
+    }
+    if (sub === 'export-status') {
+      const sourceProjection = readProjectJson(projectRoot, opt(argv, '--spec-projection'), 'Spec Kit projection');
+      const taskContract = readProjectJson(projectRoot, opt(argv, '--task-contract'), 'task contract', true);
+      const artifactInput = readProjectJson(projectRoot, opt(argv, '--input'), 'artifact input', true);
+      const result = buildSpecKitStatusProjection({
+        sourceProjection,
+        taskContracts: taskContract ? [taskContract] : [],
+        artifacts: artifactInput ? (Array.isArray(artifactInput) ? artifactInput : artifactInput.artifacts || []) : [],
+      });
+      write(result, json);
+      return 0;
+    }
+    if (sub === 'dispatch-superpowers') {
+      const taskId = opt(argv, '--task-id');
+      if (!taskId) throw Object.assign(new Error('task id is required'), { code: 'BRIDGE_ARGUMENT_INVALID' });
+      const submitted = readProjectJson(projectRoot, opt(argv, '--task-contract'), 'task contract', true);
+      const specKitProjection = readProjectJson(projectRoot, opt(argv, '--spec-projection'), 'Spec Kit projection', true);
+      const adapter = loaded.config.adapters.superpowers;
+      const adapterRoot = inspectBridgeAdapterRoot(projectRoot, adapter.root || '.superpowers', { adapter: 'superpowers', fs: bridgeFs });
+      if (!adapterRoot.valid) {
+        const result = {
+          schema_version: 1, adapter: 'superpowers', active: false, ok: false,
+          diagnostics: adapterRoot.diagnostics,
+        };
+        write(result, json);
+        return 1;
+      }
+      const present = adapterRoot.present;
+      const vault = resolveProjectVault({
+        startDir: projectRoot,
+        explicitVault: opt(argv, '--vault') || '',
+      }).base;
+      const changeSlug = opt(argv, '--change');
+      let baselineProjection = null;
+      if (loaded.config.adapters['spec-kit'].enabled) {
+        if (!changeSlug || !specKitProjection) {
+          const result = {
+            schema_version: 1, adapter: 'superpowers', active: true, ok: false,
+            diagnostics: [bridgeDiagnostic('BRIDGE_BASELINE_MISSING', {
+              adapter: 'spec-kit', message: 'dispatch requires --change and --spec-projection when Spec Kit is active',
+            })],
+          };
+          write(result, json);
+          return 1;
+        }
+        baselineProjection = readSpecKitBaseline(vault, changeSlug);
+        if (!baselineProjection) {
+          const result = {
+            schema_version: 1, adapter: 'superpowers', active: true, ok: false,
+            diagnostics: [bridgeDiagnostic('BRIDGE_BASELINE_MISSING', {
+              adapter: 'spec-kit', message: 'canonical Spec Kit baseline is missing from the bound Vault change',
+            })],
+          };
+          write(result, json);
+          return 1;
+        }
+      }
+      const authorityArgs = ['--project', projectRoot, '--vault', vault, '--task-id', taskId];
+      for (const name of ['--session', '--change']) {
+        const value = opt(argv, name);
+        if (value) authorityArgs.push(name, value);
+      }
+      const result = buildCanonicalExternalTaskDispatch({
+        adapter: 'superpowers',
+        authorityArgv: authorityArgs,
+        taskId,
+        submittedTaskContract: submitted,
+        projectRoot,
+        specKitProjection,
+        baselineProjection,
+        config: loaded.config,
+        detectedVersion: adapter.version || '',
+        present,
+      });
+      write(result, json);
+      return result.ok ? 0 : 1;
+    }
+    if (sub === 'verify-artifacts') {
+      const input = readProjectJson(projectRoot, opt(argv, '--input'), 'artifact input');
+      const proofs = readProjectJson(projectRoot, opt(argv, '--proofs'), 'proof input');
+      const artifacts = ingestSuperpowersArtifacts(Array.isArray(input) ? input : input.artifacts);
+      const proofList = (Array.isArray(proofs) ? proofs : proofs.proofs) || [];
+      const canonicalRequested = proofList.some((proof) => proof?.type === 'evidence-envelope');
+      const changeSlug = opt(argv, '--change');
+      const vault = canonicalRequested && changeSlug
+        ? resolveProjectVault({ startDir: projectRoot, explicitVault: opt(argv, '--vault') || '' }).base
+        : '';
+      const verified = artifacts.map((artifact) => {
+        const artifactProofs = proofList.filter((proof) => (
+          !proof.external_id || proof.external_id === artifact.external_id
+        ));
+        const canonicalProofs = vault ? artifactProofs.map((proof) => deriveCanonicalArtifactProof({
+          artifact, proof, projectRoot, vaultBase: vault, changeSlug,
+          sessionId: opt(argv, '--session') || '',
+        })).filter(Boolean) : [];
+        return verifyExternalArtifact(artifact, { proofs: artifactProofs, canonicalProofs });
+      });
+      const result = { schema_version: 1, ok: verified.every((item) => item.authority === 'verified'), artifacts: verified };
+      write(result, json);
+      return result.ok ? 0 : 1;
+    }
+    throw Object.assign(new Error(`unknown bridge subcommand: ${sub}`), { code: 'BRIDGE_SUBCOMMAND_UNKNOWN' });
+  } catch (error) {
+    const payload = { ok: false, code: error?.code || 'BRIDGE_COMMAND_FAILED', error: error?.message || String(error) };
+    process.stderr.write(json ? `${JSON.stringify(payload)}\n` : `wendkeep bridge: ${payload.code}: ${payload.error}\n`);
+    return 2;
+  }
+}

package/src/evidence-envelope.mjs

@@ -268,6 +268,7 @@ export function buildEvidenceEnvelope({
   version = '',
   runtimePlatform = `${process.platform}-${process.arch}`,
   hostCoverage = null,
+  externalArtifacts = [],
 } = {}) {
   const envelope = {
     schema_version: 2,
@@ -287,6 +288,7 @@ export function buildEvidenceEnvelope({
     started_at: startedAt,
     finished_at: finishedAt,
     sensors,
+    ...(externalArtifacts.length ? { external_artifacts: structuredClone(externalArtifacts) } : {}),
     ...(hostCoverage ? { host_coverage: structuredClone(hostCoverage) } : {}),
     tdd_attestations: tddAttestations,
   };

package/src/observer-auth.mjs

@@ -8,3 +8,11 @@ export function observerAuthHeaders(token, headers = {}) {
     ? { ...headers, authorization: `Bearer ${resolved}` }
     : { ...headers };
 }
+
+export {
+  registerObserverToken,
+  resolveObserverPrincipal,
+  revokeObserverToken,
+  rotateObserverToken,
+} from '../packages/observer/src/token-registry.mjs';
+export { authorizeObserverPrincipal } from '../packages/observer/src/authz.mjs';

package/src/observer-privacy.mjs

@@ -1,4 +1,5 @@
 import { basename } from 'node:path';
+import { redactObserverText, redactObserverValue } from '../packages/observer/src/redaction.mjs';
 
 const TRANSCRIPT_PATH_KEY = /^(?:transcript_path|agent_transcript_path|transcriptPath|agentTranscriptPath)$/i;
 const TRANSCRIPT_PATH_LINE = /^(\s*["']?(?:transcript_path|agent_transcript_path|transcriptPath|agentTranscriptPath)["']?\s*:\s*)(["']?)(.*?)(\2)(\s*,?\s*)$/gmi;
@@ -8,16 +9,19 @@ function sourceLabel(value) {
 }
 
 export function sanitizeObserverContent(content) {
-  return String(content || '').replace(TRANSCRIPT_PATH_LINE, (_line, prefix, quote, value, _closing, suffix) => (
+  const safePaths = String(content || '').replace(TRANSCRIPT_PATH_LINE, (_line, prefix, quote, value, _closing, suffix) => (
     `${prefix}${quote}${sourceLabel(value)}${quote}${suffix}`
   ));
+  return redactObserverText(safePaths);
 }
 
 export function sanitizeObserverMetadata(value) {
   if (Array.isArray(value)) return value.map(sanitizeObserverMetadata);
   if (!value || typeof value !== 'object') return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+  return redactObserverValue(Object.fromEntries(Object.entries(value).map(([key, item]) => [
     key,
     TRANSCRIPT_PATH_KEY.test(key) ? sourceLabel(item) : sanitizeObserverMetadata(item),
-  ]));
+  ])));
 }
+
+export { redactObserverText, redactObserverValue };

package/src/observer-publish.mjs

@@ -3,10 +3,37 @@ import { join } from 'node:path';
 import { publishObserverSqlIncremental } from './observer-sql-publish.mjs';
 import { observerAuthHeaders, resolveObserverToken } from './observer-auth.mjs';
 import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
+import { createObserverPolicy } from '../packages/observer/src/policy.mjs';
+import { createObserverEncryption } from '../packages/observer/src/encryption.mjs';
 
 const OUTBOX_REL = join('.brain', 'observer-outbox');
 const REQUEST_TIMEOUT_MS = 500;
 
+function decodeObserverKey(value) {
+  const raw = String(value || '').trim();
+  const key = /^[a-f0-9]{64}$/i.test(raw) ? Buffer.from(raw, 'hex') : Buffer.from(raw, 'base64');
+  if (key.byteLength !== 32) throw Object.assign(new Error('Observer outbox key deve ter 32 bytes em hex/base64.'), { code: 'observer_encryption_key_invalid' });
+  return key;
+}
+
+export function resolveObserverPublisherSecurity({ env = process.env } = {}) {
+  const policyFile = String(env.WENDKEEP_OBSERVER_POLICY_FILE || '').trim();
+  const policy = policyFile
+    ? createObserverPolicy(JSON.parse(readFileSync(policyFile, 'utf8')))
+    : createObserverPolicy();
+  const keyEnvName = String(env.WENDKEEP_OBSERVER_OUTBOX_KEY_ENV || '').trim();
+  if (!keyEnvName) return { policy, outboxEncryption: null };
+  const key = decodeObserverKey(env[keyEnvName]);
+  return {
+    policy,
+    outboxEncryption: createObserverEncryption({
+      required: true,
+      keyId: String(env.WENDKEEP_OBSERVER_OUTBOX_KEY_ID || keyEnvName),
+      keyProvider: () => key,
+    }),
+  };
+}
+
 function outboxDir(vaultBase) {
   return join(vaultBase, OUTBOX_REL);
 }
@@ -92,6 +119,8 @@ export async function publishObserverSnapshot({
   now = new Date(),
   input = {},
   token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
+  policy = null,
+  outboxEncryption = null,
 } = {}) {
   try {
     const project = readProjectForValidation(vaultBase);
@@ -103,6 +132,8 @@ export async function publishObserverSnapshot({
       input,
       now,
       token,
+      policy,
+      outboxEncryption,
     });
     // SQLite is the only live authority. The legacy snapshot store remains
     // readable solely as a migration source for pre-SQL installations.