xytara 2.5.0 → 2.6.0

package/lib/bolt_payment_front.js

@@ -0,0 +1,172 @@
+"use strict";
+
+const crypto = require("crypto");
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function safeEqualHex(left, right) {
+  const a = Buffer.from(String(left || ""), "hex");
+  const b = Buffer.from(String(right || ""), "hex");
+  if (a.length === 0 || b.length === 0 || a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+function decodeBase64UrlJson(value) {
+  try {
+    return JSON.parse(Buffer.from(String(value || ""), "base64url").toString("utf8"));
+  } catch (_) {
+    return null;
+  }
+}
+
+function loadBoltFrontConfig() {
+  const sharedSecret = normalizeString(process.env.XYTARA_BOLT_SHARED_SECRET);
+  return {
+    enabled: String(process.env.XYTARA_BOLT_ENABLED || (sharedSecret ? "true" : "false")).trim().toLowerCase() !== "false",
+    shared_secret: sharedSecret || null,
+    network: normalizeString(process.env.XYTARA_BOLT_NETWORK) || normalizeString(process.env.XYTARA_BSV_TERANODE_NETWORK) || "mainnet",
+    proof_mode: normalizeString(process.env.XYTARA_BOLT_PROOF_MODE) || "spv_or_block_header_verifiable",
+    max_age_seconds: Math.max(30, Number(process.env.XYTARA_BOLT_MAX_AGE_SECONDS || 300) || 300),
+    required_headers: ["authorization"],
+    auth_scheme: "BOLT",
+    token_shape: "base64url_json_with_utxo_spv_proof_and_hmac_signed_payload"
+  };
+}
+
+function parseBoltAuthorization(headers) {
+  const authorization = headers && typeof headers.authorization === "string"
+    ? headers.authorization.trim()
+    : "";
+  const match = authorization.match(/^BOLT\s+(.+)$/i);
+  if (!match) return null;
+  const decoded = decodeBase64UrlJson(match[1]);
+  if (!decoded || typeof decoded !== "object") return null;
+  return {
+    wallet_id: decoded.wallet_id || decoded.gateway_id || "bolt_gateway",
+    encoded: decoded.payload || null,
+    signature: decoded.signature || null,
+    txid: decoded.txid || null,
+    spv_proof_ref: decoded.spv_proof_ref || null,
+    merkle_path_ref: decoded.merkle_path_ref || null,
+    block_header_ref: decoded.block_header_ref || null,
+    network: decoded.network || null,
+    proof_bundle_ref: decoded.proof_bundle_ref || null,
+    scheme: "bolt"
+  };
+}
+
+function verifyBoltPaymentPayload(paymentPayload, quote, walletId, maxAgeSeconds, config) {
+  if (!paymentPayload || typeof paymentPayload !== "object") return { ok: false, reason: "bolt_payload_invalid" };
+  if (!paymentPayload.quote_id || paymentPayload.quote_id !== quote.quote_id) return { ok: false, reason: "bolt_quote_mismatch" };
+  if (paymentPayload.amount_minor !== quote.amount_minor) return { ok: false, reason: "bolt_amount_mismatch" };
+  if (paymentPayload.currency !== quote.currency) return { ok: false, reason: "bolt_currency_mismatch" };
+  if (paymentPayload.account_id && paymentPayload.account_id !== quote.account_id) return { ok: false, reason: "bolt_account_mismatch" };
+  if (walletId && paymentPayload.wallet_id && paymentPayload.wallet_id !== walletId) return { ok: false, reason: "bolt_wallet_mismatch" };
+  if (!paymentPayload.nonce || typeof paymentPayload.nonce !== "string") return { ok: false, reason: "bolt_nonce_missing" };
+  if (!paymentPayload.issued_at_iso || Number.isNaN(Date.parse(paymentPayload.issued_at_iso))) return { ok: false, reason: "bolt_issued_at_invalid" };
+  const ageSeconds = Math.max(0, Math.floor((Date.now() - Date.parse(paymentPayload.issued_at_iso)) / 1000));
+  if (ageSeconds > maxAgeSeconds) return { ok: false, reason: "bolt_token_expired" };
+  if (!normalizeString(paymentPayload.txid || paymentPayload.transaction_id)) return { ok: false, reason: "bolt_txid_missing" };
+  if (
+    !normalizeString(paymentPayload.spv_proof_ref || paymentPayload.proof_bundle_ref)
+    && !normalizeString(paymentPayload.merkle_path_ref)
+    && !normalizeString(paymentPayload.block_header_ref)
+  ) {
+    return { ok: false, reason: "bolt_proof_missing" };
+  }
+  if (
+    normalizeString(paymentPayload.network)
+    && normalizeString(config && config.network)
+    && normalizeString(paymentPayload.network) !== normalizeString(config.network)
+  ) {
+    return { ok: false, reason: "bolt_network_mismatch" };
+  }
+  return { ok: true, age_seconds: ageSeconds };
+}
+
+function verifyBoltAccessToken(headers, quote) {
+  const config = loadBoltFrontConfig();
+  if (!config.enabled) return { ok: false, status: 503, reason: "bolt_not_enabled" };
+  if (!config.shared_secret) return { ok: false, status: 503, reason: "bolt_shared_secret_missing" };
+  const payment = parseBoltAuthorization(headers || {});
+  if (!payment || !payment.encoded || !payment.signature) {
+    return { ok: false, status: 402, reason: "bolt_headers_incomplete" };
+  }
+  const expectedSignature = crypto.createHmac("sha256", config.shared_secret).update(payment.encoded).digest("hex");
+  if (!safeEqualHex(expectedSignature, payment.signature)) {
+    return { ok: false, status: 403, reason: "bolt_signature_invalid" };
+  }
+  const payload = decodeBase64UrlJson(payment.encoded);
+  const validation = verifyBoltPaymentPayload(payload, quote, payment.wallet_id, config.max_age_seconds, config);
+  if (!validation.ok) return { ok: false, status: 403, reason: validation.reason };
+  return {
+    ok: true,
+    verification_mode: "bolt_gateway_signed",
+    wallet_id: payment.wallet_id,
+    payment_payload: payload,
+    age_seconds: validation.age_seconds,
+    bolt: {
+      txid: payment.txid || payload.txid || payload.transaction_id || null,
+      spv_proof_ref: payment.spv_proof_ref || payload.spv_proof_ref || payload.proof_bundle_ref || null,
+      merkle_path_ref: payment.merkle_path_ref || payload.merkle_path_ref || null,
+      block_header_ref: payment.block_header_ref || payload.block_header_ref || null,
+      proof_bundle_ref: payment.proof_bundle_ref || payload.proof_bundle_ref || null,
+      network: payment.network || payload.network || config.network,
+      proof_mode: config.proof_mode
+    }
+  };
+}
+
+function buildBoltSecuritySummary() {
+  const config = loadBoltFrontConfig();
+  const blockers = [];
+  if (config.enabled && !config.shared_secret) blockers.push("bolt_shared_secret_missing");
+  return {
+    ok: true,
+    category: "machine-commerce-bolt-security-summary",
+    summary_version: "xytara-bolt-security-summary-v1",
+    enabled: config.enabled,
+    shared_secret_configured: Boolean(config.shared_secret),
+    network: config.network,
+    proof_mode: config.proof_mode,
+    max_age_seconds: config.max_age_seconds,
+    auth_scheme: config.auth_scheme,
+    token_shape: config.token_shape,
+    ready: config.enabled && blockers.length === 0,
+    blockers,
+    linked_surfaces: {
+      bolt_lane_ref: "/v1/bolt",
+      commands_execute_ref: "/bolt/commands/execute",
+      mcp_invoke_ref: "/bolt/mcp/tools/invoke"
+    }
+  };
+}
+
+function buildBoltChallengePayload(quote) {
+  return {
+    ok: false,
+    payment_required: {
+      scheme: "bolt",
+      quote,
+      operator_requirements: {
+        auth_scheme: "BOLT",
+        token_shape: "base64url_json_with_utxo_spv_proof_and_hmac_signed_payload",
+        security_ref: "/v1/bolt/security",
+        proof_requirements: [
+          "txid",
+          "one_of:spv_proof_ref|merkle_path_ref|block_header_ref|proof_bundle_ref"
+        ]
+      }
+    }
+  };
+}
+
+module.exports = {
+  buildBoltChallengePayload,
+  buildBoltSecuritySummary,
+  loadBoltFrontConfig,
+  parseBoltAuthorization,
+  verifyBoltAccessToken
+};

package/lib/capability_execution_truth.js

@@ -0,0 +1,269 @@
+"use strict";
+
+const packageJson = require("../package.json");
+const { catalog } = require("../fixtures/catalog");
+const { summarizeAdapterDepthPack } = require("./adapter_depth_contract");
+const { loadExecutionTargetRegistry } = require("./external_execution_runtime");
+const { loadBsvSettlementRuntimeConfig } = require("./settlement_bsv_live");
+const { summarizeTreasuryDestinationsPack } = require("./treasury_destinations_contract");
+
+const NATIVE_RUNTIME_CATEGORIES = new Set([
+  "trust",
+  "receipt",
+  "runtime",
+  "jobs",
+  "credits",
+  "a2a",
+  "a2c",
+  "policy",
+  "identity",
+  "registry",
+  "anchoring",
+  "discovery",
+  "admission"
+]);
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function hasMerchantIdentity() {
+  return Boolean(
+    normalizeString(process.env.XYTARA_BSV_TERANODE_MERCHANT_ADDRESS)
+    || normalizeString(process.env.XYTARA_BSV_TERANODE_MERCHANT_PAYMAIL)
+  );
+}
+
+function isLiveRuntimeMode(mode) {
+  return normalizeString(mode).toLowerCase() !== "mock";
+}
+
+function buildSettlementReadiness() {
+  const runtimeConfig = loadBsvSettlementRuntimeConfig();
+  const treasurySummary = summarizeTreasuryDestinationsPack();
+  const liveMode = isLiveRuntimeMode(runtimeConfig.mode);
+  const merchantConfigured = hasMerchantIdentity();
+  const treasuryConfigured = Number(treasurySummary.configured_profile_count || 0) > 0;
+  const ready = liveMode && merchantConfigured && treasuryConfigured;
+  return {
+    ready,
+    runtime_mode: runtimeConfig.mode,
+    merchant_identity_configured: merchantConfigured,
+    treasury_configured: treasuryConfigured,
+    configured_profile_count: Number(treasurySummary.configured_profile_count || 0),
+    explicit_per_rail_configured_count: Number(treasurySummary.explicit_per_rail_configured_count || 0)
+  };
+}
+
+function findMatchingExecutionTargets(task) {
+  const targets = loadExecutionTargetRegistry();
+  const taskRefs = new Set(
+    [task && task.task_ref, task && task.public_task_ref]
+      .map((value) => normalizeString(value))
+      .filter(Boolean)
+  );
+  return targets.filter((target) => {
+    const targetTaskRef = normalizeString(target && target.task_ref);
+    if (targetTaskRef && taskRefs.has(targetTaskRef)) return true;
+    if (normalizeString(task && task.public_task_ref) === "adapter.mcp.invoke") {
+      return Boolean(normalizeString(target && target.tool_name) || normalizeString(target && target.integration_id));
+    }
+    return false;
+  });
+}
+
+function classifyTask(task, settlementReadiness) {
+  const matches = findMatchingExecutionTargets(task);
+  const providerTargets = matches.map((target) => ({
+    target_id: target.target_id,
+    provider: target.provider,
+    task_ref: target.task_ref || null,
+    tool_name: target.tool_name || null,
+    integration_id: target.integration_id || null,
+    enabled: target.enabled !== false
+  }));
+
+  if (normalizeString(task && task.public_category) === "settlement") {
+    return {
+      task_ref: task.public_task_ref,
+      internal_task_ref: task.task_ref,
+      public_title: task.public_title,
+      public_category: task.public_category,
+      execution_mode: task.execution_mode,
+      latency_class: task.latency_class,
+      execution_truth: settlementReadiness.ready ? "native_live" : "operator_inputs_pending",
+      execution_origin: "native_settlement_runtime",
+      commercialization_posture: settlementReadiness.ready ? "sellable_live_now" : "sellable_when_operator_configured",
+      matching_execution_target_count: providerTargets.length,
+      matching_execution_targets: providerTargets,
+      requirements: {
+        bsv_runtime_mode: settlementReadiness.runtime_mode,
+        merchant_identity_configured: settlementReadiness.merchant_identity_configured,
+        treasury_configured: settlementReadiness.treasury_configured
+      }
+    };
+  }
+
+  if (normalizeString(task && task.public_category) === "adapter") {
+    return {
+      task_ref: task.public_task_ref,
+      internal_task_ref: task.task_ref,
+      public_title: task.public_title,
+      public_category: task.public_category,
+      execution_mode: task.execution_mode,
+      latency_class: task.latency_class,
+      execution_truth: providerTargets.length > 0 ? "provider_live" : "provider_wiring_required",
+      execution_origin: providerTargets.length > 0 ? "external_execution_target" : "adapter_lane_without_bound_target",
+      commercialization_posture: providerTargets.length > 0 ? "sellable_live_now" : "sellable_by_integration",
+      matching_execution_target_count: providerTargets.length,
+      matching_execution_targets: providerTargets,
+      requirements: {
+        configured_provider_target_required: true
+      }
+    };
+  }
+
+  if (NATIVE_RUNTIME_CATEGORIES.has(normalizeString(task && task.public_category))) {
+    return {
+      task_ref: task.public_task_ref,
+      internal_task_ref: task.task_ref,
+      public_title: task.public_title,
+      public_category: task.public_category,
+      execution_mode: task.execution_mode,
+      latency_class: task.latency_class,
+      execution_truth: "native_live",
+      execution_origin: "native_runtime_contract",
+      commercialization_posture: "sellable_live_now",
+      matching_execution_target_count: providerTargets.length,
+      matching_execution_targets: providerTargets,
+      requirements: {
+        configured_provider_target_required: false
+      }
+    };
+  }
+
+  return {
+    task_ref: task.public_task_ref,
+    internal_task_ref: task.task_ref,
+    public_title: task.public_title,
+    public_category: task.public_category,
+    execution_mode: task.execution_mode,
+    latency_class: task.latency_class,
+    execution_truth: providerTargets.length > 0 ? "provider_live" : "operator_classification_required",
+    execution_origin: providerTargets.length > 0 ? "external_execution_target" : "uncategorized_runtime_surface",
+    commercialization_posture: providerTargets.length > 0 ? "sellable_live_now" : "hold_until_classified",
+    matching_execution_target_count: providerTargets.length,
+    matching_execution_targets: providerTargets,
+    requirements: {
+      configured_provider_target_required: providerTargets.length < 1
+    }
+  };
+}
+
+function buildCapabilityExecutionTruthBundle() {
+  const settlementReadiness = buildSettlementReadiness();
+  const adapterDepth = summarizeAdapterDepthPack();
+  const tasks = (Array.isArray(catalog.tasks) ? catalog.tasks : []).map((task) => classifyTask(task, settlementReadiness));
+  const counts = {
+    task_count: tasks.length,
+    native_live_count: tasks.filter((task) => task.execution_truth === "native_live").length,
+    provider_live_count: tasks.filter((task) => task.execution_truth === "provider_live").length,
+    operator_inputs_pending_count: tasks.filter((task) => task.execution_truth === "operator_inputs_pending").length,
+    provider_wiring_required_count: tasks.filter((task) => task.execution_truth === "provider_wiring_required").length,
+    operator_classification_required_count: tasks.filter((task) => task.execution_truth === "operator_classification_required").length
+  };
+
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "machine-commerce-capability-execution-truth",
+    bundle_version: "xytara-capability-execution-truth-v1",
+    execution_posture: {
+      native_runtime_categories: Array.from(NATIVE_RUNTIME_CATEGORIES.values()),
+      settlement_readiness: settlementReadiness,
+      configured_execution_target_count: loadExecutionTargetRegistry().length,
+      adapter_depth_state: adapterDepth.adapter_depth_state,
+      adapter_depth_counts: adapterDepth.counts
+    },
+    counts,
+    tasks,
+    linked_surfaces: {
+      capability_registry_ref: "/v1/capability-registry",
+      execution_truth_summary_ref: "/v1/capability-registry/execution-truth/summary",
+      adapter_depth_ref: "/v1/adapter-depth",
+      adapter_depth_summary_ref: "/v1/adapter-depth/summary",
+      treasury_readiness_ref: "/v1/treasury-destinations",
+      native_settlement_readiness_ref: "/v1/settlement/bsv-teranode/readiness"
+    }
+  };
+}
+
+function summarizeCapabilityExecutionTruthBundle() {
+  const bundle = buildCapabilityExecutionTruthBundle();
+  return {
+    ok: true,
+    product: bundle.product,
+    category: bundle.category,
+    bundle_version: bundle.bundle_version,
+    counts: bundle.counts,
+    execution_posture: bundle.execution_posture,
+    linked_surfaces: bundle.linked_surfaces
+  };
+}
+
+function buildCapabilityCommercializationSummary() {
+  const bundle = buildCapabilityExecutionTruthBundle();
+  const tasks = Array.isArray(bundle.tasks) ? bundle.tasks : [];
+  const selfServeLiveNow = tasks.filter((task) =>
+    task.commercialization_posture === "sellable_live_now"
+  );
+  const operatorEnabledAfterConfig = tasks.filter((task) =>
+    task.commercialization_posture === "sellable_when_operator_configured"
+    || task.commercialization_posture === "sellable_by_integration"
+  );
+  const holdUntilClassified = tasks.filter((task) =>
+    task.commercialization_posture === "hold_until_classified"
+  );
+
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "machine-commerce-capability-commercialization-summary",
+    summary_version: "xytara-capability-commercialization-summary-v1",
+    commercialization_posture: {
+      primary_agent_entry_surfaces: ["x402", "mcp", "a2a", "a2c", "http_api"],
+      secondary_human_entry_surfaces: ["hosted_checkout", "web_docs", "npm_package"],
+      primary_payment_surfaces: ["x402", "credits", "hosted_checkout"],
+      discovery_surfaces: ["capability_registry", "catalog", "execution_truth"]
+    },
+    counts: {
+      self_serve_live_now: selfServeLiveNow.length,
+      operator_enabled_after_config: operatorEnabledAfterConfig.length,
+      hold_until_classified: holdUntilClassified.length
+    },
+    sellable_now_task_refs: selfServeLiveNow.map((task) => task.task_ref),
+    operator_enabled_task_refs: operatorEnabledAfterConfig.map((task) => task.task_ref),
+    hold_task_refs: holdUntilClassified.map((task) => task.task_ref),
+    recommendations: [
+      "Use x402 for machine-native pay-per-use access and keep hosted checkout as the human-friendly money-in lane.",
+      "Expose MCP and A2A entry paths for interoperable agent consumption while preserving execution-truth visibility.",
+      "Only market provider-backed capabilities as instant self-serve once execution targets are configured and operator readiness is green."
+    ],
+    linked_surfaces: {
+      capability_registry_ref: "/v1/capability-registry",
+      execution_truth_ref: "/v1/capability-registry/execution-truth",
+      execution_truth_summary_ref: "/v1/capability-registry/execution-truth/summary",
+      x402_ref: "/v1/x402",
+      mcp_ref: "/v1/mcp",
+      a2a_ref: "/v1/a2a",
+      a2c_ref: "/v1/a2c",
+      checkout_ref: "/v1/checkout/purchase-intents"
+    }
+  };
+}
+
+module.exports = {
+  buildCapabilityExecutionTruthBundle,
+  summarizeCapabilityExecutionTruthBundle,
+  buildCapabilityCommercializationSummary
+};

package/lib/capability_registry.js

@@ -34,6 +34,11 @@ const {
 const {
   buildPartnerIntelligencePack
 } = require("./partner_intelligence");
+const {
+  buildCapabilityExecutionTruthBundle,
+  summarizeCapabilityExecutionTruthBundle,
+  buildCapabilityCommercializationSummary
+} = require("./capability_execution_truth");
 
 function buildCapabilityRegistrySummary() {
   const catalogSummary = summarizeCatalog();
@@ -76,6 +81,8 @@ function buildCapabilityRegistrySummary() {
     },
     linked_surfaces: {
       capability_registry_ref: "/v1/capability-registry",
+      execution_truth_summary_ref: "/v1/capability-registry/execution-truth/summary",
+      commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       catalog_summary_ref: "/v1/catalog/summary",
       task_packs_summary_ref: "/v1/transaction-center/task-packs/summary",
       class_packs_summary_ref: "/v1/transaction-center/transaction-class-packs/summary",
@@ -94,6 +101,8 @@ function buildCapabilityRegistryBundle() {
     category: "machine-commerce-capability-registry",
     bundle_version: "xytara-capability-registry-bundle-v1",
     capability_registry_summary: buildCapabilityRegistrySummary(),
+    capability_execution_truth: buildCapabilityExecutionTruthBundle(),
+    capability_commercialization_summary: buildCapabilityCommercializationSummary(),
     catalog: getCatalog(),
     catalog_summary: summarizeCatalog(),
     task_pack_catalog: buildDefaultTransactionTaskPackCatalog(),
@@ -118,6 +127,8 @@ function buildCapabilityRegistryBundle() {
     adapter_partner_summary: summarizeAdapterPartnerPack(),
     linked_surfaces: {
       capability_registry_summary_ref: "/v1/capability-registry/summary",
+      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
+      capability_commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       catalog_ref: "/v1/catalog",
       task_pack_catalog_ref: "/v1/transaction-center/task-packs",
       class_pack_catalog_ref: "/v1/transaction-center/transaction-class-packs",
@@ -170,8 +181,11 @@ function buildCapabilityRegistryClassificationSummary() {
     task_latency_classes: Array.from(taskLatencies.entries()).map(([latency_class, task_count]) => ({ latency_class, task_count })),
     task_failure_postures: Array.from(taskFailurePostures.entries()).map(([failure_posture, task_count]) => ({ failure_posture, task_count })),
     protocol_families: protocols,
+    execution_truth_summary: summarizeCapabilityExecutionTruthBundle(),
     linked_surfaces: {
       capability_registry_ref: "/v1/capability-registry",
+      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
+      capability_commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       capability_registry_lineage_summary_ref: "/v1/capability-registry/lineage-summary",
       catalog_summary_ref: "/v1/catalog/summary"
     }
@@ -295,6 +309,8 @@ function buildCapabilityRegistryOperatorBundle(state, input) {
       recommended_registry_motion: recommendedRegistryMotion
     },
     capability_registry_summary: summary,
+    capability_execution_truth: buildCapabilityExecutionTruthBundle(),
+    capability_commercialization_summary: buildCapabilityCommercializationSummary(),
     capability_registry_bundle: bundle,
     capability_registry_classification_summary: buildCapabilityRegistryClassificationSummary(),
     capability_registry_lineage_summary: buildCapabilityRegistryLineageSummary(),
@@ -302,6 +318,8 @@ function buildCapabilityRegistryOperatorBundle(state, input) {
     linked_surfaces: {
       capability_registry_ref: "/v1/capability-registry",
       capability_registry_summary_ref: "/v1/capability-registry/summary",
+      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
+      capability_commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       capability_registry_classification_summary_ref: "/v1/capability-registry/classification-summary",
       capability_registry_lineage_summary_ref: "/v1/capability-registry/lineage-summary",
       partner_intelligence_ref: "/v1/partner-intelligence",
@@ -316,6 +334,8 @@ function buildCapabilityRegistryPolicyPack(state, input) {
   const summary = buildCapabilityRegistrySummary();
   const classification = buildCapabilityRegistryClassificationSummary();
   const lineage = buildCapabilityRegistryLineageSummary();
+  const executionTruth = summarizeCapabilityExecutionTruthBundle();
+  const commercializationSummary = buildCapabilityCommercializationSummary();
   const operatorBundle = buildCapabilityRegistryOperatorBundle(state, { account_id: accountId });
   const partnerIntelligence = buildPartnerIntelligencePack();
   const policyTemplates = [
@@ -412,11 +432,19 @@ function buildCapabilityRegistryPolicyPack(state, input) {
       partner_readiness_state: partnerIntelligence.partner_readiness_state,
       onboarding_friction_state: partnerIntelligence.onboarding_friction_state,
       protocol_family_count: Array.isArray(classification.protocol_families) ? classification.protocol_families.length : 0,
-      lineage_row_count: lineage.lineage_row_count
+      lineage_row_count: lineage.lineage_row_count,
+      native_live_count: executionTruth.counts.native_live_count,
+      provider_live_count: executionTruth.counts.provider_live_count,
+      provider_wiring_required_count: executionTruth.counts.provider_wiring_required_count,
+      operator_inputs_pending_count: executionTruth.counts.operator_inputs_pending_count,
+      self_serve_live_now_count: commercializationSummary.counts.self_serve_live_now,
+      operator_enabled_after_config_count: commercializationSummary.counts.operator_enabled_after_config
     },
     linked_surfaces: {
       capability_registry_ref: "/v1/capability-registry",
       capability_registry_summary_ref: "/v1/capability-registry/summary",
+      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
+      capability_commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       capability_registry_classification_summary_ref: "/v1/capability-registry/classification-summary",
       capability_registry_lineage_summary_ref: "/v1/capability-registry/lineage-summary",
       capability_registry_operator_bundle_ref: `/v1/capability-registry/operator-bundle?account_id=${encodeURIComponent(accountId)}`,
@@ -495,6 +523,8 @@ function buildCapabilityRegistryPackage(state, input) {
   const bundle = buildCapabilityRegistryBundle();
   const classification = buildCapabilityRegistryClassificationSummary();
   const lineage = buildCapabilityRegistryLineageSummary();
+  const executionTruth = buildCapabilityExecutionTruthBundle();
+  const commercializationSummary = buildCapabilityCommercializationSummary();
   const operatorBundle = buildCapabilityRegistryOperatorBundle(state, { account_id: accountId });
   const policyPack = buildCapabilityRegistryPolicyPack(state, { account_id: accountId });
   const policyApplicationSummary = buildCapabilityRegistryPolicyApplicationSummary(state, { account_id: accountId });
@@ -513,6 +543,8 @@ function buildCapabilityRegistryPackage(state, input) {
       recommended_policy_motion: policyPack.recommended_policy_motion
     },
     capability_registry_summary: summary,
+    capability_execution_truth: executionTruth,
+    capability_commercialization_summary: commercializationSummary,
     capability_registry_bundle: bundle,
     capability_registry_classification_summary: classification,
     capability_registry_lineage_summary: lineage,
@@ -522,6 +554,8 @@ function buildCapabilityRegistryPackage(state, input) {
     linked_surfaces: {
       capability_registry_ref: "/v1/capability-registry",
       capability_registry_summary_ref: "/v1/capability-registry/summary",
+      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
+      capability_commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
       capability_registry_operator_bundle_ref: `/v1/capability-registry/operator-bundle?account_id=${encodeURIComponent(accountId)}`,
       capability_registry_policy_pack_ref: `/v1/capability-registry/policy-pack?account_id=${encodeURIComponent(accountId)}`,
       capability_registry_policy_application_summary_ref: `/v1/capability-registry/policy-application-summary?account_id=${encodeURIComponent(accountId)}`
@@ -568,5 +602,8 @@ module.exports = {
   buildCapabilityRegistryPolicyApplicationSummary,
   buildCapabilityRegistryPackage,
   summarizeCapabilityRegistryPackage,
-  summarizeCapabilityRegistryOperatorBundle
+  summarizeCapabilityRegistryOperatorBundle,
+  buildCapabilityExecutionTruthBundle,
+  summarizeCapabilityExecutionTruthBundle,
+  buildCapabilityCommercializationSummary
 };