@botiverse/k-carrier 0.1.0

package/harness/src/teeth/fakeHost.ts

@@ -0,0 +1,120 @@
+/**
+ * fake-host teeth (harness-design §1.1 first half; the package spec:
+ * ledger equivalence incl. after rollback, and every fault switch really
+ * turning its tooth red — switch off, tooth green).
+ *
+ * Registration site only — check bodies live in fake-host/checks.ts;
+ * importing this module registers the teeth.
+ */
+import { registerTooth } from "./registry.ts";
+import {
+  checkLedgerEquivalence,
+  checkLedgerEquivalenceAfterRollback,
+  checkQuiesceCompletes,
+  checkStopCompletes,
+  checkProbeVersionMatchesSlot,
+  checkProbeBindsCurrentIncarnation,
+  checkStartCompletes,
+} from "../fake-host/checks.ts";
+
+registerTooth({
+  id: "fake-host.ledger-equivalence",
+  profiles: ["service"],
+  layers: ["L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "resume() rewrites the ledger differently than quiesce parked",
+      caughtOnlyBy: "this", // only this tooth compares parked vs resumed bytes on the direct path
+    },
+    {
+      mutate: "quiesce() does not durably park the workload (ledger lost)",
+      caughtOnlyBy: "this",
+    },
+  ],
+  run: checkLedgerEquivalence,
+});
+
+registerTooth({
+  id: "fake-host.ledger-equivalence-after-rollback",
+  profiles: ["service"],
+  layers: ["L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "resume() after rollback restores a different ledger",
+      caughtOnlyBy: "this", // the rollback path is only exercised by this tooth
+    },
+  ],
+  run: checkLedgerEquivalenceAfterRollback,
+});
+
+registerTooth({
+  id: "fake-host.fault-fail-on-quiesce",
+  profiles: ["service"],
+  layers: ["L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "quiesce() fails to park even when fail-on-quiesce is off",
+      caughtOnlyBy: "this", // only this tooth pins quiesce's normal completion
+    },
+  ],
+  run: checkQuiesceCompletes,
+});
+
+registerTooth({
+  id: "fake-host.fault-hang-on-stop",
+  profiles: ["service"],
+  layers: ["L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "stop() never completes even when hang-on-stop is off",
+      caughtOnlyBy: "this", // only this tooth races stop against a clock window
+    },
+  ],
+  run: checkStopCompletes,
+});
+
+registerTooth({
+  id: "fake-host.fault-wrong-version-probe",
+  profiles: ["service"],
+  layers: ["L2", "L3"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "healthProbe() reports a wrong version even when the switch is off",
+      caughtOnlyBy: "this", // probe veracity per slot is pinned only here
+    },
+  ],
+  run: checkProbeVersionMatchesSlot,
+});
+
+registerTooth({
+  id: "fake-host.fault-stale-startid-probe",
+  profiles: ["service"],
+  layers: ["L2", "L3"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "healthProbe() reports a stale startId even when the switch is off",
+      caughtOnlyBy: "this", // incarnation binding is pinned only here
+    },
+  ],
+  run: checkProbeBindsCurrentIncarnation,
+});
+
+registerTooth({
+  id: "fake-host.fault-crash-during-start",
+  profiles: ["service"],
+  layers: ["L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "start() throws even when crash-during-start is off",
+      caughtOnlyBy: "this", // only this tooth pins start's normal completion
+    },
+  ],
+  run: checkStartCompletes,
+});

package/harness/src/teeth/index.ts

@@ -0,0 +1,16 @@
+/**
+ * Teeth registration index — importing this module registers every tooth
+ * in the harness (the side effect the k-harness runner and CI rely on).
+ * Tests import their own modules; this is the single entry for the CLI.
+ */
+import "./m0.ts";
+import "./artifactFactory.ts";
+import "./fakeHost.ts";
+import "./selfCheck.ts";
+import "./examples.ts";
+import "./blackbox.ts";
+import "./artifact.ts";
+import "./artifactM5.ts";
+import "./artifactM6.ts";
+import "./artifactDownload.ts";
+import "./sim.ts";

package/harness/src/teeth/m0.ts

@@ -0,0 +1,135 @@
+/**
+ * M0 teeth — fake-server + scenario sandbox acceptance (test-plan M0 rows:
+ * "fake 静态 server（manifest+工件+签名，可篡改）| 正常链路可走通 | 篡改任一字节
+ * ⇒ 下游校验齿红"; harness-design §1.2/§1.3).
+ *
+ * The check bodies live in checks.ts (imported here); this module is the
+ * registration site — importing it registers every M0 tooth, and the
+ * registry forces profiles, invariant/baseline dichotomy and an answered
+ * must-red list (harness-design §1.5). Tests import this module for the
+ * side effect and drive known-green/known-red through the exported checks.
+ */
+import { registerTooth } from "./registry.ts";
+import {
+  checkServesConsistentRelease,
+  checkCorruptByteRejects,
+  checkSwapArtifactsRejects,
+  checkServeOlderVersion,
+  checkDropFileRemoves,
+  checkSandboxIsolation,
+  checkSandboxVerifyDead,
+} from "./checks.ts";
+
+registerTooth({
+  id: "fake-server.serves-consistent-release",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "publish writes a manifest whose sha256 is not the artifact's",
+      caughtOnlyBy: "this", // no other tooth checks publish-time manifest/bytes agreement
+    },
+    {
+      mutate: "point the manifest target at a different artifact than the published one",
+      caughtOnlyBy: {
+        alsoCaughtBy: "core artifact L0 sha256 integrity check (when landed)",
+        whyStillNeeded:
+          "this tooth is the harness's own上岗证: it pins the fake-server publish/serve wiring now, before any core exists",
+      },
+    },
+  ],
+  run: checkServesConsistentRelease,
+});
+
+registerTooth({
+  id: "fake-server.tamper-corrupt-byte",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "corruptByte is a no-op that leaves the served bytes unchanged",
+      caughtOnlyBy: "this", // only this tooth asserts the tamper had a verifiable effect
+    },
+  ],
+  run: checkCorruptByteRejects,
+});
+
+registerTooth({
+  id: "fake-server.tamper-swap-artifacts",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "swapFiles serves each artifact its own bytes back",
+      caughtOnlyBy: "this", // only this tooth asserts the swap is a real cross-swap
+    },
+  ],
+  run: checkSwapArtifactsRejects,
+});
+
+registerTooth({
+  id: "fake-server.tamper-serve-older-version",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "serveOlderVersion keeps serving the current version",
+      caughtOnlyBy: "this", // only this tooth asserts the downgrade actually downgrades
+    },
+  ],
+  run: checkServeOlderVersion,
+});
+
+registerTooth({
+  id: "fake-server.tamper-drop-file",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "dropFile keeps serving the dropped file",
+      caughtOnlyBy: "this", // only this tooth asserts the file is truly gone for clients
+    },
+  ],
+  run: checkDropFileRemoves,
+});
+
+registerTooth({
+  id: "scenario.sandbox-verify-dead",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "teardown sends kill but never scans/verifies death (residual marker process survives)",
+      caughtOnlyBy: "this", // only this tooth proves "发了 kill"≠"死了" at the sandbox boundary
+    },
+  ],
+  run: checkSandboxVerifyDead,
+});
+
+registerTooth({
+  id: "scenario.sandbox-isolation",
+  profiles: ["swap", "service"],
+  layers: ["L0"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "two live sandboxes share the same temp dir",
+      caughtOnlyBy: "this", // harness-internal discipline; no downstream check sees the dirs
+    },
+    {
+      mutate: "two live sandboxes share the same port",
+      caughtOnlyBy: "this", // parallel-scenario collisions are invisible to any product tooth
+    },
+    {
+      mutate: "teardown leaves the sandbox dir on disk",
+      caughtOnlyBy: "this", // "沙箱边界即清场边界"; nothing downstream re-checks残留
+    },
+  ],
+  run: checkSandboxIsolation,
+});

package/harness/src/teeth/registry.ts

@@ -0,0 +1,267 @@
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Teeth registry — the discipline carrier of the harness (harness-design §1.5).
+ *
+ * A tooth is a named, profile-tagged check with a declared way to fail.
+ * Registration IS the enforcement point: a tooth missing any discipline
+ * field (profile tags, invariant/baseline dichotomy, must-red list, layer
+ * declaration) is rejected at registration time with a typed error — it
+ * never becomes a silently weaker test.
+ *
+ * Rules enforced here (each has a test):
+ *  - unique, well-formed id
+ *  - non-empty profile set
+ *  - kind = invariant | baseline-with-failure-condition (no untagged
+ *    implementation-locking assertions — the invariant/baseline dichotomy)
+ *  - must-red: >= 1 entry, and each entry answers "who else would catch
+ *    this mutation?" — "this" (nobody else) or a justified alsoCaughtBy
+ *  - profile/layer tiering: a tooth may only be tagged with profiles whose
+ *    layer set covers every layer the tooth exercises (the tier-boundary
+ *    rule: a cli-profile tooth exercising L2 is a registration error)
+ */
+
+/**
+ * A profile is a PROCESS MODEL, defined by cardinality: how many live
+ * incarnations K itself manages.
+ *
+ *   swap     0 — K replaces bytes and touches no process. The user may run N
+ *                concurrently at mixed versions; that is normal and invisible
+ *                to K. (A one-shot CLI and a long-running interactive session
+ *                are the SAME here — surprising, but correct: neither has a
+ *                process K hands over.)
+ *   service  1 — K stops one incarnation and starts another, briefly 0.
+ *
+ * There is no third model. Workload preservation, OS lifecycle convergence and
+ * fleet drive are CAPABILITIES an adopter opts into, not another kind of
+ * process — bundling them as a profile confused "what the app does" with "what
+ * K does", which is not K's business.
+ */
+export type Profile = "swap" | "service";
+
+/**
+ * Opt-in capabilities, declared separately from the process model.
+ *
+ * A capability only belongs here once at least one tooth declares it.
+ * Selecting a capability that no tooth answers adds ZERO checks while looking
+ * like added assurance -- the empty-suite false-green this harness exists to
+ * prevent. `workload-preservation` was removed on those grounds (08-05): no
+ * tooth claimed it, and example-host, the host it was imagined for, restarts
+ * its workloads rather than preserving them (resume is enough).
+ * `core/src/invariants.ts` still exports `workloadPreserved` for a host that
+ * genuinely has continuity; it just is not a capability you can select yet.
+ */
+export type Capability =
+  | "lifecycle-convergence" // OS lifecycle surfaces must read back (L3 platform)
+  | "fleet-drive";          // server-pushed commands, policy-gated (L5)
+
+export const ALL_CAPABILITIES: readonly Capability[] = [
+  "lifecycle-convergence",
+  "fleet-drive",
+];
+
+/** L1p = the simplified cli-profile slot model ("swap is promote"). */
+/**
+ * Design-doc layers a tooth exercises. L0.5 (supply chain / signing) was
+ * removed with the feature on 2026-08-06 and is deliberately absent: a tag
+ * for a layer that does not exist makes a tooth look like it covers ground
+ * nobody is standing on.
+ */
+export type Layer = "L0" | "L1p" | "L1" | "L2" | "L3" | "L4" | "L5";
+
+/** Which layers each profile is allowed to exercise (design §2.5). */
+/**
+ * Profiles name PROCESS MODELS, not program archetypes:
+ *   swap    no live process K hands over. Bytes are replaced and take effect
+ *           on the next start. Several old-version processes may keep running
+ *           concurrently — that is normal, and invisible to K.
+ *   service exactly one live incarnation is handed over: stop old, start new,
+ *           prove it. This is where never-dual-run has meaning.
+ *   hosted  a service that also holds someone else's work (sessions/jobs) and
+ *           OS lifecycle state that must converge.
+ */
+export const PROFILE_LAYERS: Record<Profile, ReadonlySet<Layer>> = {
+  swap: new Set<Layer>(["L0", "L1p"]),
+  service: new Set<Layer>(["L0", "L1p", "L1", "L2", "L3", "L4", "L5"]),
+};
+
+export type ToothKind =
+  | { kind: "invariant" }
+  | { kind: "baseline"; failureCondition: string };
+
+export type CaughtOnlyBy =
+  | "this"
+  | { alsoCaughtBy: string; whyStillNeeded: string };
+
+export interface MustRed {
+  /** The mutation that must turn this tooth red, stated concretely. */
+  mutate: string;
+  /** "this" = nobody else catches it; otherwise justify why the tooth still earns its keep. */
+  caughtOnlyBy: CaughtOnlyBy;
+}
+
+/** Execution context handed to a tooth run. Grows with the harness. */
+export interface ToothContext {
+  profile: Profile;
+  sandboxDir: string;
+}
+
+export interface ToothSpec {
+  id: string;
+  profiles: Profile[];
+  /**
+   * Only runs when the adopter has opted into this capability. Absent = the
+   * tooth applies to every adopter at these profiles.
+   */
+  requiresCapability?: Capability;
+  layers: Layer[];
+  kind: ToothKind;
+  mustRed: MustRed[];
+  run: (ctx: ToothContext) => Promise<void>;
+  /**
+   * Where registerTooth was called, as `file:line`. Captured from the stack
+   * at registration, never written by hand: an explicit field would be one
+   * more thing to forget, and a stale pointer to a test case is worse than
+   * none. Presentation only -- `k-harness --list` prints it so "which cases
+   * exist and where do I read one" is answerable without grepping.
+   */
+  registeredAt?: string;
+}
+
+export type RegistrationErrorCode =
+  | "BAD_ID"
+  | "DUPLICATE_ID"
+  | "NO_PROFILES"
+  | "NO_LAYERS"
+  | "BASELINE_WITHOUT_FAILURE_CONDITION"
+  | "NO_MUST_RED"
+  | "MUST_RED_UNANSWERED"
+  | "TIER_BOUNDARY";
+
+export class ToothRegistrationError extends Error {
+  readonly code: RegistrationErrorCode;
+
+  constructor(code: RegistrationErrorCode, message: string) {
+    super(`[${code}] ${message}`);
+    this.name = "ToothRegistrationError";
+    this.code = code;
+  }
+}
+
+const ID_RE = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+
+const registry = new Map<string, ToothSpec>();
+
+/** The first stack frame outside this file = the registration site. */
+function callerSite(): string | undefined {
+  const stack = new Error().stack?.split("\n").slice(1) ?? [];
+  for (const frame of stack) {
+    // Three frame spellings across platforms/loaders: `file:///D:/x/y.ts:12:3`
+    // (ESM, note the drive-letter colon INSIDE the path), `/home/x/y.ts:12:3`
+    // (POSIX), `D:\x\y.ts:12:3` (win32 CJS). The path part is non-greedy so
+    // the :line:col tail — not the drive colon — anchors the split; a plain
+    // `file://` string-strip would leave `/D:/x/y.ts`, which win32
+    // path.relative mangles into `..\..\D:\...` garbage.
+    const m = /\(?((?:file:\/\/)?\/[^\s()]+?|[A-Za-z]:[\\/][^\s()]+?):(\d+):\d+\)?$/.exec(frame.trim());
+    if (!m) continue;
+    const raw = m[1]!;
+    const file = raw.startsWith("file://") ? fileURLToPath(raw) : raw;
+    if (file.replaceAll("\\", "/").endsWith("/registry.ts")) continue;
+    // Forward slashes in the recorded site: stable to parse and display
+    // everywhere, and node opens `/`-separated relative paths on win32 too.
+    return `${path.relative(process.cwd(), file).replaceAll("\\", "/")}:${m[2]}`;
+  }
+  return undefined;
+}
+
+export function registerTooth(spec: ToothSpec): void {
+  if (!spec.id || !ID_RE.test(spec.id)) {
+    throw new ToothRegistrationError(
+      "BAD_ID",
+      `tooth id ${JSON.stringify(spec.id)} must be non-empty dotted/kebab lower-case`,
+    );
+  }
+  if (registry.has(spec.id)) {
+    throw new ToothRegistrationError("DUPLICATE_ID", `tooth ${spec.id} already registered`);
+  }
+  if (!spec.profiles || spec.profiles.length === 0) {
+    throw new ToothRegistrationError("NO_PROFILES", `tooth ${spec.id} declares no profiles`);
+  }
+  if (!spec.layers || spec.layers.length === 0) {
+    throw new ToothRegistrationError("NO_LAYERS", `tooth ${spec.id} declares no layers`);
+  }
+  if (spec.kind.kind === "baseline" && !spec.kind.failureCondition.trim()) {
+    throw new ToothRegistrationError(
+      "BASELINE_WITHOUT_FAILURE_CONDITION",
+      `tooth ${spec.id} is baseline but states no failure condition (when should it go RED and what replaces it?)`,
+    );
+  }
+  if (!spec.mustRed || spec.mustRed.length === 0) {
+    throw new ToothRegistrationError(
+      "NO_MUST_RED",
+      `tooth ${spec.id} declares no must-red mutations — a check that cannot fail is decoration`,
+    );
+  }
+  for (const mr of spec.mustRed) {
+    if (!mr.mutate.trim()) {
+      throw new ToothRegistrationError("MUST_RED_UNANSWERED", `tooth ${spec.id}: empty mutation`);
+    }
+    if (
+      mr.caughtOnlyBy !== "this" &&
+      (!mr.caughtOnlyBy.alsoCaughtBy.trim() || !mr.caughtOnlyBy.whyStillNeeded.trim())
+    ) {
+      throw new ToothRegistrationError(
+        "MUST_RED_UNANSWERED",
+        `tooth ${spec.id}: mutation ${JSON.stringify(mr.mutate)} must answer "who else would catch this?" — either "this" or a justified alsoCaughtBy`,
+      );
+    }
+  }
+  for (const profile of spec.profiles) {
+    const allowed = PROFILE_LAYERS[profile];
+    for (const layer of spec.layers) {
+      if (!allowed.has(layer)) {
+        throw new ToothRegistrationError(
+          "TIER_BOUNDARY",
+          `tooth ${spec.id} is tagged profile "${profile}" but exercises layer ${layer}, outside that profile's set`,
+        );
+      }
+    }
+  }
+  const site = callerSite();
+  registry.set(spec.id, site === undefined ? { ...spec } : { ...spec, registeredAt: site });
+}
+
+/**
+ * Teeth that run for a profile and a set of opted-in capabilities.
+ * Capabilities default to all, so a caller that does not care gets the
+ * broadest set rather than silently running less than it thinks.
+ */
+export function teethFor(
+  profile: Profile,
+  capabilities: readonly Capability[] = ALL_CAPABILITIES,
+): ToothSpec[] {
+  return [...registry.values()].filter(
+    (t) =>
+      t.profiles.includes(profile) &&
+      (t.requiresCapability === undefined || capabilities.includes(t.requiresCapability)),
+  );
+}
+
+export function allTeeth(): ToothSpec[] {
+  return [...registry.values()];
+}
+
+/**
+ * Export consumed by the mutation-runner: every tooth with its declared
+ * must-red list (the runner's contract: unmutated baseline must be 0-fail,
+ * each declared mutation must turn the owning tooth red).
+ */
+export function exportForMutationRunner(): Array<{ id: string; mustRed: MustRed[] }> {
+  return [...registry.values()].map((t) => ({ id: t.id, mustRed: t.mustRed }));
+}
+
+/** Test-only: reset the registry between suites. */
+export function clearRegistry(): void {
+  registry.clear();
+}

package/harness/src/teeth/selfCheck.ts

@@ -0,0 +1,45 @@
+/**
+ * Harness self-check teeth — the tier lower-bound (a review fix:
+ * "零齿 = 假绿"). Each profile's tier must contain real (non-harness)
+ * teeth; a broken tier filter that empties a tier must go RED.
+ *
+ * Two layers of fail-closed protection:
+ *  1. runner.ts: a profile/adapter selection of ZERO checks is a typed
+ *     HARNESS_EMPTY_SELECTION FAIL (an empty receipt is never green);
+ *  2. these teeth: a tier that keeps only the harness self-check teeth
+ *     (non-empty receipt, but no real teeth) also goes RED.
+ */
+import assert from "node:assert/strict";
+import { registerTooth, teethFor, type Profile } from "./registry.ts";
+
+const HARNESS_PREFIX = "harness.";
+
+/** A profile tier must contain at least one real (non-self-check) tooth. */
+export async function checkTierHasTeeth(profile: Profile): Promise<void> {
+  const selected = teethFor(profile);
+  const real = selected.filter((t) => !t.id.startsWith(HARNESS_PREFIX));
+  assert.ok(
+    real.length > 0,
+    `HARNESS_EMPTY_TIER: profile ${profile} has ${selected.length} teeth, ${real.length} non-harness (tier filter likely emptied it)`,
+  );
+}
+
+for (const profile of ["swap", "service"] as const) {
+  registerTooth({
+    id: `harness.teeth-present-${profile}`,
+    profiles: [profile],
+    layers: ["L0"],
+    kind: { kind: "invariant" },
+    mustRed: [
+      {
+        mutate: `the tier filter drops every non-harness tooth from the ${profile} tier`,
+        caughtOnlyBy: {
+          alsoCaughtBy: "harness.empty-selection fail-closed (only when zero teeth remain at all)",
+          whyStillNeeded:
+            "empty-selection catches total emptiness; this tooth catches a tier that keeps the self-check teeth but loses the real ones — a non-empty receipt that would still be a false green",
+        },
+      },
+    ],
+    run: () => checkTierHasTeeth(profile),
+  });
+}

package/harness/src/teeth/sim.ts

@@ -0,0 +1,61 @@
+/** DST teeth: seeded replay, safety/liveness under faults, and fault-surface coverage. */
+import { registerTooth } from "./registry.ts";
+import {
+  checkFaultSurfaceCovered,
+  checkSeedReplayIdentical,
+  checkSmokeSeeds,
+} from "../sim/checks.ts";
+
+registerTooth({
+  id: "sim.seed-replay-identical",
+  profiles: ["service"],
+  layers: ["L1", "L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "the scheduler reads ambient entropy or ignores the supplied seed",
+      caughtOnlyBy: "this",
+    },
+  ],
+  run: checkSeedReplayIdentical,
+});
+
+registerTooth({
+  id: "sim.smoke-invariants",
+  profiles: ["service"],
+  layers: ["L1", "L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "journal fsync acknowledges an intent without making it durable",
+      caughtOnlyBy: "this",
+    },
+    {
+      mutate: "the host starts experiment without stopping the stable incarnation",
+      caughtOnlyBy: {
+        alsoCaughtBy: "fake-host no-dual-run scripted tooth",
+        whyStillNeeded:
+          "the scripted tooth checks one named path; DST checks the property after every seeded effect and recovery interleaving",
+      },
+    },
+    {
+      mutate: "terminal recovery leaves hosted work quiesced",
+      caughtOnlyBy: "this",
+    },
+  ],
+  run: checkSmokeSeeds,
+});
+
+registerTooth({
+  id: "sim.fault-surface-covered",
+  profiles: ["service"],
+  layers: ["L1", "L2"],
+  kind: { kind: "invariant" },
+  mustRed: [
+    {
+      mutate: "the fixed corpus silently stops generating one declared fault class",
+      caughtOnlyBy: "this",
+    },
+  ],
+  run: checkFaultSurfaceCovered,
+});

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@botiverse/k-carrier",
+  "version": "0.1.0",
+  "description": "A fail-closed upgrade carrier for long-running managed services: two-slot upgrade transactions (promote/rollback), host-driven quiesce/resume handoff, and post-upgrade convergence read-back.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": "./core/src/index.ts",
+    "./harness": "./harness/src/index.ts"
+  },
+  "bin": {
+    "k-harness": "./harness/src/cli.ts"
+  },
+  "files": [
+    "core/src/**/*.ts",
+    "harness/src/**/*.ts",
+    "!**/*.test.ts",
+    "docs",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "node --test --test-timeout=180000 \"core/src/**/*.test.ts\" \"harness/src/**/*.test.ts\"",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --deny-warnings core harness examples",
+    "ratchet": "bash scripts/ratchets.sh",
+    "sim": "node harness/src/cli.ts sim",
+    "check": "pnpm typecheck && pnpm lint && pnpm ratchet && pnpm test"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.2",
+    "oxlint": "^1.0.0",
+    "oxlint-tsgolint": "^7.0.2001",
+    "typescript": "^5.6.0"
+  }
+}