@ai-ecoverse/slicc-cdp 1.30.9 → 1.30.11

package/README.md

@@ -396,6 +396,10 @@ A complete record emits `certified-candidate @ai-ecoverse/slicc-cdp@<v> sha256=<
 
 ## PR certification tooling
 
+Cert suites record explicit guard target/slot limits, isolate the heavy corpus worker from concurrent native setup tests, and keep every first attempt and exact planned rerun. The guard test retains its declared 900-second budget; the worker permits 60 seconds for termination and records any forced kill as `INCOMPLETE`. A shared 60-minute execution budget is additionally bounded by the recorded 90-minute job start and a five-minute upload reserve. Missing, malformed or expired hosted job timing fails closed. Nested `AggregateError` causes are retained as bounded structured JSON with explicit limit markers. Every guard worker receives a new owned report path for each attempt; complete rows are embedded in the suite JSON and original diagnostic JSON bytes remain in the uploaded file, with its size and SHA256 recorded. Capturing a report is not a PASS or an attestation of honest execution in the producing workspace.
+
+`cert-guard-shards.yml` measures fixed-target shards through the PR's own read-only, secrets-free CI jobs on `vars.CERT_RUNNER`, rather than loading a shared developer Mac. Four declared target partitions cover the exact published corpus: the current 1.8.3 corpus has 11 targets and 668 rows; the partitions also name the two additional targets used by the 1.8.5 corpus. Targets absent from the selected published corpus are not declared as executed or passed. Each job keeps all assigned rows and variants with at most four targets and four slots per target, and does not retry the measurement. The rebalanced partitions separate seven, vault, vault-x and apex rather than pairing the first two with their large same-site sets. Their expected row counts are 154/160/202/152 for 1.8.3 and 154/160/204/156 for the 13-target 1.8.5 corpus; these counts are recorded beside the exact keys, never used instead of them. Their new wall times must be measured in CI rather than assumed from row counts. The data-only aggregate requires every declared shard and its exact unique row keys, not matching counts. A missing shard, unsupported execution, forced kill or absent complete report is `INCOMPLETE`; a positive failure remains FAIL. Each shard records suite time and pre-upload job wall time, plus the number of rows whose errors name `Target.createTarget`, `Target.attachToTarget` or browser-startup timeouts. That count is unknown (`null`) without a complete report; original attempts and errors remain available. The aggregate is explicitly a measurement, not a behavioural PR certificate. Selecting the candidate's exact corpus and driver, validating execution identities, declaring new-row negatives and activating the protected caller remain separately reviewed steps.
+
 Artifact-binding tools are staged before their workflow activation. `pr-artifacts.mjs --plan <plan> --bindings <job-outputs.json> --roles '["guard"]' --action download --directory <archives> --out <result>` checks the complete run inventory, exact canonical role names, IDs and SHA256 artifact digests against producer upload job outputs, then hashes the actual ZIP bytes before writing a role-named archive. It never extracts or executes candidate payloads. Download refusal exits nonzero; inspection distinguishes metadata matching from byte verification. Bindings have schema1, the exact PR plan identity and an `artifacts` array of `{role,name,id,digest}`. API listings and artifact contents cannot supply missing producer bindings. Bare uploader SHA256 and the API's `sha256:` representation are normalized explicitly, never confused with the npm tarball digest. Duplicate IDs/names, substituted metadata and unexpected extra suffix artifacts are `FAIL`; missing uploads, expired evidence or an incomplete API listing are `INCOMPLETE`, with FAIL taking precedence. `pr-record.mjs --bindings <job-outputs.json>` independently enforces the complete pre-record inventory and refuses forged extras even when other evidence is missing. Record/report scopes exclude their own not-yet-uploaded results. Existing non-required callers without this argument retain the disclosed bootstrap behaviour until a separately reviewed workflow activation provides trusted producer outputs and replaces wildcard consumers; this tools change alone does not close the rollout finding. Bios's reusable workflow must expose upload IDs/digests for its report and both shards before activation. Producer job outputs bind consumers to that producer's uploaded bytes; they do not attest the honesty of code executing in the same producer job. Deliberate same-job tampering with output files or the upload action's workspace remains a same-repository-code residual under the accidental-change threat model, not an isolation guarantee. Candidate jobs remain hosted, read-only and secrets-free; signing, model and reporting jobs do not execute candidate inputs.
 
 The `scripts/cert/pr-*` tools run in `.github/workflows/cert-review-pr.yml`, initially non-required. Every control checkout uses the main base SHA; candidate code runs only in hosted, read-only, secrets-free jobs with credentials disabled. Signing never executes input binaries. The Bedrock credential is confined to the data-only model step, which has no tools; code validates its head-bound structured verdict and execution receipt. Test-only changes and all package manifest changes, including scripts-only `postinstall` changes, take the full review. The merge-group pass-through is exact-head, ancestry-bound and code-only, consuming immutable trusted PR records and a fresh shared self-guard receipt. The always-running aggregate records missing or skipped ancestors as `INCOMPLETE`, never PASS. Release verification remains `verified` until the separately approved required-check rollout. Signed PR binaries and the collected signed assets expire after one day; digest and verification records remain for 90 days. The selected Bedrock model id is recorded in `review.json`, with the pinned default `global.anthropic.claude-opus-5-5`. Source-object fetches are credential-free for this public repository; a future trusted private-fork route would need an explicit read token, not candidate access to signing or review credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.30.9",
+  "version": "1.30.11",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -69,7 +69,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-browsers": "1.8.3",
-    "@ai-ecoverse/slicc-kernel": "1.128.2",
+    "@ai-ecoverse/slicc-kernel": "1.131.0",
     "@ai-ecoverse/slicc-shared-web": "1.24.2",
     "@biomejs/biome": "2.5.15",
     "lefthook": "2.2.1",