@dzhechkov/harness-core 0.3.144 → 0.3.146

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1b9db50b623f5737dd95a3b949d9ea85293387a010a09f4204e6a476f5127d57"
+          "content": "3ce64136feb92682d69ed9b8275ff1f894a4007826d8a2b115b260021bc0f42d"
         }
       ]
     },
@@ -615,7 +615,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "34eb7f1754a631ebe5f390dee53f1ea276a85e6cabd25806c384aeef23f64d3c"
+          "content": "26f6cf197298e8ccf61d72bb26d6f5e88a3d58af3ff0b3351f44755c5acff1da"
         }
       ]
     },
@@ -625,7 +625,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "22cddbd67b5a6204cccc2bf100735c33e138f7400769ad073dc694df4fb0f2b2"
+          "content": "571ea5e0ebb71a5325da6171b09affeb6ba3d4b759d0eb4cc8d3af57dd369104"
         }
       ]
     },
@@ -635,7 +635,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dc8d3d48e8387391828175bff981016dfa449b19aa1a55e6420adbd688a112fb"
+          "content": "83db18eb05a6400809b7c1624e3df24f40f1050b39f022d87448d8017399e4e0"
         }
       ]
     },
@@ -645,7 +645,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "afc564287b7a548b15051e64151c05687b8a45b66df7c964e7168591bb93414c"
+          "content": "f353339d08c311fb69d44960e97bcc9ddfc01d7bdb8c3ae26e9884a494c0338f"
         }
       ]
     },
@@ -929,6 +929,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/event-chain.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "ded196d2527e16e60981cef9d2502d1d5eeedbaa7c40be95ac178522682d1693"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "06e9f082b4e361b796042815bd75d807231d98965e9acbbb63d500efa932a87d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8ad73164e893627c867468a21bc5dd1386dd82adb3ea06b2b785cfa7415d558b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a874ba52b35ed445f2310a04bb0fbdb0ba34db18601d0086e7e666b7bafc8a16"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/feature-adr-claim-gate.d.ts",
@@ -1049,13 +1089,53 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/guard-promotion.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "eba21256fa7ed8082acf9571c0606aa2926c0a13635fd994aa74f44d7f3db1d4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/guard-promotion.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6da389f6fbdae2b886d526db90b09ca7fabac88f26ff96e73cdfd98d1a6a90d4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/guard-promotion.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a03bf0166ac3056d93c67a2571c6300cc92941424cc5a8aecce529a6879e4a47"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/guard-promotion.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "858b3ad88b0c2fdf3a66a89075df493e3592cbf8c12f3df880be93a0e446ad8e"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/guard.d.ts",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7a1df1aa511a5d96669e660b99d29ba633393e1a20dc346e1dedfa9aec221260"
+          "content": "5ac5bd9b2d927117d124861c5532a0618c5f3f4859b8a91a6b62203475db047e"
         }
       ]
     },
@@ -1065,7 +1145,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "be03334a1746d3261afe69252f119c82f3718e0608957eebf5de311acf9d8a04"
+          "content": "f56619488145d4ccdac45298cb76647ea670d5b37d210f30972b602d3fad5f24"
         }
       ]
     },
@@ -1075,7 +1155,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dc20d0ea9ff7e1299b52ed3ce03dbd2f8bb13b1b86ee2799a49837f33ec33883"
+          "content": "7dc53438c377aa007264384fc30f34764fcb969fd6d0bfae15a0b976bafd0e17"
         }
       ]
     },
@@ -1085,7 +1165,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1696212693b8cd400ff6d2af843e2901ad0e79679ddd09ea9831306aa75e342a"
+          "content": "389544fa42d0010f48ae1bccdd81170053fbd56d5131c1479db87535c9a34662"
         }
       ]
     },
@@ -1135,7 +1215,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "88213a2320b2b99781919788883ab99da93c4043e7c235f14d7f97db034703e0"
+          "content": "c012cd5c1e1139755edd4a27daeef19e765d70f3764c0f074a0397b5f8252dac"
         }
       ]
     },
@@ -1145,7 +1225,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e568286b5e7123dbd73a623268134af1b55555e61e90ea0271a9d4938184b6a0"
+          "content": "a0505d3d55931149733d95c1e294160395e221c567e92682acd4194c0c3d17fc"
         }
       ]
     },
@@ -1155,7 +1235,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a779d72721eb025257beee64dd6e29a8e54e1dde1f152a0887d94aa2f9c3f1be"
+          "content": "07cf71990a2f7e7e126b02082ba82df93b99239e4ca4179c995cdfc00dcfb88c"
         }
       ]
     },
@@ -1165,7 +1245,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7f3cd564e49f49d2fb6a736e98ce837f987994776730ff07f04cb71c7113c22e"
+          "content": "bc82e97c1ccded5006c1459bbcd3a84eb18651761d9b74d68d3aabe3be1101dc"
         }
       ]
     },
@@ -1265,7 +1345,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a1316ae9b953735335d02280177b4ae845e0e5c8452ea14113fa86327a786bc1"
+          "content": "ce02526852f7c5d8579a5384f4aa9aafb7b099fdfc61c1482aa969bff7407a24"
         }
       ]
     },
@@ -1275,7 +1355,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "32c16d8d0793279e60f892fdc8daaa70aeda74d9948c54a3fe6fa4cdf21cc2ea"
+          "content": "b7b9bda39dc55594375688740b9d717d07ea2f12166fbee14a29f62868268a9c"
         }
       ]
     },
@@ -1285,7 +1365,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "674495cbb7a24844e82bbc70c7ac825c84f3572144acf310ab49f2ae791ddf7e"
+          "content": "bf83c2c1af9481f4e03db72553b2d8c3b5b8ad2f87f0aab7e4d579f32e4a32d6"
         }
       ]
     },
@@ -1655,7 +1735,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d938a195e56fac7103c659ba939c9838421eede40b5f81ae1928b6cc372429e4"
+          "content": "412aa688ee1fb6bd6c132ad2f97421d6330846de1743b9461436051f29dead15"
         }
       ]
     },
@@ -1665,7 +1745,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "18c5ed38e9ac27854ba0cd9d273b0ef0002bc8ed1794766e4cb919cf55d78377"
+          "content": "758657ff3c0aef6919351af23fc229617576263d24d36b2400f5ffe43f8d1384"
         }
       ]
     },
@@ -1675,7 +1755,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "96654e2566b276d50f1ec1ebb4427cc4426fb9bdaefcdb14766abd9a07ab64c9"
+          "content": "b3603074fa6c80ee1dad75fe6f93b44f90dcfcbad81325ecca379f70c9f2fd60"
         }
       ]
     },
@@ -1685,7 +1765,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e8f1fccef45f1ab0414fe37fffdda7ab27b97e524f885771d3fcb8a2f174a533"
+          "content": "e4103c95577ac2876df7f604b1fa1c9e590e9a0df7185abc0f9d9f5bdc18ff1f"
         }
       ]
     },
@@ -2615,7 +2695,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2b12d89fc52919b1963d3bd655cf21312df2306e3b7b3ff09c6812675197c58c"
+          "content": "de8265cfe636d0042855988d585b3e3165e4a61da0259c0a498fccdac79e1ec4"
         }
       ]
     },
@@ -2765,7 +2845,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ccb87beb02047e78c192e544e5aa893eb4c95ab21542fc38fdd1e123e8fc2cd"
+          "content": "1b20b2b6ababea386d195ab3481a0af6582fda2757720732b5098e162964da32"
         }
       ]
     },
@@ -2839,6 +2919,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/event-chain.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f8306131a5021167169b525733da711ff378382f0a7368376f35834c350a9e23"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/feature-adr-claim-gate.ts",
@@ -2869,13 +2959,23 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/guard-promotion.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "45e05ef83ac730442760a55f9859f36b2b2a56db53465ca0267f517024646026"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/guard.ts",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f56d5f5e59e9ddecae339b054b9f888b81b3410c56d3a09eedd7be3c11d3438c"
+          "content": "e7559a9f42448374ae133a323f8d9e4fa21625b15853d544e1c077ae9331a2ce"
         }
       ]
     },
@@ -2895,7 +2995,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "98f3820a8d7eafeb6405e2c80b05513ddce58dfccec57612f1136cfa6abdf40e"
+          "content": "570656aaa56d8da53c83f2e93af93e6b9af4398b3e75a7077bf5a7206eee42b5"
         }
       ]
     },
@@ -2925,7 +3025,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "80b292202fad0be0e9939f67641f16987e93f962b547b56e9771d9ae9a7c94b1"
+          "content": "939e75c6a80e5812a3ab5f3ebc5fe39dd646211a27077fb47f499ecab53e790c"
         }
       ]
     },
@@ -3015,7 +3115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7535211e4f70d8880a94e6c75664a2c53c64fd6dc3292004b7a4d9e58690b047"
+          "content": "71a1e596f5f877b4ecb04cebf0670922824d0466488302e1ba9553407dfbe9af"
         }
       ]
     },
@@ -3415,7 +3515,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "125ae7b36ad75488d4dd35edc585fc1523691c3f156d3ac0a3b891fd804645d1"
+          "content": "89265131de29a2841e73068e4be256e1cbe7bd8dbd0c8eacc79039626b41e6f0"
         }
       ]
     },
@@ -3519,6 +3619,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/event-chain.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b5addb1026c8b408e49fee9e561c12ea22d8b4e94ae7092ebe60419c7a384ab6"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/feature-adr-abs-paths.test.ts",
@@ -3619,6 +3729,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/guard-promotion.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "c7d38f9ba7d2a1a1d5e40b9422eeef0ffc7784b015adb41a9c8d89893f529c9e"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/guard.test.ts",
@@ -3745,7 +3865,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "653e21e75e81bd7c4659ae0279a527663cf07108a0a613c98c7f36dac8bd4066"
+          "content": "a26d2b3cc2434cc0846e73c1c6d5c6d7223e5be5a24217b75f62d494affa2089"
         }
       ]
     },

package/src/compounding.ts

@@ -15,6 +15,8 @@
  * Everything here is PURE: callers gather facts (files, store rows); this module only computes.
  */
 
+import { EVENT_CHAIN_SCOPE, verifyEventChainText } from './event-chain.js';
+
 // ── Seeded statistics (verbatim-shape port from darwin-mode bench/stats.ts) ──
 
 /** Deterministic PRNG — same seed, same stream, byte-identical reports. */
@@ -153,11 +155,24 @@ export interface GuardEvent {
   readonly rules: readonly string[]; // violated rule ids
 }
 
+/**
+ * A raw evidence log, handed over verbatim so the chain verdict has exactly ONE definition
+ * (`verifyEventChainText`) instead of a CLI-side copy that can drift from it — the drift class this
+ * repo keeps catching. Absent ⇒ the report simply has no chain line.
+ */
+export interface EvidenceLogFact {
+  /** Display label, e.g. `.dz/recall-usage.jsonl`. */
+  readonly log: string;
+  readonly text: string;
+}
+
 export interface CompoundingFacts {
   readonly lessons: readonly LessonRow[];
   readonly usage: readonly UsageEvent[];
   readonly guard: readonly GuardEvent[];
   readonly nowTs: string;
+  /** The evidence logs themselves — verified as hash chains (feature event-chain, ADR-001). */
+  readonly evidenceLogs?: readonly EvidenceLogFact[];
 }
 
 // ── The report ──────────────────────────────────────────────────────
@@ -197,11 +212,27 @@ export interface ReplayReadiness {
   readonly note: string;
 }
 
+/** Per-log chain health — an INSTRUMENTATION fact about the evidence, not a learning verdict. */
+export interface EvidenceChainHealth {
+  readonly log: string;
+  readonly ok: boolean;
+  readonly chained: number;
+  /** Records written before chaining existed: LEGAL, and honestly reported as uncovered. */
+  readonly preChainPrefix: number;
+  readonly defects: number;
+  readonly defectKinds: readonly string[];
+}
+
 export interface InstrumentationHealth {
   readonly lastUsageTs: string | null;
   readonly gapDays: number | null;
   /** True when the newest usage record is recent enough to trust the leg is alive. */
   readonly applyLegLive: boolean;
+  /** One entry per evidence log handed in. Empty when no logs were provided. */
+  readonly chains: readonly EvidenceChainHealth[];
+  /** True when every provided log verifies. Vacuously true when none were provided — that is why
+   *  {@link EvidenceChainHealth} carries the counts: "no logs" must not read like "all clean". */
+  readonly chainsOk: boolean;
 }
 
 export interface CompoundingReport {
@@ -306,10 +337,26 @@ export function assembleCompoundingReport(facts: CompoundingFacts): CompoundingR
   const CLOCK_SKEW_MS = 60_000;
   const gapMs = lastUsage && Number.isFinite(nowMs) ? nowMs - lastUsage.ms : null;
   const gapValid = gapMs !== null && gapMs >= -CLOCK_SKEW_MS;
+  // 4b. Evidence-chain health. The numbers above are only worth as much as the log they came from,
+  //     and a compaction bug already inflated that log once (2 → 4 → 6, fixed 2026-07-28).
+  const chains: EvidenceChainHealth[] = (facts.evidenceLogs ?? []).map((f) => {
+    const v = verifyEventChainText(typeof f.text === 'string' ? f.text : '');
+    return {
+      log: f.log,
+      ok: v.ok,
+      chained: v.chained,
+      preChainPrefix: v.preChainPrefix,
+      defects: v.defects.length,
+      defectKinds: [...new Set(v.defects.map((d) => d.kind))],
+    };
+  });
+
   const instrumentation: InstrumentationHealth = {
     lastUsageTs: lastUsage?.ts ?? null,
     gapDays: gapValid ? Math.max(0, Math.floor(gapMs / 86_400_000)) : null,
     applyLegLive: gapValid && gapMs <= APPLY_LEG_STALE_DAYS * 86_400_000,
+    chains,
+    chainsOk: chains.every((c) => c.ok),
   };
 
   const improvedRules = trajectory.filter((t) => t.improved).length;
@@ -318,6 +365,13 @@ export function assembleCompoundingReport(facts: CompoundingFacts): CompoundingR
     trajectory.length > 0 ? `guard: ${improvedRules}/${trajectory.length} rules recur less in the later half` : 'guard: not enough history',
     `cold-vs-warm: ${replay.verdict === 'insufficient-data' ? 'INSUFFICIENT DATA (accruing)' : 'READY to measure'}`,
     instrumentation.applyLegLive ? 'apply leg: live' : 'apply leg: STALE — fix the instrumentation before trusting anything above',
+    ...(chains.length === 0
+      ? []
+      : [
+          instrumentation.chainsOk
+            ? 'evidence chain: verified'
+            : 'evidence chain: CORRUPT — the numbers above are computed from a damaged log',
+        ]),
   ].join(' · ');
 
   return { pool, guardTrajectory: trajectory, replay, instrumentation, verdict };
@@ -345,6 +399,13 @@ export function renderCompoundingReport(r: CompoundingReport): string {
       (r.instrumentation.gapDays !== null ? ` (${r.instrumentation.gapDays}d ago)` : '') +
       ` — ${r.instrumentation.applyLegLive ? 'live' : 'STALE'}`,
   );
+  for (const c of r.instrumentation.chains) {
+    out.push(
+      `  EVIDENCE CHAIN ${c.log}: ${c.ok ? 'verified' : `FAILED — ${c.defects} defect(s) [${c.defectKinds.join(', ')}]`}` +
+        ` · ${c.chained} chained · ${c.preChainPrefix} pre-chain (uncovered)`,
+    );
+  }
+  if (r.instrumentation.chains.length > 0) out.push(`    scope: ${EVENT_CHAIN_SCOPE}`);
   out.push('');
   out.push(`  VERDICT: ${r.verdict}`);
   return out.join('\n');