Consolidate Reader source ownership and pinned application instances

Add exact recursive source checkout, independent Git/jj developer workbenches and source-only backup/recovery commands, with Workspace instance binding outside source. Qualify two empty Reader Graphs, packaged source commands, Agent VM compilation, exact Gitea read grants and reconciled Reader settings/annotation stability. Publish checked Reader Package/root revisions to canonical review branches and retention tags, retain all 57 repositories independently in private versioned storage, verify downloaded-backup recovery and advance the example pin.

Add bounded Central pin acquisition and selection-specific read-only identities, qualified against all 57 canonical repositories without write authority. Replace regex fork dependency discovery with compiler-parsed lock imports and rewrite proposals; preserve source identities and unrelated files, passing instance binding through packed and ordinary host checks.

Hosted run-pin versus authoring preparation and maintained duplicate removal remain pending. Live source selections, Template defaults and default source branches are unchanged.

src/capability-language/tool-cli.ts

@@ -54,6 +54,61 @@ const planSummary = (plan: Awaited<ReturnType<typeof planStructure>>) => ({
 
 const main = async () => {
   const [command, ...args] = process.argv.slice(2);
+  if (command === "source-locks") {
+    if (!args[0] || (args.length !== 1 && (args.length !== 3 || args[1] !== "--replacements")))
+      throw Error("source-locks DIRECTORY [--replacements JSON_FILE]");
+    const { workspaceSourceLocks } = await import("./source-locks.js");
+    const replacements = args[2] ? JSON.parse(await readFile(args[2], "utf8")) : [];
+    process.stdout.write(JSON.stringify(await workspaceSourceLocks(path.resolve(args[0]), replacements)) + "\n");
+    return;
+  }
+  if (["source-checkout", "source-develop", "source-backup", "source-restore"].includes(command!)) {
+    const args = ["source", command.slice("source-".length), ...process.argv.slice(3)];
+    const { materializeWorkspaceSources } = await import("./source-closure.js");
+    if (!args[2]) throw Error("source requires a pinned source JSON file");
+    const flags = new Map<string, string>();
+    for (let i = 3; i < args.length; i += 2) {
+      if (
+        ![
+          "--dir",
+          ...(args[1] !== "restore" ? ["--locations"] : []),
+          ...(args[1] === "checkout" ? ["--repository-prefix"] : []),
+          ...(args[1] === "develop" ? ["--cache"] : []),
+          ...(args[1] === "backup" ? ["--output"] : []),
+        ].includes(args[i]) ||
+        !args[i + 1] ||
+        flags.has(args[i])
+      )
+        throw Error("Invalid source command options; use qx-workspace help source");
+      flags.set(args[i], args[i + 1]);
+    }
+    if (!flags.get("--dir")) throw Error("source requires --dir DIRECTORY");
+    if (args[1] === "restore") {
+      const { restoreWorkspaceSources } = await import("./source-backup.js");
+      const result = await restoreWorkspaceSources({ backup: args[2], directory: path.resolve(flags.get("--dir")!) });
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      return;
+    }
+    const locationsFile = flags.get("--locations");
+    const options = {
+      source: JSON.parse(await readFile(args[2], "utf8")),
+      directory: path.resolve(flags.get("--dir")!),
+      ...(locationsFile ? { locations: JSON.parse(await readFile(locationsFile, "utf8")) } : {}),
+      ...(flags.has("--repository-prefix") ? { repositoryPrefix: flags.get("--repository-prefix") } : {}),
+    };
+    let result;
+    if (args[1] === "develop") {
+      if (!flags.get("--cache")) throw Error("source develop requires --cache DIRECTORY");
+      const { prepareDevelopmentSources } = await import("./development-sources.js");
+      result = await prepareDevelopmentSources({ ...options, cacheDirectory: path.resolve(flags.get("--cache")!) });
+    } else if (args[1] === "backup") {
+      if (!flags.get("--output")) throw Error("source backup requires --output DIRECTORY");
+      const { backupWorkspaceSources } = await import("./source-backup.js");
+      result = await backupWorkspaceSources({ ...options, output: path.resolve(flags.get("--output")!) });
+    } else result = await materializeWorkspaceSources(options);
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return;
+  }
   if (command === "source-manifest") {
     if (args.length !== 1) throw new Error("source-manifest WORKSPACE_ROOT");
     process.stdout.write(JSON.stringify(await qxSourceManifest(args[0])) + "\n");
@@ -197,10 +252,16 @@ const main = async () => {
   }
   if (command === "check-committed" && !args.includes("--help")) {
     const [kind, repository, commit, log, ...extra] = args;
-    if (!["workspace", "interface", "package", "build"].includes(kind) || !log || extra.length)
-      throw new Error("usage: quixos-qx check-committed workspace|interface|package|build REPOSITORY COMMIT LOG_FILE");
+    if (
+      !["workspace", "interface", "package", "build"].includes(kind) ||
+      !log ||
+      (extra.length !== 0 && (kind !== "workspace" || extra.length !== 2 || extra[0] !== "--workspace-id" || !extra[1]))
+    )
+      throw new Error(
+        "usage: quixos-qx check-committed workspace|interface|package|build REPOSITORY COMMIT LOG_FILE [--workspace-id ID]",
+      );
     process.stdout.write(
-      `${await buildImmutableCandidate({ repository, commit }, kind as "workspace" | "interface" | "package" | "build", log)}\n`,
+      `${await buildImmutableCandidate({ repository, commit }, kind as "workspace" | "interface" | "package" | "build", log, false, undefined, extra[1])}\n`,
     );
     return;
   }