feat(authoring): prepare bounded public journey scenarios

cli/plugin-kit-ai/internal/authoring/scaffold/template_quoting_test.go

@@ -100,7 +100,9 @@ func checkTemplateJavaScriptSyntax(t *testing.T, source []byte) {
 	if err := os.WriteFile(path, source, 0600); err != nil {
 		t.Fatal(err)
 	}
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	// Allow bounded headroom for slow CI process startup, including Windows.
+	const timeout = 60 * time.Second
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 	// Parse only a newly generated temporary fixture. Do not import or execute
 	// the module, load the SDK, install dependencies, or inherit Node preload flags.
@@ -111,7 +113,13 @@ func checkTemplateJavaScriptSyntax(t *testing.T, source []byte) {
 		volume := filepath.VolumeName(dir)
 		cmd.Env = append(cmd.Env, "SystemRoot="+os.Getenv("SystemRoot"), "HOMEDRIVE="+volume, "HOMEPATH="+strings.TrimPrefix(dir, volume))
 	}
-	if out, err := cmd.CombinedOutput(); err != nil {
-		t.Fatalf("node --check: %v\n%s", err, out)
+	// Bound output-pipe waits as well as process execution. OS process startup
+	// itself may delay cancellation, so this is not a hard wall-clock guarantee.
+	cmd.WaitDelay = 5 * time.Second
+	started := time.Now()
+	out, err := cmd.CombinedOutput()
+	ctxErr := ctx.Err()
+	if err != nil || ctxErr != nil {
+		t.Fatalf("node --check: elapsed=%s timeout=%s context=%v process=%v output=%q", time.Since(started), timeout, ctxErr, err, out)
 	}
 }

npm/agentplugins/scripts/packed-installer-bridge.md

@@ -406,3 +406,116 @@ are still missing. Synthetic unit fixtures mock that later capability and child
 execution only; harmless tool bytes are never executed and establish no authentic
 acceptance. Full producer/validators/facades, workflow, J/E/P, genuine matrix and
 remaining release gates remain mandatory next-lane work.
+
+### C3b delivery step 2: fixed scenarios and producer
+
+This checkpoint implements `scenarioContract`, `verifyNpmLifecycle`,
+`verifyCacheProcess`, `verifyResults` and `produceJourney` in the authentic
+reader module. The original 55 kit / 127 pair core rows, including all eighteen
+installer rows per pair, remain unchanged. A separate immutable inventory adds
+five kit or 34 pair npm lifecycle rows, cache acquisition/repair/invalid-locator
+rows, simultaneous requests, literal arguments and host cancellation scenarios.
+Core command indices link observed processes to `commands.json`; they do not
+replace its inventory. No caller supplies commands, validators or policy.
+
+The producer uses the accepted source-frozen tools API and closed
+`authoring-public-produce/v1` request. It authenticates I/S before installing,
+compares both original packs and all native subject pins, derives fresh disjoint
+roots, invokes actual npm and its installed shims, finalizes the supported
+observer, rechecks source/tools/custody and then writes J plus local admission.
+Kit postinstall must use the selected npm Node. POSIX invokes the installed
+shim directly; Windows uses fixed `.cmd` version invocations and PowerShell
+`.ps1` calls with separately quoted literal arguments. npm install retains
+`--offline --ignore-scripts=false --foreground-scripts --no-audit --no-fund`;
+uninstall retains the corresponding fixed flags and exact package name.
+
+The three new records are closed, ordered schema/cell/row tables. Process rows
+bind ID/core index, actual argv/cwd/environment, executable/runtime identities,
+stdout/stderr size and SHA256, exit/signal, before/after project/prefix/cache/
+client/state/input identities, observed boundaries/counts, postinstall and
+monotonic intervals and the pinned literal-argument manifest effect. Boundary
+events are chronological: reached native/waiter boundary before cancellation,
+then final reaping; a cancelled waiter never launches native code. Repair
+records the exact intentional corruption before checked recovery. Cache
+evidence also binds descendant finalization;
+installer evidence binds assessment and eighteen readbacks. Raw observations
+and assessment are pinned `sidecars/` files, checked exhaustively with the
+128 MiB aggregate ceiling. The three scenario record files carry
+`rows: {shards: [{path,size,sha256}]}` with fixed ordered
+`sidecars/<record-name>-rows-<index>.json` transcript names. Each process row
+and envelope stays within 1 MiB; each ordered transcript shard stays within
+16 MiB. Readers verify pins, canonical partitioning and the aggregate before
+accepting expanded rows. Long workspace paths do not require omitting rows.
+Core transcripts retain 16 MiB and each output retains 1 MiB limits. Overflow
+prevents completion. Equality failures report a bounded assertion label rather
+than constructing potentially enormous diagnostic object diffs.
+
+Result validation checks engine/product versions, embedded schema and profile
+pins, command and client inventories, read profile, independent policy states,
+exact components and names, mutation effects, manifest identities and pair JSON
+and tree equality. Only explicit product/version and displayed invocation
+prefix differences are normalized. Directory and file modes and empty
+directories remain evidence. Cache checks require real repair, warm zero new
+acquisition/commit/download, four overlapping cold requests plus two warm,
+peer namespace preservation and reached cancellation/waiter boundaries.
+
+**Execution prerequisites remain absent on this source.** The fixed modules
+must be supplied and reviewed by their existing owners:
+
+- `public-authoring-custody.js`: `readPublicInputs` returning authenticated
+  `{stage,input}` with original retained subjects and checked pack closure.
+- `public-process-observation.js`: `openPublicObservation` and
+  `verifyPublicObservation`. Its session supplies `run`, `cancel`, `finish`.
+- `public-installer-evidence.js`: `requirePublicInstaller` and
+  `verifyPublicInstaller`, covering actual clean Codex detection, all three
+  lifecycle sources, genuine assessment/services and state/client readbacks.
+
+The process port's concrete return protocol for this consumer is
+`run -> {row,stdout,stderr}` and
+`finish -> {finalization,assessment,readbacks}`. The observer owns pinned raw
+sidecars in the supplied evidence root. `cancel({id,event})` uses the fixed
+scenario's reached boundary; it cannot silently pass an unreached signal.
+`verifyPublicObservation` returns checked `{rows,finalization}`;
+`verifyPublicInstaller` returns checked `{assessment,readbacks}`. Boolean
+success is rejected. These are required integration contracts, not supplied
+observer/security implementations or authentic execution evidence.
+
+Missing exports fail before npm/native effects with their exact module/export
+names. Post-admission setup, process, cancellation and finalization failures
+retain bounded diagnostics, including nested primary causes, without writing J.
+Synthetic unit fixtures establish semantic and orchestration controls
+only. The same-live-root bridge receives the producer's original ten projects;
+it must still run and independently verify its ten leaves/thirty plans in the
+later authorized integrated invocation. No Go gate is executed by this writer.
+Completed remote J/E, aggregation, E2, workflow and P remain mandatory step 3;
+`readAcceptance` stays closed. Full phases 0–11, genuine E2E, native/N2, release
+qualification and distribution gates remain open. This patch awaits independent
+review and does not constitute authentic public acceptance.
+
+### R1/R2 bounded source correction (2026-09-10)
+
+The authentic public validator now requires the exact five fixed `publicInit`
+closures: original and extra Skills, manifest, README, .gitignore, remote MCP
+references and the complete generated Node stdio sources/package/lock bytes.
+File and directory inventories and host modes are checked independently for each
+product. Captured file sizes/hashes bind the expected bytes before ordinary
+`agentplugins-tree-sha256-v1` framing is recomputed and compared with every
+retained read identity. The root is omitted from that engine digest; directory
+entries are included. The snapshot still seals the root and all empty directories.
+No additional empty directory is generated by these fixed commands. Existing
+live snapshot, bridge, evidence bounds and command inventories remain mandatory.
+
+Successful observer acquisition enters finalization scope before session method
+validation. An available finish is called exactly once even when run/cancel is
+missing; validation and finalizer errors are retained together, with no J.
+The observation owner must release all resources if open throws or returns no
+usable finalizer. The caller cannot finalize an absent method; its failure receipt
+is not evidence of quiescence. Only synthetic owner-interface tests cover this
+correction; no real observer experiment or substitute observer was performed.
+
+This correction does not authenticate execution or accept E2E/release. Genuine
+facades/provision, step 3 and full phases 0–11 remain open. N2 cyber refusal is
+NOT ACCEPTED. Refused security/crypto/ZIP work must not be retried, rerouted or
+replaced. Quarantined Windows parent-sharing/concurrency reproducers, ptrace or
+alternate observers, denied localhost/private-network/raw-download probes,
+network/auth/download/native execution and provisioning remain excluded.