@dzhechkov/harness-core 0.3.145 → 0.3.147

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1b9db50b623f5737dd95a3b949d9ea85293387a010a09f4204e6a476f5127d57"
+          "content": "3f150cc9734f8ed97077ab0ab609c705d8252c7039de89b591c6254505e54fe5"
         }
       ]
     },
@@ -615,7 +615,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "34eb7f1754a631ebe5f390dee53f1ea276a85e6cabd25806c384aeef23f64d3c"
+          "content": "26f6cf197298e8ccf61d72bb26d6f5e88a3d58af3ff0b3351f44755c5acff1da"
         }
       ]
     },
@@ -625,7 +625,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "22cddbd67b5a6204cccc2bf100735c33e138f7400769ad073dc694df4fb0f2b2"
+          "content": "571ea5e0ebb71a5325da6171b09affeb6ba3d4b759d0eb4cc8d3af57dd369104"
         }
       ]
     },
@@ -635,7 +635,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dc8d3d48e8387391828175bff981016dfa449b19aa1a55e6420adbd688a112fb"
+          "content": "83db18eb05a6400809b7c1624e3df24f40f1050b39f022d87448d8017399e4e0"
         }
       ]
     },
@@ -645,7 +645,47 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "afc564287b7a548b15051e64151c05687b8a45b66df7c964e7168591bb93414c"
+          "content": "f353339d08c311fb69d44960e97bcc9ddfc01d7bdb8c3ae26e9884a494c0338f"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cost-ledger.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "872006c1a6dac23672b6879fa5b7506d2ce7e57f9682d518ffd986e9522e623f"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cost-ledger.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8df65b2795b029e0c8a1e3de73593d487ab4b730be134646215935d0a6c73709"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cost-ledger.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "da9c70db0807f05b19825a5344d3f73ff11e3759ad5be8b2db75c259be2e0580"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/cost-ledger.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "48aa21f898920731f12e1454793f6d4bb9bcc4d0b1bef519bf1f7df87b7723f6"
         }
       ]
     },
@@ -655,7 +695,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e55d1d68facc208c4abc0258377cf0fab66ca43fe0db0a4c05e813d792d32bed"
+          "content": "be1b6a913c8ed391e12a3e0d703733fdbca0d7975d2f40a895f85921583220da"
         }
       ]
     },
@@ -665,7 +705,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "707ef5acce8a3fe4214ce4e67340ffe814d640ec02327838a23953716d27b18e"
+          "content": "04a3e07b206bf9f88750bdf061b7370558f6a6af95e109347cf18d92dbc22437"
         }
       ]
     },
@@ -675,7 +715,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6d2edea454f379708508559b145d75866c305727cf8a9ef7deb7405435f2c8de"
+          "content": "27a8789698060e69be20fe2beccf792603ad3b414aa95563e1cccddb7ab4a8cc"
         }
       ]
     },
@@ -685,7 +725,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3a9d8bbfcdbf481b8bb9f111865293aac8615386cae87e0ffb7f1310c2d77cf4"
+          "content": "fe5762b4ac2c5249116c5a18223cf41e87510feb498a8d0663a2bd6a2cadf074"
         }
       ]
     },
@@ -929,6 +969,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/event-chain.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "ded196d2527e16e60981cef9d2502d1d5eeedbaa7c40be95ac178522682d1693"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "06e9f082b4e361b796042815bd75d807231d98965e9acbbb63d500efa932a87d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8ad73164e893627c867468a21bc5dd1386dd82adb3ea06b2b785cfa7415d558b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/event-chain.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a874ba52b35ed445f2310a04bb0fbdb0ba34db18601d0086e7e666b7bafc8a16"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/feature-adr-claim-gate.d.ts",
@@ -1175,7 +1255,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "88d54740d8b19ff5dd759810459d8484c2fa5b428f5d2bf56fcbc431b439eb47"
+          "content": "84fc227b59f6ae02326b366860eba86a91402c9c1b63dc93e05829e864e79dfc"
         }
       ]
     },
@@ -1185,7 +1265,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8538e8daa8b84ad85e961062b78a25ded82cbb575fd8a60d5ad1a01d3d924396"
+          "content": "441c711a53d331714f0deeea05dcbdc484900ca488c3e60c6488e186f556ce32"
         }
       ]
     },
@@ -1195,7 +1275,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6d90d71faff6629442c9f553be6da1e8b3b1bf29c36c04ebd28b63b24cb63e67"
+          "content": "a5b73c6bf53a7638adbba592757ac470a28b77a613a316760d9c2b59fbb8f7c5"
         }
       ]
     },
@@ -1205,7 +1285,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a31f03dd37db8ddc701ddb181aaf46ec11259ea099924a03e91fdc2bb59ee125"
+          "content": "f060b457663973b21d4b5f803f0b8a3fdfc6c34736bd855ee4d63cfe9108095e"
         }
       ]
     },
@@ -1305,7 +1385,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a1316ae9b953735335d02280177b4ae845e0e5c8452ea14113fa86327a786bc1"
+          "content": "ce02526852f7c5d8579a5384f4aa9aafb7b099fdfc61c1482aa969bff7407a24"
         }
       ]
     },
@@ -1315,7 +1395,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "32c16d8d0793279e60f892fdc8daaa70aeda74d9948c54a3fe6fa4cdf21cc2ea"
+          "content": "b7b9bda39dc55594375688740b9d717d07ea2f12166fbee14a29f62868268a9c"
         }
       ]
     },
@@ -1325,7 +1405,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "674495cbb7a24844e82bbc70c7ac825c84f3572144acf310ab49f2ae791ddf7e"
+          "content": "bf83c2c1af9481f4e03db72553b2d8c3b5b8ad2f87f0aab7e4d579f32e4a32d6"
         }
       ]
     },
@@ -1695,7 +1775,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d938a195e56fac7103c659ba939c9838421eede40b5f81ae1928b6cc372429e4"
+          "content": "412aa688ee1fb6bd6c132ad2f97421d6330846de1743b9461436051f29dead15"
         }
       ]
     },
@@ -1705,7 +1785,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "18c5ed38e9ac27854ba0cd9d273b0ef0002bc8ed1794766e4cb919cf55d78377"
+          "content": "758657ff3c0aef6919351af23fc229617576263d24d36b2400f5ffe43f8d1384"
         }
       ]
     },
@@ -1715,7 +1795,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "96654e2566b276d50f1ec1ebb4427cc4426fb9bdaefcdb14766abd9a07ab64c9"
+          "content": "b3603074fa6c80ee1dad75fe6f93b44f90dcfcbad81325ecca379f70c9f2fd60"
         }
       ]
     },
@@ -1725,7 +1805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e8f1fccef45f1ab0414fe37fffdda7ab27b97e524f885771d3fcb8a2f174a533"
+          "content": "e4103c95577ac2876df7f604b1fa1c9e590e9a0df7185abc0f9d9f5bdc18ff1f"
         }
       ]
     },
@@ -2535,7 +2615,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9dc875d545dbe3fb6fcd35fd0bbe85a0b44e605361c0f6ae8b883e91f3ea97e0"
+          "content": "a03311bd06b17ee842215a65755d08d0c1e07188af344c495f73d7c5196c163f"
         }
       ]
     },
@@ -2545,7 +2625,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c4587f4494a98d98aebf81919a3626742302ef8a56fb698541c860496edd326f"
+          "content": "33eb02f603e5b668dbfa4af6ed5747d039e2562c5e018c149c21c3c4eed9549c"
         }
       ]
     },
@@ -2555,7 +2635,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f21b532a45cb8902ee73614c321ab843f69d0c7f9bfb1d027f78344c21b93d67"
+          "content": "065a9b2209111adcc448d53191ed37a08db09029cf89188446186bc284ff45bf"
         }
       ]
     },
@@ -2565,7 +2645,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "49010990ed212f5660d3ef506416b128ead1ae83797117ec577b0f263c679961"
+          "content": "e1562daf935c8e1f0dd0f3372cd5ff9c999d137d80fd900d06cd62e8b511ebb1"
         }
       ]
     },
@@ -2655,7 +2735,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "97904a633c24b3de454752e7d3d5f3b0bb8904d18b64ed90787d6963a3103087"
+          "content": "3a43b9ad9634b8242d96045c423cd09e03637c53761a91d56462cc45fca0dadf"
         }
       ]
     },
@@ -2805,7 +2885,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ccb87beb02047e78c192e544e5aa893eb4c95ab21542fc38fdd1e123e8fc2cd"
+          "content": "1b20b2b6ababea386d195ab3481a0af6582fda2757720732b5098e162964da32"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/cost-ledger.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "0658e1caedea358d50e69c5b52ac704b29f614349b7527b2ddd0f82911428abd"
         }
       ]
     },
@@ -2815,7 +2905,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9778add0fb249f4c9b650bde1c3747285568d3b8a462556059d4db7289625735"
+          "content": "8ca46e3e1396242f91fbd517b76ebbdf775d3540a033208ba0f0ca33d779d07a"
         }
       ]
     },
@@ -2879,6 +2969,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/event-chain.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f8306131a5021167169b525733da711ff378382f0a7368376f35834c350a9e23"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/feature-adr-claim-gate.ts",
@@ -2945,7 +3045,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "30f96c27c2f364d5a3aac7311167dba0f154adea3295a182f9b1cfcc28d6f3a6"
+          "content": "d16a13dfe781142b154b9d21a0f6a98cddc1e47505e7a500bc7a53b7377961a3"
         }
       ]
     },
@@ -2975,7 +3075,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "80b292202fad0be0e9939f67641f16987e93f962b547b56e9771d9ae9a7c94b1"
+          "content": "939e75c6a80e5812a3ab5f3ebc5fe39dd646211a27077fb47f499ecab53e790c"
         }
       ]
     },
@@ -3065,7 +3165,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7535211e4f70d8880a94e6c75664a2c53c64fd6dc3292004b7a4d9e58690b047"
+          "content": "71a1e596f5f877b4ecb04cebf0670922824d0466488302e1ba9553407dfbe9af"
         }
       ]
     },
@@ -3275,7 +3375,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a74ad3ca87279e0cb808a40dd8f18f52efed5c6f37f45f8186ea573c4a610fdd"
+          "content": "317fc95287308a8d7ea92222d234bf62f8415ab97e40c8ceaf2f6a3f1ac5d80c"
         }
       ]
     },
@@ -3465,7 +3565,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "125ae7b36ad75488d4dd35edc585fc1523691c3f156d3ac0a3b891fd804645d1"
+          "content": "89265131de29a2841e73068e4be256e1cbe7bd8dbd0c8eacc79039626b41e6f0"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/cost-ledger.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "75a5d06f5221fed7f98997a544c880836ead6fe74cc03ebe8c1a0875fb48ad9c"
         }
       ]
     },
@@ -3569,6 +3679,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/event-chain.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b5addb1026c8b408e49fee9e561c12ea22d8b4e94ae7092ebe60419c7a384ab6"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/feature-adr-abs-paths.test.ts",
@@ -3805,7 +3925,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "653e21e75e81bd7c4659ae0279a527663cf07108a0a613c98c7f36dac8bd4066"
+          "content": "a26d2b3cc2434cc0846e73c1c6d5c6d7223e5be5a24217b75f62d494affa2089"
         }
       ]
     },

package/src/compounding.ts

@@ -15,6 +15,8 @@
  * Everything here is PURE: callers gather facts (files, store rows); this module only computes.
  */
 
+import { EVENT_CHAIN_SCOPE, verifyEventChainText } from './event-chain.js';
+
 // ── Seeded statistics (verbatim-shape port from darwin-mode bench/stats.ts) ──
 
 /** Deterministic PRNG — same seed, same stream, byte-identical reports. */
@@ -153,11 +155,24 @@ export interface GuardEvent {
   readonly rules: readonly string[]; // violated rule ids
 }
 
+/**
+ * A raw evidence log, handed over verbatim so the chain verdict has exactly ONE definition
+ * (`verifyEventChainText`) instead of a CLI-side copy that can drift from it — the drift class this
+ * repo keeps catching. Absent ⇒ the report simply has no chain line.
+ */
+export interface EvidenceLogFact {
+  /** Display label, e.g. `.dz/recall-usage.jsonl`. */
+  readonly log: string;
+  readonly text: string;
+}
+
 export interface CompoundingFacts {
   readonly lessons: readonly LessonRow[];
   readonly usage: readonly UsageEvent[];
   readonly guard: readonly GuardEvent[];
   readonly nowTs: string;
+  /** The evidence logs themselves — verified as hash chains (feature event-chain, ADR-001). */
+  readonly evidenceLogs?: readonly EvidenceLogFact[];
 }
 
 // ── The report ──────────────────────────────────────────────────────
@@ -197,11 +212,27 @@ export interface ReplayReadiness {
   readonly note: string;
 }
 
+/** Per-log chain health — an INSTRUMENTATION fact about the evidence, not a learning verdict. */
+export interface EvidenceChainHealth {
+  readonly log: string;
+  readonly ok: boolean;
+  readonly chained: number;
+  /** Records written before chaining existed: LEGAL, and honestly reported as uncovered. */
+  readonly preChainPrefix: number;
+  readonly defects: number;
+  readonly defectKinds: readonly string[];
+}
+
 export interface InstrumentationHealth {
   readonly lastUsageTs: string | null;
   readonly gapDays: number | null;
   /** True when the newest usage record is recent enough to trust the leg is alive. */
   readonly applyLegLive: boolean;
+  /** One entry per evidence log handed in. Empty when no logs were provided. */
+  readonly chains: readonly EvidenceChainHealth[];
+  /** True when every provided log verifies. Vacuously true when none were provided — that is why
+   *  {@link EvidenceChainHealth} carries the counts: "no logs" must not read like "all clean". */
+  readonly chainsOk: boolean;
 }
 
 export interface CompoundingReport {
@@ -306,10 +337,26 @@ export function assembleCompoundingReport(facts: CompoundingFacts): CompoundingR
   const CLOCK_SKEW_MS = 60_000;
   const gapMs = lastUsage && Number.isFinite(nowMs) ? nowMs - lastUsage.ms : null;
   const gapValid = gapMs !== null && gapMs >= -CLOCK_SKEW_MS;
+  // 4b. Evidence-chain health. The numbers above are only worth as much as the log they came from,
+  //     and a compaction bug already inflated that log once (2 → 4 → 6, fixed 2026-07-28).
+  const chains: EvidenceChainHealth[] = (facts.evidenceLogs ?? []).map((f) => {
+    const v = verifyEventChainText(typeof f.text === 'string' ? f.text : '');
+    return {
+      log: f.log,
+      ok: v.ok,
+      chained: v.chained,
+      preChainPrefix: v.preChainPrefix,
+      defects: v.defects.length,
+      defectKinds: [...new Set(v.defects.map((d) => d.kind))],
+    };
+  });
+
   const instrumentation: InstrumentationHealth = {
     lastUsageTs: lastUsage?.ts ?? null,
     gapDays: gapValid ? Math.max(0, Math.floor(gapMs / 86_400_000)) : null,
     applyLegLive: gapValid && gapMs <= APPLY_LEG_STALE_DAYS * 86_400_000,
+    chains,
+    chainsOk: chains.every((c) => c.ok),
   };
 
   const improvedRules = trajectory.filter((t) => t.improved).length;
@@ -318,6 +365,13 @@ export function assembleCompoundingReport(facts: CompoundingFacts): CompoundingR
     trajectory.length > 0 ? `guard: ${improvedRules}/${trajectory.length} rules recur less in the later half` : 'guard: not enough history',
     `cold-vs-warm: ${replay.verdict === 'insufficient-data' ? 'INSUFFICIENT DATA (accruing)' : 'READY to measure'}`,
     instrumentation.applyLegLive ? 'apply leg: live' : 'apply leg: STALE — fix the instrumentation before trusting anything above',
+    ...(chains.length === 0
+      ? []
+      : [
+          instrumentation.chainsOk
+            ? 'evidence chain: verified'
+            : 'evidence chain: CORRUPT — the numbers above are computed from a damaged log',
+        ]),
   ].join(' · ');
 
   return { pool, guardTrajectory: trajectory, replay, instrumentation, verdict };
@@ -345,6 +399,13 @@ export function renderCompoundingReport(r: CompoundingReport): string {
       (r.instrumentation.gapDays !== null ? ` (${r.instrumentation.gapDays}d ago)` : '') +
       ` — ${r.instrumentation.applyLegLive ? 'live' : 'STALE'}`,
   );
+  for (const c of r.instrumentation.chains) {
+    out.push(
+      `  EVIDENCE CHAIN ${c.log}: ${c.ok ? 'verified' : `FAILED — ${c.defects} defect(s) [${c.defectKinds.join(', ')}]`}` +
+        ` · ${c.chained} chained · ${c.preChainPrefix} pre-chain (uncovered)`,
+    );
+  }
+  if (r.instrumentation.chains.length > 0) out.push(`    scope: ${EVENT_CHAIN_SCOPE}`);
   out.push('');
   out.push(`  VERDICT: ${r.verdict}`);
   return out.join('\n');