# shine-core
Reusable, UI-agnostic lifecycle runtime and domain core for the Shine CLI and future Shine
applications.
The crate owns captured runtime inputs, immutable preset snapshots, real/in-memory host ports,
App/Shell/Sys lifecycle orchestration, manifest models, shared resource-ownership primitives,
preset validation, persistence helpers, and the versioned frontend-neutral lifecycle result
envelope. It also owns the Phase 3 contract foundation for semantic security Plans, deterministic
source/state snapshot digests, permission resolution, exact Plan approval, versioned target-local
Preset permission declarations, and snapshot-scoped external-code trust grants. Workspace-internal pure planners assess App, Shell,
managed Sys lifecycle, exact Sys bootstrap, App refresh/artifact, and explicit Sys profile requests
from immutable Presets plus observation-only filesystem and split-DNS ports.
The Roadmap Phase 4 foundation keeps executable `ActionIrV1` separate from the security Plan.
Approved App install routes static Copy files with absent destinations or
backup-eligible unowned regular-file destinations through the action executor. Approved install and
upgrade also route unchanged, receipt-owned in-place static Copy replacement through
same-directory transaction rollback material. Ordinary removal of an unchanged, receipt-owned,
static Copy uses the same transaction path until receipt absence and its positive
journal commit marker are durable; when the receipt owns a fixed persistent backup, the action
restores that user file through a second fingerprint-bound rename. Forced removal of a
user-modified file uses a distinct action at the same static Copy boundary, stages the
modified bytes as fingerprint-bound rollback material, and reverses an optional backup restoration
until receipt commit. Administrator create, update, and removal reuse these actions, derive explicit
Administrator permission, hold the privileged-operation lock through receipt commit, and route
protected writes, moves, removals, and mode restoration through the host privilege port. Each
journal remains until its matching manifest receipt state is durable; a
fresh `app-recovery` Plan is required before removing or restoring unchanged transaction state.
JSON merge install/update/removal uses key-owned actions that preserve unrelated current values.
Static Copy and JSON destination relocation each replace one source receipt through a typed
two-destination transaction; JSON recovery restores/removes only the independently bound old/new
managed-key sets. Raw external Shell snapshot replacement now binds a category tree, deterministic
stage/rollback directories, selected command receipt transitions, and positive commit evidence in
the Shell journal. Embedded cache replacement binds only actual category file patches, and
lifecycle-rendered replacement/removal binds exact file identities plus every consumer receipt.
Live rendering shares the Shell lifecycle/recovery lock without creating an invocation journal.
Generators and remaining cache/snapshot uninstall, profile, and Sys resources retain their
existing executors and explicit rollback classifications until narrower contracts land.
Runtime APIs are workspace-internal and hidden from normal documentation. The versioned lifecycle
result and security Plan contracts retain their documented compatibility guarantees. Protected
App, Shell, managed Sys, Sys bootstrap, App refresh/artifact, and Sys profile CLI mutations review
and freshly revalidate Plans; existing dry-run behavior remains a separate preview. Planning does
not write, execute Preset code, request privilege, or apply system state. Permission declarations,
durable external-code trust, and one-shot Plan approval remain separate contracts.