@ai-ecoverse/slicc-cdp 1.30.16 → 1.30.17

package/README.md

@@ -410,14 +410,14 @@ The main-owned `pr-bios-files.mjs --directory <dir> --out <receipt.json>` writer
 
 Bios input preparation accepts `pr-bios-inputs.mjs --directory <case-owned-dir>` and extracts each pack beneath that directory's `base` and `candidate` subdirectories. Without the argument, each invocation creates a unique OS temporary workspace and removes only that workspace on success or refusal. Tests pass their own fixture directories and clean only those fixtures; no test removes repository-wide `.cert/bios-input-*` paths. Extraction isolation does not change pack identity, byte-hash or uploader-binding validation and is not a behavioural certification claim.
 
-Bios binding consumers are also staged before caller activation. `pr-bios-inputs.mjs --bindings <job-outputs.json>` selects reviewed complete-row producer `c2cec127b935419049568f584093d7ef03ac0721`, checks both pack upload IDs and artifact ZIP digests against the complete run API inventory, and emits `candidate-artifact-id`, `candidate-artifact-digest` and `candidate-binding: strict` beside each independently checked npm tarball hash. The ZIP and npm hashes are different identities. `pr-bios.mjs --bindings <job-outputs.json>` accepts each labelled workflow output envelope as `{result,artifact-id,artifact-digest,artifacts}`; `artifacts` may be its raw JSON-string output or the parsed array. It requires exactly the five planned uploads per label (report, both shards and both files archives), exact names/roles/IDs/digests/attempt, distinct IDs, direct report upload outputs and the result artifact URL. It cross-checks the callee outputs against trusted caller bindings and API metadata, rejecting unexpected global inventory suffixes even when another output is missing. A conditional extra plan upload is not part of these fixed two-shard calls and is rejected. The record independently repeats these checks using its own live API inventory and caller bindings; a claimed producer `PASS` or embedded metadata inspection cannot replace them. Strict selection never falls back to the old pin or API-discovered bindings when outputs are absent. Without `--bindings`, the existing non-required bootstrap caller still explicitly uses `4025d6aabc2c06add216183064d81914a171cd64`; the `bindingCommit` configuration stages the new pin without switching that caller early. The later main-owned caller activation must pin both `canary.yml` and `bios-ref` to `c2cec127b935419049568f584093d7ef03ac0721`, pass trusted producer outputs, verify actual artifact ZIP bytes before use, remove wildcard consumers and seal the final report's producer binding. These metadata consumers alone do not close those remaining rollout requirements or attest honest execution inside a producing job.
+Bios binding consumers are also staged before caller activation. `pr-bios-inputs.mjs --bindings <job-outputs.json>` selects reviewed complete-row producer `c2cec127b935419049568f584093d7ef03ac0721`, checks both pack upload IDs and artifact ZIP digests against the complete run API inventory, and emits `candidate-artifact-id`, `candidate-artifact-digest` and `candidate-binding: strict` beside each independently checked npm tarball hash. The ZIP and npm hashes are different identities. `pr-bios.mjs --bindings <job-outputs.json>` accepts each labelled workflow output envelope as `{result,artifact-id,artifact-digest,artifacts}`; `artifacts` may be its raw JSON-string output or the parsed array. It requires exactly the five planned uploads per label (report, both shards and both files archives), exact names/roles/IDs/digests/attempt, distinct IDs, direct report upload outputs and the result artifact URL. It cross-checks the callee outputs against trusted caller bindings and API metadata, rejecting unexpected global inventory suffixes even when another output is missing. A conditional extra plan upload is not part of these fixed two-shard calls and is rejected. The record independently repeats these checks using its own live API inventory and caller bindings; a claimed producer `PASS` or embedded metadata inspection cannot replace them. Strict selection never falls back to the old pin or API-discovered bindings when outputs are absent. Without `--bindings`, the default caller now uses `8d4e5d56bfdce208f853c8ea98628392787e31ea` with explicit `candidate-binding: legacy`: keeps the existing legacy binding; strict IDs are the separate staged c2 rollout. The `bindingCommit` remains `c2cec127b935419049568f584093d7ef03ac0721`, unactivated. Its historical two-shard catalog does not define the current seven-shard contract, so strict input preparation stays `INCOMPLETE`/not ready until that separate compatibility and caller activation are reviewed; there is no silent legacy fallback. The later main-owned caller activation must pin both `canary.yml` and `bios-ref` to `c2cec127b935419049568f584093d7ef03ac0721`, pass trusted producer outputs, verify actual artifact ZIP bytes before use, remove wildcard consumers and seal the final report's producer binding. These metadata consumers alone do not close those remaining rollout requirements or attest honest execution inside a producing job.
 
 The model reviewer uses the kernel lane's pinned `claude-code-action/base-action`, but keeps the attached empty operand `--tools=` and does not request `--json-schema`: an earlier schema-flag call failed to return `structured_output` in the live bootstrap proof. Unlike the kernel's filesystem-writing reviewer, this model cannot read or write files or execute commands. Main-owned `pr-review.mjs` parses only the execution receipt's successful final result: one complete JSON object or one fenced `json` block with nothing else. It validates the exact schema and head/commit binding, hashes the execution receipt, and requires exactly one `system/init` receipt with empty `tools` and `mcp_servers` arrays. Any advertised tool or MCP server is `INCOMPLETE` with `review model had tools`; absent or malformed capability receipts are also `INCOMPLETE`. The invocation flag alone is not proof of tool isolation; malformed output, free-text keywords and missing execution are never a substitute verdict.
 
 Bios comparison is between the two PR packs, not between the candidate and bios's registry pins. Both summaries must provide an untruncated `tests` array with unique stable `{key,shard,test,verdict,failed}` identities and actual completed-run ratios such as `failed.candidate: "0/3"` or `"3/3"`. The key includes the full test ancestry/variant/transport; duplicate display titles are not aligned by occurrence counters. The consumer requires the identical complete key set on both sides, recomputes all counts and validates the capped diagnostic lists against those complete rows. Only candidate-fail/base-PASS rows are introduced failures. Both-pack failures are flags, and base-fail/candidate-PASS rows are improvements. A producer `ok=false` is retained as a flag only when entirely explained by verified shared failures, or by verified base failures improved by the candidate; other rejection causes, missing/truncated/unexecuted/partial/skipped/candidate-flaky/refused evidence and mismatched row sets remain `INCOMPLETE`. Baseline-only flakes also remain `INCOMPLETE` unless the actual-row exception below is fully validated. Counts alone cannot invent base-PASS evidence. `pr-bios.mjs --base-report <bound-canary.json> --candidate-report <bound-canary.json>` can instead consume complete bound report rows, checking exact summary source, identities, counts, lists and result consistency. These options are data-only and do not discover or download artifacts: the caller must first obtain the report via trusted upload ID/digest and verify actual ZIP bytes. The independent record repeats the comparison from the raw retained rows rather than trusting producer PASS or flags. Missing `tests`/stable keys never falls back to the previous count-based candidate verdict, including for old-protocol callers. Caller transport and bios's new complete-row producer contract require their separate main-owned rollout; this comparator does not activate artifact binding or erase historical canary failures.
 
-The workflow opts in with `CERT_BIOS_ACTUAL_ROWS=1` only on the MAIN-owned classifier step; it does not pass new argv to older MAIN controls. Without this opt-in or an explicit direct `--rows` flag, the original strict classification remains unchanged, including baseline flakes staying `INCOMPLETE`. Older MAIN ignores the env opt-in and keeps its strict comparison; actual-row advisories activate only after the new consumer lands. The opt-in never accepts missing or mismatched uploaded documents. `pr-bios.mjs --rows` remains available for direct tests and downloads each declared base/candidate canary shard by its unique exact artifact name, API ID and digest in the current run/head. It bounds archive/document reads, verifies the whole uploaded ZIP SHA256, selects one canonical shard document, and binds its pack override/source to the exact side. Only MAIN tools read these bytes; this step has read-only Actions access and does not execute candidate code. The evidence retains every exact scoped row and its three actual outcomes as a bounded projection, plus the original document SHA256, ZIP identity and projection hash. Full original diagnostics remain in the linked raw shard artifacts. The independent record downloads these same exact artifacts again and checks projection/identity agreement rather than trusting the producer's flags or fractions. This binding is specific to the new actual-row input; the default BIOS pin and staged strict producer activation are unchanged.
+The workflow opts in with `CERT_BIOS_ACTUAL_ROWS=1` only on the MAIN-owned classifier step; it does not pass new argv to older MAIN controls. Without this opt-in or an explicit direct `--rows` flag, the original strict classification remains unchanged, including baseline flakes staying `INCOMPLETE`. Older MAIN ignores the env opt-in and keeps its strict comparison; actual-row advisories activate only after the new consumer lands. The opt-in never accepts missing or mismatched uploaded documents. `pr-bios.mjs --rows` remains available for direct tests and downloads each declared base/candidate canary shard by its unique exact artifact name, API ID and digest in the current run/head. It bounds archive/document reads, verifies the whole uploaded ZIP SHA256, selects one canonical shard document, and binds its pack override/source to the exact side. Only MAIN tools read these bytes; this step has read-only Actions access and does not execute candidate code. The evidence retains every exact scoped row and its three actual outcomes as a bounded projection, plus the original document SHA256, ZIP identity and projection hash. Full original diagnostics remain in the linked raw shard artifacts. The independent record downloads these same exact artifacts again and checks projection/identity agreement rather than trusting the producer's flags or fractions. This binding is specific to the actual-row input; it does not activate the staged strict producer binding.
 
 A base-only flaky row becomes an advisory only when the identical candidate `(shard,key)` has three actual executed `pass` outcomes. A `0/3` summary alone is insufficient for this exception. Missing rows/repeats, skips, timeouts, killed/unexecuted rows and candidate flakes stay `INCOMPLETE`; stable regression/shared-failure/improvement rules and integrity `FAIL` precedence remain. `biosLedger` in the producer evidence and independent record preserves repository/run/attempt/PR/head/audit/BIOS pin, scoped key, exact outcomes/rates and both uploaded artifact identities. Producer advisory/ledger fields must agree with independent recomputation. `biosLedgerObservations` deduplicates separately validated records by repository/run/attempt/scoped key and rejects conflicting duplicates; it is reporting only, not a history input to certification. `bios-ledger-first-case.json` records the original #373 E2.vault control prompt observation with its original `INCOMPLETE`, never retroactive certification. Only another independently validated base-side flagged run is a second observation; a clean, skipped, cancelled or refused run is not.
 
-Mandatory bios evidence uses `ai-ecoverse/slicc-bios/.github/workflows/canary.yml` pinned to merged commit `4025d6aabc2c06add216183064d81914a171cd64`, with `packages-update-cdp` and `guard` shards, repeat three, against both unpublished base and candidate packs. Main prepares distinct `base` and `candidate` labels and verifies both pack hashes without executing them. The consumer checks the producer's real `result` output: pinned bios ref, caller run, repeat, labelled artifact URL, exact override version/hash and artifact-source status binding, counts and completion arrays. The producer summary has no structured candidate `source` field; its exact artifact/run/hash status and override hash are checked, not an invented field or `ok` alone. Candidate-introduced failures on base-PASS tests are `FAIL`; pre-existing both-pack failures and confirmed improvements are flags. Missing calls, unfinished shards, skips, candidate flakes, unvalidated baseline flakes or malformed output are `INCOMPLETE`. Both-failing rows remain visible as flags rather than being mistaken for new regressions. The final record independently revalidates both result documents against its own byte-checked packs. The pin alone never makes the slot pass: the rollout workflow still needs two literal pinned canary calls and complete results. Required checks and rulesets need separate rollout approval. The shared guard's accepted residual is: self-guard catches accidental cert-path edits; not enforced against a deliberate rewrite of the workflow.
+Mandatory bios evidence uses `ai-ecoverse/slicc-bios/.github/workflows/canary.yml` and tested BIOS ref pinned to `8d4e5d56bfdce208f853c8ea98628392787e31ea`, whose workflow owns its tools commit. `scripts/cert/pr-bios.json` is the single seven-shard source: packages-update-cdp and the six guard-* shards, repeat three against both unpublished base and candidate packs. Artifact names and paired evidence use this same configuration; both workflow calls consume MAIN's prepared shard/ref outputs rather than their own arrays. MAIN reads `scripts/canary/shards.json` at the immutable pinned ref with bounded, credential-free, read-only access. Unknown names, missing definitions or unavailable catalog give clear `INCOMPLETE` evidence and `ready=false`, not canary execution or empty PASS. During this PR's bootstrap, older MAIN still prepares the old guard list and has no validated shard-contract receipt: the compatible workflow adapter records `INCOMPLETE`/not ready and skips both producers until the new MAIN control lands. No force flag, secret widening, producer PASS or behavioural certificate is invented. Pairing/ledger keys remain exact `(shard,key)` identities across all seven shards; equal ancestry/display names in different shards never collapse. Main prepares distinct `base` and `candidate` labels and verifies both pack hashes without executing them. The consumer checks the producer's real `result` output: pinned bios ref, caller run, repeat, labelled artifact URL, exact override version/hash and artifact-source status binding, counts and completion arrays. The producer summary has no structured candidate `source` field; its exact artifact/run/hash status and override hash are checked, not an invented field or `ok` alone. Candidate-introduced failures on base-PASS tests are `FAIL`; pre-existing both-pack failures and confirmed improvements are flags. Missing calls, unfinished shards, skips, candidate flakes, unvalidated baseline flakes or malformed output are `INCOMPLETE`. Both-failing rows remain visible as flags rather than being mistaken for new regressions. The final record independently revalidates both result documents against its own byte-checked packs. The pin alone never makes the slot pass: The rollout needs both literal workflow pins, their prepared matching tested-ref/shard inputs and complete results. Required checks and rulesets need separate rollout approval. The shared guard's accepted residual is: self-guard catches accidental cert-path edits; not enforced against a deliberate rewrite of the workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.30.16",
+  "version": "1.30.17",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -69,10 +69,10 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-browsers": "1.10.3",
-    "@ai-ecoverse/slicc-kernel": "1.135.0",
-    "@ai-ecoverse/slicc-shared-web": "1.27.1",
+    "@ai-ecoverse/slicc-kernel": "1.136.2",
+    "@ai-ecoverse/slicc-shared-web": "1.28.0",
     "@biomejs/biome": "2.5.15",
-    "lefthook": "2.2.1",
+    "lefthook": "2.2.2",
     "semantic-release": "25.0.9"
   }
 }