@dailephd/my-dev-kit-lab 0.8.1 → 0.9.0

package/dist/src/evaluation/agentSuccess/taskTypes.js

@@ -0,0 +1,14 @@
+export const AGENT_SUCCESS_TASK_SCHEMA_VERSION = "my-dev-kit-lab-agent-success-task-v1";
+/** Upper bound for one verification check; bounded so a hung check cannot stall an evaluation indefinitely. */
+export const MAX_VERIFICATION_CHECK_TIMEOUT_MS = 300_000;
+export class AgentSuccessTaskValidationError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Invalid agent-success task: ${issues
+            .slice(0, 5)
+            .map((issue) => `${issue.path}: ${issue.code}`)
+            .join("; ")}${issues.length > 5 ? `; +${issues.length - 5} more` : ""}`);
+        this.name = "AgentSuccessTaskValidationError";
+        this.issues = [...issues];
+    }
+}

package/dist/src/evaluation/agentSuccess/validateAgentSuccessCorpus.js

@@ -0,0 +1,307 @@
+import { AGENT_SUCCESS_CORPUS_PROJECT_IDS, AGENT_SUCCESS_CORPUS_RAW_INCLUDE_GLOBS, AGENT_SUCCESS_CORPUS_TASKS, AGENT_SUCCESS_PROJECTS_DIRECTORY, AGENT_SUCCESS_PROJECT_PROFILES_SCHEMA_VERSION, AgentSuccessCorpusError } from "./corpusTypes.js";
+import { extractPatchCandidate } from "./extractPatchCandidate.js";
+import { parseUnifiedDiff } from "./parseUnifiedDiff.js";
+import { normalizeProjectRelativePath } from "./taskPaths.js";
+import { validateAgentSuccessTask } from "./validateAgentSuccessTask.js";
+import { validatePatchPolicy } from "./validatePatchPolicy.js";
+const MAX_ISSUES = 60;
+const PROJECT_FIELDS = ["projectId", "displayName", "description", "rootPath", "sourceRoots", "testRoots", "primaryLanguage", "runtime"];
+const PROFILES_FIELDS = ["schemaVersion", "projects"];
+const CHECK_FILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\.check\.mjs$/;
+const MIN_LEAK_LINE_LENGTH = 12;
+/** Files every task must protect in addition to its check files. */
+const ALWAYS_PROTECTED = ["README.md", "package.json", "tests/regression.check.mjs"];
+class Collector {
+    issues = [];
+    add(code, path, message) {
+        if (this.issues.length < MAX_ISSUES)
+            this.issues.push({ code, path, message });
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sameList(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function isStringList(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function readProfiles(collector, input) {
+    if (!isRecord(input)) {
+        collector.add("PROFILES_INVALID", "profiles", "the project-profile catalog must be an object.");
+        return [];
+    }
+    for (const key of Object.keys(input)) {
+        if (!PROFILES_FIELDS.includes(key))
+            collector.add("PROFILES_INVALID", `profiles.${key}`, `unknown field "${key}".`);
+    }
+    if (input.schemaVersion !== AGENT_SUCCESS_PROJECT_PROFILES_SCHEMA_VERSION) {
+        collector.add("PROFILES_INVALID", "profiles.schemaVersion", `must equal ${AGENT_SUCCESS_PROJECT_PROFILES_SCHEMA_VERSION}.`);
+    }
+    if (!Array.isArray(input.projects)) {
+        collector.add("PROFILES_INVALID", "profiles.projects", "must be an array.");
+        return [];
+    }
+    const profiles = [];
+    input.projects.forEach((entry, index) => {
+        const base = `profiles.projects[${index}]`;
+        if (!isRecord(entry)) {
+            collector.add("PROFILE_INVALID", base, "must be an object.");
+            return;
+        }
+        for (const key of Object.keys(entry)) {
+            if (!PROJECT_FIELDS.includes(key))
+                collector.add("PROFILE_INVALID", `${base}.${key}`, `unknown field "${key}".`);
+        }
+        for (const key of ["projectId", "displayName", "description", "rootPath"]) {
+            if (typeof entry[key] !== "string" || entry[key].trim() === "") {
+                collector.add("PROFILE_INVALID", `${base}.${key}`, "must be a non-empty string.");
+            }
+        }
+        if (!isStringList(entry.sourceRoots) || !sameList(entry.sourceRoots, ["src"])) {
+            collector.add("PROFILE_INVALID", `${base}.sourceRoots`, 'must equal ["src"].');
+        }
+        if (!isStringList(entry.testRoots) || !sameList(entry.testRoots, ["tests"])) {
+            collector.add("PROFILE_INVALID", `${base}.testRoots`, 'must equal ["tests"].');
+        }
+        if (entry.primaryLanguage !== "javascript")
+            collector.add("PROFILE_INVALID", `${base}.primaryLanguage`, 'must equal "javascript".');
+        if (entry.runtime !== "node>=24")
+            collector.add("PROFILE_INVALID", `${base}.runtime`, 'must equal "node>=24".');
+        if (typeof entry.projectId === "string" && typeof entry.rootPath === "string") {
+            const normalized = normalizeProjectRelativePath(entry.rootPath);
+            const expected = `${AGENT_SUCCESS_PROJECTS_DIRECTORY}/${entry.projectId}`;
+            if (!normalized.ok || normalized.path !== expected) {
+                collector.add("PROFILE_ROOT_INVALID", `${base}.rootPath`, `must equal ${expected} (inside the controlled benchmark projects directory).`);
+            }
+        }
+        profiles.push({
+            projectId: String(entry.projectId ?? ""),
+            displayName: String(entry.displayName ?? ""),
+            description: String(entry.description ?? ""),
+            rootPath: String(entry.rootPath ?? ""),
+            sourceRoots: isStringList(entry.sourceRoots) ? [...entry.sourceRoots] : [],
+            testRoots: isStringList(entry.testRoots) ? [...entry.testRoots] : [],
+            primaryLanguage: "javascript",
+            runtime: "node>=24"
+        });
+    });
+    return profiles;
+}
+function validateProfileSet(collector, profiles) {
+    const ids = profiles.map((profile) => profile.projectId);
+    if (new Set(ids).size !== ids.length)
+        collector.add("PROJECT_SET_MISMATCH", "profiles.projects", "project ids must be unique.");
+    if (!sameList(ids, AGENT_SUCCESS_CORPUS_PROJECT_IDS)) {
+        collector.add("PROJECT_SET_MISMATCH", "profiles.projects", `expected exactly these project ids in order: ${AGENT_SUCCESS_CORPUS_PROJECT_IDS.join(", ")}.`);
+    }
+}
+function checkFileOf(args, testRoot) {
+    if (args.length !== 2 || args[0] !== "--test")
+        return null;
+    const normalized = normalizeProjectRelativePath(args[1]);
+    if (!normalized.ok)
+        return null;
+    const segments = normalized.path.split("/");
+    if (segments.length !== 2 || segments[0] !== testRoot)
+        return null;
+    return CHECK_FILE_PATTERN.test(segments[1]) ? normalized.path : null;
+}
+function validateChecks(collector, task, index, profile) {
+    const base = `tasks[${index}]`;
+    if (task.taskChecks.length !== 2)
+        collector.add("CHECK_COUNT_INVALID", `${base}.taskChecks`, "exactly two task checks are required.");
+    if (task.regressionChecks.length < 1)
+        collector.add("CHECK_COUNT_INVALID", `${base}.regressionChecks`, "at least one regression check is required.");
+    const files = [];
+    const testRoot = profile?.testRoots[0] ?? "tests";
+    const groups = [
+        ["taskChecks", task.taskChecks],
+        ["regressionChecks", task.regressionChecks]
+    ];
+    for (const [key, checks] of groups) {
+        checks.forEach((check, checkIndex) => {
+            const path = `${base}.${key}[${checkIndex}].args`;
+            const unsafe = check.args.some((arg) => normalizeProjectRelativePath(arg).ok === false && arg !== "--test");
+            const file = checkFileOf(check.args, testRoot);
+            if (file === null) {
+                collector.add(unsafe ? "CHECK_PATH_UNSAFE" : "CHECK_COMMAND_INVALID", path, `must be exactly ["--test", "${testRoot}/<name>.check.mjs"].`);
+            }
+            else {
+                files.push(file);
+            }
+        });
+    }
+    if (new Set(files).size !== files.length)
+        collector.add("CHECK_COMMAND_INVALID", `${base}.taskChecks`, "check files must be unique within a task.");
+    return files;
+}
+function validateScopes(collector, task, index, checkFiles) {
+    const base = `tasks[${index}]`;
+    if (task.expectedEditFiles.length === 0)
+        collector.add("EDIT_SCOPE_INVALID", `${base}.expectedEditFiles`, "must not be empty.");
+    for (const key of ["expectedEditFiles", "allowedEditFiles"]) {
+        for (const file of task[key]) {
+            if (!file.startsWith("src/"))
+                collector.add("EDIT_SCOPE_INVALID", `${base}.${key}`, `${file} is outside the project source root.`);
+        }
+    }
+    const protectedSet = new Set(task.protectedFiles);
+    for (const required of [...ALWAYS_PROTECTED, ...checkFiles]) {
+        if (!protectedSet.has(required))
+            collector.add("PROTECTED_SCOPE_INVALID", `${base}.protectedFiles`, `${required} must be protected.`);
+    }
+    for (const file of task.protectedFiles) {
+        if (file.startsWith("src/"))
+            collector.add("PROTECTED_SCOPE_INVALID", `${base}.protectedFiles`, `${file} is source and must not be protected.`);
+    }
+}
+function validateFacts(collector, task, index) {
+    const base = `tasks[${index}].behaviorFacts`;
+    if (!task.behaviorFacts.some((fact) => fact.required))
+        collector.add("FACT_COVERAGE_INVALID", base, "at least one required fact is needed.");
+    if (!task.behaviorFacts.some((fact) => !fact.required))
+        collector.add("FACT_COVERAGE_INVALID", base, "at least one optional fact is needed.");
+    task.behaviorFacts.forEach((fact, factIndex) => {
+        if (fact.verificationCheckIds.length === 0) {
+            collector.add("FACT_COVERAGE_INVALID", `${base}[${factIndex}].verificationCheckIds`, "every fact must reference at least one check.");
+        }
+    });
+}
+function changedLines(patch) {
+    return patch
+        .split("\n")
+        .filter((line) => (line.startsWith("+") && !line.startsWith("+++")) || (line.startsWith("-") && !line.startsWith("---")))
+        .map((line) => line.slice(1).trim())
+        .filter((line) => line.length >= MIN_LEAK_LINE_LENGTH);
+}
+function validateFixture(collector, task, index) {
+    const base = `tasks[${index}].deterministicFixture`;
+    const fixture = task.deterministicFixture;
+    if (fixture === undefined) {
+        collector.add("FIXTURE_MISSING", base, "a deterministic reference fixture is required.");
+        return;
+    }
+    const extracted = extractPatchCandidate(fixture.patch);
+    if (!extracted.ok) {
+        collector.add("FIXTURE_INVALID", base, `the reference patch is not an acceptable patch (${extracted.code}).`);
+        return;
+    }
+    const parsed = parseUnifiedDiff(extracted.patch);
+    if (!parsed.ok) {
+        collector.add("FIXTURE_INVALID", base, `the reference patch does not parse (${parsed.code}).`);
+        return;
+    }
+    const policy = validatePatchPolicy(parsed.files, { protectedFiles: task.protectedFiles });
+    if (!policy.ok) {
+        collector.add("FIXTURE_INVALID", base, `the reference patch violates the patch policy (${policy.rejections.map((r) => r.code).join(", ")}).`);
+        return;
+    }
+    const paths = policy.files.map((file) => file.path);
+    if (!sameList(paths, task.expectedEditFiles) || policy.files.some((file) => file.status !== "modified")) {
+        collector.add("FIXTURE_SCOPE_MISMATCH", base, "the reference patch must modify exactly the task's expectedEditFiles.");
+    }
+    const visibleText = `${task.query}\n${task.instruction}\n${task.title}`;
+    if (/(^|\n)(diff --git |@@ -)/.test(visibleText) || changedLines(fixture.patch).some((line) => visibleText.includes(line))) {
+        collector.add("FIXTURE_LEAKED", `tasks[${index}]`, "the task query, title or instruction reveals reference-patch content.");
+    }
+}
+function validateTasks(collector, input, profiles) {
+    if (!Array.isArray(input)) {
+        collector.add("TASKS_NOT_ARRAY", "tasks", "the task catalog must be an array.");
+        return [];
+    }
+    const tasks = [];
+    input.forEach((entry, index) => {
+        const result = validateAgentSuccessTask(entry);
+        if (!result.ok) {
+            for (const issue of result.issues.slice(0, 5))
+                collector.add("TASK_INVALID", `tasks[${index}].${issue.path}`.replace(/\.$/, ""), `${issue.code}: ${issue.message}`);
+            return;
+        }
+        tasks.push(result.task);
+    });
+    if (tasks.length !== input.length)
+        return tasks;
+    const ids = tasks.map((task) => task.id);
+    const seen = new Set();
+    ids.forEach((id, index) => {
+        if (seen.has(id))
+            collector.add("TASK_ID_DUPLICATE", `tasks[${index}].id`, `duplicate task id: ${id}.`);
+        seen.add(id);
+    });
+    const expectedIds = AGENT_SUCCESS_CORPUS_TASKS.map((task) => task.id);
+    if (tasks.length !== expectedIds.length) {
+        collector.add("TASK_COUNT_MISMATCH", "tasks", `expected exactly ${expectedIds.length} tasks, found ${tasks.length}.`);
+    }
+    else if (!sameList(ids, expectedIds) && new Set(ids).size === ids.length) {
+        collector.add("TASK_ORDER_MISMATCH", "tasks", `expected task ids in this order: ${expectedIds.join(", ")}.`);
+    }
+    const profileById = new Map(profiles.map((profile) => [profile.projectId, profile]));
+    const fixtureIds = new Set();
+    const fixturePatches = new Set();
+    const perProject = new Map();
+    tasks.forEach((task, index) => {
+        const base = `tasks[${index}]`;
+        const expectation = AGENT_SUCCESS_CORPUS_TASKS.find((candidate) => candidate.id === task.id);
+        const profile = profileById.get(task.projectProfileRef);
+        if (task.projectProfileRef !== task.benchmarkProject || profile === undefined) {
+            collector.add("PROJECT_REF_INVALID", `${base}.projectProfileRef`, "must equal benchmarkProject and resolve to a known project profile.");
+        }
+        else if (expectation !== undefined && expectation.project !== task.benchmarkProject) {
+            collector.add("PROJECT_REF_INVALID", `${base}.benchmarkProject`, `task ${task.id} belongs to ${expectation.project}.`);
+        }
+        if (expectation !== undefined && expectation.locality !== task.taskLocality) {
+            collector.add("LOCALITY_MISMATCH", `${base}.taskLocality`, `task ${task.id} must be ${expectation.locality}.`);
+        }
+        perProject.set(task.benchmarkProject, [...(perProject.get(task.benchmarkProject) ?? []), task.taskLocality]);
+        const sourceRoots = profile?.sourceRoots ?? ["src"];
+        if (!sameList(task.sourceRoots, sourceRoots)) {
+            collector.add("SOURCE_SCOPE_INVALID", `${base}.sourceRoots`, `must equal the project's source roots (${sourceRoots.join(", ")}).`);
+        }
+        if (!sameList(task.rawIncludeGlobs, AGENT_SUCCESS_CORPUS_RAW_INCLUDE_GLOBS)) {
+            collector.add("SOURCE_SCOPE_INVALID", `${base}.rawIncludeGlobs`, `must equal ${AGENT_SUCCESS_CORPUS_RAW_INCLUDE_GLOBS.join(", ")} so tests and contracts stay out of agent context.`);
+        }
+        const checkFiles = validateChecks(collector, task, index, profile);
+        validateScopes(collector, task, index, checkFiles);
+        validateFacts(collector, task, index);
+        validateFixture(collector, task, index);
+        if (task.deterministicFixture !== undefined) {
+            if (fixtureIds.has(task.deterministicFixture.id))
+                collector.add("FIXTURE_DUPLICATE", `${base}.deterministicFixture.id`, "fixture ids must be unique.");
+            if (fixturePatches.has(task.deterministicFixture.patch))
+                collector.add("FIXTURE_DUPLICATE", `${base}.deterministicFixture.patch`, "tasks must not share a reference patch.");
+            fixtureIds.add(task.deterministicFixture.id);
+            fixturePatches.add(task.deterministicFixture.patch);
+        }
+    });
+    for (const [project, localities] of perProject) {
+        const sorted = [...localities].sort();
+        if (!sameList(sorted, ["broad-change", "cross-module", "localized"])) {
+            collector.add("LOCALITY_DISTRIBUTION", "tasks", `project ${project} must have exactly one localized, one cross-module and one broad-change task.`);
+        }
+    }
+    return tasks;
+}
+/**
+ * Structural validation of the agent-success implementation corpus. Pure: it only inspects the two parsed
+ * catalogs. It never touches the filesystem and never applies or executes a reference patch; that is dynamic
+ * benchmark acceptance and is tested separately. The task shape is validated by validateAgentSuccessTask.
+ */
+export function validateAgentSuccessCorpus(input) {
+    const collector = new Collector();
+    const profiles = readProfiles(collector, input.profiles);
+    validateProfileSet(collector, profiles);
+    const tasks = validateTasks(collector, input.tasks, profiles);
+    if (collector.issues.length > 0)
+        return { ok: false, issues: collector.issues };
+    const corpus = { profiles, tasks };
+    return { ok: true, corpus };
+}
+export function assertAgentSuccessCorpus(input) {
+    const result = validateAgentSuccessCorpus(input);
+    if (!result.ok)
+        throw new AgentSuccessCorpusError(result.issues);
+    return result.corpus;
+}

package/dist/src/evaluation/agentSuccess/validateAgentSuccessTask.js

@@ -0,0 +1,297 @@
+import { TASK_LOCALITIES } from "../types.js";
+import { normalizeProjectRelativePath } from "./taskPaths.js";
+import { AGENT_SUCCESS_TASK_SCHEMA_VERSION, AgentSuccessTaskValidationError, MAX_VERIFICATION_CHECK_TIMEOUT_MS } from "./taskTypes.js";
+const MAX_ISSUES = 50;
+const MAX_SHORT_TEXT = 1000;
+const MAX_INSTRUCTION = 20_000;
+const MAX_FIXTURE_PATCH_BYTES = 1_048_576;
+const MAX_CHECK_ARGS = 64;
+const MAX_CHECK_ARG_LENGTH = 4096;
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const CHECK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const TASK_FIELDS = [
+    "schemaVersion",
+    "id",
+    "title",
+    "benchmarkProject",
+    "projectProfileRef",
+    "taskLocality",
+    "query",
+    "sourceRoots",
+    "rawIncludeGlobs",
+    "instruction",
+    "expectedEditFiles",
+    "allowedEditFiles",
+    "protectedFiles",
+    "taskChecks",
+    "regressionChecks",
+    "behaviorFacts",
+    "deterministicFixture"
+];
+const CHECK_FIELDS = ["id", "executable", "args", "timeoutMs"];
+const FACT_FIELDS = ["id", "text", "required", "verificationCheckIds"];
+const FIXTURE_FIELDS = ["id", "patch", "notes"];
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+class IssueCollector {
+    issues = [];
+    add(code, path, message) {
+        if (this.issues.length < MAX_ISSUES)
+            this.issues.push({ code, path, message });
+    }
+}
+function rejectUnknownFields(collector, value, allowed, base) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            collector.add("UNKNOWN_FIELD", base === "" ? key : `${base}.${key}`, `unknown field "${key}".`);
+    }
+}
+function readText(collector, source, key, base, maxLength) {
+    const path = base === "" ? key : `${base}.${key}`;
+    const value = source[key];
+    if (value === undefined) {
+        collector.add("MISSING_FIELD", path, "required field is missing.");
+        return "";
+    }
+    if (typeof value !== "string" || value.trim() === "") {
+        collector.add("INVALID_TYPE", path, "must be a non-empty string.");
+        return "";
+    }
+    if (value.length > maxLength) {
+        collector.add("INVALID_VALUE", path, `must be at most ${maxLength} characters.`);
+    }
+    return value;
+}
+function readArray(collector, source, key) {
+    const value = source[key];
+    if (value === undefined) {
+        collector.add("MISSING_FIELD", key, "required field is missing.");
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        collector.add("INVALID_TYPE", key, "must be an array.");
+        return undefined;
+    }
+    return value;
+}
+/** Normalizes, rejects duplicates, and returns the list sorted in code-unit order. */
+function readPathList(collector, source, key, requireNonEmpty) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (requireNonEmpty && raw.length === 0)
+        collector.add("INVALID_VALUE", key, "must not be empty.");
+    const seen = new Set();
+    raw.forEach((entry, index) => {
+        const normalized = normalizeProjectRelativePath(entry);
+        const path = `${key}[${index}]`;
+        if (!normalized.ok) {
+            collector.add(normalized.code, path, `unsafe or malformed project-relative path.`);
+            return;
+        }
+        if (seen.has(normalized.path)) {
+            collector.add("DUPLICATE_PATH", path, `duplicate path after normalization: ${normalized.path}.`);
+            return;
+        }
+        seen.add(normalized.path);
+    });
+    return [...seen].sort();
+}
+function readGlobList(collector, source, key) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (raw.length === 0)
+        collector.add("INVALID_VALUE", key, "must not be empty.");
+    const globs = [];
+    raw.forEach((entry, index) => {
+        const path = `${key}[${index}]`;
+        if (typeof entry !== "string" || entry.trim() === "" || entry.includes("\0")) {
+            collector.add("INVALID_TYPE", path, "must be a non-empty string without NUL.");
+        }
+        else if (/^([A-Za-z]:|[\\/])/.test(entry) || entry.replace(/\\/g, "/").split("/").includes("..")) {
+            collector.add("INVALID_VALUE", path, "must be a project-relative glob without traversal.");
+        }
+        else {
+            globs.push(entry);
+        }
+    });
+    return globs;
+}
+function readChecks(collector, source, key) {
+    const raw = readArray(collector, source, key);
+    if (raw === undefined)
+        return [];
+    if (raw.length < 1)
+        collector.add("TOO_FEW_CHECKS", key, "at least one check is required.");
+    const checks = [];
+    raw.forEach((entry, index) => {
+        const base = `${key}[${index}]`;
+        if (!isRecord(entry)) {
+            collector.add("NOT_OBJECT", base, "must be an object.");
+            return;
+        }
+        rejectUnknownFields(collector, entry, CHECK_FIELDS, base);
+        const id = entry.id;
+        if (typeof id !== "string" || !CHECK_ID_PATTERN.test(id)) {
+            collector.add("INVALID_VALUE", `${base}.id`, `must match ${CHECK_ID_PATTERN.source}.`);
+        }
+        if (entry.executable !== "node") {
+            collector.add("INVALID_EXECUTABLE", `${base}.executable`, 'the only supported executable is "node".');
+        }
+        const args = entry.args;
+        if (!Array.isArray(args) ||
+            args.length > MAX_CHECK_ARGS ||
+            !args.every((arg) => typeof arg === "string" && !arg.includes("\0") && arg.length <= MAX_CHECK_ARG_LENGTH)) {
+            collector.add("INVALID_TYPE", `${base}.args`, `must be an array of at most ${MAX_CHECK_ARGS} strings without NUL.`);
+        }
+        const timeoutMs = entry.timeoutMs;
+        if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_VERIFICATION_CHECK_TIMEOUT_MS) {
+            collector.add("INVALID_TIMEOUT", `${base}.timeoutMs`, `must be a finite number in (0, ${MAX_VERIFICATION_CHECK_TIMEOUT_MS}].`);
+        }
+        if (typeof id === "string" && Array.isArray(args) && typeof timeoutMs === "number") {
+            checks.push({ id, executable: "node", args: args, timeoutMs });
+        }
+    });
+    return checks;
+}
+function readFacts(collector, source, checkIds) {
+    const raw = readArray(collector, source, "behaviorFacts");
+    if (raw === undefined)
+        return [];
+    const facts = [];
+    const seen = new Set();
+    raw.forEach((entry, index) => {
+        const base = `behaviorFacts[${index}]`;
+        if (!isRecord(entry)) {
+            collector.add("NOT_OBJECT", base, "must be an object.");
+            return;
+        }
+        rejectUnknownFields(collector, entry, FACT_FIELDS, base);
+        const id = readText(collector, entry, "id", base, 128);
+        const text = readText(collector, entry, "text", base, MAX_SHORT_TEXT);
+        if (id !== "" && seen.has(id))
+            collector.add("DUPLICATE_FACT_ID", `${base}.id`, `duplicate fact id: ${id}.`);
+        seen.add(id);
+        if (typeof entry.required !== "boolean")
+            collector.add("INVALID_TYPE", `${base}.required`, "must be a boolean.");
+        const ids = entry.verificationCheckIds;
+        if (!Array.isArray(ids) || !ids.every((value) => typeof value === "string")) {
+            collector.add("INVALID_TYPE", `${base}.verificationCheckIds`, "must be an array of strings.");
+            return;
+        }
+        ids.forEach((checkId, checkIndex) => {
+            if (!checkIds.has(checkId)) {
+                collector.add("UNRESOLVED_CHECK_ID", `${base}.verificationCheckIds[${checkIndex}]`, `unknown check id: ${checkId}.`);
+            }
+        });
+        if (entry.required === true && ids.length === 0) {
+            collector.add("REQUIRED_FACT_UNMAPPED", `${base}.verificationCheckIds`, "a required fact must reference at least one check.");
+        }
+        facts.push({ id, text, required: entry.required === true, verificationCheckIds: [...ids] });
+    });
+    return facts;
+}
+function readFixture(collector, source) {
+    const raw = source.deterministicFixture;
+    if (raw === undefined)
+        return undefined;
+    if (!isRecord(raw)) {
+        collector.add("NOT_OBJECT", "deterministicFixture", "must be an object.");
+        return undefined;
+    }
+    rejectUnknownFields(collector, raw, FIXTURE_FIELDS, "deterministicFixture");
+    const id = readText(collector, raw, "id", "deterministicFixture", 128);
+    const patch = readText(collector, raw, "patch", "deterministicFixture", MAX_FIXTURE_PATCH_BYTES);
+    const fixture = { id, patch };
+    if (raw.notes !== undefined) {
+        if (typeof raw.notes === "string")
+            fixture.notes = raw.notes;
+        else
+            collector.add("INVALID_TYPE", "deterministicFixture.notes", "must be a string.");
+    }
+    return fixture;
+}
+/**
+ * Validates an AgentSuccessTaskV1 candidate. Closed-set: unknown fields are rejected. Returns the normalized
+ * task (POSIX paths, sorted, de-duplicated by rejection) or a bounded, deterministically ordered issue list.
+ */
+export function validateAgentSuccessTask(input) {
+    const collector = new IssueCollector();
+    if (!isRecord(input)) {
+        collector.add("NOT_OBJECT", "", "a task must be an object.");
+        return { ok: false, issues: collector.issues };
+    }
+    rejectUnknownFields(collector, input, TASK_FIELDS, "");
+    if (input.schemaVersion !== AGENT_SUCCESS_TASK_SCHEMA_VERSION) {
+        collector.add("INVALID_SCHEMA_VERSION", "schemaVersion", `must equal ${AGENT_SUCCESS_TASK_SCHEMA_VERSION}.`);
+    }
+    const id = readText(collector, input, "id", "", 128);
+    if (id !== "" && !ID_PATTERN.test(id))
+        collector.add("INVALID_VALUE", "id", `must match ${ID_PATTERN.source}.`);
+    const title = readText(collector, input, "title", "", MAX_SHORT_TEXT);
+    const benchmarkProject = readText(collector, input, "benchmarkProject", "", MAX_SHORT_TEXT);
+    const projectProfileRef = readText(collector, input, "projectProfileRef", "", MAX_SHORT_TEXT);
+    const query = readText(collector, input, "query", "", MAX_SHORT_TEXT);
+    const instruction = readText(collector, input, "instruction", "", MAX_INSTRUCTION);
+    const taskLocality = input.taskLocality;
+    if (!TASK_LOCALITIES.includes(taskLocality)) {
+        collector.add("INVALID_VALUE", "taskLocality", `must be one of ${TASK_LOCALITIES.join(", ")}.`);
+    }
+    const sourceRoots = readPathList(collector, input, "sourceRoots", true);
+    const rawIncludeGlobs = readGlobList(collector, input, "rawIncludeGlobs");
+    const expectedEditFiles = readPathList(collector, input, "expectedEditFiles", false);
+    const allowedEditFiles = readPathList(collector, input, "allowedEditFiles", false);
+    const protectedFiles = readPathList(collector, input, "protectedFiles", false);
+    const allowed = new Set(allowedEditFiles);
+    expectedEditFiles.forEach((file) => {
+        if (!allowed.has(file))
+            collector.add("EXPECTED_NOT_ALLOWED", "expectedEditFiles", `${file} is not in allowedEditFiles.`);
+    });
+    const protectedSet = new Set(protectedFiles);
+    for (const file of [...expectedEditFiles, ...allowedEditFiles]) {
+        if (protectedSet.has(file))
+            collector.add("PROTECTED_OVERLAP", "protectedFiles", `${file} is also an expected or allowed edit file.`);
+    }
+    const taskChecks = readChecks(collector, input, "taskChecks");
+    const regressionChecks = readChecks(collector, input, "regressionChecks");
+    const checkIds = new Set();
+    for (const check of [...taskChecks, ...regressionChecks]) {
+        if (checkIds.has(check.id))
+            collector.add("DUPLICATE_CHECK_ID", "taskChecks", `check id used more than once: ${check.id}.`);
+        checkIds.add(check.id);
+    }
+    const behaviorFacts = readFacts(collector, input, checkIds);
+    const deterministicFixture = readFixture(collector, input);
+    if (collector.issues.length > 0) {
+        return { ok: false, issues: collector.issues };
+    }
+    const task = {
+        schemaVersion: AGENT_SUCCESS_TASK_SCHEMA_VERSION,
+        id,
+        title,
+        benchmarkProject,
+        projectProfileRef,
+        taskLocality: taskLocality,
+        query,
+        sourceRoots,
+        rawIncludeGlobs,
+        instruction,
+        expectedEditFiles,
+        allowedEditFiles,
+        protectedFiles,
+        taskChecks,
+        regressionChecks,
+        behaviorFacts,
+        ...(deterministicFixture ? { deterministicFixture } : {})
+    };
+    return { ok: true, task };
+}
+/** Throwing variant for callers that treat an invalid task as a programming/configuration error. */
+export function assertAgentSuccessTask(input) {
+    const result = validateAgentSuccessTask(input);
+    if (!result.ok)
+        throw new AgentSuccessTaskValidationError(result.issues);
+    return result.task;
+}