liris: add program cube ingestion map

docs/LIRIS-PROGRAM-CUBE-INGESTION-MAP-2026-06-14.hbp

@@ -0,0 +1,6 @@
+PROGCANONHDR|doc=LIRIS-PROGRAM-CUBE-INGESTION-MAP-2026-06-14|date=2026-06-14|owner=liris|scope=local-programs-to-cubes-before-any-update|tag=DESCRIPTOR-ONLY|json=0
+PROGCANONLAW|claim=every-local-program-surface-can-be-ingested-as-cube-descriptor-but-not-blindly-mutated|required_order=census->map3->cube3->hookwall->gnn->omnishannon->white-room->gc->promotion-gate|process_launch=0|live_patch=0|json=0
+PROGCANONSURFACES|owned=ASOLARIA-AS-NEURAL-NETWORK+Asolaria-ASI-On-Metal-Fabric-and-matrix|external=live-node-processes+codex-session+browser-webview|devices=2TB-SOVLINUX+128GB-USB+Falcon+Aether|cloud=35TB-Google+NotebookLM-copy|json=0
+PROGCANONGATE|rule=owned-repo-edits-may-advance-through-tests-and-sidecars;external-programs-read-only-until-owner-proof;devices-read-only-walk-before-write;cloud-copy-not-primary-authority|operator_cosign_required=1|json=0
+PROGCANONTOOL|tool=tools/behcs/program-cube-ingestion-map.mjs|test=tests/program-cube-ingestion-map.unit.test.mjs|catalog=tools/behcs/fabric-agent-preload-catalog.mjs|json=0
+PROGCANONFTR|status=SEALED-INTAKE-MAP|next=use-map-to-plan-owned-upgrades-then-ask-fabric-before-any-live-patch|json=0

docs/LIRIS-PROGRAM-CUBE-INGESTION-MAP-2026-06-14.hbp.sha256

@@ -0,0 +1 @@
+B563B5B4E6149F7E3225A45D10CC8A11C8F36A7AB556A0EA32668AD0C083D3B6  LIRIS-PROGRAM-CUBE-INGESTION-MAP-2026-06-14.hbp

tests/fabric-agent-preload-catalog.unit.test.mjs

@@ -29,6 +29,7 @@ test('preload catalog includes the laws, tools, roles, and cadence agents need',
   assert.ok(TOOLS.some((t) => t.id === 'model-selector-matrix' && t.gate.includes('live-model-invocation-0')));
   assert.ok(TOOLS.some((t) => t.id === 'project-guide-matrix' && t.gate.includes('no-cutover')));
   assert.ok(TOOLS.some((t) => t.id === 'tool-skill-registry-matrix' && t.gate.includes('live-tool-execution-0')));
+  assert.ok(TOOLS.some((t) => t.id === 'program-cube-ingestion-map' && t.gate.includes('blind_mutation-0')));
   assert.ok(ROLES.some((r) => r.id === 'flywheel' && r.must_do.includes('compare-to-acer-local-truth')));
   assert.ok(WORKFLOW.join('-').includes('memory-index-plan'));
   assert.equal(toolById('token-cube-catalog-binder').gate, 'mint-write-live-DEFER_TO_OPERATOR');

tests/fabric-agent-preload-catalog.unit.test.mjs.sha256

@@ -1 +1 @@
-307951DD48D2C36507BFBF140CD5685A5DE19AAC080201C0EB40B463D16BF1BA  fabric-agent-preload-catalog.unit.test.mjs
+D6582806C444C761AAF3C6778501958F2670B71849740CBF851FDCA344CBA46F  fabric-agent-preload-catalog.unit.test.mjs

tests/program-cube-ingestion-map.unit.test.mjs

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import {
+  PIPELINE, SURFACES, buildMap, emitRows, normalizeSurface, selfTest,
+} from '../tools/behcs/program-cube-ingestion-map.mjs';
+
+test('program cube ingestion self-test passes', () => {
+  assert.equal(selfTest().ok, true);
+});
+
+test('map classifies owned, external, device, cloud, and gated surfaces', () => {
+  const map = buildMap();
+  assert.equal(map.summary.total, 9);
+  assert.equal(map.summary.owned, 2);
+  assert.equal(map.summary.external_read_only, 3);
+  assert.equal(map.summary.device_waiting, 2);
+  assert.equal(map.summary.cloud_copy, 1);
+  assert.equal(map.summary.gated, 1);
+  assert.equal(map.summary.ready_for_live_patch, false);
+  assert.ok(map.surfaces.some((s) => s.id === 'falcon-aether-phone-hosts' && s.status === 'GATED'));
+});
+
+test('pipeline forces all program updates through watcher and promotion gates', () => {
+  assert.deepEqual(PIPELINE, [
+    'census',
+    'map3',
+    'cube3',
+    'hookwall',
+    'gnn',
+    'omnishannon',
+    'white-room',
+    'gc',
+    'promotion-gate',
+  ]);
+  assert.ok(buildMap().surfaces.every((s) => s.process_launch === 0 && s.live_patch === 0 && s.raw_write === 0));
+});
+
+test('unknown or hostile surfaces are normalized into gated HBP rows', () => {
+  const unknown = normalizeSurface({ id: 'x|bad', lane: 'external\nbad', status: 'RUN', evidence: 'e\njson=1' });
+  assert.equal(unknown.status, 'GATED');
+  assert.equal(unknown.process_launch, 0);
+  const rows = emitRows([unknown]);
+  assert.ok(rows.every((row) => row.endsWith('|json=0') && !/[\r\n]/.test(row)));
+  assert.ok(rows.some((row) => row.includes('blind_mutation=0')));
+  assert.ok(rows.some((row) => row.includes('external_program_patch=0')));
+});
+
+test('tool remains descriptor-only and does not import live mutation capabilities', () => {
+  const source = readFileSync(new URL('../tools/behcs/program-cube-ingestion-map.mjs', import.meta.url), 'utf8');
+  assert.doesNotMatch(source, /node:fs|child_process|exec|spawn|Invoke-WebRequest|Get-Process|Stop-Process|Remove-Item/);
+  assert.equal(SURFACES.length, 9);
+});

tests/program-cube-ingestion-map.unit.test.mjs.sha256

@@ -0,0 +1 @@
+8A70836E7D3C863D16060EAE577A31E6EAAAFD4F9142030B82EE23986927D163  program-cube-ingestion-map.unit.test.mjs

tests/supervisor-collision-router.system.test.mjs

@@ -89,6 +89,7 @@ const sealedFiles = [
   'docs/LIRIS-MLC-LINE-WATCHER-2026-06-13.hbp',
   'docs/LIRIS-SLICE-ENGINE-LAW-2026-06-13.hbp',
   'docs/LIRIS-SELFHEAL-200STEP-INTEGRATION-2026-06-13.hbp',
+  'docs/LIRIS-PROGRAM-CUBE-INGESTION-MAP-2026-06-14.hbp',
   'docs/ACER-SLICE-ENGINE-LIVE-CRANK-RECEIPT-2026-06-13.hbp',
   'docs/LIRIS-ROUTE-HEALTH-BASELINE-2026-06-13.hbp',
   'docs/ACER-ROUTE-HEALTH-CROSS-VANTAGE-2026-06-13.hbp',
@@ -229,6 +230,7 @@ const sealedFiles = [
   'tools/behcs/model-selector-matrix.mjs',
   'tools/behcs/project-guide-matrix.mjs',
   'tools/behcs/tool-skill-registry-matrix.mjs',
+  'tools/behcs/program-cube-ingestion-map.mjs',
   'tools/behcs/logical-extreme-stress.mjs',
   'tools/behcs/logical-stress-cube-feed.mjs',
   'tools/behcs/brown-hilbert-expansion-stress.mjs',
@@ -263,6 +265,7 @@ const sealedFiles = [
   'tests/model-selector-matrix.unit.test.mjs',
   'tests/project-guide-matrix.unit.test.mjs',
   'tests/tool-skill-registry-matrix.unit.test.mjs',
+  'tests/program-cube-ingestion-map.unit.test.mjs',
   'tests/logical-extreme-stress.unit.test.mjs',
   'tests/logical-stress-cube-feed.unit.test.mjs',
   'tests/brown-hilbert-expansion-stress.unit.test.mjs',

tests/supervisor-collision-router.system.test.mjs.sha256

@@ -1 +1 @@
-D39E177E7DAC093B59ACD6385668BCEFFD028FDDB9CBC58BA7AA3184C78AEC9A  supervisor-collision-router.system.test.mjs
+A0564CF213CCC4E4B1DAA4B90462F5BEA50B54B4803C9C665C8E34B975263AB6  supervisor-collision-router.system.test.mjs

tools/behcs/fabric-agent-preload-catalog.mjs

@@ -128,6 +128,12 @@ export const TOOLS = Object.freeze([
     provides: 'front-end-T-cell-tool-skill-registry-no-live-tool-execution',
     gate: 'descriptor-only-process_launch-0-live-tool-execution-0',
   }),
+  Object.freeze({
+    id: 'program-cube-ingestion-map',
+    path: 'tools/behcs/program-cube-ingestion-map.mjs',
+    provides: 'local-program-surface-to-cube-descriptor-map-before-any-update',
+    gate: 'descriptor-only-process_launch-0-live_patch-0-blind_mutation-0',
+  }),
   Object.freeze({
     id: 'token-cube-catalog-binder',
     path: 'tools/behcs/token-cube-catalog-binder.mjs',
@@ -298,7 +304,7 @@ export function selfTest() {
     && !!toolById('github-live-office-reconcile-expansion') && !!toolById('catch-count-ledger')
     && !!toolById('mlc-engine-wiring-increment') && !!toolById('frontend-parity-matrix')
     && !!toolById('model-selector-matrix') && !!toolById('project-guide-matrix')
-    && !!toolById('tool-skill-registry-matrix'));
+    && !!toolById('tool-skill-registry-matrix') && !!toolById('program-cube-ingestion-map'));
   add('slice-engine-law-preloaded', LAWS.some((law) => law.startsWith('slice-engine-law-'))
     && emitPreloadRows().some((row) => row.startsWith('FABPRELOADSLICEENGINE|')));
   add('emitters-pipe-hookwall-gnn', EMITTERS.some((e) => e.id === 'hookwall') && EMITTERS.some((e) => e.id === 'gnn-edge'));

tools/behcs/fabric-agent-preload-catalog.mjs.sha256

@@ -1 +1 @@
-F693776F96557535408C772713C8BB01F5E69EAC6E3C6FFCE49CFF4568A166D0  fabric-agent-preload-catalog.mjs
+F9279886A65F38A0D038E283B83250ED64381BA0451B208F2FFBDDDF7DDD2AAF  fabric-agent-preload-catalog.mjs

tools/behcs/program-cube-ingestion-map.mjs

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+// program-cube-ingestion-map.mjs - descriptor map for local programs before any cube promotion.
+//
+// This is a census and routing artifact only. It does not enumerate processes, read arbitrary
+// program files, patch binaries, start daemons, mint cubes, or write outside stdout. Live changes
+// must move through hookwall, GNN, OmniShannon, white-room, GC, and operator/fabric promotion.
+
+import { createHash } from 'node:crypto';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const MAP_ID = 'program-cube-ingestion-map.v1';
+export const STATUSES = Object.freeze([
+  'OWNED_DESCRIPTOR_READY',
+  'EXTERNAL_READ_ONLY',
+  'DEVICE_WAITING_FOR_PHYSICAL',
+  'CLOUD_COPY_ONLY',
+  'GATED',
+]);
+
+export const PIPELINE = Object.freeze([
+  'census',
+  'map3',
+  'cube3',
+  'hookwall',
+  'gnn',
+  'omnishannon',
+  'white-room',
+  'gc',
+  'promotion-gate',
+]);
+
+export const SURFACES = Object.freeze([
+  Object.freeze({
+    id: 'asolaria-nn-tools',
+    lane: 'owned-repo',
+    status: 'OWNED_DESCRIPTOR_READY',
+    evidence: 'ASOLARIA-AS-NEURAL-NETWORK/tools/behcs',
+    next: 'seal-descriptor-tools-and-tests-before-any-runtime-binding',
+  }),
+  Object.freeze({
+    id: 'sister-onmetal-tools',
+    lane: 'owned-repo',
+    status: 'OWNED_DESCRIPTOR_READY',
+    evidence: 'Asolaria-ASI-On-Metal-Fabric-and-matrix/tools',
+    next: 'absorb-via-git-blob-hash-sidecars-before-cross-hydration',
+  }),
+  Object.freeze({
+    id: 'live-node-processes',
+    lane: 'external-program',
+    status: 'EXTERNAL_READ_ONLY',
+    evidence: '8-node-processes-observed-on-liris-host',
+    next: 'map-process-owner-and-source-before-patch-proposal',
+  }),
+  Object.freeze({
+    id: 'codex-session',
+    lane: 'external-program',
+    status: 'EXTERNAL_READ_ONLY',
+    evidence: 'current-agent-host-process',
+    next: 'do-not-self-modify-running-agent-use-repo-artifacts-only',
+  }),
+  Object.freeze({
+    id: 'browser-webview-surfaces',
+    lane: 'external-program',
+    status: 'EXTERNAL_READ_ONLY',
+    evidence: 'edge-webview-process-family',
+    next: 'only-ingest-public-descriptor-claims-no-profile-or-token-access',
+  }),
+  Object.freeze({
+    id: 'sovlinux-2tb',
+    lane: 'device',
+    status: 'DEVICE_WAITING_FOR_PHYSICAL',
+    evidence: 'SOVLINUX-kernel-and-index-to-be-farmed-when-mounted',
+    next: 'read-only-walk-first-then-cube-descriptors-no-raw-write',
+  }),
+  Object.freeze({
+    id: 'usb-128gb',
+    lane: 'device',
+    status: 'DEVICE_WAITING_FOR_PHYSICAL',
+    evidence: 'packed-usb-surface-to-be-farmed-when-mounted',
+    next: 'read-only-walk-first-then-cube-descriptors-no-raw-write',
+  }),
+  Object.freeze({
+    id: 'google-35tb-notebooklm',
+    lane: 'cloud-copy',
+    status: 'CLOUD_COPY_ONLY',
+    evidence: 'NotebookLM-canon-docs-and-drive-copy',
+    next: 'cloud-remains-copy-and-critic-not-primary-authority',
+  }),
+  Object.freeze({
+    id: 'falcon-aether-phone-hosts',
+    lane: 'device',
+    status: 'GATED',
+    evidence: 'phone-file-manager-hosts-require-per-device-proof',
+    next: 'round-trip-pull-push-hash-proof-before-message-or-promotion',
+  }),
+]);
+
+const sha16 = (text) => createHash('sha256').update(String(text), 'utf8').digest('hex').slice(0, 16);
+const isObj = (x) => x !== null && typeof x === 'object';
+const safe = (x) => String(x ?? '').replace(/[|\r\n]/g, '_').replace(/[^A-Za-z0-9._:/+@=-]+/g, '-').replace(/^-|-$/g, '') || 'empty';
+const prop = (obj, key, fallback = '') => {
+  try { return isObj(obj) ? obj[key] : fallback; } catch { return fallback; }
+};
+
+export function normalizeStatus(value) {
+  const status = safe(value).toUpperCase();
+  return STATUSES.includes(status) ? status : 'GATED';
+}
+
+export function normalizeSurface(input = {}) {
+  try {
+    const id = safe(prop(input, 'id', 'unknown'));
+    const lane = safe(prop(input, 'lane', 'unknown'));
+    const status = normalizeStatus(prop(input, 'status', 'GATED'));
+    const evidence = safe(prop(input, 'evidence', 'not-proven'));
+    const next = safe(prop(input, 'next', 'define-next-proof'));
+    const map3 = sha16(`map:${id}:${lane}:${status}`);
+    const cube3 = sha16(`cube:${map3}:${evidence}`);
+    return Object.freeze({
+      id,
+      lane,
+      status,
+      evidence,
+      next,
+      map3,
+      cube3,
+      pid16: sha16(`pid:${id}:${cube3}`),
+      process_launch: 0,
+      live_patch: 0,
+      raw_write: 0,
+    });
+  } catch {
+    return Object.freeze({
+      id: 'invalid',
+      lane: 'invalid',
+      status: 'GATED',
+      evidence: 'normalize-threw',
+      next: 'fix-invalid-program-surface-row',
+      map3: sha16('invalid-map'),
+      cube3: sha16('invalid-cube'),
+      pid16: sha16('invalid-pid'),
+      process_launch: 0,
+      live_patch: 0,
+      raw_write: 0,
+    });
+  }
+}
+
+export function buildMap(input = SURFACES) {
+  const surfaces = (Array.isArray(input) ? input : SURFACES).map(normalizeSurface);
+  const count = (status) => surfaces.filter((s) => s.status === status).length;
+  return Object.freeze({
+    tool: MAP_ID,
+    pipeline: PIPELINE,
+    surfaces,
+    summary: Object.freeze({
+      total: surfaces.length,
+      owned: count('OWNED_DESCRIPTOR_READY'),
+      external_read_only: count('EXTERNAL_READ_ONLY'),
+      device_waiting: count('DEVICE_WAITING_FOR_PHYSICAL'),
+      cloud_copy: count('CLOUD_COPY_ONLY'),
+      gated: count('GATED'),
+      ready_for_live_patch: false,
+    }),
+  });
+}
+
+export function emitRows(input = SURFACES, opts = {}) {
+  try {
+    const built = buildMap(input);
+    const limitRaw = Number.parseInt(safe(prop(opts, 'limit', built.surfaces.length)), 10);
+    const limit = Math.max(0, Math.min(Number.isFinite(limitRaw) ? limitRaw : built.surfaces.length, built.surfaces.length));
+    const rows = [
+      `PROGCUBEHDR|tool=${MAP_ID}|purpose=program-surface-to-cube-ingestion-map-before-any-local-program-update|surfaces=${built.summary.total}|pipeline=${PIPELINE.join('+')}|read_only=1|process_launch=0|live_patch=0|raw_write=0|json=0`,
+      `PROGCUBESUM|owned=${built.summary.owned}|external_read_only=${built.summary.external_read_only}|device_waiting=${built.summary.device_waiting}|cloud_copy=${built.summary.cloud_copy}|gated=${built.summary.gated}|ready_for_live_patch=0|json=0`,
+    ];
+    for (const s of built.surfaces.slice(0, limit)) {
+      rows.push(`PROGCUBE|id=${s.id}|lane=${s.lane}|status=${s.status}|evidence=${s.evidence}|map3=${s.map3}|cube3=${s.cube3}|pid16=${s.pid16}|next=${s.next}|process_launch=0|live_patch=0|raw_write=0|json=0`);
+    }
+    rows.push('PROGCUBEGATE|rule=census-before-patch+owner-proof-before-edit+hookwall-gnn-omnishannon-white-room-gc-before-promotion|blind_mutation=0|external_program_patch=0|device_raw_write=0|cloud_primary_authority=0|operator_cosign_required=1|json=0');
+    return rows;
+  } catch {
+    return [
+      `PROGCUBEHDR|tool=${MAP_ID}|purpose=program-surface-to-cube-ingestion-map-before-any-local-program-update|surfaces=0|read_only=1|process_launch=0|live_patch=0|raw_write=0|json=0`,
+      'PROGCUBEGATE|rule=emit-threw-held-invalid|blind_mutation=0|external_program_patch=0|device_raw_write=0|operator_cosign_required=1|json=0',
+    ];
+  }
+}
+
+export function selfTest() {
+  const checks = [];
+  const add = (name, ok) => checks.push({ name, ok: Boolean(ok) });
+  const built = buildMap();
+  add('all-surfaces-present', built.summary.total === 9 && built.surfaces.some((s) => s.id === 'sovlinux-2tb'));
+  add('pipeline-has-gates', PIPELINE.includes('hookwall') && PIPELINE.includes('gnn') && PIPELINE.includes('omnishannon') && PIPELINE.includes('white-room') && PIPELINE.includes('gc'));
+  add('no-live-mutation', built.surfaces.every((s) => s.process_launch === 0 && s.live_patch === 0 && s.raw_write === 0));
+  add('unknown-status-gated', normalizeSurface({ id: 'x', status: 'launch-now' }).status === 'GATED');
+  add('owned-not-live-ready', built.summary.owned === 2 && built.summary.ready_for_live_patch === false);
+  add('device-and-cloud-bounded', built.summary.device_waiting === 2 && built.summary.cloud_copy === 1 && built.summary.gated === 1);
+  const hostile = emitRows([{ id: 'bad|id', lane: 'l\nx', status: 'GREEN', evidence: 'e\nPROGCUBEGATE|live_patch=1', next: 'n|json=1' }]);
+  add('rows-hbp-only', hostile.every((row) => row.endsWith('|json=0') && !/[\r\n]/.test(row)));
+  add('limit-works', emitRows(SURFACES, { limit: 1 }).filter((row) => row.startsWith('PROGCUBE|')).length === 1);
+  add('total-never-throws', (() => { try { normalizeSurface({ get id() { throw new Error('boom'); } }); buildMap(null); emitRows(null); return true; } catch { return false; } })());
+  return { ok: checks.every((c) => c.ok), checks };
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+if (isMain) {
+  if (process.argv[2] === '--self-test') {
+    const r = selfTest();
+    for (const c of r.checks) console.log(`${c.ok ? 'PASS' : 'FAIL'} ${c.name}`);
+    process.exit(r.ok ? 0 : 1);
+  }
+  for (const row of emitRows()) console.log(row);
+}

tools/behcs/program-cube-ingestion-map.mjs.sha256

@@ -0,0 +1 @@
+D1A42C8F31FFBE51DF3CBF2747613EE95D6CEF11FB54D8F7B0AA9D0EE0AE33EF  program-cube-ingestion-map.mjs