Export artifact bytes explicitly

scripts/artifact-export-smoke.js

@@ -2,7 +2,9 @@
 
 const assert = require("assert");
 const cp = require("child_process");
+const fs = require("fs");
 const net = require("net");
+const os = require("os");
 const path = require("path");
 
 const repo = path.resolve(__dirname, "..");
@@ -111,6 +113,20 @@ function nodeCapabilities() {
   };
 }
 
+function runJson(command, args, options = {}) {
+  const result = cp.spawnSync(command, args, {
+    cwd: repo,
+    encoding: "utf8",
+    ...options,
+  });
+  if (result.status !== 0) {
+    throw new Error(
+      `${command} ${args.join(" ")} failed with code ${result.status}\n${result.stderr}\n${result.stdout}`
+    );
+  }
+  return JSON.parse(result.stdout);
+}
+
 async function reportNode(addr, node, { directConnectivity = true, online = true } = {}) {
   const response = await send(addr, {
     type: "report_node_capabilities",
@@ -192,6 +208,41 @@ async function reportNode(addr, node, { directConnectivity = true, online = true
     assert.strictEqual(exportPlan.plan.coordinator_assisted_rendezvous, true);
     assert.strictEqual(exportPlan.plan.coordinator_bulk_relay_allowed, false);
     assert.match(exportPlan.plan.authorization_digest, /^sha256:[0-9a-f]{64}$/);
+    assert.strictEqual(exportPlan.artifact_size_bytes, produced.stdout_bytes);
+
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), "disasmer-artifact-export-"));
+    const exportPath = path.join(temp, "export-output.txt");
+    const cliExport = runJson("cargo", [
+      "run",
+      "-q",
+      "-p",
+      "disasmer-cli",
+      "--bin",
+      "disasmer",
+      "--",
+      "artifact",
+      "export",
+      "--coordinator",
+      `${addr.host}:${addr.port}`,
+      "--tenant",
+      "tenant",
+      "--project-id",
+      "project",
+      "--user",
+      "user",
+      "--json",
+      "export-output.txt",
+      "--receiver-node",
+      "node-export-receiver",
+      "--to",
+      exportPath,
+    ]);
+    assert.strictEqual(cliExport.command, "artifact export");
+    assert.strictEqual(cliExport.export_plan.local_bytes_written_by_cli, true);
+    assert.strictEqual(cliExport.export_plan.local_export_status, "local_bytes_written");
+    assert.strictEqual(cliExport.export_plan.bytes_written, produced.stdout_bytes);
+    assert.strictEqual(cliExport.local_export.stream.content_material_returned_in_report, false);
+    assert.strictEqual(fs.readFileSync(exportPath, "utf8"), produced.stdout_tail);
 
     const crossTenant = await send(addr, {
       type: "export_artifact_to_node",

scripts/cli-first-contract-smoke.js

@@ -81,6 +81,11 @@ expect(
   "CLI-first non-e2e gate wording",
   /scripts\/acceptance-cli-first\.sh[\s\S]*final public-release e2e remains intentionally excluded/
 );
+expect(
+  criteria,
+  "artifact export explicit local byte write",
+  /artifact export <id> --to <path>` writes bytes[\s\S]*explicit bounded download stream[\s\S]*complete staged content is available/
+);
 expect(
   cliFirstAcceptance,
   "CLI-first acceptance report",
@@ -330,6 +335,21 @@ expect(
   "CLI blocks build before scheduling unsafe inputs",
   /blocked_before_schedule[\s\S]*scheduled_work[\s\S]*false/
 );
+expect(
+  cli,
+  "CLI artifact export writes explicit local bytes from stream content",
+  /fn artifact_export_local_write_followup[\s\S]*open_artifact_download_stream[\s\S]*content_base64[\s\S]*std::fs::write/
+);
+expect(
+  cli,
+  "CLI artifact export keeps content out of reports",
+  /fn artifact_stream_summary[\s\S]*content_material_returned_in_report[\s\S]*false/
+);
+expect(
+  coordinator,
+  "coordinator exposes conservative artifact stream content",
+  /fn download_stream_content_base64[\s\S]*stdout_truncated[\s\S]*artifact_size_bytes[\s\S]*BASE64_STANDARD\.encode/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],