@aria_asi/cli 0.2.40 → 0.2.41

package/scripts/self-test-task-worker-lane.mjs

@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, '..');
+const ariaBin = path.join(packageRoot, 'bin', 'aria.js');
+const taskId = 'worker-lane-smoke';
+const phaseId = '01-implementation';
+
+function sha256Json(value) {
+  return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+function runAria(args, env) {
+  return spawnSync(process.execPath, [ariaBin, ...args], {
+    cwd: packageRoot,
+    env,
+    encoding: 'utf8',
+  });
+}
+
+const tempHome = mkdtempSync(path.join(tmpdir(), 'aria-task-worker-lane-'));
+const taskRoot = path.join(tempHome, '.aria', 'cli-tasks');
+mkdirSync(taskRoot, { recursive: true, mode: 0o700 });
+
+try {
+  const taskPath = path.join(taskRoot, `${taskId}.json`);
+  const state = {
+    schema: 'aria.cli_task.v2',
+    taskId,
+    goal: 'exercise bounded cheap-worker ingestion without granting completion authority',
+    cwd: packageRoot,
+    status: 'active',
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    requiredSkills: [],
+    forcedSkillLoad: {
+      ok: true,
+      skillExecutionMode: 'self-test-mechanical-receipt',
+      skillExecutionReceipt: { ok: true, schema: 'self-test', receiptHash: 'self-test' },
+      loadedCount: 15,
+      activeRuntimeCount: 1,
+      activePrimitiveCount: 1,
+      activeMappingCount: 1,
+      qaSkillCount: 1,
+      correctionSkillCount: 1,
+    },
+    checkpoints: [],
+    phases: [
+      {
+        phaseId,
+        title: 'implementation',
+        status: 'in_progress',
+        createdAt: new Date().toISOString(),
+        startedAt: new Date().toISOString(),
+        attempts: 1,
+        consumerReceipts: [],
+      },
+    ],
+    activePhaseId: phaseId,
+    recovery: { attempts: 0, lastReason: null, lastAt: null },
+  };
+  writeFileSync(taskPath, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+
+  const packetBase = {
+    schema: 'aria.task_worker_packet.v1',
+    generatedAt: new Date().toISOString(),
+    taskId,
+    phaseId,
+    executor: 'spark',
+    goal: state.goal,
+    phaseTitle: 'implementation',
+    phaseStatus: 'in_progress',
+    cwd: packageRoot,
+    allowedFiles: ['src/task-runner.ts'],
+    forbiddenFiles: ['.env'],
+    verificationCommand: 'node --version',
+    qualityContract: {
+      completionAuthority: 'aria_codex_forced_qa_only',
+    },
+  };
+  const packet = { ...packetBase, receiptHash: sha256Json(packetBase) };
+  const packetPath = path.join(taskRoot, `${taskId}.${phaseId}.spark.worker-packet.json`);
+  writeFileSync(packetPath, `${JSON.stringify(packet, null, 2)}\n`, { mode: 0o600 });
+
+  const env = {
+    ...process.env,
+    ARIA_HOME: tempHome,
+    ARIA_SELF_UPDATE: 'off',
+    ARIA_NOOR_HOOK: 'off',
+  };
+
+  const dispatchDryRun = spawnSync(process.execPath, [
+    path.join(packageRoot, 'scripts', 'aria-task-cheap-worker-dispatch.mjs'),
+    '--packet',
+    packetPath,
+    '--dry-run',
+  ], {
+    cwd: packageRoot,
+    env,
+    encoding: 'utf8',
+  });
+  assert(!dispatchDryRun.error, `cheap worker dispatcher dry-run spawn failed: ${dispatchDryRun.error?.message || dispatchDryRun.error}`);
+  assert(dispatchDryRun.status === 0, `cheap worker dispatcher dry-run failed\nstdout=${dispatchDryRun.stdout}\nstderr=${dispatchDryRun.stderr}`);
+  assert(dispatchDryRun.stdout.trim(), `cheap worker dispatcher dry-run returned empty stdout\nstderr=${dispatchDryRun.stderr}`);
+  const dispatchDryRunPayload = JSON.parse(dispatchDryRun.stdout);
+  assert(dispatchDryRunPayload.model === 'gpt-5.3-codex-spark', 'cheap worker dispatcher default model drifted');
+  assert(existsSync(dispatchDryRunPayload.outputSchemaPath), 'cheap worker dispatcher did not write an output schema');
+  const dispatchOutputSchema = JSON.parse(readFileSync(dispatchDryRunPayload.outputSchemaPath, 'utf8'));
+  assert(dispatchOutputSchema.properties.schema.const === 'aria.task_worker_output.v1', 'worker output schema is not bound to aria.task_worker_output.v1');
+  assert(dispatchOutputSchema.properties.taskId.const === taskId, 'worker output schema is not bound to the packet taskId');
+
+  const goodOutputPath = path.join(tempHome, 'worker-output-good.json');
+  writeFileSync(goodOutputPath, `${JSON.stringify({
+    schema: 'aria.task_worker_output.v1',
+    taskId,
+    phaseId,
+    executor: 'spark',
+    changedFiles: ['src/task-runner.ts'],
+    verification: { command: 'node --version', exitCode: 0, summary: 'node responded' },
+    summary: 'bounded implementation returned for parent QA',
+    evidence: 'self-test fixture only touches src/task-runner.ts',
+    blockers: [],
+  }, null, 2)}\n`, { mode: 0o600 });
+
+  const good = runAria(['task', 'worker-ingest', taskId, '--file', goodOutputPath, '--packet', packetPath], env);
+  assert(good.status === 0, `expected accepted worker output, got status=${good.status}\nstdout=${good.stdout}\nstderr=${good.stderr}`);
+  const goodPayload = JSON.parse(good.stdout);
+  assert(goodPayload.accepted === true, 'good worker output was not accepted');
+  assert(existsSync(goodPayload.receiptPath), 'accepted ingest receipt was not written');
+  const afterGood = JSON.parse(readFileSync(taskPath, 'utf8'));
+  assert(afterGood.phases[0].status === 'in_progress', 'accepted worker output must not complete the phase');
+
+  const badOutputPath = path.join(tempHome, 'worker-output-bad.json');
+  writeFileSync(badOutputPath, `${JSON.stringify({
+    schema: 'aria.task_worker_output.v1',
+    taskId,
+    phaseId,
+    executor: 'spark',
+    changedFiles: ['.env'],
+    verification: { command: 'node --version', exitCode: 0, summary: 'node responded' },
+    summary: 'forbidden scope attempt',
+    evidence: 'self-test fixture intentionally violates forbiddenFiles',
+    blockers: [],
+  }, null, 2)}\n`, { mode: 0o600 });
+
+  const bad = runAria(['task', 'worker-ingest', taskId, '--file', badOutputPath, '--packet', packetPath], env);
+  assert(bad.status !== 0, 'forbidden worker output unexpectedly exited with success');
+  const badPayload = JSON.parse(bad.stdout);
+  assert(badPayload.accepted === false, 'forbidden worker output was not rejected');
+  assert(badPayload.gaps.some((gap) => gap.includes('forbidden scope')), 'forbidden scope gap was not reported');
+  const afterBad = JSON.parse(readFileSync(taskPath, 'utf8'));
+  assert(afterBad.status === 'blocked', 'rejected worker output should block the task until correction');
+  assert(afterBad.phases[0].status === 'qa_failed', 'rejected worker output should mark the phase qa_failed');
+
+  let liveRunPacketPath = null;
+  let liveDispatchReceiptPath = null;
+  if (process.env.ARIA_TASK_WORKER_LIVE_SMOKE === '1') {
+    const liveTaskId = `worker-run-smoke-${randomUUID().slice(0, 8)}`;
+    const start = runAria(['task', 'start', '--id', liveTaskId, '--goal', 'live cheap worker run smoke', '--phases', 'implementation'], env);
+    assert(start.status === 0, `live worker run task start failed\nstdout=${start.stdout}\nstderr=${start.stderr}`);
+    const liveRun = runAria([
+      'task',
+      'run',
+      liveTaskId,
+      '--executor',
+      'spark',
+      '--summary',
+      'prepare bounded worker packet',
+      '--evidence',
+      'dry-run live smoke',
+      '--allowed-files',
+      'src/task-runner.ts',
+      '--forbidden-files',
+      '.env',
+      '--verify',
+      'node --version',
+      '--dry-run',
+    ], env);
+    assert(liveRun.status === 0, `live worker run dry-run failed\nstdout=${liveRun.stdout}\nstderr=${liveRun.stderr}`);
+    const livePayload = JSON.parse(liveRun.stdout);
+    assert(livePayload.dispatchPrepared === true, 'live run did not prepare worker dispatch');
+    assert(livePayload.dispatched === false, 'dry-run worker run should not dispatch');
+    assert(existsSync(livePayload.packetPath), 'live run packet path was not written');
+    liveRunPacketPath = livePayload.packetPath;
+
+    const dispatchWorkerPath = path.join(tempHome, 'dispatch-worker.mjs');
+    writeFileSync(dispatchWorkerPath, [
+      "let input = '';",
+      "process.stdin.setEncoding('utf8');",
+      "process.stdin.on('data', (chunk) => { input += chunk; });",
+      "process.stdin.on('end', () => {",
+      "  const packet = JSON.parse(input);",
+      "  process.stdout.write(JSON.stringify({",
+      "    schema: 'aria.task_worker_output.v1',",
+      "    taskId: packet.taskId,",
+      "    phaseId: packet.phaseId,",
+      "    executor: packet.executor,",
+      "    changedFiles: [packet.allowedFiles[0]],",
+      "    verification: { command: packet.verificationCommand, exitCode: 0, summary: 'worker fixture returned' },",
+      "    summary: 'bounded worker fixture output',",
+      "    evidence: 'fixture output preserved Aria ingestion authority',",
+      "    blockers: []",
+      "  }));",
+      "});",
+      '',
+    ].join('\n'), { mode: 0o700 });
+    const liveDispatch = runAria([
+      'task',
+      'run',
+      liveTaskId,
+      '--executor',
+      'spark',
+      '--summary',
+      'dispatch bounded worker packet',
+      '--evidence',
+      'live dispatch fixture smoke',
+      '--allowed-files',
+      'src/task-runner.ts',
+      '--forbidden-files',
+      '.env',
+      '--verify',
+      'node --version',
+      '--dispatch-command',
+      `${process.execPath} ${dispatchWorkerPath}`,
+    ], env);
+    assert(liveDispatch.status === 0, `live worker dispatch failed\nstdout=${liveDispatch.stdout}\nstderr=${liveDispatch.stderr}`);
+    const liveDispatchPayload = JSON.parse(liveDispatch.stdout);
+    assert(liveDispatchPayload.accepted === true, 'live dispatch worker output was not accepted');
+    assert(existsSync(liveDispatchPayload.receiptPath), 'live dispatch receipt was not written');
+    const liveState = JSON.parse(readFileSync(path.join(taskRoot, `${liveTaskId}.json`), 'utf8'));
+    assert(liveState.phases[0].status === 'in_progress', 'live dispatch must not complete the phase');
+    liveDispatchReceiptPath = liveDispatchPayload.receiptPath;
+  }
+
+  console.log(JSON.stringify({
+    ok: true,
+    test: 'task-worker-lane',
+    acceptedReceipt: goodPayload.receiptPath,
+    rejectedGaps: badPayload.gaps,
+    liveRunPacketPath,
+    liveDispatchReceiptPath,
+  }, null, 2));
+} finally {
+  rmSync(tempHome, { recursive: true, force: true });
+}

package/scripts/self-test-turn-substrate-qa-kernel.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+import { pathToFileURL } from 'node:url';
+
+const runtimeClient = await import(pathToFileURL('/home/hamzaibrahim1/.codex/hooks/lib/runtime-client.mjs'));
+
+const {
+  buildTurnSubstratePacket,
+  writeTurnSubstratePacket,
+  loadTurnSubstratePacket,
+  readinessSkillFloorGaps,
+  evaluateQaExecutionKernel,
+  consumeTurnSubstratePacket,
+  buildLocalMechanicalSkillLoad,
+  ARIA_CODEX_UNIVERSAL_RUNTIME_FLOOR,
+  ARIA_CODEX_UNIVERSAL_PRIMITIVE_FLOOR,
+  ARIA_CODEX_UNIVERSAL_MAPPING_FLOOR,
+  ARIA_CODEX_UNIVERSAL_NOOR_FLOOR,
+} = runtimeClient;
+
+const numbered = (prefix, count) => Array.from({ length: count }, (_, index) => `${prefix}-${index + 1}`);
+const mechanicalSkillLoad = buildLocalMechanicalSkillLoad({
+  source: 'self-test-turn-substrate-qa-kernel',
+  reason: 'turn_substrate_readiness_fixture',
+});
+const universalReadinessSkillLoad = {
+  ...mechanicalSkillLoad,
+  skillExecutionMode: 'mechanical-receipt',
+  activeRuntimes: numbered('runtime', ARIA_CODEX_UNIVERSAL_RUNTIME_FLOOR),
+  activePrimitives: numbered('primitive', ARIA_CODEX_UNIVERSAL_PRIMITIVE_FLOOR),
+  activeMappings: numbered('mapping', ARIA_CODEX_UNIVERSAL_MAPPING_FLOOR),
+  doctrineRuntimeReceipt: { ok: true },
+  phaseRuntimeExecution: { ok: true, providerReceivesFullSkillBodies: false },
+  gardenMemorySubstrate: { ok: true, providerProjection: { includesMemoryBodies: false } },
+  cognitiveRuntimeReceipts: {
+    ok: true,
+    tadabbur: { stageCount: 12 },
+    qiyas: { perspectiveCount: 15 },
+    noor: { noorSuiteCount: ARIA_CODEX_UNIVERSAL_NOOR_FLOOR },
+  },
+  qaCorrectionReceipt: { ok: true },
+  hiveObserverSourceTopology: { ok: true },
+  ownerApprovalPacket: { required: false, ownerApprovalStatus: 'not_required', blocksProductionPromotion: false },
+};
+const firedSkillIds = mechanicalSkillLoad.skillExecutionReceipt.firedSkillIds;
+const threadId = `phase69-smoke-${Date.now()}`;
+const producerEvent = { thread_id: threadId, turn_id: 'producer' };
+const consumerEvent = { thread_id: threadId, turn_id: 'consumer' };
+const producerSessionId = `codex:${threadId}:producer`;
+const consumerSessionId = `codex:${threadId}:consumer`;
+
+const producerState = {
+  sessionId: producerSessionId,
+  hiveThreadId: `codex:${threadId}`,
+  traceId: `trace-${threadId}`,
+  userText: 'wire corpus skills into runtime surfaces with QA recovery',
+  readiness: {
+    status: 'ready',
+    currentPhase: 'ready',
+    progress: 100,
+  },
+  forcedSkillLoad: universalReadinessSkillLoad,
+  requiredSkills: firedSkillIds,
+  preReceiptId: `pre-${threadId}`,
+};
+
+const packet = buildTurnSubstratePacket({
+  sessionId: producerSessionId,
+  event: producerEvent,
+  state: producerState,
+  phase: 'userprompt',
+  action: 'bind_packet',
+  text: producerState.userText,
+});
+const writeResult = writeTurnSubstratePacket(packet, {
+  sessionId: producerSessionId,
+  event: producerEvent,
+  state: producerState,
+});
+
+assert.equal(writeResult.ok, true, 'packet write succeeds');
+assert.ok(writeResult.aliases.includes(`codex:${threadId}`), 'packet includes hive-thread alias');
+
+const loadedFromConsumerTurn = loadTurnSubstratePacket({
+  sessionId: consumerSessionId,
+  event: consumerEvent,
+  state: {},
+});
+
+assert.equal(loadedFromConsumerTurn?.schema, 'aria.turn_substrate_packet.v1', 'consumer turn loads packet through hive-thread alias');
+assert.deepEqual(readinessSkillFloorGaps({ turnSubstratePacket: loadedFromConsumerTurn }), [], 'packet readiness closes split-brain readiness gap');
+
+const unrelatedThreadLoad = loadTurnSubstratePacket({
+  sessionId: `codex:${threadId}-other:consumer`,
+  event: { thread_id: `${threadId}-other`, turn_id: 'consumer' },
+  state: {},
+});
+
+assert.equal(unrelatedThreadLoad, null, 'unrelated thread does not load fresh latest packet');
+
+const explicitLatestLoad = loadTurnSubstratePacket({
+  sessionId: `codex:${threadId}-other:consumer`,
+  event: { thread_id: `${threadId}-other`, turn_id: 'consumer' },
+  state: { allowLatestTurnPacket: true },
+});
+
+assert.equal(explicitLatestLoad?.schema, 'aria.turn_substrate_packet.v1', 'latest packet load requires explicit opt-in');
+
+const lowRiskKernel = evaluateQaExecutionKernel({
+  surface: 'self-test',
+  phase: 'pre_tool',
+  action: 'read',
+  text: 'bounded status with evidence gap recorded',
+  turnPacket: loadedFromConsumerTurn,
+  readinessGaps: ['simulated low-risk freshness miss'],
+});
+
+assert.equal(lowRiskKernel.decision, 'repair', 'low-risk QA finding becomes repair work');
+assert.equal(lowRiskKernel.hardBlock, false, 'low-risk QA finding does not hard-block');
+assert.equal(lowRiskKernel.recoveryFirst, true, 'low-risk QA finding is recovery-first');
+
+const consumer = consumeTurnSubstratePacket({
+  sessionId: consumerSessionId,
+  event: consumerEvent,
+  state: {},
+  surface: 'self-test-consumer',
+  phase: 'pre_tool',
+  action: 'read',
+  text: 'read code and preserve bounded evidence gaps',
+  qualityGaps: ['simulated low-risk quality miss'],
+});
+
+assert.equal(consumer.receipt.schema, 'aria.turn_packet_consumer_receipt.v1', 'shared consumer emits receipt');
+assert.equal(consumer.receipt.sourcePacketPresent, true, 'shared consumer loads canonical packet');
+assert.equal(consumer.receipt.recoveryFirst, true, 'shared consumer is recovery-first for low-risk misses');
+assert.equal(consumer.receipt.hardBlock, false, 'shared consumer does not hard-block low-risk misses');
+assert.ok(['pass', 'repair'].includes(consumer.receipt.qaDecision), 'shared consumer records pass/repair decision');
+assert.equal(consumer.turnPacket?.qaKernel?.schema, 'aria.qa_execution_kernel.v1', 'shared consumer writes QA kernel into packet');
+
+const hardRiskKernel = evaluateQaExecutionKernel({
+  surface: 'self-test',
+  phase: 'stop',
+  action: 'deploy',
+  text: 'production ready and verified',
+  goalQa: {
+    blockers: ['false completion or readiness claim without bounded evidence'],
+    warnings: [],
+    repairs: ['add verified evidence before release'],
+  },
+});
+
+assert.equal(hardRiskKernel.decision, 'block', 'hard-risk QA finding blocks');
+assert.equal(hardRiskKernel.hardBlock, true, 'hard-risk QA finding remains an emergency brake');
+
+const hardDeleteKernel = evaluateQaExecutionKernel({
+  surface: 'self-test',
+  phase: 'pre_tool',
+  action: 'delete',
+  text: 'remove generated files',
+});
+
+assert.equal(hardDeleteKernel.hardBlock, true, 'delete action hard-blocks without needing a separate warning');
+
+const hardSecretKernel = evaluateQaExecutionKernel({
+  surface: 'self-test',
+  phase: 'stop',
+  action: 'release',
+  text: 'the api key is ready for use',
+});
+
+assert.equal(hardSecretKernel.hardBlock, true, 'secret-bearing output hard-blocks without needing a separate warning');
+
+console.log(JSON.stringify({
+  ok: true,
+  checked: [
+    'turn packet alias write',
+    'cross-turn packet load',
+    'cross-thread latest isolation',
+    'explicit latest recovery opt-in',
+    'readiness split-brain closure',
+    'shared packet consumer receipt',
+    'shared packet consumer recovery-first QA',
+    'low-risk repair-first decision',
+    'hard-risk block decision',
+    'hard delete action block decision',
+    'hard secret content block decision',
+  ],
+}, null, 2));

package/scripts/self-test-universal-action-capture.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const home = process.env.HOME || homedir();
+const taskRoot = process.env.ARIA_CLI_TASK_ROOT || join(home, '.aria', 'cli-tasks');
+const runtimeUrl = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+const taskId = process.env.ARIA_UNIVERSAL_ACTION_CAPTURE_TEST_TASK_ID
+  || `task-universal-action-capture-smoke-${Date.now()}`;
+const statePath = join(taskRoot, `${taskId}.json`);
+const eventsPath = join(taskRoot, `${taskId}.events.jsonl`);
+
+function readJson(path, fallback = null) {
+  try {
+    if (!existsSync(path)) return fallback;
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function readJsonl(path) {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, 'utf8')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => JSON.parse(line));
+}
+
+mkdirSync(dirname(statePath), { recursive: true, mode: 0o700 });
+if (!existsSync(statePath)) {
+  writeFileSync(statePath, `${JSON.stringify({
+    schema: 'aria.cli_task.v2',
+    taskId,
+    goal: 'self-test universal action capture into Aria CLI task ledger',
+    cwd: process.cwd(),
+    status: 'active',
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    requiredSkills: [],
+    forcedSkillLoad: null,
+    checkpoints: [],
+    phases: [],
+    activePhaseId: null,
+    recovery: { attempts: 0, lastReason: null, lastAt: null },
+  }, null, 2)}\n`, { mode: 0o600 });
+}
+
+const beforeEvents = readJsonl(eventsPath).length;
+const response = await fetch(`${runtimeUrl}/task-project-ledger/event`, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify({
+    platform: 'codex',
+    phase: 'pre_tool',
+    source: 'self-test-universal-action-capture',
+    event: {
+      taskId,
+      phaseId: 'self-test-phase',
+      sessionId: 'self-test-session',
+      threadId: 'self-test-thread',
+      actionId: 'self-test-action',
+      eventId: `self-test-event-${Date.now()}`,
+      intent: 'verify universal action capture writes to Aria CLI task ledger',
+      prompt: 'self-test universal action capture',
+    },
+    evidence: {
+      verification: true,
+      qaReceipt: {
+        ok: true,
+        suites: ['qiyas_15', 'tadabbur_12', 'claim_gate'],
+        findingCount: 0,
+      },
+      correctionPlan: {
+        required: false,
+        nextAction: 'keep compact universal action capture active for every task event',
+      },
+      learningDelta: {
+        loop: 'dalio_reflexion_i_tibaar',
+        lesson: 'Universal action capture must persist QA, correction, and learning markers, not only event existence.',
+        feedsNextSelection: true,
+      },
+      evidenceRefs: [
+        { kind: 'self_test_runtime_post', path: '/task-project-ledger/event' },
+      ],
+    },
+  }),
+});
+
+const text = await response.text();
+let body = {};
+try { body = text ? JSON.parse(text) : {}; } catch { body = { raw: text }; }
+if (!response.ok || body.ok !== true) {
+  console.error(JSON.stringify({ ok: false, status: response.status, body }, null, 2));
+  process.exit(1);
+}
+
+const afterEvents = readJsonl(eventsPath);
+const state = readJson(statePath, {});
+const capturedRows = afterEvents.filter((entry) => entry?.type === 'universal_action_captured');
+const latestCapture = capturedRows[capturedRows.length - 1] || null;
+const stateCapture = state.universalActionCapture || null;
+
+const ok = Boolean(
+  body.cliTaskActionCapture?.captured === true
+  && afterEvents.length > beforeEvents
+  && latestCapture?.schema === 'aria.cli_task_universal_action_capture.v1'
+  && latestCapture?.route === '/task-project-ledger/event'
+  && latestCapture?.qaPresent === true
+  && latestCapture?.correctionPresent === true
+  && latestCapture?.learningPresent === true
+  && stateCapture?.schema === 'aria.cli_task_universal_action_capture_projection.v1'
+  && Number(stateCapture.capturedCount || 0) >= 1
+);
+
+if (!ok) {
+  console.error(JSON.stringify({
+    ok: false,
+    taskId,
+    bodyCapture: body.cliTaskActionCapture || null,
+    beforeEvents,
+    afterEventCount: afterEvents.length,
+    latestCapture,
+    stateCapture,
+    statePath,
+    eventsPath,
+  }, null, 2));
+  process.exit(1);
+}
+
+appendFileSync(eventsPath, `${JSON.stringify({
+  at: new Date().toISOString(),
+  type: 'self_test_universal_action_capture_verified',
+  bodyCapture: body.cliTaskActionCapture,
+})}\n`, { mode: 0o600 });
+
+console.log(JSON.stringify({
+  ok: true,
+  taskId,
+  statePath,
+  eventsPath,
+  beforeEvents,
+  afterEventCount: afterEvents.length,
+  capturedCount: stateCapture.capturedCount,
+  qaPresent: latestCapture.qaPresent,
+  correctionPresent: latestCapture.correctionPresent,
+  learningPresent: latestCapture.learningPresent,
+  captureResolution: body.cliTaskActionCapture.resolution,
+  predicate: 'POST /task-project-ledger/event writes a compact universal_action_captured row and projection with QA, correction, and learning markers into the Aria CLI task ledger.',
+}, null, 2));