@aifabrix/builder 2.51.0 → 2.52.0

package/lib/channels/channel-probe-evidence.js

@@ -0,0 +1,79 @@
+/**
+ * Probe BTA Evidence authoring reachability for channel installs (plan 163 T7).
+ *
+ * @fileoverview Evidence metadata/download live checks without mutating activate/upload
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  getEvidenceMetadata,
+  downloadEvidence
+} = require('../api/evidence-authoring.api');
+
+const EVIDENCE_AUTHORING_CAPABILITY_KEYS = Object.freeze([
+  'evidence.metadata',
+  'evidence.download',
+  'evidence.upload',
+  'evidence.activate'
+]);
+
+/**
+ * Prefer Business Transformation when present; otherwise first catalog role key.
+ *
+ * @param {Object[]} catalogItems
+ * @returns {string}
+ */
+function pickEvidenceRoleKey(catalogItems) {
+  const keys = (Array.isArray(catalogItems) ? catalogItems : [])
+    .map((item) => String(item?.key || item?.roleKey || item?.roleRef || '').trim())
+    .filter(Boolean);
+  const preferred = keys.find((key) => key.includes('business-transformation'));
+  return preferred || keys[0] || '';
+}
+
+/**
+ * Live metadata + download prove Evidence path; upload/activate remain contract keys.
+ *
+ * @async
+ * @param {Object} ctx
+ * @param {Object[]} catalogItems
+ * @returns {Promise<{ reachable: boolean, roleKey: string, capabilityKeys: string[] }>}
+ */
+async function probeEvidenceAuthoringReachable(ctx, catalogItems) {
+  const roleKey = pickEvidenceRoleKey(catalogItems);
+  const capabilityKeys = [...EVIDENCE_AUTHORING_CAPABILITY_KEYS];
+  if (!roleKey || !ctx?.dataplaneUrl || !ctx?.authConfig || !ctx?.controllerUrl) {
+    return { reachable: false, roleKey, capabilityKeys };
+  }
+  try {
+    const options = { controllerUrl: ctx.controllerUrl };
+    const metadata = await getEvidenceMetadata(
+      ctx.dataplaneUrl,
+      ctx.authConfig,
+      roleKey,
+      options
+    );
+    const downloaded = await downloadEvidence(
+      ctx.dataplaneUrl,
+      ctx.authConfig,
+      { roleKey, pageSize: 1 },
+      options
+    );
+    const reachable =
+      Boolean(metadata?.roleKey) &&
+      Array.isArray(metadata?.evidenceKinds) &&
+      Array.isArray(downloaded?.data);
+    return { reachable, roleKey, capabilityKeys };
+  } catch {
+    return { reachable: false, roleKey, capabilityKeys };
+  }
+}
+
+module.exports = {
+  EVIDENCE_AUTHORING_CAPABILITY_KEYS,
+  pickEvidenceRoleKey,
+  probeEvidenceAuthoringReachable
+};

package/lib/channels/channel-probe.js

@@ -8,8 +8,15 @@
 
 'use strict';
 
-const { ApiClient } = require('../api/index');
+const { ApiClient, createDataplaneApiClient } = require('../api/index');
 const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
+const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
+const {
+  fetchRuntimeLayerBToolNames,
+  isRuntimeMcpGatewayReachable
+} = require('./runtime-tool-catalog');
+const { probeEvidenceAuthoringReachable } = require('./channel-probe-evidence');
+const { RUNTIME_ORCHESTRATION_SYSTEM_KEY } = require('./chatgpt-runtime-contract');
 
 /**
  * @async
@@ -35,12 +42,48 @@ async function isUrlReachable(url) {
  * @returns {Promise<boolean>}
  */
 async function isAssistantCatalogReachable(dataplaneUrl, authConfig) {
-  const client = require('../api/index').createDataplaneApiClient(dataplaneUrl, authConfig);
+  const summary = await fetchAssistantCatalogSummary(dataplaneUrl, authConfig);
+  return summary.reachable;
+}
+
+/**
+ * @param {Object} response
+ * @returns {Object[]}
+ */
+function extractAssistantCatalogItems(response) {
+  const body = response?.data ?? response;
+  const data = body?.data ?? body;
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (Array.isArray(data?.items)) {
+    return data.items;
+  }
+  if (Array.isArray(data?.workers)) {
+    return data.workers;
+  }
+  if (Array.isArray(data?.assistants)) {
+    return data.assistants;
+  }
+  return [];
+}
+
+/**
+ * @async
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @returns {Promise<{ reachable: boolean, items: Object[] }>}
+ */
+async function fetchAssistantCatalogSummary(dataplaneUrl, authConfig) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   try {
     const res = await client.get('/api/v1/workers/available', { timeoutMs: 10000 });
-    return res && res.success !== false;
+    return {
+      reachable: Boolean(res && res.success !== false),
+      items: extractAssistantCatalogItems(res)
+    };
   } catch {
-    return false;
+    return { reachable: false, items: [] };
   }
 }
 
@@ -59,31 +102,240 @@ function evaluateInboundVerification(channelExt) {
 }
 
 /**
- * @async
  * @param {Object} ctx
  * @param {Object|null} channelExt
- * @returns {Promise<Object>}
+ * @param {boolean} catalogOk
+ * @param {string[]} layerBToolNames
+ * @param {Object[]} [catalogItems]
+ * @returns {Promise<{ probeTiers: Object, runtimeChecks: Object, evidenceCapabilityKeys?: string[] }>}
  */
-async function runChannelProbe(ctx, channelExt) {
-  const health = await fetchDataplaneGeneralHealth(ctx.dataplaneUrl, { timeoutMs: 8000 });
-  const catalogOk = await isAssistantCatalogReachable(ctx.dataplaneUrl, ctx.authConfig);
-  const callbackOk = health?.status === 'healthy' || health?.status === 'ok';
+/**
+ * @param {Object|null} channelExt
+ * @param {Object} runtime
+ * @param {Object} runtimeChecks
+ * @param {Object} evidence
+ * @returns {Object}
+ */
+function buildChatGptProbePayload(channelExt, runtime, runtimeChecks, evidence) {
+  return {
+    probeTiers: {
+      locallyValidated: Boolean(
+        channelExt?.credentialKey &&
+          channelExt?.artifactHash &&
+          runtime.mcpUrl &&
+          !runtime.mcpUrl.includes('/api/v1/chatgpt/')
+      ),
+      runtimeValidated: Object.values(runtimeChecks).every(Boolean),
+      requiresChatGptWorkspaceAdmin: true
+    },
+    runtimeChecks,
+    evidenceCapabilityKeys: evidence.capabilityKeys,
+    evidenceRoleKey: evidence.roleKey
+  };
+}
 
-  const inbound = evaluateInboundVerification(channelExt);
+/**
+ * @param {Object} ctx
+ * @param {Object|null} channelExt
+ * @param {boolean} catalogOk
+ * @param {string[]} layerBToolNames
+ * @param {Object[]} [catalogItems]
+ * @returns {Promise<{ probeTiers: Object, runtimeChecks: Object, evidenceCapabilityKeys?: string[] }>}
+ */
+async function buildChatGptProbeDetails(
+  ctx,
+  channelExt,
+  catalogOk,
+  layerBToolNames,
+  catalogItems = []
+) {
+  const runtime = resolveChannelRuntimeValues({
+    dataplaneBaseUrl: ctx.dataplaneUrl,
+    channelTarget: 'chatgpt',
+    appName: channelExt?.name || 'chatgpt',
+    baseName: channelExt?.baseName || channelExt?.name || 'chatgpt',
+    appDescription: channelExt?.description || 'ChatGPT custom MCP app',
+    layerBToolNames
+  });
+  const mcpHandshakeReachable = await isRuntimeMcpGatewayReachable(
+    ctx.dataplaneUrl,
+    ctx.authConfig,
+    RUNTIME_ORCHESTRATION_SYSTEM_KEY
+  );
+  const evidence = await probeEvidenceAuthoringReachable(ctx, catalogItems);
+  const runtimeChecks = {
+    mcpHandshakeReachable,
+    layerBToolNamesDiscovered: Array.isArray(layerBToolNames) && layerBToolNames.length > 0,
+    roleAssistantResolutionReachable: catalogOk,
+    tenantEnvironmentBoundaryConfirmed: Boolean(ctx.environment || channelExt?.name),
+    evidenceAuthoringReachable: evidence.reachable
+  };
+  return buildChatGptProbePayload(channelExt, runtime, runtimeChecks, evidence);
+}
 
+/**
+ * @param {Object} ctx
+ * @param {Object|null} channelExt
+ * @param {boolean} catalogOk
+ * @param {string[]} layerBToolNames
+ * @returns {Promise<{ probeTiers: Object, runtimeChecks: Object }>}
+ */
+async function buildMicrosoftCopilotProbeDetails(ctx, channelExt, catalogOk, layerBToolNames) {
+  const runtime = resolveChannelRuntimeValues({
+    dataplaneBaseUrl: ctx.dataplaneUrl,
+    channelTarget: 'microsoft-copilot',
+    appName: channelExt?.name || 'microsoft-copilot',
+    baseName: channelExt?.baseName || channelExt?.name || 'microsoft-copilot',
+    appDescription: channelExt?.description || 'Microsoft Copilot package channel',
+    layerBToolNames
+  });
+  const mcpHandshakeReachable = await isRuntimeMcpGatewayReachable(
+    ctx.dataplaneUrl,
+    ctx.authConfig,
+    RUNTIME_ORCHESTRATION_SYSTEM_KEY
+  );
+  const runtimeChecks = {
+    mcpHandshakeReachable,
+    layerBToolNamesDiscovered: Array.isArray(layerBToolNames) && layerBToolNames.length > 0,
+    authMetadataConfigured: Boolean(runtime.runtimeAuthMode && channelExt?.credentialKey),
+    roleAssistantResolutionReachable: catalogOk,
+    tenantEnvironmentBoundaryConfirmed: Boolean(ctx.environment || channelExt?.name)
+  };
+  return {
+    probeTiers: {
+      builderValidated: Boolean(
+        channelExt?.credentialKey &&
+          channelExt?.artifactHash &&
+          runtime.mcpUrl &&
+          !runtime.mcpUrl.includes('/api/v1/copilot/')
+      ),
+      runtimeValidated: Object.values(runtimeChecks).every(Boolean),
+      requiresMicrosoftAdmin: true
+    },
+    runtimeChecks
+  };
+}
+
+/**
+ * @param {Object} health
+ * @param {boolean} callbackOk
+ * @param {boolean} catalogOk
+ * @param {Object|null} channelExt
+ * @param {Object} inbound
+ * @returns {Object}
+ */
+function buildBaseProbeResult(health, callbackOk, catalogOk, channelExt, inbound) {
   return {
     dataplaneHealth: health?.status || 'unknown',
     callbackReachable: callbackOk,
     assistantCatalogReachable: catalogOk,
     credentialValid: Boolean(channelExt?.credentialKey),
-    inboundVerification: inbound,
-    passed: callbackOk && catalogOk && Boolean(channelExt?.credentialKey)
+    inboundVerification: inbound
   };
 }
 
+/**
+ * @param {Object} base
+ * @param {Object} probe
+ * @param {Object|null} channelExt
+ * @returns {Object}
+ */
+function buildCopilotProbeResult(base, probe, channelExt) {
+  return {
+    ...base,
+    ...probe,
+    expectedLayerBToolNames: [...(probe.discoveredLayerBToolNames || [])],
+    passed:
+      probe.probeTiers.builderValidated &&
+      probe.probeTiers.runtimeValidated &&
+      Boolean(channelExt?.credentialKey)
+  };
+}
+
+/**
+ * @param {Object} base
+ * @param {Object} probe
+ * @param {Object|null} channelExt
+ * @returns {Object}
+ */
+function buildChatGptProbeResult(base, probe, channelExt) {
+  return {
+    ...base,
+    ...probe,
+    expectedLayerBToolNames: [...(probe.discoveredLayerBToolNames || [])],
+    passed:
+      probe.probeTiers.locallyValidated &&
+      probe.probeTiers.runtimeValidated &&
+      Boolean(channelExt?.credentialKey)
+  };
+}
+
+/**
+ * @async
+ * @param {Object} ctx
+ * @param {Object|null} channelExt
+ * @returns {Promise<Object>}
+ */
+async function runChannelProbe(ctx, channelExt) {
+  const health = await fetchDataplaneGeneralHealth(ctx.dataplaneUrl, { timeoutMs: 8000 });
+  const catalog = await fetchAssistantCatalogSummary(ctx.dataplaneUrl, ctx.authConfig);
+  const catalogOk = catalog.reachable;
+  const callbackOk = health?.status === 'healthy' || health?.status === 'ok';
+  const inbound = evaluateInboundVerification(channelExt);
+  const base = buildBaseProbeResult(health, callbackOk, catalogOk, channelExt, inbound);
+
+  if (channelExt?.type !== 'chatgpt' && channelExt?.type !== 'microsoftCopilot') {
+    return {
+      ...base,
+      passed: callbackOk && catalogOk && Boolean(channelExt?.credentialKey)
+    };
+  }
+
+  const channelTarget = channelExt?.type === 'chatgpt' ? 'chatgpt' : 'microsoft-copilot';
+  const layerBToolNames = await fetchRuntimeLayerBToolNames(
+    ctx.dataplaneUrl,
+    ctx.authConfig,
+    channelTarget
+  );
+
+  if (channelExt?.type === 'microsoftCopilot') {
+    const copilotProbe = await buildMicrosoftCopilotProbeDetails(
+      ctx,
+      channelExt,
+      catalogOk,
+      layerBToolNames
+    );
+    return buildCopilotProbeResult(
+      base,
+      { ...copilotProbe, discoveredLayerBToolNames: layerBToolNames },
+      channelExt
+    );
+  }
+
+  const chatgptProbe = await buildChatGptProbeDetails(
+    ctx,
+    channelExt,
+    catalogOk,
+    layerBToolNames,
+    catalog.items
+  );
+  return buildChatGptProbeResult(
+    base,
+    { ...chatgptProbe, discoveredLayerBToolNames: layerBToolNames },
+    channelExt
+  );
+}
+
 module.exports = {
   isUrlReachable,
   isAssistantCatalogReachable,
+  extractAssistantCatalogItems,
+  fetchAssistantCatalogSummary,
   evaluateInboundVerification,
+  buildChatGptProbeDetails,
+  buildMicrosoftCopilotProbeDetails,
+  buildBaseProbeResult,
+  buildCopilotProbeResult,
+  buildChatGptProbeResult,
   runChannelProbe
 };

package/lib/channels/channel-runtime-resolver.js

@@ -8,8 +8,17 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const { getChannelTarget } = require('./channel-targets');
 const { normalizeSlackAppDescription } = require('./channel-description');
+const {
+  CHATGPT_RUNTIME_SYSTEM_KEY,
+  CHATGPT_RUNTIME_TRANSPORT,
+  CHATGPT_RUNTIME_AUTH_MODE,
+  COPILOT_RUNTIME_SYSTEM_KEY,
+  COPILOT_RUNTIME_TRANSPORT,
+  COPILOT_RUNTIME_AUTH_MODE
+} = require('./chatgpt-runtime-contract');
 
 /** Default Slack slash prefix — matches dataplane `templates/slack/command_catalog.yaml`. */
 const DEFAULT_SLACK_COMMAND_PREFIX = 'af';
@@ -62,13 +71,10 @@ function getEndpointPathSuffixes(channelTarget) {
       botConfigUrl: '/bot-config'
     },
     'microsoft-copilot': {
-      openapiUrl: '/openapi.yaml',
-      actionsBaseUrl: '/actions'
+      mcpUrl: '/mcp'
     },
     chatgpt: {
-      openapiUrl: '/openapi.yaml',
-      mcpUrl: '/mcp',
-      actionsBaseUrl: '/actions'
+      mcpUrl: '/mcp'
     },
     'web-embed': {
       configUrl: '/config'
@@ -78,21 +84,12 @@ function getEndpointPathSuffixes(channelTarget) {
 }
 
 /**
- * Legacy / non-external-system paths (Copilot/ChatGPT until dataplane routes exist).
+ * Legacy / non-external-system paths where fallback is still allowed.
  * @param {string} channelTarget
  * @returns {Record<string, string>}
  */
 function getLegacyApiPaths(channelTarget) {
   const legacy = {
-    'microsoft-copilot': {
-      openapiUrl: '/api/v1/copilot/openapi.yaml',
-      actionsBaseUrl: '/api/v1/copilot/actions'
-    },
-    chatgpt: {
-      openapiUrl: '/api/v1/chatgpt/openapi.yaml',
-      mcpUrl: '/api/v1/chatgpt/mcp',
-      actionsBaseUrl: '/api/v1/chatgpt/actions'
-    },
     'web-embed': {
       configUrl: '/api/v1/web-embed/config'
     }
@@ -120,6 +117,101 @@ function resolveSlackOAuthManifestFields(oauthCallbackUrl) {
   };
 }
 
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ */
+function applyChatGptRuntimeValues(resolved, params) {
+  resolved.runtimeSystemKey = CHATGPT_RUNTIME_SYSTEM_KEY;
+  resolved.runtimeTransport = CHATGPT_RUNTIME_TRANSPORT;
+  resolved.runtimeAuthMode = CHATGPT_RUNTIME_AUTH_MODE;
+  resolved.layerBToolNames = Array.isArray(params.layerBToolNames) ? [...params.layerBToolNames] : [];
+  resolved.scopes = Array.isArray(params.scopes) ? [...params.scopes] : [];
+  resolved.scopesJson = JSON.stringify(resolved.scopes);
+}
+
+/**
+ * @param {string} seed
+ * @returns {string}
+ */
+function buildDeterministicGuid(seed) {
+  const hex = crypto.createHash('sha256').update(String(seed || ''), 'utf8').digest('hex');
+  const bytes = hex.slice(0, 32).split('');
+  bytes[12] = '4';
+  bytes[16] = 'a';
+  return [
+    bytes.slice(0, 8).join(''),
+    bytes.slice(8, 12).join(''),
+    bytes.slice(12, 16).join(''),
+    bytes.slice(16, 20).join(''),
+    bytes.slice(20, 32).join('')
+  ].join('-');
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ */
+function applyMicrosoftCopilotRuntimeValues(resolved, params) {
+  resolved.runtimeSystemKey = COPILOT_RUNTIME_SYSTEM_KEY;
+  resolved.runtimeTransport = COPILOT_RUNTIME_TRANSPORT;
+  resolved.runtimeAuthMode = COPILOT_RUNTIME_AUTH_MODE;
+  resolved.layerBToolNames = Array.isArray(params.layerBToolNames) ? [...params.layerBToolNames] : [];
+  resolved.scopes = Array.isArray(params.scopes)
+    ? [...params.scopes]
+    : ['openid', 'profile', 'offline_access'];
+  resolved.scopesJson = JSON.stringify(resolved.scopes);
+  resolved.packageVersion = typeof params.packageVersion === 'string' ? params.packageVersion : '1.0.0';
+  resolved.packageAppId = buildDeterministicGuid(
+    `${resolved.channelTarget}:${resolved.baseName}:${resolved.environment}:app`
+  );
+  resolved.pluginId = buildDeterministicGuid(
+    `${resolved.channelTarget}:${resolved.baseName}:${resolved.environment}:plugin`
+  );
+  resolved.runtimeDomain = '';
+  try {
+    resolved.runtimeDomain = new URL(resolved.mcpUrl).hostname;
+  } catch {
+    try {
+      resolved.runtimeDomain = new URL(resolved.dataplaneBaseUrl).hostname;
+    } catch {
+      resolved.runtimeDomain = '';
+    }
+  }
+}
+
+/**
+ * @param {Object} resolved
+ * @param {string} base
+ * @param {string} systemPrefix
+ * @param {Record<string, string>} suffixes
+ * @param {Record<string, string>} legacy
+ */
+function applyResolvedPaths(resolved, base, systemPrefix, suffixes, legacy) {
+  for (const [key, suffix] of Object.entries(suffixes)) {
+    resolved[key] = joinUrl(base, `${systemPrefix}${suffix}`);
+  }
+  for (const [key, legacyPath] of Object.entries(legacy)) {
+    if (!resolved[key]) {
+      resolved[key] = joinUrl(base, legacyPath);
+    }
+  }
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ */
+function applySlackRuntimeValues(resolved, params) {
+  const oauthCallbackUrl = params.oauthCallbackUrl || resolved.oauthCallbackUrl;
+  Object.assign(resolved, resolveSlackOAuthManifestFields(oauthCallbackUrl));
+  const prefix =
+    typeof params.commandPrefix === 'string' && params.commandPrefix.trim()
+      ? params.commandPrefix.trim()
+      : DEFAULT_SLACK_COMMAND_PREFIX;
+  resolved.commandPrefix = prefix;
+}
+
 /**
  * @param {Object} params
  * @param {string} params.dataplaneBaseUrl
@@ -158,24 +250,18 @@ function resolveChannelRuntimeValues(params) {
     scopes: []
   };
 
-  for (const [key, suffix] of Object.entries(suffixes)) {
-    resolved[key] = joinUrl(base, `${systemPrefix}${suffix}`);
+  applyResolvedPaths(resolved, base, systemPrefix, suffixes, legacy);
+
+  if (params.channelTarget === 'slack') {
+    applySlackRuntimeValues(resolved, params);
   }
 
-  for (const [key, legacyPath] of Object.entries(legacy)) {
-    if (!resolved[key]) {
-      resolved[key] = joinUrl(base, legacyPath);
-    }
+  if (params.channelTarget === 'microsoft-copilot') {
+    applyMicrosoftCopilotRuntimeValues(resolved, params);
   }
 
-  if (params.channelTarget === 'slack') {
-    const oauthCallbackUrl = params.oauthCallbackUrl || resolved.oauthCallbackUrl;
-    Object.assign(resolved, resolveSlackOAuthManifestFields(oauthCallbackUrl));
-    const prefix =
-      typeof params.commandPrefix === 'string' && params.commandPrefix.trim()
-        ? params.commandPrefix.trim()
-        : DEFAULT_SLACK_COMMAND_PREFIX;
-    resolved.commandPrefix = prefix;
+  if (params.channelTarget === 'chatgpt') {
+    applyChatGptRuntimeValues(resolved, params);
   }
 
   return resolved;
@@ -186,6 +272,11 @@ module.exports = {
   joinUrl,
   externalSystemsPrefix,
   getEndpointPathSuffixes,
+  buildDeterministicGuid,
+  applyResolvedPaths,
+  applySlackRuntimeValues,
+  applyMicrosoftCopilotRuntimeValues,
+  applyChatGptRuntimeValues,
   resolveSlackOAuthManifestFields,
   resolveChannelRuntimeValues,
   DEFAULT_SLACK_COMMAND_PREFIX

package/lib/channels/channel-status-display.js

@@ -148,6 +148,50 @@ function displayValidationSection(validation) {
   if (validation.inboundVerification) {
     logger.log(formatSuccessLine('Inbound verification configured'));
   }
+  displayProbeTiers(validation.probeTiers);
+  displayRuntimeChecks(validation.runtimeChecks);
+}
+
+/**
+ * @param {Object|null} probeTiers
+ */
+function displayProbeTiers(probeTiers) {
+  if (!probeTiers) return;
+  logger.log('');
+  logger.log(metadata('Probe tiers:'));
+  const rows = [];
+  if (Object.prototype.hasOwnProperty.call(probeTiers, 'builderValidated')) {
+    rows.push(['builderValidated', probeTiers.builderValidated, false]);
+  }
+  if (Object.prototype.hasOwnProperty.call(probeTiers, 'locallyValidated')) {
+    rows.push(['locallyValidated', probeTiers.locallyValidated, false]);
+  }
+  rows.push(['runtimeValidated', probeTiers.runtimeValidated, false]);
+  if (Object.prototype.hasOwnProperty.call(probeTiers, 'requiresMicrosoftAdmin')) {
+    rows.push(['requiresMicrosoftAdmin', probeTiers.requiresMicrosoftAdmin, true]);
+  }
+  if (Object.prototype.hasOwnProperty.call(probeTiers, 'requiresChatGptWorkspaceAdmin')) {
+    rows.push(['requiresChatGptWorkspaceAdmin', probeTiers.requiresChatGptWorkspaceAdmin, true]);
+  }
+  for (const [label, value, isPendingGate] of rows) {
+    if (isPendingGate) {
+      logger.log(value ? formatWarningLine(label) : formatSuccessLine(`${label} (cleared)`));
+      continue;
+    }
+    logger.log(value ? formatSuccessLine(label) : formatWarningLine(`${label} (pending or failed)`));
+  }
+}
+
+/**
+ * @param {Object|null} runtimeChecks
+ */
+function displayRuntimeChecks(runtimeChecks) {
+  if (!runtimeChecks || typeof runtimeChecks !== 'object') return;
+  logger.log('');
+  logger.log(metadata('Runtime checks:'));
+  for (const [key, value] of Object.entries(runtimeChecks)) {
+    logger.log(value ? formatSuccessLine(key) : formatWarningLine(`${key} (failed)`));
+  }
 }
 
 /**