@dailephd/my-dev-kit-lab 0.4.2 → 0.4.3

package/dist/src/securityValidation/attackScenarios/scenarios/secretLeakageScenario.js

@@ -12,11 +12,215 @@ const SECRET_PATTERNS = [
     { kind: "github-token", regex: /gh[pousr]_[A-Za-z0-9]{16,}/g },
     { kind: "openai-token", regex: /sk-[A-Za-z0-9]{16,}/g },
     { kind: "aws-key", regex: /AKIA[0-9A-Z]{12,}/g },
-    {
-        kind: "generic-secret-assignment",
-        regex: /(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*["']?([A-Za-z0-9_\-]{8,})["']?/gi,
-    },
 ];
+// Only recognized configuration file forms may carry an unquoted literal
+// value; every other file (including all TypeScript/JavaScript/JVM/Gradle
+// source) requires a genuine quoted string literal before a match is even
+// considered.
+function genericSecretFileMode(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    const basename = normalized.slice(normalized.lastIndexOf("/") + 1).toLowerCase();
+    if (basename === ".env" || basename.startsWith(".env."))
+        return "allow-unquoted";
+    if (/\.(properties|yaml|yml|toml)$/.test(basename))
+        return "allow-unquoted";
+    return "quoted-only";
+}
+// Deterministic line-by-line comment filter. Preserves the original string
+// length and every newline so line numbers computed from the filtered
+// content remain identical to the original file; comment content (line or
+// block) is replaced with spaces so it can never contribute to a match.
+// Quote-aware: a comment marker inside a single- or double-quoted literal
+// does not start a comment, and a backslash-escaped quote does not end one.
+function stripCodeCommentsPreservingLength(content) {
+    const result = new Array(content.length);
+    let index = 0;
+    let inLineComment = false;
+    let inBlockComment = false;
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    while (index < content.length) {
+        const ch = content[index];
+        const next = index + 1 < content.length ? content[index + 1] : "";
+        if (inLineComment) {
+            if (ch === "\n") {
+                inLineComment = false;
+                result[index] = "\n";
+            }
+            else {
+                result[index] = " ";
+            }
+            index++;
+            continue;
+        }
+        if (inBlockComment) {
+            if (ch === "*" && next === "/") {
+                result[index] = " ";
+                result[index + 1] = " ";
+                inBlockComment = false;
+                index += 2;
+                continue;
+            }
+            result[index] = ch === "\n" ? "\n" : " ";
+            index++;
+            continue;
+        }
+        if (inSingleQuote || inDoubleQuote) {
+            result[index] = ch;
+            if (ch === "\\" && next !== "") {
+                result[index + 1] = next;
+                index += 2;
+                continue;
+            }
+            if ((inSingleQuote && ch === "'") || (inDoubleQuote && ch === '"')) {
+                inSingleQuote = false;
+                inDoubleQuote = false;
+            }
+            index++;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            inLineComment = true;
+            result[index] = " ";
+            index++;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            inBlockComment = true;
+            result[index] = " ";
+            index++;
+            continue;
+        }
+        if (ch === "'") {
+            inSingleQuote = true;
+            result[index] = ch;
+            index++;
+            continue;
+        }
+        if (ch === '"') {
+            inDoubleQuote = true;
+            result[index] = ch;
+            index++;
+            continue;
+        }
+        result[index] = ch;
+        index++;
+    }
+    return result.join("");
+}
+const GENERIC_SENSITIVE_SINGLE_WORDS = new Set(["password", "passwd", "secret", "token"]);
+function splitGenericIdentifierWords(identifier) {
+    const unquoted = identifier.replace(/^['"]|['"]$/g, "");
+    return unquoted
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .split(/[_\-.\s]+/)
+        .map((word) => word.toLowerCase())
+        .filter((word) => word.length > 0);
+}
+// Classifies only the complete left-side identifier already isolated by the
+// caller. Never inspects right-side text, so a function name, type name, or
+// argument on the right of an assignment can never itself be treated as a
+// sensitive identifier.
+//
+// The sensitive word must be the identifier's final component (e.g.
+// storePassword, DB_PASSWORD, accessToken) rather than appearing anywhere in
+// a compound name — this keeps unrelated metadata fields that merely mention
+// "token" as a leading/middle word (tokenUsageSource, tokenCountMethod) from
+// being treated as credential-shaped identifiers, while every required
+// sensitive example (password, storePassword, keyPassword, DB_PASSWORD,
+// SECRET_TOKEN, clientSecret, accessToken, apiKey, api_key) still ends in
+// its sensitive word.
+function isGenericSecretIdentifier(identifier) {
+    const words = splitGenericIdentifierWords(identifier);
+    if (words.length === 0)
+        return false;
+    const lastWord = words[words.length - 1];
+    if (GENERIC_SENSITIVE_SINGLE_WORDS.has(lastWord))
+        return true;
+    if (words.length >= 2 && words[words.length - 2] === "api" && lastWord === "key")
+        return true;
+    return false;
+}
+function stripSurroundingQuotes(value) {
+    if (value.length >= 2 && ((value[0] === '"' && value.endsWith('"')) || (value[0] === "'" && value.endsWith("'")))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+const DYNAMIC_VALUE_PREFIXES = ["$", "process.env", "system.getenv", "providers.gradleproperty"];
+function isDynamicUnquotedValue(rawValue) {
+    const lower = rawValue.toLowerCase();
+    return DYNAMIC_VALUE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+// Requires an identifier, a separator, and a value immediately following the
+// separator whose first non-whitespace character is a quote — this alone
+// structurally excludes function calls, identifier references, environment
+// lookups, and Gradle-property lookups, none of which begin with a quote.
+const QUOTED_ASSIGNMENT_PATTERN = /(?<![A-Za-z0-9_$])(["']?)([A-Za-z_$][A-Za-z0-9_$]*)\1\s*[:=]\s*(["'])((?:\\.|(?!\3)[^\\\r\n])*)\3/g;
+const UNQUOTED_CONFIG_PATTERN = /^([A-Za-z_][A-Za-z0-9_.-]*)\s*[:=]\s*(\S.*?)\s*$/;
+const MIN_GENERIC_SECRET_LENGTH = 8;
+function scanGenericSecretAssignments(relativePath, content) {
+    const findings = [];
+    const mode = genericSecretFileMode(relativePath);
+    const scannedContent = mode === "quoted-only" ? stripCodeCommentsPreservingLength(content) : content;
+    const lines = scannedContent.split("\n");
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+        const line = lines[lineIndex];
+        if (mode === "allow-unquoted") {
+            const trimmed = line.trim();
+            if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith(";"))
+                continue;
+            const unquotedMatch = UNQUOTED_CONFIG_PATTERN.exec(trimmed);
+            if (!unquotedMatch)
+                continue;
+            const identifier = unquotedMatch[1];
+            if (!isGenericSecretIdentifier(identifier))
+                continue;
+            const rawCandidate = unquotedMatch[2];
+            if (isDynamicUnquotedValue(rawCandidate))
+                continue;
+            const rawValue = stripSurroundingQuotes(rawCandidate);
+            if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
+                continue;
+            if (isPlaceholder(rawValue))
+                continue;
+            findings.push({
+                kind: "generic-secret-assignment",
+                file: relativePath,
+                line: lineIndex + 1,
+                matchedText: `${identifier} ${line.includes(":") ? ":" : "="} [REDACTED]`,
+                matchLength: rawValue.length,
+                severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
+            });
+            continue;
+        }
+        QUOTED_ASSIGNMENT_PATTERN.lastIndex = 0;
+        let match;
+        while ((match = QUOTED_ASSIGNMENT_PATTERN.exec(line)) !== null) {
+            const identifier = match[2];
+            const rawValue = match[4];
+            if (match[0].length === 0) {
+                QUOTED_ASSIGNMENT_PATTERN.lastIndex += 1;
+                continue;
+            }
+            if (!isGenericSecretIdentifier(identifier))
+                continue;
+            if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
+                continue;
+            if (isPlaceholder(rawValue))
+                continue;
+            findings.push({
+                kind: "generic-secret-assignment",
+                file: relativePath,
+                line: lineIndex + 1,
+                matchedText: `${identifier} [REDACTED]`,
+                matchLength: rawValue.length,
+                severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
+            });
+        }
+    }
+    return findings;
+}
 const PLACEHOLDER_MARKERS = [
     /\bexample\b/i,
     /change[-_]?me/i,
@@ -49,10 +253,7 @@ function scanFileForSecrets(relativePath, content) {
         let match;
         while ((match = re.exec(content)) !== null) {
             const matchedText = match[0];
-            // For the generic assignment pattern, judge placeholder-ness on the
-            // captured value; for shaped tokens, judge on the whole match.
-            const judgedText = kind === "generic-secret-assignment" ? (match[1] ?? matchedText) : matchedText;
-            if (isPlaceholder(judgedText) || isPlaceholder(matchedText)) {
+            if (isPlaceholder(matchedText)) {
                 // Downgrade: not a high-confidence finding, skip entirely rather
                 // than add noise — placeholders are expected in source/config.
                 continue;
@@ -72,12 +273,17 @@ function scanFileForSecrets(relativePath, content) {
             });
         }
     }
+    // Generic sensitive-identifier assignment scanning is syntax-aware (see
+    // scanGenericSecretAssignments above) and is appended after the shaped-
+    // token findings for this file; the caller's global sort by file/line
+    // keeps overall ordering deterministic.
+    findings.push(...scanGenericSecretAssignments(relativePath, content));
     return findings;
 }
 export const SECRET_LEAKAGE_SCENARIO = {
     id: "secret-leakage-bounded-scan",
     title: "Secret leakage: bounded static scan finds no high-confidence secret-shaped literals",
-    description: "Scans a bounded, deterministic set of project files (manifests, tsconfig, src/, scripts/, .env*) for high-confidence secret-shaped literal values (private keys, GitHub/OpenAI/AWS-style tokens, generic password/token/secret assignments). Placeholder values and bare env-var-name references are excluded from findings.",
+    description: "Scans a bounded, deterministic set of project files (manifests, tsconfig, src/, scripts/, .env*) for high-confidence secret-shaped literal values (private keys, GitHub/OpenAI/AWS-style tokens, and generic password/token/secret assignments). Generic assignments in code files require a genuine quoted string literal value; recognized configuration files (.env*, .properties, .yaml/.yml, .toml) may also carry an unquoted literal. Comments, type declarations, function calls, identifier references, and environment/Gradle-property lookups are never treated as literal values. Placeholder values are excluded from findings.",
     checkId: "secrets",
     applicableProfiles: [],
     severityBaseline: "informational",

package/docs/METRICS.md

@@ -3,17 +3,25 @@
 This document is the canonical metric glossary for my-dev-kit-lab. It defines every metric that appears in benchmark profiles, prompt variants, controlled experiment artifacts, and rendered reports.
 
 Related documentation:
-- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) — how metrics flow through the pipeline
-- [docs/TUTORIAL.md](docs/TUTORIAL.md) — how to read token savings and correctness scores in the report
-- [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md) — current baseline and limitations
+- [ARCHITECTURE.md](ARCHITECTURE.md) — how metrics flow through the pipeline
+- [TUTORIAL.md](TUTORIAL.md) — how to read token savings and correctness scores in the report
+- [CURRENT_STATE.md](CURRENT_STATE.md) — current capabilities, plans, and limitations
 
 ## Metric interpretation quick reference
 
-| Metric | Positive means | Negative means | N/A means |
+| Metric | Higher or positive value | Lower or negative value | Unavailable or N/A |
 |---|---|---|---|
-| `tokenSavings` | my-dev-kit used fewer tokens | my-dev-kit used more tokens | Token totals unavailable for one or both runs |
-| `correctnessScore` | More answer-key facts matched | Fewer answer-key facts matched | Run did not complete |
-| `complexityScore` | Higher project complexity | Lower project complexity | — |
+| `tokenSavingsPercent` | my-dev-kit used fewer tokens | my-dev-kit used more tokens | One or both runs lacked total-token data |
+| `correctnessScore` | More weighted answer-key evidence matched | Less weighted answer-key evidence matched | The run did not produce a scorable answer |
+| `complexityScore` | The heuristic indicates greater project complexity | The heuristic indicates lower project complexity | The project was not profiled |
+
+Each entry below uses the same fields: **Meaning**, **Appears in** (the artifact or report source), **Formula**, **Interpretation**, and **Caveat**. Availability follows these repository-wide rules:
+
+- Provider-reported tokens and character-based estimates are different sources and must remain labeled.
+- Unavailable means the required input was not supplied or exposed; it is not zero.
+- Zero is a measured or derived numeric result with a valid denominator.
+- Not applicable means the metric does not describe that run or strategy.
+- Invalid zero-denominator cases are reported explicitly rather than divided or coerced to zero.
 
 **Token savings notes:**
 - A positive token savings value means the my-dev-kit-guided strategy used fewer tokens than raw-full-file for that run pair.
@@ -30,7 +38,7 @@ Related documentation:
 - Small projects may show negative token savings because raw-full-file is cheaper when the entire project fits easily in context.
 - Larger, more localized tasks are where my-dev-kit is expected to become more useful.
 
-## Project Complexity Metrics
+## Project complexity metrics
 
 - `fileCount`
   Meaning: total non-generated files captured in the benchmark file tree.
@@ -129,7 +137,7 @@ Related documentation:
   Interpretation: human-readable size category.
   Caveat: coarse label; use the score and metrics for detail.
 
-## Prompt Complexity Metrics
+## Prompt complexity metrics
 
 - `promptChars`
   Meaning: prompt length in characters.
@@ -198,7 +206,7 @@ Related documentation:
   Interpretation: `true` means retrieval commands are part of the task.
   Caveat: prompt intent only.
 
-## Experiment And Run Metrics
+## Experiment and run metrics
 
 - `durationMs`
   Meaning: measured wall-clock duration of a normalized run.
@@ -284,3 +292,41 @@ Related documentation:
   Formula: derived from paired run outcomes and metric availability.
   Interpretation: stronger labels mean safer aggregate interpretation.
   Caveat: comparison reliability is not the same as correctness.
+
+## Planned v0.4.3 metrics
+
+Implemented in `src/evaluation/stageContextMetrics` and published in `v0.4.3`. This section is retained under its original "Planned v0.4.3 metrics" heading for documentation-consistency tooling; the metrics below are implemented and published, not planned. See [ROADMAP.md](ROADMAP.md) and [CHANGELOG.md](../CHANGELOG.md) for its release state.
+
+Every ratio metric below reports `availability` (`available`, `unavailable`, or `not-applicable`), `numerator`, `denominator`, and `rate` explicitly. Missing metric input is reported as `unavailable`, never coerced to zero; `not-applicable` is distinct from both. Every count metric reports `availability`, `count`, and bounded `evidenceKeys`.
+
+- `requiredEvidenceRecall`
+  Meaning: fraction of fixture-required evidence (files, symbols, source ranges, contracts, validators, constants, errors, schemas/serializers, production responsibilities, package scripts, test commands, and workflow/stage/command/rule/report-contract IDs) found in observed evidence.
+  Formula: matched required evidence / total required evidence.
+  Caveat: requires an explicit `StageContextExpectationFixtureV1`; not computable without it.
+- `allowedEvidenceCoverage`
+  Meaning: fraction of fixture-allowed (optional) evidence found in observed evidence.
+  Formula: matched allowed evidence / total allowed evidence.
+- `forbiddenEvidenceInclusion`
+  Meaning: fraction of fixture-forbidden evidence that was nonetheless observed.
+  Formula: observed forbidden evidence / total forbidden evidence.
+  Caveat: a `not-applicable` availability when no forbidden evidence is defined is not the same as zero forbidden inclusion.
+- `irrelevantFileInclusion` / `irrelevantInstructionInclusion`
+  Meaning: count of observed files/instructions that are not required or allowed by the fixture.
+  Caveat: zero irrelevant items is a real, available zero, not the same as `unavailable`.
+- `requiredProvenanceRecall`
+  Meaning: fraction of fixture-required provenance evidence IDs found in observed evidence.
+- `responsibilityMappingCompleteness`
+  Meaning: per source instance, whether context-capsule/retrieval-audit-record responsibility mappings are mapped, partially mapped, unmapped, or not applicable, with a mapped rate; partial mappings do not count as complete.
+- `stateComparisons`
+  Meaning: explicit expected-versus-actual comparisons of artifact state fields (for example context/role adequacy status, freshness state, truncation, unresolved-item counts, warning counts) declared in the fixture's expected states, each with its own `available`/`unavailable`/`not-applicable` availability.
+- `contextSize`
+  Meaning: per-source character count and estimated token count, plus totals, across all context sources supplied to the strategy.
+  Formula: estimated tokens use `ceil(characterCount / 4)` per source — an estimate, not provider-reported tokens.
+- `consideredButUnselectedReads` / `unnecessaryReads`
+  Meaning: counts of considered-but-unselected and unnecessary reads.
+  Caveat: the published upstream `RetrievalAuditRecord` does not expose this evidence; these metrics report `unavailable` with an explicit reason, never zero.
+- `targetImmutability`
+  Meaning: count of target mutations detected between the before and after target snapshots for a run.
+  Caveat: reports `unavailable` when no target-immutability configuration was supplied for the run; a configured, unchanged target reports an available count of zero.
+
+Repeated-run determinism (`StageContextDeterminismResultV1` in `src/evaluation/stageContextDeterminism`) reports whether repeated canonical runs (`repeatCount` 1 through 10, run 1 as baseline) produce identical canonicalized run values via SHA-256 digest comparison. A single run reports `not-applicable`; a canonicalization failure (for example a circular reference) reports `unavailable`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {

package/tests/fixtures/full-workflow-library/complete-v1.0.0.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "1.0.0",
+  "fixtureId": "FULL-WORKFLOW-LIBRARY-V043-001",
+  "title": "Complete workflow instruction library",
+  "description": "Deterministic full-workflow-library fixture for v0.4.3 strategy execution.",
+  "workflowIds": ["workflow.feature", "workflow.release"],
+  "stageIds": [
+    "stage.feature.architecture",
+    "stage.feature.implementation",
+    "stage.feature.test-implementation",
+    "stage.release.readiness"
+  ],
+  "commandIds": [
+    "command.context.inspect",
+    "command.test.focused",
+    "command.test.full",
+    "command.release.publish"
+  ],
+  "ruleIds": ["rule.scope.bounded", "rule.testing.required", "rule.release.publish-last"],
+  "reportContractIds": ["report.implementation", "report.release"],
+  "provenanceEvidenceIds": ["provenance.workflow.feature", "provenance.workflow.release"],
+  "rawText": "A deterministic complete workflow instruction library fixture containing architecture, implementation, test, validation, release, and reporting instructions.",
+  "warnings": []
+}

package/tests/fixtures/full-workflow-library/future-minor-v1.1.0-additive.json

@@ -0,0 +1,25 @@
+{
+  "schemaVersion": "1.1.0",
+  "fixtureId": "FULL-WORKFLOW-LIBRARY-V043-001",
+  "title": "Complete workflow instruction library",
+  "description": "Deterministic full-workflow-library fixture for v0.4.3 strategy execution.",
+  "futureMinorRootField": "preserved",
+  "workflowIds": ["workflow.feature", "workflow.release"],
+  "stageIds": [
+    "stage.feature.architecture",
+    "stage.feature.implementation",
+    "stage.feature.test-implementation",
+    "stage.release.readiness"
+  ],
+  "commandIds": [
+    "command.context.inspect",
+    "command.test.focused",
+    "command.test.full",
+    "command.release.publish"
+  ],
+  "ruleIds": ["rule.scope.bounded", "rule.testing.required", "rule.release.publish-last"],
+  "reportContractIds": ["report.implementation", "report.release"],
+  "provenanceEvidenceIds": ["provenance.workflow.feature", "provenance.workflow.release"],
+  "rawText": "A deterministic complete workflow instruction library fixture containing architecture, implementation, test, validation, release, and reporting instructions.",
+  "warnings": []
+}

package/tests/fixtures/stage-context-expectations/complete-v1.0.0.json

@@ -0,0 +1,230 @@
+{
+  "schemaVersion": "1.0.0",
+  "caseId": "CASE-STAGE-CONTEXT-002",
+  "title": "Complete stage-context expectation",
+  "description": "Complete valid expectation fixture covering every expectation category.",
+  "expectedEvidence": [
+    {
+      "expectationId": "REQ-FILE-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "file",
+      "match": { "path": "src/example.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-SYMBOL-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "symbol",
+      "match": { "symbolId": "symbol:src/example.ts#Example" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-SOURCE-RANGE-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "source-range",
+      "match": { "filePath": "src/example.ts", "startLine": 1, "endLine": 10 },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-CONTRACT-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "contract",
+      "match": { "symbolId": "contract:src/example.ts#ExampleContract" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-VALIDATOR-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "validator",
+      "match": { "symbolId": "validator:src/example.ts#validateExample" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-CONSTANT-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "constant",
+      "match": { "symbolId": "constant:src/example.ts#EXAMPLE_CONST" },
+      "notes": []
+    },
+    {
+      "expectationId": "FORBID-ERROR-001",
+      "inclusion": "forbidden",
+      "sourceArtifact": "context-capsule",
+      "category": "error",
+      "match": { "symbolId": "error:src/example.ts#ExampleError" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-SCHEMA-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "schema-or-serializer",
+      "match": { "symbolId": "schema:src/example.ts#ExampleSchema" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-RESPONSIBILITY-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "production-responsibility",
+      "match": { "responsibilityId": "fixture.responsibility.001" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-RESPONSIBILITY-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "retrieval-audit-record",
+      "category": "production-responsibility",
+      "match": { "responsibilityId": "fixture.responsibility.002" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-TEST-FILE-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "test-file",
+      "match": { "path": "tests/example.spec.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-FIXTURE-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "fixture",
+      "match": { "path": "tests/fixtures/example.json" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-FACTORY-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "factory",
+      "match": { "path": "tests/factories/exampleFactory.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "FORBID-MOCK-001",
+      "inclusion": "forbidden",
+      "sourceArtifact": "context-capsule",
+      "category": "mock",
+      "match": { "path": "tests/mocks/exampleMock.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-SETUP-FILE-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "setup-file",
+      "match": { "path": "tests/setup.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-TEST-CONFIGURATION-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "test-configuration",
+      "match": { "path": "vitest.config.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-PACKAGE-SCRIPT-001",
+      "inclusion": "required",
+      "sourceArtifact": "context-capsule",
+      "category": "package-script",
+      "match": { "name": "test" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-TEST-COMMAND-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "context-capsule",
+      "category": "test-command",
+      "match": { "commandText": "vitest run tests/example.spec.ts" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-WORKFLOW-001",
+      "inclusion": "required",
+      "sourceArtifact": "workflow-instruction-packet",
+      "category": "workflow",
+      "match": { "id": "workflow.feature" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-STAGE-001",
+      "inclusion": "required",
+      "sourceArtifact": "workflow-instruction-packet",
+      "category": "stage",
+      "match": { "id": "stage.feature.implementation" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-COMMAND-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "workflow-instruction-packet",
+      "category": "command",
+      "match": { "id": "command.repo.lint" },
+      "notes": []
+    },
+    {
+      "expectationId": "ALLOW-RULE-001",
+      "inclusion": "allowed",
+      "sourceArtifact": "full-workflow-library",
+      "category": "rule",
+      "match": { "id": "rule.quality.prefer-tests" },
+      "notes": []
+    },
+    {
+      "expectationId": "FORBID-REPORT-CONTRACT-001",
+      "inclusion": "forbidden",
+      "sourceArtifact": "workflow-instruction-packet",
+      "category": "report-contract",
+      "match": { "id": "report.other-summary" },
+      "notes": []
+    },
+    {
+      "expectationId": "REQ-PROVENANCE-001",
+      "inclusion": "required",
+      "sourceArtifact": "workflow-instruction-packet",
+      "category": "provenance",
+      "match": { "evidenceId": "symbol:src/example.ts#Example" },
+      "notes": []
+    }
+  ],
+  "expectedStates": {
+    "contextCapsule": {
+      "contextAdequacyStatus": "context sufficient with listed assumptions",
+      "roleAdequacyStatus": "context sufficient with listed assumptions",
+      "freshnessState": "fresh",
+      "truncated": false,
+      "fullFileFallbackUsed": 0,
+      "unresolvedItemIds": ["fixture.unresolved.001"],
+      "warningCount": 1
+    },
+    "retrievalAuditRecord": {
+      "contextAdequacyStatus": "context sufficient with listed assumptions",
+      "roleAdequacyStatus": "context sufficient with listed assumptions",
+      "freshnessState": "fresh",
+      "truncated": false,
+      "fullFileFallbackUsed": 1,
+      "unresolvedItemIds": [],
+      "warningCount": 1
+    },
+    "workflowInstructionPacket": {
+      "adequacyStatus": "adequate",
+      "truncated": false,
+      "unresolvedReferences": ["command.repo.unresolved-example"],
+      "warningCount": 0
+    },
+    "targetImmutability": {
+      "newMutationCount": 0
+    }
+  },
+  "warnings": []
+}