docs(LGT-021): require authoritative context launch

Author: liushiao

.legatura/contracts/context-kernel-interface.json

@@ -9,7 +9,7 @@
   "claims": [
     {
       "id": "context-materialization-binds-exact-authorized-bytes",
-      "statement": "Given one closed create input whose canonical Worker Work Specification and compiler-owned Change and Context bindings agree, Project Model alone expands the logical compiled Context Capsule over its frozen Git-visible inventory into one exact canonical UTF-8-byte-sorted concrete read plan and materialization-plan digest, and Context Kernel binds that digest into immutable Session context, consumes one matching live Assurance Runtime Repository Source Product only through the process-local options seam, and preserves its exact body-free projection and digest formulas to emit a bounded canonical content-addressed manifest and distinct process-local controller and delivery products; missing, extra, cross-repository, drifted, escaping, ambiguous, symlink, non-regular, unreadable, duplicate, unsorted, malformed, forged, serialized, caller-classified, or over-limit source, scope, Change, Context, or Worker facts fail closed."
+      "statement": "Given one closed self-digested create input, Context Kernel first requires a matching live Change Kernel-issued process-local Context Session Create Product whose factory-bound projection independently proves that one current compiled Change and stable composite Model, Git, and Store snapshot derived the exact compiler-owned Change binding, logical Context Capsule, and canonical Worker Work Specification; agreement among caller-created serializable values is never creation authority. Project Model alone then expands the authorized Capsule over its frozen Git-visible inventory into one exact canonical UTF-8-byte-sorted concrete read plan and materialization-plan digest, and Context Kernel binds that digest into immutable Session context, consumes one matching live Assurance Runtime Repository Source Product only through the process-local options seam, and preserves its exact body-free projection and digest formulas to emit a bounded canonical content-addressed manifest and distinct process-local controller and delivery products. Missing, extra, cross-repository, drifted, escaping, ambiguous, symlink, non-regular, unreadable, duplicate, unsorted, malformed, forged, serialized, cloned, proxied, cross-instance, wrong-snapshot, caller-classified, or over-limit creation product, source, scope, Change, Context, or Worker facts fail closed before source projection, byte reads, blob commits, or lineage creation."
     },
     {
       "id": "context-expansion-is-recorded-before-content-disclosure",

.legatura/modules/context-kernel.json

@@ -8,8 +8,8 @@
   "decisionAuthority": "module-maintainer",
   "interface": {
     "entrypoints": [
-      "createContextKernel({ repoPath, model, modulePathOwnershipProduct, trackedPathFacts, gitContentDigest, compileContextMaterializationPlan, compileContextExpansionImpact, projectRepositorySourceProduct, readRepositorySourceBytes, validateWorkerExecutionDocument, blobStore, sessionLedger, limits })",
-      "kernel.createContextSession(input, { repositorySourceProduct })",
+      "createContextKernel({ repoPath, model, modulePathOwnershipProduct, trackedPathFacts, gitContentDigest, compileContextMaterializationPlan, compileContextExpansionImpact, projectContextSessionCreateProduct, projectRepositorySourceProduct, readRepositorySourceBytes, validateWorkerExecutionDocument, blobStore, sessionLedger, limits })",
+      "kernel.createContextSession(input, { contextSessionCreateProduct, repositorySourceProduct })",
       "kernel.resolveContextExpansion(input, { controllerSessionProduct, repositorySourceProduct })",
       "kernel.readContextDeliveryFile(deliveryProduct, pathRef)",
       "validateContextKernelDocument(value)",
@@ -18,20 +18,20 @@
       "CONTEXT_KERNEL_LIMITS"
     ],
     "invariants": [
-      "createContextKernel binds one process-local instance to the private repository path, frozen Project Model, opaque exact ownership product, tracked-path facts, Git content digest, Project Model materialization-plan and Context-Impact compilers, Assurance Runtime source projection and byte-read functions, Worker document validator, bounded blob-batch store, compare-and-swap Session ledger, and limits; callers cannot replace those bindings through Session creation or resolution input.",
-      "The closed create input contains schemaVersion 1, kind context-session-create, one compiler-owned Change binding and logical Context Capsule, and one canonical Worker Work Specification; Context Kernel validates exact execution, Change, compilation, Governance Baseline, and Work Specification Capsule, read-scope, and write-scope digest agreement plus the materializationPlanDigest returned by the exact Project Model plan, while caller-supplied Session, materialization, resolution, source, Impact, authority, or product fields fail closed.",
+      "createContextKernel binds one process-local instance to the private repository path, frozen Project Model, opaque exact ownership product, tracked-path facts, Git content digest, Project Model materialization-plan and Context-Impact compilers, a factory-bound Change Kernel Context Session Create Product projector, Assurance Runtime source projection and byte-read functions, Worker document validator, bounded blob-batch store, compare-and-swap Session ledger, and limits; callers cannot replace those bindings through Session creation or resolution input.",
+      "The closed create input contains schemaVersion 1, kind context-session-create, one compiler-owned Change binding and logical Context Capsule, one canonical Worker Work Specification, and contextSessionCreateDigest sealing those ordinary fields. The matching live Context Session Create Product arrives only through the options seam and independently proves that one Change Kernel instance derived this exact create document from one current compiled Change and stable composite Model, Git, and Store snapshot; digest agreement among caller-created serializable Change, Capsule, or Work Specification values is never creation authority. Context Kernel validates the projected exact execution, Change, compilation, Governance Baseline, snapshot Git, Work Specification, Capsule, read-scope, and write-scope bindings plus the materializationPlanDigest returned by the exact Project Model plan, while missing, forged, serialized, cloned, proxied, cross-instance, wrong-snapshot, or mismatched products and caller-supplied Session, materialization, resolution, source, Impact, authority, or product fields fail closed before source projection, byte reads, blob commits, or lineage compare-and-swap.",
       "Project Model alone compiles the Capsule read selectors over the frozen tracked-path facts into the exact canonical UTF-8-byte-sorted concrete initial pathRefs and path-set digest; Context Kernel consumes that plan without parsing selectors or deriving Module, Contract, assurance, disposition, semantic-impact, or verification classifications.",
-      "createContextSession accepts the matching live Repository Source Product only through its options seam, projects it with complete exact private repository, Git content, tracked-path, and planned path-set expectations, verifies its ordered path-length-content-digest manifest, commits the exact initial blob batch and expected-empty lineage, and only then returns one closed Context Session plus distinct controller and delivery products.",
+      "createContextSession accepts the matching live Context Session Create Product and Repository Source Product only through its options seam, projects the creation product before the source product, projects source with complete exact private repository, Git content, tracked-path, and planned path-set expectations, verifies its ordered path-length-content-digest manifest, commits the exact initial blob batch and expected-empty lineage, and only then returns one closed Context Session plus distinct controller and delivery products. The creation product may be retried after a failed attempt but cannot bypass expected-empty lineage compare-and-swap after success.",
       "Context Kernel accepts the Assurance Runtime projection verbatim as { schemaVersion: 1, repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest, productDigest, manifest } with manifest entries { pathRef, byteLength, contentDigest }, requires canonical UTF-8-byte-sorted pathRefs, verifies pathSetDigest as canonicalDigest({ schemaVersion: 1, paths: pathRefs }), manifestDigest as canonicalDigest({ schemaVersion: 1, entries: manifest }), and productDigest as canonicalDigest({ schemaVersion: 1, repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest }), and never recompiles an alternate source binding.",
       "A Context Session has exactly schemaVersion 1, kind context-session, lineageRef, sequence, priorSessionDigest, executionBinding, changeBinding, contextBinding, materialization, resolution, acceptanceAuthority, and sessionDigest: executionBinding contains executionRef and workSpecificationDigest; changeBinding contains changeId, primaryModuleRef, compilationDigest, and governanceBaselineDigest; contextBinding contains contextCapsuleDigest, readScopeDigest, invariant writeScopeDigest, and invariant materializationPlanDigest; materialization contains sourceBinding with repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest, and productDigest plus only ordered pathRef, byteLength, and contentDigest manifest entries; resolution is null initially or contains contextExpansionRequestDigest, requestedPathRefs, controllerDecision, compiler-derived disposition, proposalSourceBinding, neutral self-digested contextImpact, and newlyDisclosedPathRefs; acceptanceAuthority is always false and sessionDigest seals every preceding field.",
       "lineageRef is exactly canonicalDigest({ executionBinding, changeBinding, contextBinding }); initial Session sequence is zero, priorSessionDigest is null, and its ledger compare-and-swap expects null. Every successor preserves the same lineageRef and entire contextBinding, sets sequence to prior sequence plus one and priorSessionDigest to the current Session digest, and calls compare-and-swap with that current digest as expectedSessionDigest.",
-      "Source bodies live only in bounded process-lifetime content-addressed blob state and opaque source or delivery products; controller, delivery, Repository Source, and Project Model ownership products never enter ordinary input or Context Session, Worker Execution, Change, Store, HTTP, CLI, or Profile records, and every returned source byte is defensively copied.",
+      "Source bodies live only in bounded process-lifetime content-addressed blob state and opaque source or delivery products; Context Session Create, controller, delivery, Repository Source, and Project Model ownership products never enter ordinary input or Context Session, Worker Execution, Change, Store, HTTP, CLI, or Profile records, and every returned source byte is defensively copied.",
       "The closed resolution input contains only schemaVersion 1, kind context-expansion-resolution, one canonical Worker Context Expansion Request, and controllerDecision grant or deny; Worker Interface validation proves the request's canonical self-declared execution, Work Specification, priorRecordDigest, Capsule, and capability bindings, but Context Kernel does not observe whether that Worker Record is current, settle it, or use it as resolution authority, while the current controller product alone binds the prior Context Session.",
       "Every granted, denied, or compiler-derived redundant resolution preserves the prior contextBinding including materializationPlanDigest and requires through options the current controller product and a live Repository Source Product whose exact canonical UTF-8-byte-sorted full proposal pathRefs are prior materialization union original requested paths; proposalSourceBinding contains exactly repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest, and productDigest, its repositoryIdentityDigest, gitContentDigest, and trackedPathFactsDigest must respectively equal the prior materialization sourceBinding fields, every prior manifest entry must remain byteLength- and contentDigest-identical, contextImpact.primaryModuleRef must equal changeBinding.primaryModuleRef, and contextImpact.repositorySourceBinding must be field-for-field equal to proposalSourceBinding. Context Kernel derives the exact set relation before calling Project Model: a fully already-disclosed original request is redundant and becomes a canonical empty Impact disclosure delta, a disjoint original request becomes its exact Impact disclosure delta and may be granted or denied, and mixed already-disclosed and new paths fail closed; Project Model alone derives every structural fact in the neutral Context Impact from that normalized delta, the exact Change-bound primaryModuleRef, and the full proposal projection.",
       "The controller holder may choose only grant or deny; disposition, redundancy, successor scope, full source selection, materialization, neutral Context Impact, and lineage are compiler-derived from frozen inputs, and no Worker or caller may supply classifications, a successor, or its own grant.",
       "The default blobStore and sessionLedger are bounded process-lifetime implementations. blobStore.commitBatch([{ contentDigest, bytes }]) is atomic, treats an existing identical digest and byte sequence as idempotent, and fails on a digest collision or partial write; blobStore.read(contentDigest) returns a defensive copy only after revalidating its digest. sessionLedger.compareAndSwap({ lineageRef, expectedSessionDigest, successorSession }) returns exactly { committed, currentSessionDigest }; a throw, malformed result, or committed false is a failed compare-and-swap and cannot rotate products or disclose bytes.",
       "Initial creation and granted expansion call blobStore.commitBatch before sessionLedger.compareAndSwap; an initial blob or ledger failure produces no Session, controller, or delivery, while an expansion failure leaves the prior Session and controller current and produces no successor or delivery. A grant reads and commits only its newly disclosed byte delta, adopts the exact full-proposal projection as successor materialization, and only after successful compare-and-swap consumes the prior controller and mints the successor controller and delivery; a completed blob commit followed by failed compare-and-swap may leave only unreachable content-addressed blob residue. Denied and redundant resolutions only project their body-free full-proposal source, never read requested bytes or commit new blobs, compare-and-swap successors whose materialization is field-for-field identical to the prior materialization, and never return a new delivery product.",
-      "Session creation and every successful resolution return one new opaque controller product bound to the exact Context Kernel instance and current Session; resolution rejects forged, serialized, proxied, cloned, cross-instance, wrong-kind, stale, or consumed controller products. Create and grant additionally return a distinct opaque delivery product bound to the exact complete current manifest, while deny and redundant return no delivery; delivery reads reject forged, serialized, proxied, cloned, cross-instance, wrong-kind, or unknown-path products and return defensive byte copies.",
+      "The Change Kernel-issued Context Session Create Product, Context Kernel-issued controller and delivery products, Assurance Runtime-issued Repository Source Product, and Project Model-issued ownership product are distinct frozen zero-own-key process-local capabilities whose authority cannot be serialized, cloned, proxied, reconstructed from their ordinary projections, or substituted across issuer instances or kinds. Session creation and every successful resolution return one new opaque controller product bound to the exact Context Kernel instance and current Session; resolution rejects forged, serialized, proxied, cloned, cross-instance, wrong-kind, stale, or consumed controller products. Create and grant additionally return a distinct opaque delivery product bound to the exact complete current manifest, while deny and redundant return no delivery; delivery reads reject forged, serialized, proxied, cloned, cross-instance, wrong-kind, or unknown-path products and return defensive byte copies.",
       "Context Kernel does not settle or resume a Worker Execution Record; Adapter adoption of a successor Context belongs to LGT-023 and must not create a Worker Execution to Context Kernel dependency cycle.",
       "Context Kernel owns disclosure facts, not raw filesystem enforcement, worker knowledge, semantic code impact, Evidence, Knowledge Closure, Outcome, Claim, Authority, or Change acceptance conclusions."
     ]