@deeeed/metamask-harness 0.51.9 → 0.52.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.52.0 - 2026-09-17
+
+### Added
+
+- Export portable runtime proof validation so standalone QA requires executed assertions and rejects passing packages without behavioral proof.
+
+### Changed
+
+- Align tutorials with explicit workflow invocation, static review, recipe-qa scopes and caller-owned publication/cleanup; refresh shared execution-template examples.
+
 ## 0.51.9 - 2026-09-16
 
 ### Changed

package/README.md

@@ -262,3 +262,17 @@ mm-harness --version
 ```
 
 Unset `MM_HARNESS_BIN` to return to the published installation.
+
+
+### Workflow entry points and completion
+
+Explicitly invoke `mms-recipe-dev`, `mms-recipe-fixbug`, `mms-recipe-qa` or the team's static review skill. `mms-recipe-cook` selects or resumes their shared Markdown checklist. Matching descriptions or changed paths never activates these workflows.
+
+Static Perps review uses a generated source checklist without installing or launching the app harness. `recipe-qa` freezes a PR, range or daily change window and requires runtime smoke plus selected recipe proof. Official release validation uses its named release profile and proof lane.
+
+TASK.md holds the request; CHECKLIST.md is the sole step list. The frozen terminal contract and task-local mark validate completion. Publication, retained sessions and workspace cleanup belong to the caller. Farmslot handles them through its control plane; direct invocation returns the outcome to the engineer. See the [task-directory guide](site/task-dir.html) and [QA tutorial](site/tutorials/v5.html).
+
+
+### Portable runtime proof
+
+`validateRuntimeProof(bundle, smokeTarget)` validates a retained Recipe v1 artifact package, requiring executed behavioral assertions for its declared targets. A passing command or end node alone is insufficient. QA skills use this exported function through their locked harness installation; no gateway, farm profile or run ID is required.

package/dist/index.js

@@ -9,6 +9,7 @@ import {
   walletFixturePath
 } from "./paths.js";
 import { captureActiveRecipeRecordingSnapshot } from "./run-recording.js";
+import { validateRuntimeProof } from "./runtime-proof.js";
 export {
   captureActiveRecipeRecordingSnapshot,
   createDoctorReport,
@@ -21,5 +22,6 @@ export {
   loadActionManifest,
   recipeHarnessPath,
   validateManifest,
+  validateRuntimeProof,
   walletFixturePath
 };

package/dist/runtime-proof.js

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import { normalizeRecipeRef, validateRecipeArtifactPackage } from "@farmslot/protocol";
+function validateRuntimeProof(bundle, smokeTarget) {
+  const checked = validateRecipeArtifactPackage(bundle);
+  assert.equal(checked.status, "valid", JSON.stringify(checked.findings));
+  const { recipe, summary, trace, manifest, recipeResolution, resolvedRecipes } = bundle;
+  assert.equal(summary.status, "pass", "Runtime recipe did not pass");
+  const entries = Array.isArray(trace) ? trace : trace.entries;
+  assert(entries.length && entries.every((entry) => entry.ok === true), "Runtime trace contains failed or unknown actions");
+  assert(entries.some((entry) => entry.action === "end" && entry.status === "pass" && !String(entry.nodeId ?? entry.id).includes("/")), "Runtime recipe did not reach its passing end");
+  const documents = new Map(recipeResolution.dependencies.map((dependency) => [normalizeRecipeRef(dependency.ref), resolvedRecipes[dependency.digest]]));
+  const nodes = /* @__PURE__ */ new Map();
+  function collect(document, prefix = "", stack = /* @__PURE__ */ new Set()) {
+    for (const [id, node] of Object.entries(document.workflow.nodes)) {
+      nodes.set(prefix + id, node);
+      if (node.action === "call" && typeof node.ref === "string") {
+        const ref = normalizeRecipeRef(node.ref);
+        assert(!stack.has(ref), "Recursive recipe proof");
+        const nested = documents.get(ref);
+        assert(nested, `Missing resolved recipe ${ref}`);
+        collect(nested, `${prefix}${id}/`, new Set(stack).add(ref));
+      }
+    }
+  }
+  collect(recipe);
+  const executed = new Map(entries.map((entry, index) => [entry.nodeId ?? entry.id, { entry, index }]));
+  const assertions = /* @__PURE__ */ new Set(["assert_output", "assert_json", "ui.wait_for"]);
+  const controls = /* @__PURE__ */ new Set(["end", "wait", "manual", "switch", "call", "index_artifacts", "assert_exit_code", "assert_file", "branch", "repeat", "set", "log"]);
+  function proves(id) {
+    const node = nodes.get(id);
+    const current = executed.get(id);
+    if (!current || current.entry.action !== node.action) return false;
+    if (node.action === "call") return [...nodes.keys()].some((child) => child.startsWith(`${id}/`) && proves(child));
+    if (!assertions.has(node.action) || !current.entry.output || typeof current.entry.output !== "object") return false;
+    if (node.action === "assert_output") {
+      const prefix = id.includes("/") ? id.slice(0, id.lastIndexOf("/") + 1) : "";
+      const source = prefix + String(node.source ?? node.node ?? "");
+      const prior = executed.get(source);
+      const action = nodes.get(source)?.action;
+      return Boolean(prior && prior.index < current.index && action && action === prior.entry.action && !controls.has(action) && !assertions.has(action));
+    }
+    if (node.action === "ui.wait_for") return entries.slice(0, current.index).some((entry) => ["ui.press", "ui.key_press", "ui.set_input", "ui.swipe", "ui.drag", "ui.long_press"].includes(entry.action));
+    return typeof node.path === "string" && manifest.artifacts.some((artifact) => artifact.path === node.path && artifact.category === "proof");
+  }
+  assert(recipe.proofTargets?.length, "Runtime recipe has no behavioral proof targets");
+  for (const target of recipe.proofTargets) {
+    const linked = [...nodes].filter(([, node]) => node.proves?.includes(target.id));
+    assert(linked.some(([id]) => proves(id)), `Proof target ${target.id} has no executed runtime assertion`);
+  }
+  if (smokeTarget) assert(recipe.proofTargets.some((target) => target.id === smokeTarget), "Smoke target is absent from recipe");
+}
+export {
+  validateRuntimeProof
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.51.9",
+  "version": "0.52.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"

package/scripts/site-contrast.mjs

@@ -391,7 +391,7 @@ async function checkBehavior(browserEndpoint, port, pages) {
     const expected = [
       ['npm i -g @deeeed/metamask-harness@latest', copied.setup],
       ['yarn skills', copied.setup],
-      ['/mms-recipe-pr-qa-review', copied.work.join('\n')],
+      ['/mms-recipe-qa', copied.work.join('\n')],
       ['/mms-recipe-cook', copied.work.join('\n')],
       ['/mms-recipe-performance', copied.work.join('\n')],
       ['/mms-recipe-evidence', copied.work.join('\n')],
@@ -425,6 +425,32 @@ async function checkBehavior(browserEndpoint, port, pages) {
 
   // The walkthrough and its saved progress live one click deeper.
   await withPage(browserEndpoint, `${base}how-it-works.html`, async (page) => {
+    const previews = await page.evaluate(String.raw`
+      (async () => {
+        document.querySelector('[data-map-key="template"]').click();
+        const checked = [];
+        for (const button of document.querySelectorAll('[data-template-example]')) {
+          button.click();
+          const dialog = document.querySelector('#template-preview');
+          for (let attempt = 0; attempt < 100; attempt++) {
+            if (!dialog.querySelector('.template-preview-controls').hidden) break;
+            await new Promise(resolve => setTimeout(resolve, 20));
+          }
+          const meta = dialog.querySelector('#template-preview-meta').textContent;
+          const raw = dialog.querySelector('#template-preview-raw').textContent;
+          const source = dialog.querySelector('#template-preview-source');
+          if (!dialog.open || !meta.includes(button.dataset.templateExample) || !raw.includes('- [ ]') || source.hidden || !/\/blob\/[a-f0-9]{40}\//.test(source.href)) {
+            throw new Error('Invalid canonical template preview: ' + button.dataset.templateExample);
+          }
+          checked.push(button.dataset.templateExample);
+          dialog.querySelector('[data-template-close]').click();
+        }
+        return checked;
+      })()
+    `);
+    if (!previews.includes('review-pr/static-perps') || !previews.includes('qa/pr.extension')) {
+      throw new Error('Static review and QA previews must both be available');
+    }
     const progress = await page.evaluate(String.raw`
       (() => {
         const box = document.querySelector('.step-check');