Publish quixos-protocol from 286ada5419c4fc2184b387cea4715fae1a74bde5

.quixos-subtree-source.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos",
-  "sourceCommit": "37a50c17063a41d23037b39785f7054992d7c708",
+  "sourceCommit": "286ada5419c4fc2184b387cea4715fae1a74bde5",
   "sourcePath": "quixos-protocol",
   "exportName": "quixos-protocol",
   "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"

flake.nix

@@ -65,6 +65,7 @@
               esbuild dist/src/bindings/portable-client-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-client.mjs
               esbuild dist/src/bindings/react-platform.js --bundle --platform=node --target=node24 --format=esm --outfile=react-platform.mjs
               esbuild dist/src/capability-language/tool-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-qx.mjs
+              esbuild dist/src/capability-language/source-check-driver.js --bundle --platform=node --target=node24 --format=esm --outfile=source-check-driver.mjs
               runHook postBuild
             '';
             doCheck = true;
@@ -132,6 +133,7 @@
                           install -m644 client-codegen.mjs "$out/libexec/quixos-protocol/client-codegen.mjs"
                           install -m644 react-platform.mjs "$out/libexec/quixos-protocol/react-platform.mjs"
                           install -m644 quixos-codegen-ts.mjs quixos-qx.mjs "$out/libexec/quixos-protocol/"
+                          install -m644 source-check-driver.mjs "$out/libexec/quixos-protocol/"
                           install -m644 quixos-codegen-client.mjs "$out/libexec/quixos-protocol/"
                           install -m644 quixos-descriptor-check.mjs "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs"
                           install -m644 quixos-capability-compile.mjs "$out/libexec/quixos-protocol/quixos-capability-compile.mjs"

src/capability-language/checked-build.ts

@@ -128,6 +128,7 @@ export async function buildImmutableCandidate(
     log.once("open", () => resolve());
     log.once("error", reject);
   });
+  let logBytes = 0;
   const run = async (executable: string, args: string[]) =>
     await new Promise<string>((resolve, reject) => {
       let output = "",
@@ -140,9 +141,18 @@ export async function buildImmutableCandidate(
       };
       log.on("error", failedLog);
       child.stdout.on("data", (chunk) => {
-        output += chunk;
+        if (failure) return;
+        if (Buffer.byteLength(output) + chunk.length > 65536)
+          failedLog(new Error("Candidate checker output exceeds 64 KiB"));
+        else output += chunk;
       });
       child.stderr.on("data", (chunk) => {
+        if (failure) return;
+        logBytes += chunk.length;
+        if (logBytes > 16 * 1024 * 1024) {
+          failedLog(new Error("Candidate checker log exceeds 16 MiB"));
+          return;
+        }
         log.write(chunk);
         tail = (tail + String(chunk)).slice(-6000);
       });

src/capability-language/pin-upgrades.ts

@@ -15,7 +15,12 @@ import {
 } from "./assembly.js";
 import { createGitCapabilityResolver } from "./git-resolver.js";
 import { snapshotCommit, buildImmutableCandidate } from "./checked-build.js";
-import { planEvolution, type WorkspaceRevision, type EvolutionReview } from "../capability-model/index.js";
+import {
+  planEvolution,
+  reviewSemanticMajors,
+  type WorkspaceRevision,
+  type EvolutionReview,
+} from "../capability-model/index.js";
 import { withFileLock } from "./file-lock.js";
 const execFile = promisify(callback);
 type Source = { repository: string; commit: string };
@@ -187,6 +192,34 @@ export type UpgradeEffects = {
   snapshot(root: string): Promise<string>;
   publish(root: string, commit: string): Promise<void>;
 };
+
+/** Review a successfully built immutable candidate using the same boundary as
+ * ordinary authoring checks. Execution storage compatibility is checked against
+ * the current graph at activation; the legacy evolution model is not its schema.
+ */
+export async function reviewUpgradeCandidate({
+  artifact,
+  baseline,
+  candidate,
+  reviews = [],
+}: {
+  artifact: string;
+  baseline: WorkspaceRevision | null;
+  candidate: WorkspaceRevision;
+  reviews?: EvolutionReview[];
+}) {
+  let execution = false;
+  try {
+    await fs.access(path.join(artifact, "execution-plan.json"));
+    execution = true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  return execution
+    ? { filename: "semantic-review.json", review: reviewSemanticMajors(baseline, candidate, reviews) }
+    : { filename: "evolution.json", review: planEvolution(baseline, candidate, { reviews }) };
+}
+
 const effects: UpgradeEffects = {
   async check(node, root, output, spec) {
     if (node.kind === "workspace" && !spec.baseline && !spec.bootstrap)
@@ -206,10 +239,15 @@ const effects: UpgradeEffects = {
         ? (JSON.parse(await fs.readFile(spec.baseline, "utf8")) as WorkspaceRevision)
         : null;
       const reviews = spec.reviews ? (JSON.parse(await fs.readFile(spec.reviews, "utf8")) as EvolutionReview[]) : [];
-      const evolution = planEvolution(baseline, JSON.parse(candidate), { reviews });
-      await fs.writeFile(path.join(output, "evolution.json"), JSON.stringify(evolution, null, 2));
-      if (evolution.blockers.length)
-        throw new Error(`Refactor required in ${node.directory}: ${evolution.blockers.join("; ")}`);
+      const { filename, review } = await reviewUpgradeCandidate({
+        artifact,
+        baseline,
+        candidate: JSON.parse(candidate),
+        reviews,
+      });
+      await fs.writeFile(path.join(output, filename), JSON.stringify(review, null, 2));
+      if (review.blockers.length)
+        throw new Error(`Refactor required in ${node.directory}: ${review.blockers.join("; ")}`);
     }
   },
   async snapshot(root) {
@@ -443,13 +481,13 @@ export const applyPinUpgrades = async (
           quixos: compiled.lock.quixos,
           directResources: [...compiled.directResources.entries()].map(([bindingKey, node]) => {
             const [kind, binding] = bindingKey.split("\0");
-            return { kind, binding, resourceKey: node.key, directory: node.directory };
+            return { kind, binding, resourceKey: node.key, directory: path.relative(plan.workbench, node.directory) };
           }),
           resources: [...resources.values()].map((node) => ({
             key: node.key,
             kind: node.kind,
             source: node.source,
-            directory: node.directory,
+            directory: path.relative(plan.workbench, node.directory),
             ...(node.resource.kind === "build"
               ? {}
               : {

src/capability-language/source-check-driver.ts

@@ -0,0 +1,8 @@
+import { buildImmutableCandidate } from "./checked-build.js";
+
+// Installed platform driver, run only inside the sealed checker's unprivileged
+// evaluator. Authored flakes never become the outer evaluator program.
+const [repository, commit, log] = process.argv.slice(2);
+if (!repository || !commit || !log || process.argv.length !== 5)
+  throw Error("source-check-driver REPOSITORY COMMIT LOG");
+process.stdout.write((await buildImmutableCandidate({ repository, commit }, "workspace", log)) + "\n");

src/capability-language/structural-plan.ts

@@ -167,11 +167,12 @@ export const planStructure = async (rootPath: string, request: StructuralRequest
           resolveResource,
         });
         if (compiled.resource.kind === "package") {
-          const configuration = JSON.parse(await fs.readFile(path.join(resourceRoot, "quixos.check.json"), "utf8"));
+          const configurationSource = await read(resourceRoot, "quixos.check.json");
+          const configuration = configurationSource === null ? undefined : JSON.parse(configurationSource);
           // Execution bindings are immutable build outputs owned by checkedArtifacts,
           // not source edits produced by a structural preview.
           const artifacts =
-            configuration.backend === "execution"
+            !configuration || configuration.backend === "execution"
               ? []
               : [
                   {

src/capability-model/validation.ts

@@ -1526,7 +1526,6 @@ const validateBoundDependencies = (
           );
           break;
         }
-        validateAttachmentAccess(issues, attachment, params.conformance, `${path}.binding.edgeTypeId`);
         const projection = edgeProjection(attachment.attachment, edgeBinding.projectionId);
         if (!projection) {
           issue(
@@ -1537,6 +1536,12 @@ const validateBoundDependencies = (
           );
           break;
         }
+        // Exporting traversal never exports writes or subscription ownership.
+        const publicRead =
+          projection.endpoint.publicTraversal &&
+          requirement.primitives.length > 0 &&
+          requirement.primitives.every((primitive) => primitive === "resolve");
+        if (!publicRead) validateAttachmentAccess(issues, attachment, params.conformance, `${path}.binding.edgeTypeId`);
         if (projection.target.keyType && requirement.primitives.includes("connect"))
           issue(
             issues,

src/execution-world/README.md

@@ -1,5 +1,11 @@
 # Closed execution plans and artifacts
 
+This page documents current compiler/runtime representations. Its universal
+artifact inventory, React metadata and overlapping world/installation structures
+are [known architectural gaps](../../../docs/ARCHITECTURE_STATUS.md), not the
+[core package contract](../../../docs/ARCHITECTURE.md). Historical LF task numbers
+refer to the original implementation sequence, not an active queue.
+
 `compileExecutionPlan` validates a workspace, links its checked queries, resolves
 public forwarding, and emits one versioned plan with an SHA-256 digest. It retains
 exact interface/package revisions and generic applications, owner initialization,
@@ -60,11 +66,11 @@ the core codec's canonical ordering and domain-separated SHA-256 framing. The
 monorepo `camino-execution-world` check compares the compiler and core implementations.
 No machine-local Nix path enters the world descriptor.
 
-The current binding schema is the closed workspace schema. This is conservative:
-an unrelated contract change can require checking/rebuilding several packages.
-LF-05 may narrow it to exact checked per-package closures, but must use the same
-schema for generation, receipts, and world validation. It must not substitute an
-older package schema just because the source revision did not change.
+Reusable package compilation now receives a canonical per-package build contract;
+exact source provenance and workspace linking remain separate. See
+[package build contracts](../../../docs/PACKAGE_BUILD_CONTRACTS.md). Generation,
+receipts and checking must agree on that contract; unchanged source alone does
+not justify reusing an incompatible binding schema.
 
 ## Transaction-port ABI
 

src/execution-world/artifacts.ts

@@ -11,7 +11,7 @@ export interface ArtifactFile {
 export interface ArtifactImplementation {
   id: string;
   target: string;
-  compatibility: "quixos-service-v1" | "quixos-js-module-v1";
+  compatibility: "quixos-service-v1" | "quixos-js-module-v1" | "quixos-restricted-module-v1";
   path: string;
   ports: "quixos-transaction-ports-v1";
   registryExport?: string;
@@ -225,7 +225,11 @@ export function parseArtifactGroup(value: unknown): ArtifactGroup {
         ["registryExport"],
         path,
       );
-      if (entry.compatibility !== "quixos-service-v1" && entry.compatibility !== "quixos-js-module-v1")
+      if (
+        !["quixos-service-v1", "quixos-js-module-v1", "quixos-restricted-module-v1"].includes(
+          String(entry.compatibility),
+        )
+      )
         fail(path, "Unsupported artifact ABI");
       if (entry.ports !== "quixos-transaction-ports-v1") fail(path, "Unsupported transaction port ABI");
       if (
@@ -233,7 +237,9 @@ export function parseArtifactGroup(value: unknown): ArtifactGroup {
         (entry.target !== "server" || entry.registryExport !== undefined)
       )
         fail(path, "Service must target server and has no JS registry export");
-      if (entry.compatibility === "quixos-js-module-v1") text(entry.registryExport, `${path}.registryExport`);
+      if (entry.compatibility !== "quixos-service-v1") text(entry.registryExport, `${path}.registryExport`);
+      if (entry.compatibility === "quixos-restricted-module-v1" && entry.target !== "server")
+        fail(path, "Restricted modules must target server");
       const exports = array(entry.exports, `${path}.exports`).map((value) => text(value, `${path}.exports`));
       unique(exports, `${path}.exports`);
       const files = parseArtifactFiles(entry.files, `${path}.files`);
@@ -300,6 +306,11 @@ export function checkPackageCoverage(
     for (const id of implementation.exports) {
       const entry = expected.exports.find((e) => e.id === id);
       if (!entry) fail(implementation.id, `Unknown export ${id}`);
+      if (
+        implementation.compatibility === "quixos-restricted-module-v1" &&
+        (entry!.execution.kind === "remote" || !entry!.execution.targets.includes("server"))
+      )
+        fail(implementation.id, `Export ${id} does not promise restricted server computation`);
       if (
         implementation.target !== "server" &&
         (!entry?.execution ||

src/execution-world/candidate.ts

@@ -1,18 +1,31 @@
 import { graphExecutionRepresentation } from "./graph-execution.js";
-import { open, lstat } from "node:fs/promises";
-import { constants } from "node:fs";
+import { lstat } from "node:fs/promises";
 import { join } from "node:path";
 import { hexDigest, ExecutionPlanError, type ExecutionPlan } from "./plan.js";
-import { loadExecutionInstallation, type PackageInstallationSelection } from "./installation.js";
+import {
+  loadExecutionInstallation,
+  createClientContractCatalog,
+  type PackageInstallationSelection,
+} from "./installation.js";
+import {
+  candidateMetadataBudget,
+  readCandidateMetadata,
+  type CandidateMetadataBudget,
+  type CandidateMetadataScope,
+} from "./metadata.js";
 const rootPattern = /^\/nix\/store\/[a-z0-9]{32}-[^/\s]+$/;
-async function readJson(root: string, file: string): Promise<any> {
-  const handle = await open(join(root, file), constants.O_RDONLY | constants.O_NOFOLLOW);
+async function readJson(root: string, file: string, scope: CandidateMetadataScope) {
+  const input = await readCandidateMetadata(join(root, file), scope, 32 * 1024 * 1024);
   try {
-    const metadata = await handle.stat();
-    if (!metadata.isFile() || metadata.size > 32 * 1024 * 1024) throw Error(`Invalid checked candidate file: ${file}`);
-    return JSON.parse(await handle.readFile("utf8"));
+    return {
+      value: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.bytes)),
+      releaseTree: input.releaseTree,
+    };
+  } catch (error) {
+    input.releaseTree();
+    throw error;
   } finally {
-    await handle.close();
+    input.releaseInput();
   }
 }
 /** Load the checked Nix output, preserving its original compilation and provenance.
@@ -22,113 +35,156 @@ async function readJson(root: string, file: string): Promise<any> {
 export async function loadCheckedInstallationCandidate(
   root: string,
   selections: Readonly<Record<string, PackageInstallationSelection>> = {},
+  resources: { budget?: CandidateMetadataBudget; owner?: string } = {},
 ) {
   if (!rootPattern.test(root) || !(await lstat(root)).isDirectory())
     throw Error("Candidate must be an immutable Nix output directory");
-  const [candidate, plan, artifacts, source, entryRequest, kernel, queries, graph] = await Promise.all([
-    readJson(root, "candidate.json"),
-    readJson(root, "execution-plan.json"),
-    readJson(root, "execution-artifacts.json"),
-    readJson(root, "source.json"),
-    readJson(root, "entry.json"),
-    readJson(root, "kernel.json"),
-    readJson(root, "queries.json"),
-    readJson(root, "graph-execution.json"),
-  ]);
-  const { executionContracts: _legacyContracts, ...workspace } = candidate;
-  if (
-    plan?.definition?.codec !== "camino-execution-plan-v1" ||
-    hexDigest(plan.definition) !== plan.digest ||
-    hexDigest(workspace) !== hexDigest(plan.definition.workspace)
-  )
-    throw new ExecutionPlanError(
-      "CANDIDATE_PLAN_MISMATCH",
-      root,
-      "Stored plan must match its digest and exact workspace source contract",
-    );
-  if (
-    source.kind !== "workspace" ||
-    source.commit !== plan.definition.workspace.sourceRootCommit ||
-    typeof source.repository !== "string"
-  )
-    throw new ExecutionPlanError("CANDIDATE_SOURCE_MISMATCH", root, "Expected exact workspace source provenance");
-  const repository = new URL(source.repository);
-  if (
-    !["https:", "ssh:"].includes(repository.protocol) ||
-    repository.username ||
-    repository.password ||
-    repository.hash ||
-    repository.search
-  )
-    throw new ExecutionPlanError("CANDIDATE_SOURCE_INVALID", root, "Expected a source URL without credentials");
-  if (
-    artifacts.codec !== "camino-checked-execution-v2" ||
-    typeof artifacts.generator !== "string" ||
-    !/^[0-9a-f]{64}$/.test(artifacts.generator) ||
-    !artifacts.roots ||
-    typeof artifacts.roots !== "object" ||
-    Array.isArray(artifacts.roots)
-  )
-    throw new ExecutionPlanError("CANDIDATE_ARTIFACTS_INVALID", root, "Expected checked package roots");
-  for (const entry of Object.values(artifacts.roots))
-    if (typeof entry !== "string" || !rootPattern.test(entry))
+  const scope = (resources.budget ?? candidateMetadataBudget).acquire(resources.owner ?? root);
+  try {
+    // Validate the duplicated source contract by digest, then discard its tree
+    // before allocating the substantially larger checked execution plan.
+    const workspaceDigest = await (async () => {
+      const input = await readJson(root, "candidate.json", scope);
+      try {
+        const { executionContracts: _legacyContracts, ...workspace } = input.value;
+        return hexDigest(workspace);
+      } finally {
+        input.releaseTree();
+      }
+    })();
+    // Sequential reads avoid partially rejected Promise.all() work allocating
+    // after the failed candidate's reservation has been released.
+    const values = [];
+    for (const file of [
+      "execution-plan.json",
+      "execution-artifacts.json",
+      "source.json",
+      "entry.json",
+      "kernel.json",
+      "queries.json",
+    ]) {
+      const parsed = await readJson(root, file, scope);
+      values.push(parsed.value);
+    }
+    const [plan, artifacts, source, entryRequest, kernel, queries] = values;
+    if (
+      plan?.definition?.codec !== "camino-execution-plan-v1" ||
+      hexDigest(plan.definition) !== plan.digest ||
+      workspaceDigest !== hexDigest(plan.definition.workspace)
+    )
       throw new ExecutionPlanError(
-        "CANDIDATE_ARTIFACTS_INVALID",
+        "CANDIDATE_PLAN_MISMATCH",
         root,
-        "Package artifacts must be immutable Nix roots",
+        "Stored plan must match its digest and exact workspace source contract",
       );
-  const installation = await loadExecutionInstallation(plan, artifacts.roots, selections);
-  const entry = compileWorkspaceEntry(plan, entryRequest);
-  for (const [name, program, codec] of [
-    ["kernel", kernel, "camino-kernel-program-v1"],
-    ["queries", queries, "camino-query-program-v1"],
-  ] as const)
-    if (program?.codec !== codec || program.plan !== kernel.plan || hexDigest(program) !== artifacts.programs?.[name])
-      throw new ExecutionPlanError(
-        "CANDIDATE_PROGRAM_MISMATCH",
-        name,
-        "Stored interpreter input must match the checked build and plan",
-      );
-  const expectedGraph = graphExecutionRepresentation(plan, installation, kernel, queries);
-  if (hexDigest(graph) !== hexDigest(expectedGraph) || artifacts.execution !== hexDigest(graph))
-    throw new ExecutionPlanError(
-      "CANDIDATE_EXECUTION_MISMATCH",
+    if (
+      source.kind !== "workspace" ||
+      source.commit !== plan.definition.workspace.sourceRootCommit ||
+      typeof source.repository !== "string"
+    )
+      throw new ExecutionPlanError("CANDIDATE_SOURCE_MISMATCH", root, "Expected exact workspace source provenance");
+    const repository = new URL(source.repository);
+    if (
+      !["https:", "ssh:"].includes(repository.protocol) ||
+      repository.username ||
+      repository.password ||
+      repository.hash ||
+      repository.search
+    )
+      throw new ExecutionPlanError("CANDIDATE_SOURCE_INVALID", root, "Expected a source URL without credentials");
+    if (
+      artifacts.codec !== "camino-checked-execution-v2" ||
+      typeof artifacts.generator !== "string" ||
+      !/^[0-9a-f]{64}$/.test(artifacts.generator) ||
+      !artifacts.roots ||
+      typeof artifacts.roots !== "object" ||
+      Array.isArray(artifacts.roots)
+    )
+      throw new ExecutionPlanError("CANDIDATE_ARTIFACTS_INVALID", root, "Expected checked package roots");
+    for (const entry of Object.values(artifacts.roots))
+      if (typeof entry !== "string" || !rootPattern.test(entry))
+        throw new ExecutionPlanError(
+          "CANDIDATE_ARTIFACTS_INVALID",
+          root,
+          "Package artifacts must be immutable Nix roots",
+        );
+    const installation = await loadExecutionInstallation(plan, artifacts.roots, selections, scope);
+    const entry = compileWorkspaceEntry(plan, entryRequest);
+    for (const [name, program, codec] of [
+      ["kernel", kernel, "camino-kernel-program-v1"],
+      ["queries", queries, "camino-query-program-v1"],
+    ] as const)
+      if (program?.codec !== codec || program.plan !== kernel.plan || hexDigest(program) !== artifacts.programs?.[name])
+        throw new ExecutionPlanError(
+          "CANDIDATE_PROGRAM_MISMATCH",
+          name,
+          "Stored interpreter input must match the checked build and plan",
+        );
+    const expectedGraph = graphExecutionRepresentation(plan, installation, kernel, queries);
+    // The stored graph embeds the same kernel/query programs. Validate it in a
+    // short-lived scope and retain the representation that shares those trees.
+    await (async () => {
+      const input = await readJson(root, "graph-execution.json", scope);
+      try {
+        const digest = hexDigest(input.value);
+        if (digest !== hexDigest(expectedGraph) || artifacts.execution !== digest)
+          throw new ExecutionPlanError(
+            "CANDIDATE_EXECUTION_MISMATCH",
+            root,
+            "Stored graph execution differs from checked inputs",
+          );
+      } finally {
+        input.releaseTree();
+      }
+    })();
+    const provenance = {
+      workspaceRevision: plan.definition.workspace.id as string,
+      source: { repository: source.repository as string, commit: source.commit as string },
+      generator: artifacts.generator as string,
+      packages: (plan as ExecutionPlan).definition.packages.map((pkg) => ({
+        revision: pkg.revision,
+        source: pkg.source,
+      })),
+    };
+    const reference = {
       root,
-      "Stored graph execution differs from checked inputs",
-    );
-  const provenance = {
-    workspaceRevision: workspace.id as string,
-    source: { repository: source.repository as string, commit: source.commit as string },
-    generator: artifacts.generator as string,
-    packages: (plan as ExecutionPlan).definition.packages.map((pkg) => ({
-      revision: pkg.revision,
-      source: pkg.source,
-    })),
-  };
-  const reference = {
-    root,
-    digest: hexDigest({
-      plan: plan.digest,
-      world: installation.world,
+      digest: hexDigest({
+        plan: plan.digest,
+        world: installation.world,
+        provenance,
+        roots: artifacts.roots,
+        entry,
+        programs: artifacts.programs,
+      }),
+    };
+    const catalog = createClientContractCatalog(plan, installation, scope, kernel);
+    return {
+      reference,
+      workspace: plan.definition.workspace.workspaceId,
+      world: hexDigest(expectedGraph),
+      plan: kernel.plan as string,
+      graphExecution: expectedGraph,
       provenance,
-      roots: artifacts.roots,
       entry,
-      programs: artifacts.programs,
-    }),
-  };
-  return {
-    reference,
-    workspace: plan.definition.workspace.workspaceId,
-    world: hexDigest(graph),
-    plan: kernel.plan as string,
-    graphExecution: graph,
-    provenance,
-    entry,
-    kernel,
-    queries,
-    installation,
-    executionPlan: plan as ExecutionPlan,
-  };
+      kernel,
+      queries,
+      installation,
+      executionPlan: plan as ExecutionPlan,
+      clientContractCatalog: catalog.select,
+      metadata: {
+        get bytes() {
+          return scope.bytes;
+        },
+        release: () => {
+          catalog.close();
+          scope.release();
+        },
+      },
+    };
+  } catch (error) {
+    scope.release();
+    throw error;
+  }
 }
 
 export function compileWorkspaceEntry(plan: ExecutionPlan, entryRequest: unknown): { operation: string } | null {

src/execution-world/files.ts

@@ -13,6 +13,7 @@ import {
   type CheckedWorld,
 } from "./artifacts.js";
 import { type ExecutionPlan, ExecutionPlanError } from "./plan.js";
+import { readCandidateMetadata, type CandidateMetadataScope } from "./metadata.js";
 
 const maxFileBytes = 256 * 1024 * 1024;
 const metadataLimit = 16 * 1024 * 1024;
@@ -21,6 +22,18 @@ const fail = (where: string, message: string): never => {
 };
 /** Roots must be trusted immutable output directories. Refuse symlinks, including
  * interior directory links. Hash verification is still required before serving bytes. */
+async function artifactFile(root: string, relative: string): Promise<string> {
+  artifactPath(relative);
+  const components = relative.split("/");
+  let resolved = root;
+  for (let index = 0; index < components.length; index++) {
+    resolved = path.join(resolved, components[index]!);
+    const stat = await lstat(resolved);
+    if (stat.isSymbolicLink() || (index < components.length - 1 ? !stat.isDirectory() : !stat.isFile()))
+      fail(relative, "Only real directories and regular files are allowed");
+  }
+  return resolved;
+}
 export async function artifactFileReader(roots: Readonly<Record<string, string>>): Promise<ArtifactReader> {
   const directories = new Map<string, string>();
   for (const [revision, root] of Object.entries(roots)) {
@@ -33,16 +46,8 @@ export async function artifactFileReader(roots: Readonly<Record<string, string>>
   return async (revision, relative, limit) => {
     const root = directories.get(revision);
     if (!root) fail(revision, "Unknown package output");
-    artifactPath(relative);
     if (!Number.isSafeInteger(limit) || limit < 0 || limit > maxFileBytes) fail(relative, "Invalid file byte limit");
-    const components = relative.split("/");
-    let resolved = root!;
-    for (let index = 0; index < components.length; index++) {
-      resolved = path.join(resolved, components[index]!);
-      const stat = await lstat(resolved);
-      if (stat.isSymbolicLink() || (index < components.length - 1 ? !stat.isDirectory() : !stat.isFile()))
-        fail(relative, "Only real directories and regular files are allowed");
-    }
+    const resolved = await artifactFile(root!, relative);
     const handle = await open(resolved, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     try {
       const stat = await handle.stat();
@@ -72,6 +77,7 @@ export interface LoadedArtifactWorld {
 export async function loadArtifactWorld(
   plan: ExecutionPlan,
   roots: Readonly<Record<string, string>>,
+  metadata?: CandidateMetadataScope,
 ): Promise<LoadedArtifactWorld> {
   const read = await artifactFileReader(roots),
     manifests: PackageArtifacts[] = [];
@@ -79,8 +85,16 @@ export async function loadArtifactWorld(
   if (JSON.stringify(Object.keys(roots).sort()) !== JSON.stringify(expected))
     fail("world", "Output roots must exactly match the installed plan");
   for (const revision of expected) {
-    const bytes = await read(revision, "share/quixos/package-artifacts.json", metadataLimit);
-    const manifest = parsePackageArtifacts(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
+    const file = "share/quixos/package-artifacts.json";
+    const input = metadata
+      ? await readCandidateMetadata(await artifactFile(roots[revision]!, file), metadata, metadataLimit)
+      : { bytes: await read(revision, file, metadataLimit), releaseInput: () => {} };
+    let manifest: PackageArtifacts;
+    try {
+      manifest = parsePackageArtifacts(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.bytes)));
+    } finally {
+      input.releaseInput();
+    }
     if (manifest.packageRevisionId !== revision) fail(revision, "Output belongs to another package revision");
     manifests.push(manifest);
   }

src/execution-world/index.ts

@@ -17,6 +17,7 @@ export * from "./queries.js";
 export * from "./query-document.js";
 export { generatePortableClientBindings } from "../bindings/portable-client.js";
 export * from "./candidate.js";
+export * from "./metadata.js";
 
 export { reviewSemanticMajors } from "../capability-model/evolution.js";
 
@@ -25,3 +26,4 @@ export * from "./public-reflection.js";
 export * from "./graph-execution.js";
 
 export * from "./build-contract.js";
+export * from "./placement.js";

src/execution-world/inspection.ts

@@ -35,20 +35,23 @@ export interface InspectionTemplate {
 }
 /** A finite installed template per interface/lane, not a per-client query compiler.
  * Flags select public cache boundaries; normal scope identity bounds specialization. */
-export function compileInspectionTemplates(plan: ExecutionPlan) {
-  const kernel = compileKernelProgram(plan) as {
-    operations: {
-      key: string;
-      atom: string;
-      interface: string;
-      operation: string;
-      effect: string;
-      targets: string[];
-      unsupported: string | null;
-      output: unknown;
-      binding: { kind: string };
-    }[];
-  };
+export interface InspectionKernel {
+  operations: {
+    key: string;
+    atom: string;
+    interface: string;
+    operation: string;
+    effect: string;
+    targets: string[];
+    unsupported: string | null;
+    output: unknown;
+    binding: { kind: string };
+  }[];
+}
+export function compileInspectionTemplates(
+  plan: ExecutionPlan,
+  kernel: InspectionKernel = compileKernelProgram(plan) as InspectionKernel,
+) {
   const queries: unknown[] = [],
     contracts: PublicQueryContract[] = [],
     templates: InspectionTemplate[] = [];

src/execution-world/installation.ts

@@ -1,4 +1,4 @@
-import { compileInspectionTemplates, type InspectionTemplate } from "./inspection.js";
+import { compileInspectionTemplates, type InspectionTemplate, type InspectionKernel } from "./inspection.js";
 import path from "node:path";
 import { loadCheckedArtifactWorld } from "./receipts.js";
 import { contentArtifactUrl, loadArtifactWorld, type LoadedArtifactWorld } from "./files.js";
@@ -11,6 +11,7 @@ import {
   type PublicQueryContract,
 } from "./client-contracts.js";
 import { resultInterfaces } from "./projections.js";
+import type { CandidateMetadataScope } from "./metadata.js";
 
 /** Activation is assigned by graph authority, never by a package artifact. */
 export interface ActiveExecutionIdentity {
@@ -44,6 +45,7 @@ export function clientContractCatalog(
   plan: ExecutionPlan,
   installation: ExecutionInstallation,
   requestedPackages: readonly string[],
+  checkedKernel?: InspectionKernel,
 ): ClientContractCatalog {
   if (installation.plan !== plan.digest || hexDigest(plan.definition) !== plan.digest)
     throw new ExecutionPlanError(
@@ -68,7 +70,7 @@ export function clientContractCatalog(
           .map((operation) => publicOperationContract(iface, operation)),
       ),
     );
-  const inspection = compileInspectionTemplates(plan);
+  const inspection = compileInspectionTemplates(plan, checkedKernel);
   return {
     inspections: inspection.templates,
     resultInterfaces: Object.fromEntries(
@@ -97,6 +99,75 @@ export function clientContractCatalog(
   };
 }
 
+/** Candidate-owned compiler output, never graph state or authorization. Compile
+ * once, then project each requested package set without hashing/recompiling the
+ * plan. Reserve bounded metadata before compilation; disposal releases both the
+ * catalog and its charge. Callers must supply the candidate's checked inputs. */
+export function createClientContractCatalog(
+  plan: ExecutionPlan,
+  installation: ExecutionInstallation,
+  metadata: CandidateMetadataScope,
+  checkedKernel?: InspectionKernel,
+) {
+  const revisions = plan.definition.workspace.packageImports.map((pkg) => pkg.revisionId);
+  const installed = new Set<string>(revisions);
+  let catalog: ClientContractCatalog | undefined;
+  let release: (() => void) | undefined;
+  let closed = false;
+  const freeze = (value: unknown, seen = new WeakSet<object>()) => {
+    if (!value || typeof value !== "object" || seen.has(value)) return;
+    seen.add(value);
+    for (const child of Object.values(value)) freeze(child, seen);
+    Object.freeze(value);
+  };
+  return {
+    select(requestedPackages: readonly string[]): ClientContractCatalog {
+      if (closed) throw Error("CANDIDATE_METADATA_CLOSED");
+      for (const revision of requestedPackages)
+        if (!installed.has(revision))
+          throw new ExecutionPlanError("UNINSTALLED_PACKAGE", revision, "Requested catalog package is not installed");
+      if (!catalog) {
+        // Like other candidate admission charges, this is an allocation estimate,
+        // not a V8 heap limit. The process/cgroup ceiling bounds transient work.
+        const reservation = metadata.reserve(32 * 1024 * 1024);
+        try {
+          const compiled = clientContractCatalog(plan, installation, revisions, checkedKernel);
+          const bytes = Buffer.byteLength(JSON.stringify(compiled));
+          if (bytes > 8 * 1024 * 1024) throw Error("CANDIDATE_CATALOG_LIMIT");
+          freeze(compiled);
+          // No await between reservations: replacing the transient upper bound
+          // with a smaller retained estimate cannot race another admission.
+          reservation();
+          release = metadata.reserve(Math.max(64 * 1024, bytes * 4));
+          catalog = compiled;
+        } catch (error) {
+          reservation();
+          throw error;
+        }
+      }
+      const requested = new Set(requestedPackages);
+      return {
+        inspections: catalog.inspections,
+        resultInterfaces: catalog.resultInterfaces,
+        operations: catalog.operations,
+        queries: [
+          ...catalog.queries.filter((query) => !installed.has(query.package)),
+          ...requestedPackages.flatMap((revision) => catalog!.queries.filter((query) => query.package === revision)),
+        ],
+        components: catalog.components.filter((component) => requested.has(component.packageRevision)),
+        moduleBindings: catalog.moduleBindings.filter((binding) => requested.has(binding.packageRevision)),
+        presentations: catalog.presentations.filter((presentation) => requested.has(presentation.packageRevision)),
+      };
+    },
+    close() {
+      closed = true;
+      catalog = undefined;
+      release?.();
+      release = undefined;
+    },
+  };
+}
+
 export interface PackageInstallationSelection {
   readonly browser?: { readonly id?: string };
   readonly service?: { readonly id?: string };
@@ -112,6 +183,8 @@ export interface ExecutionInstallation {
     readonly root: string;
     readonly service?: ArtifactImplementation;
     readonly module?: ArtifactImplementation;
+    /** Checked candidate only; the qualified host verifies its import surface and SDK. */
+    readonly restricted?: ArtifactImplementation;
     readonly browserImplementation?: ArtifactImplementation;
     readonly browserURL?: string;
     readonly browserRegistry?: string;
@@ -159,8 +232,9 @@ export async function loadExecutionInstallation(
   plan: ExecutionPlan,
   roots: Readonly<Record<string, string>>,
   selections: Readonly<Record<string, PackageInstallationSelection>> = {},
+  metadata?: CandidateMetadataScope,
 ): Promise<ExecutionInstallation> {
-  return assembleExecutionInstallation(plan, roots, await loadArtifactWorld(plan, roots), selections);
+  return assembleExecutionInstallation(plan, roots, await loadArtifactWorld(plan, roots, metadata), selections);
 }
 function assembleExecutionInstallation(
   plan: ExecutionPlan,
@@ -249,6 +323,11 @@ function assembleExecutionInstallation(
           exports: exports.map((entry) => entry.id),
         })
       : undefined;
+    const restrictedCandidates = manifest.implementations.filter(
+      (entry) => entry.compatibility === "quixos-restricted-module-v1",
+    );
+    if (restrictedCandidates.length > 1) fail(revision, "Ambiguous restricted module candidates");
+    const restricted = restrictedCandidates[0];
     const browserExports = exports.filter(
       (entry) =>
         entry.execution.kind !== "remote" &&
@@ -256,7 +335,13 @@ function assembleExecutionInstallation(
     );
     if (!browserExports.length) {
       if (selection.browser) fail(revision, "Package has no browser exports to select");
-      packages.push({ revision, root, ...(service ? { service } : {}), ...(module ? { module } : {}) });
+      packages.push({
+        revision,
+        root,
+        ...(service ? { service } : {}),
+        ...(module ? { module } : {}),
+        ...(restricted ? { restricted } : {}),
+      });
       continue;
     }
     const browser = selectArtifactImplementation(manifest, {
@@ -287,6 +372,7 @@ function assembleExecutionInstallation(
       root,
       ...(service ? { service } : {}),
       ...(module ? { module } : {}),
+      ...(restricted ? { restricted } : {}),
       browserImplementation: browser,
       browserURL: contentArtifactUrl(entry),
       browserRegistry: browser.registryExport,

src/execution-world/metadata.ts

@@ -0,0 +1,138 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+
+/** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
+ * still required. Charge input, parse trees and derived indexes before reading
+ * or parsing. Each live candidate retains its reservation until explicit close. */
+export class CandidateMetadataBudget {
+  readonly limits: Readonly<{ bytes: number; ownerBytes: number; candidates: number }>;
+  private bytes = 0;
+  private scopes = 0;
+  private readonly owners = new Map<string, number>();
+  // A cutover holds both the serving and proposed installation plus transient
+  // parsing space. The 57-repository reader retains ~133 MiB per installation;
+  // a 256 MiB owner ceiling cannot admit its ordinary atomic replacement.
+  // Keep the aggregate ceiling independent and leave room for parsing overlap.
+  constructor(limits = { bytes: 512 * 1024 * 1024, ownerBytes: 384 * 1024 * 1024, candidates: 128 }) {
+    for (const value of Object.values(limits))
+      if (!Number.isSafeInteger(value) || value < 1) throw Error("INVALID_CANDIDATE_METADATA_BUDGET");
+    if (limits.ownerBytes > limits.bytes) throw Error("INVALID_CANDIDATE_METADATA_BUDGET");
+    this.limits = Object.freeze({ ...limits });
+  }
+  snapshot() {
+    return { bytes: this.bytes, candidates: this.scopes, owners: this.owners.size, limits: this.limits };
+  }
+  acquire(owner: string) {
+    if (!owner || owner.length > 4096) throw Error("INVALID_CANDIDATE_METADATA_OWNER");
+    if (this.scopes >= this.limits.candidates) throw Error("CANDIDATE_METADATA_LIMIT");
+    this.scopes++;
+    let bytes = 0,
+      closed = false;
+    const charge = (amount: number) => {
+      if (closed) throw Error("CANDIDATE_METADATA_CLOSED");
+      if (!Number.isSafeInteger(amount) || amount < 0) throw Error("INVALID_CANDIDATE_METADATA_CHARGE");
+      const owned = this.owners.get(owner) ?? 0;
+      if (this.bytes + amount > this.limits.bytes || owned + amount > this.limits.ownerBytes)
+        throw Error("CANDIDATE_METADATA_LIMIT");
+      bytes += amount;
+      this.bytes += amount;
+      this.owners.set(owner, owned + amount);
+    };
+    const subtract = (amount: number) => {
+      bytes -= amount;
+      this.bytes -= amount;
+      const remaining = (this.owners.get(owner) ?? 0) - amount;
+      if (remaining) this.owners.set(owner, remaining);
+      else this.owners.delete(owner);
+    };
+    return {
+      get bytes() {
+        return bytes;
+      },
+      charge,
+      /** Opaque, idempotent transient reservation; callers cannot subtract an
+       * arbitrary amount or release another candidate's charges. */
+      reserve: (amount: number) => {
+        charge(amount);
+        let released = false;
+        return () => {
+          if (closed || released) return;
+          released = true;
+          subtract(amount);
+        };
+      },
+      release: () => {
+        if (closed) return;
+        closed = true;
+        subtract(bytes);
+        this.scopes--;
+      },
+    };
+  }
+}
+export type CandidateMetadataScope = ReturnType<CandidateMetadataBudget["acquire"]>;
+export const candidateMetadataBudget = new CandidateMetadataBudget();
+
+// Estimate JSON allocation without constructing its tree. Object/array headers,
+// value slots and strings get explicit weights, with a multiplier for checked
+// indexes/derived representations. Indentation must not multiply tree charges.
+function jsonAllocation(bytes: Uint8Array): number {
+  let estimate = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    const c = bytes[i]!;
+    if (c === 123) estimate += 64;
+    else if (c === 91) estimate += 32;
+    else if (c === 34) {
+      const start = ++i;
+      while (i < bytes.length && bytes[i] !== 34) {
+        if (bytes[i] === 92) i++;
+        i++;
+      }
+      estimate += 32 + 2 * (i - start);
+    } else if (c === 45 || (c >= 48 && c <= 57) || c === 116 || c === 102 || c === 110) {
+      estimate += 16;
+      while (i + 1 < bytes.length) {
+        const next = bytes[i + 1]!;
+        if (next === 9 || next === 10 || next === 13 || next === 32 || next === 44 || next === 93 || next === 125)
+          break;
+        i++;
+      }
+    }
+  }
+  return estimate * 2;
+}
+
+/** Immutable regular files only. Fixed allocation plus an extra byte catches
+ * growth; readFile() would allocate before the admission check can intervene. */
+export async function readCandidateMetadata(
+  path: string,
+  scope: CandidateMetadataScope,
+  limit: number,
+): Promise<{ bytes: Uint8Array; releaseInput: () => void; releaseTree: () => void }> {
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  let releaseInput: (() => void) | undefined;
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > limit)
+      throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    // Reserve the input buffer and UTF-16 decoding before allocating either.
+    releaseInput = scope.reserve((stat.size + 1) * 3);
+    const bytes = Buffer.alloc(stat.size + 1);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const read = await handle.read(bytes, offset, bytes.length - offset, offset);
+      if (!read.bytesRead) break;
+      offset += read.bytesRead;
+    }
+    if (offset !== stat.size) throw Error("CANDIDATE_METADATA_CHANGED");
+    const content = bytes.subarray(0, offset);
+    // No JSON.parse/decoded tree exists until its shape-based charge succeeds.
+    const releaseTree = scope.reserve(jsonAllocation(content));
+    return { bytes: content, releaseInput, releaseTree };
+  } catch (error) {
+    releaseInput?.();
+    throw error;
+  } finally {
+    await handle.close();
+  }
+}

src/execution-world/placement.ts

@@ -0,0 +1,367 @@
+import { parse } from "@babel/parser";
+import { builtinModules } from "node:module";
+import { ExecutionPlanError, hexDigest, type ExecutionPlan } from "./plan.js";
+import type { ExecutionInstallation } from "./installation.js";
+import type { ArtifactImplementation, ArtifactReader } from "./artifacts.js";
+
+export interface PlacementBlocker {
+  readonly code: string;
+  readonly path: readonly string[];
+  readonly detail: string;
+}
+export interface PlacementEntry {
+  readonly operation: string;
+  readonly effect: string;
+  readonly availableTargets: readonly string[];
+  readonly requiresVM: boolean;
+  readonly nativeBindings: readonly string[];
+  readonly cycles: readonly (readonly string[])[];
+  readonly blockers: readonly PlacementBlocker[];
+}
+export interface ImportFinding {
+  readonly code: string;
+  readonly detail: string;
+  readonly line: number | null;
+}
+export const restrictedSDKSpecifier = "quixos:restricted-sdk/v1";
+export const restrictedSDKPath = "share/quixos/restricted/core.mjs";
+
+/** Compare trusted SDK syntax without build-machine paths in source comments.
+ * Keep literal/directive spelling and every executable AST node. This is SDK
+ * compatibility only: artifact files and the executed host SDK still have exact
+ * byte digests, and authored SDK bytes are never loaded by the restricted host.
+ */
+export function restrictedSDKIdentity(source: string): string {
+  if (Buffer.byteLength(source) > 2 * 1024 * 1024) throw Error("RESTRICTED_SDK_ANALYSIS_LIMIT");
+  const syntax = parse(source, { sourceType: "module", attachComment: false });
+  const metadata = new Set([
+    "start",
+    "end",
+    "loc",
+    "comments",
+    "leadingComments",
+    "innerComments",
+    "trailingComments",
+    "parenStart",
+  ]);
+  let nodes = 0;
+  const encoded = JSON.stringify(syntax, (key, value) => {
+    if (metadata.has(key)) return undefined;
+    if (value && typeof value === "object" && typeof value.type === "string" && ++nodes > 100000)
+      throw Error("RESTRICTED_SDK_ANALYSIS_LIMIT");
+    return value;
+  });
+  return hexDigest({ codec: "quixos-restricted-sdk-syntax-v1", syntax: JSON.parse(encoded) });
+}
+
+/** Mechanical candidate checks, not authorization or an engine-safety proof.
+ * The caller must first verify the manifest and all declared file digests. */
+export async function inspectRestrictedImplementation(
+  revision: string,
+  implementation: ArtifactImplementation,
+  read: ArtifactReader,
+  qualifiedSDKIdentity?: string,
+): Promise<ImportFinding[]> {
+  const entry = implementation.files.find((file) => file.path === implementation.path);
+  const sdk = implementation.files.find((file) => file.path === restrictedSDKPath);
+  if (
+    implementation.compatibility !== "quixos-restricted-module-v1" ||
+    implementation.target !== "server" ||
+    implementation.files.length !== 2 ||
+    !entry ||
+    !sdk ||
+    entry === sdk ||
+    entry.mediaType !== "text/javascript" ||
+    sdk.mediaType !== "text/javascript" ||
+    !/^[$A-Z_a-z][$\w]*$/.test(implementation.registryExport ?? "")
+  )
+    return [{ code: "RESTRICTED_CLOSURE", detail: "Expected one closed module and the restricted SDK", line: null }];
+  if (entry.bytes > 1024 * 1024 || sdk.bytes > 2 * 1024 * 1024)
+    return [{ code: "ANALYSIS_LIMIT", detail: "Restricted closure exceeds the source budget", line: null }];
+  if (qualifiedSDKIdentity) {
+    const source = Buffer.from(await read(revision, sdk.path, sdk.bytes)).toString("utf8");
+    try {
+      if (restrictedSDKIdentity(source) !== qualifiedSDKIdentity) throw Error("SDK syntax differs");
+    } catch {
+      return [
+        { code: "RESTRICTED_SDK_UNSUPPORTED", detail: "SDK differs from the qualified host profile", line: null },
+      ];
+    }
+  }
+  return inspectJavaScriptSurface(Buffer.from(await read(revision, entry.path, entry.bytes)).toString("utf8"), [
+    restrictedSDKSpecifier,
+  ]);
+}
+const nativeImports = new Set(builtinModules.flatMap((name) => [name, name.replace(/^node:/, "")]));
+const ambient = new Set([
+  "process",
+  "global",
+  "globalThis",
+  "fetch",
+  "WebSocket",
+  "XMLHttpRequest",
+  "Deno",
+  "Bun",
+  "eval",
+  "Function",
+  "SharedArrayBuffer",
+  "Atomics",
+]);
+
+/** Diagnostic scan of compiled JavaScript, never a certificate of purity. A
+ * shadowed name can conservatively produce a finding; computed access/aliases
+ * cannot be proven safe here. No findings still require a qualified loader and
+ * runtime before this artifact can enter restricted execution. */
+export function inspectJavaScriptSurface(source: string, checkedSDKImports: readonly string[] = []): ImportFinding[] {
+  if (Buffer.byteLength(source) > 1024 * 1024)
+    return [{ code: "ANALYSIS_LIMIT", detail: "JavaScript exceeds the 1 MiB inspection budget", line: null }];
+  let ast;
+  try {
+    ast = parse(source, { sourceType: "module", createImportExpressions: true });
+  } catch {
+    return [
+      {
+        code: "UNCLASSIFIED_SYNTAX",
+        detail: "Compiled source cannot be classified by the selected parser",
+        line: null,
+      },
+    ];
+  }
+  const findings: ImportFinding[] = [],
+    seen = new Set<string>(),
+    sdk = new Set(checkedSDKImports);
+  const add = (code: string, detail: string, node: any) => {
+    const key = JSON.stringify([code, detail]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (findings.length < 63) findings.push({ code, detail, line: node?.loc?.start.line ?? null });
+  };
+  const imported = (node: any, at: any) => {
+    if (node?.type !== "StringLiteral") {
+      add("COMPUTED_MODULE_LOADING", "Module name is computed", at);
+      return;
+    }
+    const name: string = node.value;
+    if (sdk.has(name)) return;
+    add(
+      name.startsWith("node:") || nativeImports.has(name) ? "NATIVE_IMPORT" : "UNCLASSIFIED_IMPORT",
+      name.slice(0, 256),
+      at,
+    );
+  };
+  const pending: { node: any; parent?: any; key?: string }[] = [{ node: ast }];
+  let visited = 0;
+  while (pending.length) {
+    if (++visited > 100000) {
+      add("ANALYSIS_LIMIT", "JavaScript exceeds the syntax-node inspection budget", null);
+      break;
+    }
+    const { node, parent, key } = pending.pop()!;
+    if (!node || typeof node !== "object") continue;
+    if (["ImportDeclaration", "ExportAllDeclaration", "ExportNamedDeclaration"].includes(node.type) && node.source)
+      imported(node.source, node);
+    if (node.type === "ImportExpression") imported(node.source, node);
+    if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require")
+      imported(node.arguments[0], node);
+    const propertyName = key === "property" && parent?.type === "MemberExpression" && !parent.computed;
+    const recordKey =
+      key === "key" &&
+      ["ObjectProperty", "ObjectMethod"].includes(parent?.type) &&
+      !parent.computed &&
+      !parent.shorthand;
+    if (node.type === "Identifier" && ambient.has(node.name) && !propertyName && !recordKey)
+      add("AMBIENT_HOST_ACCESS", node.name, node);
+    if (
+      node.type === "MemberExpression" &&
+      node.object?.type === "Identifier" &&
+      node.object.name === "Math" &&
+      (node.computed || node.property?.name === "random")
+    )
+      add("AMBIENT_RANDOMNESS", "Use captured input or a frame-scoped seed", node);
+    if (
+      (node.type === "CallExpression" || node.type === "NewExpression") &&
+      node.callee?.type === "Identifier" &&
+      node.callee.name === "Date" &&
+      node.arguments.length === 0
+    )
+      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
+    if (
+      node.type === "MemberExpression" &&
+      node.object?.type === "Identifier" &&
+      node.object.name === "Date" &&
+      (node.computed || node.property?.name === "now")
+    )
+      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
+    for (const [childKey, child] of Object.entries(node)) {
+      if (["loc", "start", "end", "extra", "comments", "tokens"].includes(childKey)) continue;
+      if (Array.isArray(child)) {
+        for (const value of child)
+          if (value && typeof value === "object") pending.push({ node: value, parent: node, key: childKey });
+      } else if (child && typeof child === "object") pending.push({ node: child, parent: node, key: childKey });
+    }
+  }
+  if (seen.size > findings.length)
+    findings.push({ code: "ANALYSIS_LIMIT", detail: "Additional findings omitted", line: null });
+  return findings;
+}
+
+/** Derived metadata only. A build report can describe a closed candidate but
+ * cannot qualify the host's engine, SDK, OS sandbox or resource controller. */
+export async function reportExecutionPlacement(
+  plan: ExecutionPlan,
+  installation: ExecutionInstallation,
+  read: ArtifactReader,
+) {
+  if (installation.plan !== plan.digest || hexDigest(plan.definition) !== plan.digest)
+    throw new ExecutionPlanError(
+      "PLACEMENT_PLAN_MISMATCH",
+      plan.digest,
+      "Expected the selected checked plan and installation",
+    );
+  const operations = new Map(plan.definition.operations.map((entry) => [entry.key, entry]));
+  const queries = new Map(plan.definition.queries.map((entry) => [entry.id, entry]));
+  const packages = await Promise.all(
+    installation.packages.map(async (pkg) => {
+      const implementations: { id: string; digest: string; compatibility: string; findings: ImportFinding[] }[] = [];
+      for (const implementation of [pkg.service, pkg.module, pkg.restricted].filter(
+        (entry): entry is ArtifactImplementation => !!entry,
+      )) {
+        let findings: ImportFinding[];
+        if (implementation.compatibility === "quixos-restricted-module-v1")
+          findings = await inspectRestrictedImplementation(pkg.revision, implementation, read);
+        else if (implementation.compatibility === "quixos-js-module-v1") {
+          const file = implementation.files.find((file) => file.path === implementation.path)!;
+          if (!file || file.bytes > 1024 * 1024)
+            findings = [
+              { code: "ANALYSIS_LIMIT", detail: "Entry source unavailable within the inspection budget", line: null },
+            ];
+          else {
+            const sdk = implementation.files.filter((file) => file.path.endsWith("/core.mjs"));
+            const allowed = sdk.flatMap((file) => [
+              `${pkg.root}/${file.path}`,
+              `/__quixos/artifacts/content/${file.digest}/core.mjs`,
+            ]);
+            findings = inspectJavaScriptSurface(
+              Buffer.from(await read(pkg.revision, file.path, file.bytes)).toString("utf8"),
+              allowed,
+            );
+          }
+        } else
+          findings = [
+            { code: "NATIVE_SERVICE", detail: "Native/persistent service stays in VM execution", line: null },
+          ];
+        implementations.push({
+          id: implementation.id,
+          digest: implementation.contentDigest,
+          compatibility: implementation.compatibility,
+          findings,
+        });
+      }
+      return {
+        revision: pkg.revision,
+        requiresVM: implementations.length > 0,
+        restrictedEligible: false as const,
+        reason: pkg.restricted ? "HOST_PROFILE_QUALIFICATION_REQUIRED" : "NO_RESTRICTED_IMPLEMENTATION",
+        restrictedCandidate: pkg.restricted
+          ? {
+              digest: pkg.restricted.contentDigest,
+              exports: pkg.restricted.exports,
+              compatible: implementations.find((entry) => entry.id === pkg.restricted!.id)!.findings.length === 0,
+            }
+          : null,
+        implementations,
+      };
+    }),
+  );
+  const entries: PlacementEntry[] = plan.definition.operations.map((root) => {
+    const native = new Set<string>(),
+      visited = new Set<string>(),
+      cycles: string[][] = [],
+      blockers: PlacementBlocker[] = [];
+    const pending = [{ key: root.key, path: [root.key] }];
+    let limited = false;
+    const block = (code: string, path: string[], detail: string) => {
+      if (blockers.length < 63) blockers.push({ code, path, detail });
+      else limited = true;
+    };
+    while (pending.length) {
+      if (visited.size >= 512) {
+        limited = true;
+        break;
+      }
+      const { key, path } = pending.pop()!;
+      const repeated = path.slice(0, -1).indexOf(key);
+      if (repeated >= 0) {
+        if (cycles.length < 16) cycles.push(path.slice(repeated));
+        else limited = true;
+        continue;
+      }
+      if (visited.has(key)) continue;
+      if (path.length > 128) {
+        limited = true;
+        continue;
+      }
+      visited.add(key);
+      const node = operations.get(key);
+      if (!node) {
+        block("UNCLASSIFIED_DEPENDENCY", path, "Operation is absent from the checked closure");
+        continue;
+      }
+      if (node.execution.kind === "remote")
+        block("REMOTE_EFFECT", path, "Remote effects require VM or separately approved effect authority");
+      if (node.binding.kind === "package")
+        block(
+          "UNQUALIFIED_PACKAGE",
+          path,
+          `${node.binding.packageRevisionId}/${node.binding.exportId}: no qualified restricted implementation`,
+        );
+      else if (["state", "edge", "journal", "subscription", "lifecycle"].includes(node.binding.kind))
+        native.add(node.binding.kind);
+      else block("UNCLASSIFIED_NATIVE", path, node.binding.kind);
+      for (const dependency of node.dependencies) {
+        if (dependency.kind === "operation")
+          pending.push({ key: dependency.operation, path: [...path, dependency.port, dependency.operation] });
+        if (dependency.kind === "query") {
+          const query = queries.get(dependency.query);
+          if (!query) block("UNCLASSIFIED_QUERY", [...path, dependency.port], dependency.query);
+          else
+            for (const operation of new Set([...query.operations, ...query.admittedOperations]))
+              pending.push({ key: operation, path: [...path, dependency.port, dependency.query, operation] });
+        }
+      }
+    }
+    if (limited)
+      blockers.push({
+        code: "ANALYSIS_LIMIT",
+        path: [root.key],
+        detail: "Dependency closure exceeds the bounded report; keep VM placement",
+      });
+    return {
+      operation: root.key,
+      effect: root.execution.kind,
+      availableTargets: [...root.availableTargets],
+      requiresVM: blockers.length > 0,
+      nativeBindings: [...native].sort(),
+      cycles,
+      blockers,
+    };
+  });
+  const background = plan.definition.packages.flatMap((pkg) =>
+    (pkg.controllers ?? []).map((controller) => ({
+      package: pkg.revision,
+      id: controller.id,
+      requiresVM: true,
+      reason: "PERSISTENT_CONTROLLER_EXECUTION",
+    })),
+  );
+  return {
+    codec: "quixos-execution-placement-v1" as const,
+    workspace: plan.definition.workspace.workspaceId,
+    plan: plan.digest,
+    requiresVM:
+      packages.some((pkg) => pkg.requiresVM) || entries.some((entry) => entry.requiresVM) || background.length > 0,
+    operations: entries,
+    packages,
+    background,
+  };
+}

src/execution-world/ports.ts

@@ -29,6 +29,8 @@ export interface PackageInvocation {
   /** Capability arguments/receiver use the versioned managed-reference codec. */
   input: unknown;
   receiver: unknown | null;
+  /** Host-owned remaining root resources, separate from authored input. */
+  budget?: { root: string; depth: number; calls: number; deadlineMs: number };
 }
 export type InvocationReply =
   | { abi: typeof transactionPortAbi; invocation: string; status: "returned"; output: unknown }

test/candidate-metadata.test.ts

@@ -0,0 +1,160 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, writeFile, symlink, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { CandidateMetadataBudget, readCandidateMetadata } from "../src/execution-world/metadata.js";
+import { loadCheckedInstallationCandidate } from "../src/execution-world/candidate.js";
+
+test(
+  "a real checked application can stage its replacement within the default metadata budget",
+  {
+    skip: !process.env.QX_CHECKED_CANDIDATE,
+  },
+  async () => {
+    const root = process.env.QX_CHECKED_CANDIDATE!;
+    const budget = new CandidateMetadataBudget();
+    const first = await loadCheckedInstallationCandidate(root, {}, { budget, owner: "reader" });
+    try {
+      const retained = budget.snapshot().bytes;
+      const second = await loadCheckedInstallationCandidate(root, {}, { budget, owner: "reader" });
+      try {
+        assert.equal(budget.snapshot().bytes, retained * 2);
+        assert.deepEqual(second.reference, first.reference, "Compaction preserves exact checked identity");
+        assert.equal(second.graphExecution.kernel, second.kernel, "Graph representation shares the validated program");
+        assert.equal(second.graphExecution.queries, second.queries);
+        // A deliberately tighter pool admits the serving installation but must
+        // reject replacement parsing without leaking a candidate or tree lease.
+        const tight = new CandidateMetadataBudget({
+          bytes: retained + 1,
+          ownerBytes: retained + 1,
+          candidates: 2,
+        });
+        const blocker = tight.acquire("reader");
+        blocker.charge(retained);
+        try {
+          await assert.rejects(
+            loadCheckedInstallationCandidate(root, {}, { budget: tight, owner: "reader" }),
+            /CANDIDATE_METADATA_LIMIT/,
+          );
+          assert.equal(tight.snapshot().bytes, retained);
+          assert.equal(tight.snapshot().candidates, 1);
+        } finally {
+          blocker.release();
+        }
+        const other = budget.acquire("other");
+        try {
+          assert.throws(() => other.charge(budget.limits.bytes), /CANDIDATE_METADATA_LIMIT/);
+          assert.equal(budget.snapshot().bytes, retained * 2, "Rejected admission must not leak charges");
+        } finally {
+          other.release();
+        }
+      } finally {
+        second.metadata.release();
+      }
+      assert.equal(budget.snapshot().bytes, retained, "The serving candidate survives failed or completed staging");
+    } finally {
+      first.metadata.release();
+    }
+    assert.equal(budget.snapshot().bytes, 0);
+    assert.equal(budget.snapshot().candidates, 0);
+  },
+);
+
+test("concurrent candidate reservations enforce aggregate and owner limits and release exactly once", () => {
+  const budget = new CandidateMetadataBudget({ bytes: 1000, ownerBytes: 600, candidates: 3 });
+  const first = budget.acquire("a"),
+    second = budget.acquire("a"),
+    third = budget.acquire("b");
+  assert.throws(() => budget.acquire("c"), /CANDIDATE_METADATA_LIMIT/);
+  first.charge(400);
+  second.charge(200);
+  third.charge(400);
+  assert.throws(() => second.charge(1), /CANDIDATE_METADATA_LIMIT/);
+  assert.throws(() => third.charge(1), /CANDIDATE_METADATA_LIMIT/);
+  assert.equal(budget.snapshot().bytes, 1000);
+  second.release();
+  second.release();
+  assert.equal(budget.snapshot().bytes, 800);
+  assert.throws(() => second.charge(1), /CANDIDATE_METADATA_CLOSED/);
+  first.release();
+  third.release();
+  assert.deepEqual(budget.snapshot(), { bytes: 0, candidates: 0, owners: 0, limits: budget.limits });
+});
+
+test("metadata files reserve parse/index space before allocation and refuse oversized or linked inputs", async () => {
+  const root = await mkdtemp(join(tmpdir(), "qx-metadata-budget-"));
+  const budget = new CandidateMetadataBudget({ bytes: 450, ownerBytes: 450, candidates: 2 });
+  const scope = budget.acquire("workspace");
+  try {
+    const file = join(root, "metadata.json");
+    await writeFile(file, '{"ok":true}');
+    const input = await readCandidateMetadata(file, scope, 100);
+    assert.equal(new TextDecoder().decode(input.bytes), '{"ok":true}');
+    const withInput = scope.bytes;
+    input.releaseInput();
+    input.releaseInput();
+    const first = scope.bytes;
+    assert.equal(withInput - first, (Buffer.byteLength('{"ok":true}') + 1) * 3);
+    assert.ok(first > 12 * 3, "Decoded tree and derived metadata are reserved before parsing");
+    await assert.rejects(readCandidateMetadata(file, scope, 100), /CANDIDATE_METADATA_LIMIT/);
+    assert.equal(scope.bytes, first, "Rejected tree allocation releases its transient input buffer");
+    await assert.rejects(readCandidateMetadata(file, scope, 5), /CANDIDATE_METADATA_FILE_LIMIT/);
+    await symlink(file, join(root, "linked"));
+    await assert.rejects(readCandidateMetadata(join(root, "linked"), scope, 100), { code: "ELOOP" });
+    await assert.rejects(readCandidateMetadata(root, scope, 100), /CANDIDATE_METADATA_FILE_LIMIT/);
+    assert.equal(scope.bytes, first);
+    input.releaseTree();
+    input.releaseTree();
+    assert.equal(scope.bytes, 0, "Discarded validation trees can release independently of the candidate");
+  } finally {
+    scope.release();
+    await rm(root, { recursive: true, force: true });
+  }
+  assert.equal(budget.snapshot().bytes, 0);
+});
+
+test("JSON structure accounting is independent of indentation and covers strings, values and dense nodes", async () => {
+  const root = await mkdtemp(join(tmpdir(), "qx-metadata-shape-"));
+  const budget = new CandidateMetadataBudget();
+  try {
+    for (const value of [{}, [null, true, false, 1, -3.5e8], { 'a"b': '雪\\"', nodes: [{}, {}, {}] }]) {
+      const measured = [];
+      for (const spaces of [0, 4]) {
+        const file = join(root, "metadata.json"),
+          text = JSON.stringify(value, null, spaces);
+        await writeFile(file, text);
+        const scope = budget.acquire("test");
+        try {
+          const input = await readCandidateMetadata(file, scope, 10000);
+          assert.deepEqual(JSON.parse(new TextDecoder().decode(input.bytes)), value);
+          input.releaseInput();
+          measured.push(scope.bytes);
+        } finally {
+          scope.release();
+        }
+      }
+      assert.equal(measured[0], measured[1], "Whitespace changes input storage, not the allocated JSON shape");
+      assert.ok(measured[0] >= 128);
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+  assert.equal(budget.snapshot().bytes, 0);
+});
+
+test("transient leases release exactly once, including after their parent closes", () => {
+  const budget = new CandidateMetadataBudget({ bytes: 1000, ownerBytes: 600, candidates: 3 });
+  const scope = budget.acquire("a");
+  scope.charge(200);
+  const release = scope.reserve(300);
+  assert.throws(() => scope.reserve(101), /CANDIDATE_METADATA_LIMIT/);
+  release();
+  release();
+  assert.equal(scope.bytes, 200);
+  const afterClose = scope.reserve(100);
+  scope.release();
+  afterClose();
+  assert.equal(scope.bytes, 0);
+  assert.equal(budget.snapshot().bytes, 0);
+});

test/capability-model.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { test } from "node:test";
 import {
   compileWorkspaceRevision,
+  capabilityId,
   computeCapabilityClosure,
   resolveOperationPlan,
   validateWorkspaceRevision,
@@ -197,6 +198,62 @@ test("public traversal permits a native inverse read without exporting mutation
   expectIssue(workspace, "private-attachment-access");
 });
 
+test("public traversal exports only the selected read-only package edge port", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const exportDefinition = workspace.packageImports
+    .flatMap((pkg) => pkg.exports)
+    .find((entry) => entry.id === fixtureId.summaryGetExport)!;
+  const port = {
+    id: capabilityId.dependencyPort("port:summary:owner"),
+    displayName: "owner",
+    requirement: {
+      kind: "edge" as const,
+      target: { kind: "interface" as const, interfaceRevisionId: fixtureId.namedV1 },
+      cardinality: "exactly-one" as const,
+      primitives: ["resolve" as const],
+    },
+  };
+  exportDefinition.dependencyPorts.push(port);
+  const binding = conformance(workspace, fixtureId.projectSummaryConformance).operationBindings[0].binding;
+  assert.ok(binding.kind === "package");
+  binding.dependencies.push({
+    portId: port.id,
+    binding: {
+      kind: "edge",
+      edgeTypeId: fixtureId.projectOwner,
+      projectionId: fixtureId.projectOwnerProjection,
+    },
+  });
+  const edge = conformance(workspace, fixtureId.projectOwnedConformance).privateAttachments.find(
+    (entry) => entry.id === fixtureId.projectOwner,
+  );
+  assert.ok(edge?.kind === "edge");
+  const endpoint = edge.endpoints.find((entry) => entry.projectionId === fixtureId.projectOwnerProjection)!;
+  expectIssue(workspace, "private-attachment-access");
+
+  // Publicity of the opposite projection does not grant this receiver access.
+  edge.endpoints.find((entry) => entry !== endpoint)!.publicTraversal = true;
+  expectIssue(workspace, "private-attachment-access");
+  endpoint.publicTraversal = true;
+  assert.deepEqual(validateWorkspaceRevision(workspace), []);
+  const compiled = compileWorkspaceRevision(workspace);
+  assert.ok(compiled.ok);
+  const plan = resolveOperationPlan(compiled.plan, fixtureId.project, fixtureId.summaryV1, fixtureId.summaryGet);
+  assert.ok(plan?.kind === "package");
+  assert.deepEqual(plan.dependencies.find((entry) => entry.port.id === port.id)?.port.requirement, port.requirement);
+
+  for (const primitive of ["connect", "disconnect", "watch-start", "watch-stop"] as const) {
+    const mutated = structuredClone(workspace);
+    const requirement = mutated.packageImports
+      .flatMap((pkg) => pkg.exports)
+      .find((entry) => entry.id === fixtureId.summaryGetExport)!
+      .dependencyPorts.find((entry) => entry.id === port.id)!.requirement;
+    assert.ok(requirement.kind === "edge");
+    requirement.primitives.push(primitive);
+    expectIssue(mutated, "private-attachment-access");
+  }
+});
+
 test("native state and edge providers must match operation shape", () => {
   const stateWorkspace = makeValidCapabilityWorkspace();
   const state = conformance(stateWorkspace, fixtureId.projectNamedConformance).operationBindings[0]!.binding;

test/emit-controllers.ts

@@ -3,6 +3,8 @@ import { readFile, mkdir, writeFile } from "node:fs/promises";
 import { compileCapabilityResourceSource, compileCapabilitySource } from "../src/capability-language/index.js";
 import { compileQuery } from "../src/query/compile.js";
 import { parseControllerCatalog } from "../src/capability-model/controllers.js";
+import { presentationDeclarations, preparationArtifact } from "../src/react-build/declarations.js";
+import { compileQueryComposition } from "../src/query/composition.js";
 import {
   compileExecutionPlan,
   generateInterfaceClientBindings,
@@ -59,6 +61,15 @@ const viewerPackage = viewer.resource.revision;
 viewerPackage.checkedQueries = await Promise.all(
   viewerPackage.queries!.map((query) => compileQuery(query, [iface], read)),
 );
+const preparation = presentationDeclarations(
+  await read("quixos.react.json"),
+  viewerPackage,
+  environment.interfaceClosure,
+);
+viewerPackage.buildArtifacts = { [preparationArtifact]: preparation.artifact };
+viewerPackage.queryCompositions = preparation.compositions.map((entry) =>
+  compileQueryComposition(entry, new Map(viewerPackage.checkedQueries!.map((query) => [query.declaration.id, query]))),
+);
 for (const variant of ["controller", "controller-next"]) {
   const extra = variant.endsWith("next")
     ? 'atom Dashboard id "dashboard"; import package DeviceViewer; presentation DeviceStatus id "device:status" for Device using DeviceViewer.Status;'

test/fixtures/controller-device/quixos.react.json

@@ -0,0 +1,14 @@
+{
+  "modules": {
+    "Status": {
+      "inputs": [
+        {
+          "name": "view",
+          "query": "View",
+          "root": { "from": "input", "path": ["subject"] },
+          "arguments": { "record": {} }
+        }
+      ]
+    }
+  }
+}

test/pin-upgrades.test.ts

@@ -5,9 +5,90 @@ import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { execFile as callback } from "node:child_process";
-import { planPinUpgrades, applyPinUpgrades, type UpgradeEffects } from "../src/capability-language/pin-upgrades.js";
+import {
+  planPinUpgrades,
+  applyPinUpgrades,
+  discoverUpgradeSpec,
+  reviewUpgradeCandidate,
+  type UpgradeEffects,
+} from "../src/capability-language/pin-upgrades.js";
+import { capabilityId } from "../src/capability-model/index.js";
+import { makeValidCapabilityWorkspace } from "./fixtures/capability-model.js";
 const execFile = promisify(callback);
 
+test("execution pin upgrades accept unchanged shared attachments without legacy migration planning", async (context) => {
+  const artifact = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-execution-review-"));
+  context.after(() => fs.rm(artifact, { recursive: true, force: true }));
+  await fs.writeFile(path.join(artifact, "execution-plan.json"), "{}");
+  const baseline = makeValidCapabilityWorkspace();
+  assert.ok(baseline.sharedAttachments.length);
+  const candidate = structuredClone(baseline);
+  candidate.sourceRootCommit = "f".repeat(40);
+  const { filename, review } = await reviewUpgradeCandidate({ artifact, baseline, candidate });
+  assert.equal(filename, "semantic-review.json");
+  assert.equal(review.checkerVersion, "quixos-semantic-review-v1");
+  assert.deepEqual(review.blockers, []);
+  assert.equal("migrationRequired" in review, false);
+  assert.equal("runtimeActions" in review, false);
+});
+
+test("execution pin upgrades require exact semantic-major receipts and reject foreign workspaces", async (context) => {
+  const artifact = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-semantic-review-"));
+  context.after(() => fs.rm(artifact, { recursive: true, force: true }));
+  await fs.writeFile(path.join(artifact, "execution-plan.json"), "{}");
+  const baseline = makeValidCapabilityWorkspace();
+  baseline.conformances[0]!.id = capabilityId.conformance("conformance:project:named");
+  const candidate = structuredClone(baseline);
+  candidate.conformances[0]!.semanticMajor = 2;
+  const { review } = await reviewUpgradeCandidate({ artifact, baseline, candidate });
+  assert.equal(review.reviews.length, 1);
+  assert.equal(review.reviews[0]!.accepted, false);
+  assert.match(review.blockers[0]!, /Semantic-major review required/);
+  const receipt = {
+    requirementDigest: review.reviews[0]!.requirementDigest,
+    decision: "accepted-unchanged" as const,
+    rationale: "Reviewed the consumer against the provider's unchanged label behavior",
+    agentId: "upgrade-fixture-agent",
+  };
+  assert.deepEqual(
+    (await reviewUpgradeCandidate({ artifact, baseline, candidate, reviews: [receipt] })).review.blockers,
+    [],
+  );
+  candidate.packageImports[0]!.source.commit = "f".repeat(40);
+  assert.equal(
+    (await reviewUpgradeCandidate({ artifact, baseline, candidate, reviews: [receipt] })).review.reviews[0]!.accepted,
+    false,
+  );
+  candidate.workspaceId = capabilityId.workspace("workspace:foreign");
+  await assert.rejects(() => reviewUpgradeCandidate({ artifact, baseline, candidate }), /different workspace/);
+});
+
+test("nonexecution pin upgrades retain their evolution checks", async (context) => {
+  const artifact = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-evolution-review-"));
+  context.after(() => fs.rm(artifact, { recursive: true, force: true }));
+  const baseline = makeValidCapabilityWorkspace();
+  const { filename, review } = await reviewUpgradeCandidate({
+    artifact,
+    baseline,
+    candidate: structuredClone(baseline),
+  });
+  assert.equal(filename, "evolution.json");
+  assert.equal(review.checkerVersion, "quixos-evolution-v1");
+  assert.ok(review.blockers.some((message) => message.includes("legacy workspace-shared attachments")));
+  assert.equal("migrationRequired" in review, true);
+});
+
+test("unexpected artifact access failures do not select nonexecution checks", async (context) => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-review-failure-"));
+  context.after(() => fs.rm(directory, { recursive: true, force: true }));
+  const artifact = path.join(directory, "not-a-directory");
+  await fs.writeFile(artifact, "not an artifact");
+  const candidate = makeValidCapabilityWorkspace();
+  await assert.rejects(() => reviewUpgradeCandidate({ artifact, baseline: candidate, candidate }), {
+    code: "ENOTDIR",
+  });
+});
+
 test(
   "real jj snapshots and immutable Git publication propagate a changed interface into the root",
   { skip: !process.env.QX_CHECK_GENERATOR },
@@ -73,6 +154,21 @@ test(
       await run(workbench, "git", ["--git-dir", path.join(workbench, "remotes/named.git"), "show-ref"]),
       new RegExp(commit),
     );
+    assert.equal(graph.resources[0].directory, "resources/Named");
+    assert.equal(graph.directResources[0].directory, "resources/Named");
+    // A retained workbench can move without keeping its original absolute path
+    // alive. Recovery journals remain bound to their original writer/root.
+    const relocated = `${workbench}-relocated`;
+    context.after(() => fs.rm(relocated, { recursive: true, force: true }));
+    await fs.cp(workbench, relocated, { recursive: true });
+    const discovered = await discoverUpgradeSpec(relocated);
+    assert.equal(discovered.nodes[1]!.directory, "resources/Named");
+    const relocatedPlan = await planPinUpgrades(relocated, { ...discovered, bootstrap: true });
+    assert.equal(relocatedPlan.workbench, relocated);
+    assert.deepEqual(
+      relocatedPlan.nodes.map((node) => node.directory),
+      ["resources/Named", "root"],
+    );
   },
 );
 

test/placement.test.ts

@@ -0,0 +1,168 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { loadReaderWorkspace } from "./reader-fixture.js";
+import { buildArtifactFixture } from "./artifact-fixture.js";
+import {
+  compileExecutionPlan,
+  hexDigest,
+  inspectJavaScriptSurface,
+  inspectRestrictedImplementation,
+  restrictedSDKIdentity,
+  restrictedSDKPath,
+  type ArtifactImplementation,
+  reportExecutionPlacement,
+  type ExecutionInstallation,
+} from "../src/execution-world/index.js";
+
+test("restricted SDK identity ignores build comments and positions, preserving executable syntax", () => {
+  const source = 'export function value() { return ("hello"); }';
+  const x86 = "// /nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-core/dist/portable.js\n" + source;
+  const arm = "// /nix/store/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-core/dist/portable.js\n\n" + source;
+  assert.equal(restrictedSDKIdentity(x86), restrictedSDKIdentity(arm));
+  for (const changed of [
+    'export function value() { return ("goodbye"); }',
+    'export function value() { return\n("hello"); }',
+    'export function value() { fetch("hello"); }',
+    'import x from "node:fs"; ' + source,
+    'export function value() { return "/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-core"; }',
+  ])
+    assert.notEqual(restrictedSDKIdentity(source), restrictedSDKIdentity(changed));
+  assert.notEqual(restrictedSDKIdentity('"use strict";'), restrictedSDKIdentity('"use\\x20strict";'));
+  assert.notEqual(restrictedSDKIdentity('const value="// comment";'), restrictedSDKIdentity('const value="";'));
+  assert.throws(() => restrictedSDKIdentity("const ???"));
+  assert.throws(() => restrictedSDKIdentity(" ".repeat(2 * 1024 * 1024 + 1)), /ANALYSIS_LIMIT/);
+});
+
+test("restricted admission accepts the same SDK syntax and rejects changed SDK behavior", async () => {
+  const source = "export const registry = {};";
+  const sdk = 'export const value = "trusted";';
+  const implementation: ArtifactImplementation = {
+    id: "restricted",
+    target: "server",
+    compatibility: "quixos-restricted-module-v1",
+    path: "module.mjs",
+    ports: "quixos-transaction-ports-v1",
+    registryExport: "registry",
+    exports: ["value"],
+    contentDigest: "a".repeat(64),
+    files: [
+      { path: "module.mjs", digest: "b".repeat(64), bytes: source.length, mediaType: "text/javascript" },
+      { path: restrictedSDKPath, digest: "c".repeat(64), bytes: sdk.length, mediaType: "text/javascript" },
+    ],
+  };
+  const check = (candidateSDK: string) => {
+    implementation.files[1]!.bytes = Buffer.byteLength(candidateSDK);
+    return inspectRestrictedImplementation(
+      "package:test@1",
+      implementation,
+      async (_revision, path) => Buffer.from(path === restrictedSDKPath ? candidateSDK : source),
+      restrictedSDKIdentity(sdk),
+    );
+  };
+  assert.deepEqual(await check("// a different build path\n" + sdk), []);
+  assert.equal((await check('export const value = "untrusted";'))[0]?.code, "RESTRICTED_SDK_UNSUPPORTED");
+  assert.equal((await check("export const ???"))[0]?.code, "RESTRICTED_SDK_UNSUPPORTED");
+});
+
+test("compiled-source inspection finds authority imports and ambient facilities without executing code", () => {
+  const surface = inspectJavaScriptSurface(
+    `
+    import sdk from "/checked/core.mjs";
+    export * from "node:fs";
+    import path from "path";
+    import unknown from "./another.mjs";
+    const load = () => import(moduleName);
+    const req = () => require("node:net");
+    const n = Math.random(); const t = Date.now(); const next = new Date();
+    const call = () => fetch("https://example.test/");
+    const globalValue = globalThis["hidden"];
+    throw Error("INSPECTION_MUST_NOT_EXECUTE");
+  `,
+    ["/checked/core.mjs"],
+  );
+  assert.equal(
+    surface.some((f) => f.detail === "/checked/core.mjs"),
+    false,
+  );
+  for (const name of ["node:fs", "path", "node:net"])
+    assert.ok(surface.some((f) => f.code === "NATIVE_IMPORT" && f.detail === name));
+  for (const code of [
+    "UNCLASSIFIED_IMPORT",
+    "COMPUTED_MODULE_LOADING",
+    "AMBIENT_CLOCK",
+    "AMBIENT_RANDOMNESS",
+    "AMBIENT_HOST_ACCESS",
+  ])
+    assert.ok(
+      surface.some((f) => f.code === code),
+      code,
+    );
+  assert.ok(surface.some((f) => f.detail === "fetch"));
+  assert.ok(surface.some((f) => f.detail === "globalThis"));
+  assert.ok(surface.every((f) => typeof f.line === "number"));
+  assert.deepEqual(
+    inspectJavaScriptSurface(
+      'const d = new Date("2026-01-01"); const properties = { fetch: 1 }; properties.fetch; Math.floor(3.1);',
+    ),
+    [],
+  );
+  assert.equal(inspectJavaScriptSurface("const ???")[0]!.code, "UNCLASSIFIED_SYNTAX");
+  assert.equal(inspectJavaScriptSurface(" ".repeat(1024 * 1024 + 1))[0]!.code, "ANALYSIS_LIMIT");
+  const many = Array.from({ length: 100 }, (_, i) => `import x${i} from "unknown-${i}";`).join("\n");
+  const bounded = inspectJavaScriptSurface(many);
+  assert.equal(bounded.length, 64);
+  assert.equal(bounded.at(-1)!.code, "ANALYSIS_LIMIT");
+});
+
+const fixture = async () => {
+  const plan = compileExecutionPlan(await loadReaderWorkspace());
+  const artifacts = plan.definition.packages.map((pkg) => buildArtifactFixture(plan, pkg.revision));
+  const installation: ExecutionInstallation = {
+    codec: "camino-execution-installation-v1",
+    plan: plan.digest,
+    world: "a".repeat(64),
+    routes: {},
+    components: [],
+    packages: artifacts.map((f) => ({
+      revision: f.manifest.packageRevisionId,
+      root: "/fixture",
+      service: f.manifest.implementations[0]!,
+      module: f.manifest.implementations[1]!,
+    })),
+  };
+  return { plan, installation, read: artifacts[0]!.read };
+};
+
+test("placement separates native bindings, target portability, package eligibility and transitive blockers", async () => {
+  const { plan, installation, read } = await fixture();
+  const report = await reportExecutionPlacement(plan, installation, read);
+  const native = plan.definition.operations.find((op) => op.binding.kind === "state")!;
+  assert.equal(report.operations.find((op) => op.operation === native.key)!.requiresVM, false);
+  const consumer = plan.definition.operations.find(
+    (op) => op.binding.kind === "package" && op.dependencies.some((dep) => dep.kind === "operation"),
+  )!;
+  const before = structuredClone(consumer);
+  const entry = report.operations.find((op) => op.operation === consumer.key)!;
+  assert.equal(entry.requiresVM, true);
+  assert.deepEqual(entry.availableTargets, consumer.availableTargets);
+  assert.ok(entry.blockers.some((blocker) => blocker.code === "UNQUALIFIED_PACKAGE"));
+  assert.ok(entry.nativeBindings.includes("state"));
+  assert.ok(report.packages.every((pkg) => pkg.restrictedEligible === false));
+  assert.deepEqual(consumer, before, "Analysis cannot alter public contracts or placement");
+
+  // Add a dependency that disqualifies the consumer while preserving its interface.
+  const target = plan.definition.operations.find((op) => op.key !== consumer.key && op.binding.kind === "package")!;
+  consumer.dependencies.push({ kind: "operation", port: "unsafe-provider", operation: target.key });
+  target.execution = { kind: "remote" };
+  target.dependencies.push({ kind: "operation", port: "return-to-caller", operation: consumer.key });
+  plan.digest = hexDigest(plan.definition);
+  const after = await reportExecutionPlacement(plan, { ...installation, plan: plan.digest }, read);
+  const changed = after.operations.find((op) => op.operation === consumer.key)!;
+  assert.ok(
+    changed.blockers.some((blocker) => blocker.code === "REMOTE_EFFECT" && blocker.path.includes("unsafe-provider")),
+  );
+  assert.ok(changed.cycles.some((cycle) => cycle[0] === consumer.key && cycle.at(-1) === consumer.key));
+  assert.deepEqual(consumer.input, before.input);
+  assert.deepEqual(consumer.output, before.output);
+  await assert.rejects(reportExecutionPlacement(plan, installation, read), { code: "PLACEMENT_PLAN_MISMATCH" });
+});

test/presentations.test.ts

@@ -19,12 +19,16 @@ import {
   expectedArtifactReceipt,
   checkExecutionInstallation,
   clientContractCatalog,
+  createClientContractCatalog,
+  CandidateMetadataBudget,
+  compileKernelProgram,
   type ComponentArtifact,
   type PackageArtifacts,
 } from "../src/execution-world/index.js";
 import { validateWorkspaceRevision } from "../src/capability-model/index.js";
 import { presentationDeclarations, preparationArtifact } from "../src/react-build/declarations.js";
 import { compileQueryComposition } from "../src/query/composition.js";
+import type { InspectionKernel } from "../src/execution-world/inspection.js";
 
 const source = { repository: "https://example.test/components.git", commit: "a".repeat(40) };
 const contract = (name: string) => {
@@ -255,6 +259,56 @@ test("checked component-only artifacts install without a service and reject miss
       () => clientContractCatalog(plan, { ...installation, plan: "bad" }, [pkg.revision]),
       /CATALOG_PLAN_MISMATCH/,
     );
+    const budget = new CandidateMetadataBudget();
+    const scope = budget.acquire("catalog-test");
+    const prepared = createClientContractCatalog(
+      plan,
+      installation,
+      scope,
+      compileKernelProgram(plan) as InspectionKernel,
+    );
+    try {
+      assert.throws(() => prepared.select(["absent"]), /UNINSTALLED_PACKAGE/);
+      assert.equal(scope.bytes, 0, "Unknown requests do not allocate compiler metadata");
+      assert.deepEqual(prepared.select([pkg.revision]), catalog);
+      const retained = scope.bytes;
+      assert.ok(retained > 0);
+      assert.ok(retained < 32 * 1024 * 1024, "Small catalogs retain a proportional metadata charge");
+      const full = prepared.select([pkg.revision]);
+      const empty = prepared.select([]);
+      assert.deepEqual(empty.components, []);
+      assert.deepEqual(empty.presentations, []);
+      assert.deepEqual(empty.moduleBindings, []);
+      assert.equal(empty.operations, full.operations, "Shared compiled metadata is reused");
+      assert.equal(Object.isFrozen(full.operations), true);
+      // Any plan access now would reveal a repeated digest/compile on the warm path.
+      const definition = plan.definition;
+      Object.defineProperty(plan, "definition", {
+        configurable: true,
+        get() {
+          throw Error("RECOMPILED_PLAN");
+        },
+      });
+      try {
+        assert.deepEqual(prepared.select([pkg.revision]), full);
+        assert.equal(scope.bytes, retained, "Package projections do not accumulate cache entries");
+      } finally {
+        Object.defineProperty(plan, "definition", { configurable: true, value: definition });
+      }
+      prepared.close();
+      assert.equal(scope.bytes, 0);
+      assert.throws(() => prepared.select([pkg.revision]), /CANDIDATE_METADATA_CLOSED/);
+    } finally {
+      prepared.close();
+      scope.release();
+    }
+    const tight = new CandidateMetadataBudget({ bytes: 1000, ownerBytes: 1000, candidates: 1 });
+    const tightScope = tight.acquire("catalog-test");
+    const refused = createClientContractCatalog(plan, installation, tightScope);
+    assert.throws(() => refused.select([pkg.revision]), /CANDIDATE_METADATA_LIMIT/);
+    assert.equal(tightScope.bytes, 0);
+    refused.close();
+    tightScope.release();
   } finally {
     await rm(root, { recursive: true, force: true });
   }

test/structural-plan.test.ts

@@ -13,6 +13,37 @@ import {
 } from "../src/capability-language/structural-plan.js";
 const execFile = promisify(callback);
 
+test("package structural validation does not require source-generated bindings", async (context) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "qx-structural-package-test-"));
+  context.after(() => fs.rm(root, { recursive: true, force: true }));
+  await execFile("git", ["-C", root, "init"]);
+  await fs.writeFile(path.join(root, ".gitignore"), ".quixos/\n");
+  await fs.writeFile(
+    path.join(root, "quixos.lock"),
+    `quixos-lock version 1 { quixos source { repository "https://example.test/quixos.git"; commit "${"a".repeat(40)}"; } }`,
+  );
+  const before = 'package Test id "package:test" revision "package:test@1" {}';
+  await fs.writeFile(path.join(root, "package.qx"), before);
+  const request: StructuralRequest = {
+    kind: "package",
+    source: { repository: "https://example.test/package.git", commit: "b".repeat(40) },
+    files: [{ file: "package.qx", expected: before, replace: `${before}\n// updated` }],
+  };
+  const plan = await planStructure(root, request);
+  assert.deepEqual(
+    plan.changes.map((change) => change.file),
+    ["package.qx"],
+  );
+  assert.equal(plan.validation, "resource-graph");
+  await fs.writeFile(path.join(root, "quixos.check.json"), "not valid json");
+  await assert.rejects(() => planStructure(root, request), SyntaxError);
+  await fs.writeFile(path.join(root, "quixos.check.json"), '{"backend":"execution"}');
+  assert.deepEqual(
+    (await planStructure(root, request)).changes.map((change) => change.file),
+    ["package.qx"],
+  );
+});
+
 test("structural plans validate the graph, journal originals, and reject stale edits", async (context) => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "qx-structural-test-"));
   context.after(() => fs.rm(root, { recursive: true, force: true }));