@danceiny/gotry 0.2.0-rc.32 → 0.2.0-rc.33

package/dist/scripts/booking-copilot-gateway-chat-adapter-tests.js

@@ -0,0 +1,233 @@
+/**
+ * Proof tests for the gateway chat-completions LLM plugin
+ * (dsh-llm-gateway-chat.js): wire dialect against a mock OpenAI-style
+ * chat/completions server, patch wiring, and provider selection.
+ *
+ * Run: npx tsx scripts/booking-copilot-gateway-chat-adapter-tests.ts
+ */
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+// A string-typed specifier keeps TypeScript from resolving the undeclared JS
+// module; GatewayChatModule above is the surface this proof relies on.
+const GATEWAY_CHAT_MODULE = '../src/booking-surface/dsh-llm-gateway-chat.js';
+const { GatewayChatAdapter } = await import(GATEWAY_CHAT_MODULE);
+const { buildDshEmbeddedBookingPatch, resolveRealRunPortConfig } = await import('../src/booking-surface/dsh-planner.js');
+function chunksOf(chunks, type) {
+    return chunks.filter((chunk) => chunk.type === type);
+}
+function firstChunk(chunks, type) {
+    const [chunk] = chunksOf(chunks, type);
+    assert.ok(chunk, `expected a ${type} chunk`);
+    return chunk;
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+}
+function sse(res, frames) {
+    res.writeHead(200, { 'content-type': 'text/event-stream' });
+    for (const frame of frames)
+        res.write(frame);
+    res.end('data: [DONE]\n\n');
+}
+async function withMockServer(handler, run) {
+    const server = createServer(handler);
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    try {
+        const address = server.address();
+        assert.ok(address !== null && typeof address === 'object', 'mock server listens on a TCP port');
+        return await run(address.port);
+    }
+    finally {
+        server.close();
+    }
+}
+function adapterFor(port, captured) {
+    return new GatewayChatAdapter({
+        resolveConnection: () => ({ baseURL: `http://127.0.0.1:${port}/v1`, models: [] }),
+        resolveApiKey: async () => 'test-only-key',
+        providerName: 'Gateway Chat',
+        ...(captured !== undefined ? { __captured: captured } : {}),
+    });
+}
+// 1. A tool-calling stream translates to harness chunks: text block, tool-call
+//    accumulation across deltas, deferred block-ends, usage, and tool-calls finish.
+{
+    const requests = [];
+    const chunks = await withMockServer((req, res) => {
+        let body = '';
+        req.on('data', (c) => { body += c; });
+        req.on('end', () => {
+            requests.push(JSON.parse(body));
+            sse(res, [
+                'data: {"choices":[{"delta":{"role":"assistant","content":"Let me search"}}]}\n\n',
+                'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"id":"call_1","function":{"name":"booking_search_hotels","arguments":"{\\"input\\":"}}]}}]}\n\n',
+                'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"function":{"arguments":"{\\"destination\\":\\"Osaka\\"}"}}]}}]}\n\n',
+                'data: {"choices":[{"delta":{},"finish_reason":"tool_calls"}],"usage":{"prompt_tokens":100,"completion_tokens":20,"total_tokens":120,"prompt_tokens_details":{"cached_tokens":40},"completion_tokens_details":{"reasoning_tokens":5}}}\n\n',
+            ]);
+        });
+    }, async (port) => {
+        const out = [];
+        for await (const chunk of adapterFor(port).stream({
+            provider: 'gateway-chat',
+            model: 'deepseek-flash',
+            messages: [
+                { role: 'system', content: [{ type: 'text', text: 'planner system prompt' }] },
+                { role: 'user', content: [{ type: 'text', text: 'hotels in Osaka' }] },
+            ],
+            tools: [{ name: 'booking_search_hotels', description: 'search hotels', parameters: { type: 'object', properties: {} } }],
+            maxTokens: 16_384,
+        }))
+            out.push(chunk);
+        return out;
+    });
+    assert.equal(requests.length, 1);
+    assert.equal(requests[0].model, 'deepseek-flash');
+    assert.deepEqual(requests[0].messages.map((m) => m.role), ['system', 'user']);
+    assert.equal(requests[0].tools?.[0].type, 'function');
+    assert.equal(requests[0].tools?.[0].function.name, 'booking_search_hotels');
+    assert.equal(requests[0].stream, true);
+    assert.deepEqual(requests[0].stream_options, { include_usage: true });
+    // The harness profile runs the planner with thinking enabled at high effort
+    // (rc.1 wire parity); dropping these fields measurably degrades the model's
+    // adherence to the planner's intent rules.
+    assert.deepEqual(requests[0].thinking, { type: 'enabled' });
+    assert.equal(requests[0].reasoning_effort, 'high');
+    const kinds = chunks.map((c) => c.type);
+    assert.deepEqual(kinds, ['block-start', 'text-delta', 'block-start', 'tool-call-delta', 'tool-call-delta', 'block-end', 'block-end', 'usage', 'finish']);
+    const text = firstChunk(chunks, 'text-delta');
+    assert.equal(text.text, 'Let me search');
+    const toolDelta = chunksOf(chunks, 'tool-call-delta');
+    assert.equal(toolDelta[0].id, 'call_1');
+    assert.equal(toolDelta[0].name, 'booking_search_hotels');
+    assert.equal(toolDelta.map((c) => c.argumentsDelta).join(''), '{"input":{"destination":"Osaka"}');
+    const ends = chunksOf(chunks, 'block-end');
+    assert.equal(ends[0].block.type, 'text');
+    const toolBlock = ends[1].block;
+    assert.ok(toolBlock.type === 'tool-call', 'the second block closes the tool call');
+    assert.equal(toolBlock.arguments, '{"input":{"destination":"Osaka"}');
+    const usage = firstChunk(chunks, 'usage');
+    assert.equal(usage.usage.inputTokens, 60, 'cache reads subtract from prompt tokens');
+    assert.equal(usage.usage.outputTokens, 20);
+    assert.equal(usage.usage.totalTokens, 120);
+    assert.equal(usage.usage.cacheReadTokens, 40);
+    assert.equal(usage.usage.reasoningTokens, 5);
+    const finish = firstChunk(chunks, 'finish');
+    assert.deepEqual(finish.reason, { kind: 'tool-calls' });
+}
+// 2. Tool-result history round-trips as `role:"tool"` wire messages.
+{
+    const requests = [];
+    await withMockServer((req, res) => {
+        let body = '';
+        req.on('data', (c) => { body += c; });
+        req.on('end', () => {
+            requests.push(JSON.parse(body));
+            sse(res, [
+                'data: {"choices":[{"delta":{"content":"done"}}]}\n\n',
+                'data: {"choices":[{"delta":{},"finish_reason":"stop"}]}\n\n',
+            ]);
+        });
+    }, async (port) => {
+        const out = [];
+        for await (const chunk of adapterFor(port).stream({
+            provider: 'gateway-chat',
+            model: 'deepseek-flash',
+            reasoningEffort: 'off',
+            messages: [
+                { role: 'user', content: [{ type: 'text', text: 'hotels in Osaka' }] },
+                { role: 'assistant', content: [{ type: 'tool-call', id: 'call_9', name: 'booking_search_hotels', arguments: '{"input":{}}' }] },
+                { role: 'user', content: [{ type: 'tool-result', toolCallId: 'call_9', content: [{ type: 'text', text: '598 hotels' }] }] },
+            ],
+        }))
+            out.push(chunk);
+        return out;
+    });
+    assert.deepEqual(requests[0].thinking, { type: 'disabled' }, 'reasoningEffort=off maps to thinking disabled');
+    assert.equal(requests[0].reasoning_effort, undefined, 'off never crosses the wire as an effort');
+    const roles = requests[0].messages.map((m) => m.role);
+    assert.deepEqual(roles, ['user', 'assistant', 'tool']);
+    assert.equal(requests[0].messages[1].tool_calls?.[0].id, 'call_9');
+    assert.equal(requests[0].messages[2].tool_call_id, 'call_9');
+    assert.equal(requests[0].messages[2].content, '598 hotels');
+}
+// 3. HTTP failure statuses map to typed LlmError codes.
+{
+    await withMockServer((req, res) => {
+        res.writeHead(401, { 'content-type': 'application/json' });
+        res.end('{"error":"bad key"}');
+    }, async (port) => {
+        await assert.rejects(() => adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] }).next(), (error) => errorCode(error) === 'AUTH');
+    });
+}
+// 4. A stream that dies before [DONE] is STREAM_CLOSED, never a silent success.
+{
+    await withMockServer((req, res) => {
+        res.writeHead(200, { 'content-type': 'text/event-stream' });
+        res.write('data: {"choices":[{"delta":{"content":"partial"}}]}\n\n');
+        res.end();
+    }, async (port) => {
+        await assert.rejects(() => adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] }).next(), () => true).catch((error) => {
+            // first next() may surface the text-delta fine; the failure lands on the
+            // following tick — drain to the throw.
+        });
+        let saw = false;
+        try {
+            for await (const _chunk of adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] })) {
+                void _chunk;
+            }
+        }
+        catch (error) {
+            saw = errorCode(error) === 'STREAM_CLOSED';
+        }
+        assert.ok(saw, 'a truncated stream must surface STREAM_CLOSED');
+    });
+}
+// 4b. Exact model metadata satisfies the harness INVALID_MODEL_INFO gate
+//     (provider/id/name required) and prepareCall returns the { model } shape.
+{
+    const adapter = adapterFor(1);
+    const info = await adapter.resolveModel('gateway-chat', 'deepseek-flash');
+    assert.equal(info.provider, 'gateway-chat');
+    assert.equal(info.id, 'deepseek-flash');
+    assert.equal(info.name, 'deepseek-flash');
+    assert.ok(info.context.contextWindow > 0);
+    assert.ok(info.reasoning.efforts.some((e) => e.id === 'off'));
+    const prepared = await adapter.prepareCall('gateway-chat', 'deepseek-flash');
+    assert.equal(prepared.model.id, 'deepseek-flash');
+    assert.equal(typeof prepared.stream, 'function');
+}
+// 5. The patch renders both plugin inserts: the typed tools plugin and the
+//    gateway chat-completions LLM plugin.
+{
+    const patch = buildDshEmbeddedBookingPatch('/tools/plugin.js', '/llm/gateway.js');
+    assert.match(patch, /- id: gotry-embedded-booking\n/);
+    assert.match(patch, /name: '\/tools\/plugin\.js'/);
+    assert.match(patch, /- id: llm-gateway-chat\n/);
+    assert.match(patch, /name: '\/llm\/gateway\.js'/);
+    const minimal = buildDshEmbeddedBookingPatch('/tools/plugin.js');
+    assert.match(minimal, /gotry-embedded-booking/);
+    assert.doesNotMatch(minimal, /llm-gateway-chat/);
+}
+// 6. Provider selection: DEEPSEEK_PROVIDER rides the child env and selects the
+//    gateway route without an explicit option.
+{
+    const resolved = resolveRealRunPortConfig({
+        env: {
+            DEEPSEEK_API_KEY: 'k',
+            DEEPSEEK_BASE_URL: 'http://gw/v1',
+            DEEPSEEK_MODEL: 'deepseek-flash',
+            DEEPSEEK_PROVIDER: 'gateway-chat',
+        },
+    });
+    assert.equal(resolved.provider, 'gateway-chat');
+    assert.equal(resolved.childEnv.DEEPSEEK_PROVIDER, 'gateway-chat');
+    const fallback = resolveRealRunPortConfig({
+        env: {
+            DEEPSEEK_API_KEY: 'k',
+            DEEPSEEK_MODEL: 'deepseek-flash',
+        },
+    });
+    assert.equal(fallback.provider, 'deepseek-official');
+    assert.equal(fallback.childEnv.DEEPSEEK_PROVIDER, undefined);
+}
+console.log('BOOKING COPILOT GATEWAY CHAT ADAPTER PROOF: wire dialect/tool round-trip/status mapping/patch wiring/provider selection OK');

package/dist/scripts/booking-copilot-planner-live-probe.js

@@ -67,6 +67,7 @@ try {
             DEEPSEEK_API_KEY: apiKey,
             DEEPSEEK_BASE_URL: baseUrl,
             DEEPSEEK_MODEL: model,
+            ...(process.env.DEEPSEEK_PROVIDER ? { DEEPSEEK_PROVIDER: process.env.DEEPSEEK_PROVIDER } : {}),
         },
         // Match the UAT deployment deadline (planner-model-plane.yaml turnTimeoutMs).
         turnTimeoutMs: 45_000,

package/dist/scripts/booking-copilot-startup-proof-tests.js

@@ -68,7 +68,7 @@ const started = await startBookingCopilotFromEnvironment(trustedEnv, {
     ingressBinding: trustedBinding,
     principal: { subject: 'startup-bff', scope: 'booking:read' },
     async startServer(options) {
-        serverApiKey = options.apiKey;
+        serverApiKey = options.apiKey ?? '';
         serverArtifactId = options.artifactId ?? '';
         assert.equal(options.ingressMode, 'bff-ingress-binding');
         return {

package/dist/scripts/bridge-ledger-tests.js

@@ -31,6 +31,8 @@ import Database from 'better-sqlite3';
 import { EXTENSION_ORIGIN, createBridgeJobQueue, } from '../capabilities/session/extension-bridge.js';
 import { BRIDGE_SITE_COOLDOWN_MS, BridgeLedgerStore, bridgeLedgerDbPath, openBridgeLedgerStore, } from '../capabilities/session/bridge-ledger.js';
 import { startSessionSearchModule } from '../src/backend/modules/session-search.js';
+// 账本方法的组织参数必填(漏传是编译错误):本套件验证的是缺省的单车道,统一传 local
+const LOCAL = 'local';
 let passed = 0;
 async function check(label, assertion) {
     await assertion();
@@ -180,7 +182,7 @@ async function main() {
             assert.equal(row?.claimed_by_client, CLAIM_CLIENT);
             assert.equal(row?.attempts, 1);
             assert.ok(row?.claimed_at !== null, 'claimed_at 落账');
-            const pacing = storeC.pacingOf('dida-portal');
+            const pacing = storeC.pacingOf(LOCAL, 'dida-portal');
             assert.ok(pacing && pacing.cooldownUntil > Date.now(), '导航类作业领取即记节律冷却');
             // 正常善果回包 → resolved + result 保留
             const r = await postResult(server.port, polled.job.jobId, { ok: true, kind: 'search', body: '{"rates":[]}', title: 'ok' }, { clientId: CLAIM_CLIENT });
@@ -213,7 +215,7 @@ async function main() {
             const row = storeC.getJob(polled.job.jobId);
             assert.equal(row?.status, 'unresolved', '曾被领取的超时终态 = unresolved');
             assert.ok(row?.result_json?.includes('timeout'), '超时结算留 timeout 备注');
-            const pacing = storeC.pacingOf('train-12306');
+            const pacing = storeC.pacingOf(LOCAL, 'train-12306');
             assert.ok(pacing && pacing.cooldownUntil >= Date.now() + BRIDGE_SITE_COOLDOWN_MS - 2_000, '超时结算把站点冷却推满');
         }
         finally {
@@ -224,7 +226,7 @@ async function main() {
         const server = await serveQueue(queueC);
         try {
             const pending = queueC.submit({ kind: 'search', site: 'ctrip-hotel', url: 'https://hotels.ctrip.com/hotels/list' }, { timeoutMs: 300, extensionWaitMs: 30_000 });
-            const pacingAtSubmit = storeC.pacingOf('ctrip-hotel');
+            const pacingAtSubmit = storeC.pacingOf(LOCAL, 'ctrip-hotel');
             assert.ok(pacingAtSubmit && pacingAtSubmit.cooldownUntil > Date.now(), '导航类作业提交即记节律(与 sessionDidaSearch 内存闸同语义:提交即承诺一次导航)');
             const outcome = await pending;
             assert.equal(outcome.ok, false);
@@ -238,7 +240,7 @@ async function main() {
                 raw.close();
             }
             assert.equal(voided.length, 1, '未被领取的超时作业 = void');
-            const pacingAfter = storeC.pacingOf('ctrip-hotel');
+            const pacingAfter = storeC.pacingOf(LOCAL, 'ctrip-hotel');
             assert.equal(pacingAfter?.cooldownUntil, pacingAtSubmit?.cooldownUntil, '从未被领取的超时结算不追加冷却(站点未被打)');
         }
         finally {
@@ -273,12 +275,12 @@ async function main() {
         let server;
         try {
             // 直接落账模拟上一进程崩溃后的持久状态(不经过队列 close——close 会把未领取作业落 void)
-            storeE.insertQueuedJob({ jobId: 'rec-queued-fresh', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, t0 + 60_000);
-            storeE.insertQueuedJob({ jobId: 'rec-queued-stale', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, t0 - 1_000);
-            storeE.insertQueuedJob({ jobId: 'rec-claimed-live', kind: 'search', site: 'ctrip-flight', url: 'https://flights.ctrip.com/online/list' }, t0 + 60_000);
-            storeE.markClaimed('rec-claimed-live', { origin: EXTENSION_ORIGIN, clientId: LIVE_CLIENT });
-            storeE.insertQueuedJob({ jobId: 'rec-claimed-dead', kind: 'search', site: 'ctrip-hotel', url: 'https://hotels.ctrip.com/hotels/list' }, t0 - 1_000);
-            storeE.markClaimed('rec-claimed-dead', { origin: EXTENSION_ORIGIN });
+            storeE.insertQueuedJob(LOCAL, { jobId: 'rec-queued-fresh', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, t0 + 60_000);
+            storeE.insertQueuedJob(LOCAL, { jobId: 'rec-queued-stale', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, t0 - 1_000);
+            storeE.insertQueuedJob(LOCAL, { jobId: 'rec-claimed-live', kind: 'search', site: 'ctrip-flight', url: 'https://flights.ctrip.com/online/list' }, t0 + 60_000);
+            storeE.markClaimed(LOCAL, 'rec-claimed-live', { origin: EXTENSION_ORIGIN, clientId: LIVE_CLIENT });
+            storeE.insertQueuedJob(LOCAL, { jobId: 'rec-claimed-dead', kind: 'search', site: 'ctrip-hotel', url: 'https://hotels.ctrip.com/hotels/list' }, t0 - 1_000);
+            storeE.markClaimed(LOCAL, 'rec-claimed-dead', { origin: EXTENSION_ORIGIN });
             q = createBridgeJobQueue({ store: storeE });
             server = await serveQueue(q);
             // 恢复先于任何轮询执行(等价挂载路径:模块启动即 recoverOnBoot)
@@ -289,7 +291,7 @@ async function main() {
             assert.equal(summary.settledUnresolved, 1);
             assert.equal(storeE.getJob('rec-queued-stale')?.status, 'void', '未被领取即过期 → void,不再派发(零花费)');
             assert.equal(storeE.getJob('rec-claimed-dead')?.status, 'unresolved', '领取后超时 → unresolved');
-            assert.ok(storeE.pacingOf('ctrip-hotel') && storeE.pacingOf('ctrip-hotel').cooldownUntil > Date.now(), '超时结算记节律冷却');
+            assert.ok(storeE.pacingOf(LOCAL, 'ctrip-hotel') && storeE.pacingOf(LOCAL, 'ctrip-hotel').cooldownUntil > Date.now(), '超时结算记节律冷却');
             // 重排作业可被新进程的扩展领取并善果落账
             const polled = await pollJobs(server.port, { clientId: LIVE_CLIENT, capabilities: ['dida-portal'] });
             assert.equal(polled.job?.jobId, 'rec-queued-fresh', '恢复的 queued 作业重排进队列');
@@ -314,13 +316,13 @@ async function main() {
         const server = await serveQueue(queueC);
         try {
             const CLIENT = randomUUID();
-            const pacingBefore = storeC.pacingOf('dida-portal');
+            const pacingBefore = storeC.pacingOf(LOCAL, 'dida-portal');
             const first = queueC.submit({ kind: 'cookie-names', site: 'dida-portal', timeoutMs: 3_000 }, { timeoutMs: 3_000 });
             const polled = await pollJobs(server.port, { clientId: CLIENT, capabilities: ['dida-portal'] });
             assert.ok(polled.job, 'cookie-names 作业应被领取');
             await postResult(server.port, polled.job.jobId, { ok: true, kind: 'cookie-names', names: ['dida_session_sig'] }, { clientId: CLIENT });
             assert.equal((await first).ok, true);
-            const row1 = storeC.getClient(CLIENT);
+            const row1 = storeC.getClient(LOCAL, CLIENT);
             assert.ok(row1, '轮询即注册客户端');
             assert.equal(row1?.origin, EXTENSION_ORIGIN);
             assert.deepEqual(JSON.parse(row1?.capabilities_json ?? '[]'), ['dida-portal']);
@@ -332,11 +334,11 @@ async function main() {
             assert.ok(polled2.job, '第二次轮询仍可领取');
             await postResult(server.port, polled2.job.jobId, { ok: true, kind: 'cookie-names', names: [] }, { clientId: CLIENT });
             assert.equal((await second).ok, true);
-            const row2 = storeC.getClient(CLIENT);
+            const row2 = storeC.getClient(LOCAL, CLIENT);
             assert.deepEqual(JSON.parse(row2?.capabilities_json ?? '[]'), ['dida-portal', 'train-12306'], 'upsert 覆盖能力清单');
             assert.ok((row2?.last_seen_at ?? 0) >= seen1, 'last_seen_at 单调刷新');
             assert.deepEqual(JSON.parse(row2?.login_sites_json ?? '[]'), ['dida-portal'], 'upsert 不回退 login_sites');
-            const pacingAfter = storeC.pacingOf('dida-portal');
+            const pacingAfter = storeC.pacingOf(LOCAL, 'dida-portal');
             assert.deepEqual(pacingAfter, pacingBefore, 'cookie-names 非导航作业,不推动节律');
         }
         finally {
@@ -352,8 +354,8 @@ async function main() {
         try {
             // 预置一条上一进程遗留的已超时 claimed 作业:模块启动即应结算 unresolved
             const seed = openBridgeLedgerStore(rootG);
-            seed.insertQueuedJob({ jobId: 'mount-recover-dead', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, Date.now() - 1_000);
-            seed.markClaimed('mount-recover-dead', { origin: EXTENSION_ORIGIN });
+            seed.insertQueuedJob(LOCAL, { jobId: 'mount-recover-dead', kind: 'search', site: 'dida-portal', url: 'https://portal.dida.com/find' }, Date.now() - 1_000);
+            seed.markClaimed(LOCAL, 'mount-recover-dead', { origin: EXTENSION_ORIGIN });
             seed.close();
             const mod = startSessionSearchModule({
                 apiKey: () => 'ledger-test-key',
@@ -369,7 +371,7 @@ async function main() {
                     // recoverOnBoot 已在模块启动路径跑过:遗留 claimed 超时作业被结算
                     assert.equal(probe.getJob('mount-recover-dead')?.status, 'unresolved', '启动即恢复结算遗留超时作业');
                     // 账本节律读判定:冷却内 429(带 retry-after)
-                    probe.applyCooldown('dida-portal');
+                    probe.applyCooldown(LOCAL, 'dida-portal');
                     const hot = await driveModuleSearch(mod, 'Bearer ledger-test-key');
                     assert.equal(hot.statusCode, 429, '账本冷却内检索被节律闸拒绝');
                     assert.ok(String(hot.headers['retry-after'] ?? '').length > 0, '429 携带 retry-after');

package/dist/scripts/fixtures/tenant-runaway-worker-fixture.mjs

@@ -0,0 +1,73 @@
+// A worker for the managed port's JSON-lines protocol that misbehaves on request (AaaS threat S-17 drill).
+// Every runaway mode bounds itself, so a governor that fails costs a red test and not a dead machine.
+import { spawn } from 'node:child_process'
+import { writeFileSync } from 'node:fs'
+import { createInterface } from 'node:readline'
+
+const MIB = 1024 * 1024
+
+if (process.env.TENANT_FIXTURE_PID_FILE) writeFileSync(process.env.TENANT_FIXTURE_PID_FILE, String(process.pid))
+// TENANT_FIXTURE_NO_LIFECYCLE=1: a worker that never says who it is, so nothing can attach a governor to it.
+if (process.env.TENANT_FIXTURE_NO_LIFECYCLE !== '1') {
+  // TENANT_FIXTURE_LIE_PID=1: it names a process that is not its own, so a sampler that trusts it would watch nothing.
+  const reported = process.env.TENANT_FIXTURE_LIE_PID === '1' ? 2_147_000_000 : process.pid
+  process.stdout.write(`${JSON.stringify({ lifecycle: 'worker_started', workerPid: reported, parentPid: process.ppid })}\n`)
+}
+
+const hold = []
+const input = createInterface({ input: process.stdin, crlfDelay: Infinity })
+
+function reply(value) {
+  process.stdout.write(`${JSON.stringify(value)}\n`)
+}
+
+input.on('line', (line) => {
+  const request = JSON.parse(line)
+  // TENANT_FIXTURE_MODE lets a planner, which sends its own prompt text, drive the same behavior.
+  const mode = process.env.TENANT_FIXTURE_MODE ?? request.prompt
+  if (mode === 'ok') {
+    reply({ id: request.id, ok: true, result: { finalResponse: 'ok', events: [{
+      nodeOptions: process.env.NODE_OPTIONS ?? null,
+      execArgv: process.execArgv,
+      ambient: { LLM_BASE_URL: process.env.LLM_BASE_URL ?? null, LLM_API_KEY: process.env.LLM_API_KEY ?? null, DEEPSEEK_API_KEY: process.env.DEEPSEEK_API_KEY ?? null, DEEPSEEK_BASE_URL: process.env.DEEPSEEK_BASE_URL ?? null },
+    }], notifications: [] } })
+  } else if (mode === 'memory') {
+    // Off-heap memory: the V8 heap cap cannot see a Buffer, so only the process-tree sampler can stop this one.
+    let total = 0
+    const timer = setInterval(() => {
+      hold.push(Buffer.alloc(16 * MIB, 1))
+      total += 16 * MIB
+      if (total >= 1536 * MIB) clearInterval(timer)
+    }, 10)
+  } else if (mode === 'memory-in-child') {
+    // The runaway is a descendant, not the worker: the tree is what is limited.
+    const child = spawn(process.execPath, ['-e', `
+      const hold = []; let total = 0
+      const timer = setInterval(() => { hold.push(Buffer.alloc(${16 * MIB}, 1)); total += ${16 * MIB}; if (total >= ${1536 * MIB}) clearInterval(timer) }, 10)
+    `], { stdio: 'ignore' })
+    reply({ id: request.id, ok: true, result: { finalResponse: 'spawned', events: [{ childPid: child.pid }], notifications: [] } })
+  } else if (mode === 'cpu') {
+    // Blocks this thread's event loop; the check comes from outside. Gives up by itself after 30 s.
+    const end = Date.now() + 30_000
+    while (Date.now() < end) { /* spin */ }
+  } else if (mode === 'heap') {
+    // JS heap growth: the V8 ceiling in NODE_OPTIONS must end this long before the machine notices.
+    const objects = []
+    while (process.memoryUsage().heapUsed < 900 * MIB) objects.push({ filler: 'x'.repeat(1000) })
+    reply({ id: request.id, ok: true, result: { finalResponse: 'heap-not-limited', events: [], notifications: [] } })
+  } else if (mode === 'flood') {
+    // One line that never ends, written as fast as the pipe takes it, up to 256 MiB.
+    const chunk = 'x'.repeat(64 * 1024)
+    let written = 0
+    const write = () => {
+      while (written < 256 * MIB) {
+        written += chunk.length
+        if (!process.stdout.write(chunk)) { process.stdout.once('drain', write); return }
+      }
+    }
+    write()
+  }
+})
+
+process.on('SIGTERM', () => process.exit(143))
+setInterval(() => {}, 1_000)

package/dist/scripts/mutation-check.js

@@ -0,0 +1,153 @@
+/**
+ * Mutation check runner (AaaS A2, docs/rfc/aaas-rfc.md §8.3: "falsification tests that must fail against a
+ * deliberately broken guard").
+ *
+ * A mutation list names a suite and a set of source edits. For each edit the runner clones the source trees into a
+ * scratch directory, breaks exactly one guard there, runs the suite, and requires it to fail. A suite that stays
+ * green under a broken guard proves nothing about that guard, so a surviving mutation fails the run. The list's
+ * unmutated baseline must pass first, otherwise "red" would only mean the harness is broken.
+ *
+ * The working tree is never edited: mutations happen in the clone, so a run can sit beside other work. A mutation file must
+ * name a path inside the clone (no absolute path, no `..`, nothing under node_modules, which is shared with the real tree).
+ *
+ * A mutation is "killed" only when the suite fails for a reason about behaviour. A suite that times out, and an edit that
+ * does not even load (syntax or module errors), prove nothing about the guard, so both fail the run as well.
+ *
+ *   cd ts && npx tsx scripts/mutation-check.ts scripts/tenant-seam-mutations.json [--only <id>] [--keep] [--scratch <dir>]
+ *
+ * List format: { "suite": "scripts/x-tests.ts", "timeoutMs"?: number,
+ *               "mutations": [{ "id", "file" (relative to ts/), "find" (must occur exactly once), "replace", "note"? }] }
+ */
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const TS_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const REPO_ROOT = resolve(TS_ROOT, '..');
+const SKIP = new Set(['node_modules', '.git', 'dsh-runtime', 'gotry-state']);
+function argValue(args, flag) {
+    const at = args.indexOf(flag);
+    return at >= 0 ? args[at + 1] : undefined;
+}
+function cloneTrees(scratch) {
+    const copy = (from, to) => {
+        cpSync(from, to, { recursive: true, filter: (source) => !SKIP.has(basename(source)) });
+    };
+    const tsClone = join(scratch, 'ts');
+    copy(TS_ROOT, tsClone);
+    for (const dir of ['schemas', 'data']) {
+        if (existsSync(join(REPO_ROOT, dir)))
+            copy(join(REPO_ROOT, dir), join(scratch, dir));
+    }
+    // Installed packages are shared, not copied: the suites only read them.
+    symlinkSync(join(TS_ROOT, 'node_modules'), join(tsClone, 'node_modules'));
+    if (existsSync(join(REPO_ROOT, 'node_modules')))
+        symlinkSync(join(REPO_ROOT, 'node_modules'), join(scratch, 'node_modules'));
+    return tsClone;
+}
+/** An edit that does not load says nothing about a guard: `tsx` reports these, not an assertion. */
+const BROKEN_EDIT = /SyntaxError|TransformError|Transform failed|ERR_MODULE_NOT_FOUND|ERR_UNKNOWN_FILE_EXTENSION|Unexpected token/;
+class ListError extends Error {
+}
+/** The file a mutation edits, which must be inside the scratch clone and never in the shared node_modules. */
+function mutationTarget(tsClone, file) {
+    const parts = file.split(/[\\/]/);
+    if (isAbsolute(file) || parts.includes('..') || parts.includes('node_modules'))
+        throw new ListError(`mutation file "${file}" must be a relative path inside ts/ and not under node_modules`);
+    const path = resolve(tsClone, file);
+    if (!path.startsWith(tsClone + sep))
+        throw new ListError(`mutation file "${file}" leaves the clone`);
+    if (!existsSync(path))
+        throw new ListError(`mutation file "${file}" does not exist`);
+    return path;
+}
+function runSuite(tsClone, suite, timeoutMs) {
+    const result = spawnSync(process.execPath, [join(tsClone, 'node_modules', 'tsx', 'dist', 'cli.mjs'), suite], {
+        cwd: tsClone,
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        env: { ...process.env, GOTRY_SESSION_LIVE: '0', GOTRY_HBCLI_LIVE: '0', GOTRY_HOTELBYTE_SKILLS_LIVE: '0' },
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    const timedOut = result.error?.code === 'ETIMEDOUT';
+    return { status: result.status, output: `${result.stdout ?? ''}${result.stderr ?? ''}`, timedOut };
+}
+function lastLines(text, count) {
+    return text.trim().split('\n').slice(-count).join('\n');
+}
+const args = process.argv.slice(2);
+const listPath = args.find((arg) => !arg.startsWith('--') && arg !== argValue(args, '--only') && arg !== argValue(args, '--scratch'));
+if (!listPath) {
+    console.error('usage: mutation-check.ts <mutation-list.json> [--only <id>] [--keep] [--scratch <dir>]');
+    process.exit(2);
+}
+const list = JSON.parse(readFileSync(resolve(TS_ROOT, listPath), 'utf8'));
+const only = argValue(args, '--only');
+const timeoutMs = list.timeoutMs ?? 180_000;
+function run() {
+    const scratch = mkdtempSync(join(argValue(args, '--scratch') ?? tmpdir(), 'gotry-mutation-'));
+    try {
+        const tsClone = cloneTrees(scratch);
+        // Every target is checked before anything runs, so a bad list fails at once and leaves no half-run behind.
+        const targets = list.mutations.map((mutation) => ({ mutation, path: mutationTarget(tsClone, mutation.file) }));
+        const baseline = runSuite(tsClone, list.suite, timeoutMs);
+        if (baseline.status !== 0) {
+            console.error(`baseline FAILED (exit ${baseline.status}${baseline.timedOut ? ', timed out' : ''}) — mutation results would mean nothing\n${lastLines(baseline.output, 20)}`);
+            return 2;
+        }
+        console.log(`baseline ok: ${list.suite}`);
+        let killed = 0;
+        let failed = 0;
+        for (const { mutation, path } of targets) {
+            if (only && mutation.id !== only)
+                continue;
+            const original = readFileSync(path, 'utf8');
+            const occurrences = original.split(mutation.find).length - 1;
+            if (occurrences !== 1)
+                throw new ListError(`${mutation.id}: "find" occurs ${occurrences} times in ${mutation.file} (need exactly 1)`);
+            writeFileSync(path, original.replace(mutation.find, () => mutation.replace));
+            let outcome;
+            try {
+                outcome = runSuite(tsClone, list.suite, timeoutMs);
+            }
+            finally {
+                writeFileSync(path, original);
+            }
+            const label = `${mutation.id} ${mutation.file}${mutation.note ? ` — ${mutation.note}` : ''}`;
+            if (outcome.status === 0) {
+                failed += 1;
+                console.log(`SURVIVED ${label}`);
+            }
+            else if (outcome.timedOut) {
+                failed += 1;
+                console.log(`TIMEOUT  ${label}\n           the suite hung under this edit (${timeoutMs} ms): that is not a kill`);
+            }
+            else if (BROKEN_EDIT.test(outcome.output)) {
+                failed += 1;
+                console.log(`BROKEN   ${label}\n           the edited file does not load: ${(outcome.output.split('\n').find((line) => BROKEN_EDIT.test(line)) ?? '').trim().slice(0, 140)}`);
+            }
+            else {
+                killed += 1;
+                const reason = outcome.output.split('\n').find((line) => /AssertionError|Error:|FAIL|not ok/.test(line)) ?? `exit ${outcome.status}`;
+                console.log(`killed   ${label}\n           ${reason.trim().slice(0, 160)}`);
+            }
+        }
+        console.log(`${killed} killed, ${failed} not killed (survived, hung or did not load)`);
+        return failed === 0 ? 0 : 1;
+    }
+    catch (error) {
+        if (error instanceof ListError) {
+            console.error(error.message);
+            return 2;
+        }
+        throw error;
+    }
+    finally {
+        if (args.includes('--keep'))
+            console.log(`scratch kept: ${scratch}`);
+        else
+            rmSync(scratch, { recursive: true, force: true });
+    }
+}
+process.exit(run());