@effect-agent/testing 0.1.0-beta.38 → 0.1.0-beta.40

package/dist/certification.d.mts

@@ -0,0 +1,102 @@
+import { Crypto, Duration, Effect, Layer } from "effect";
+import { DurableRuntimeFailpointLocation, SubmissionLedger, ThreadStore, WakeScheduler } from "@effect-agent/thread";
+import { CertificationCaseResult, CertificationReport, CertificationScenario, CertificationSweepResult, CertificationTierThreeReport } from "@effect-agent/thread/testing";
+//#region src/certification.d.ts
+/**
+ * P7 WP2 — `certifyDurableAdapters` (plan §1): the one certification entry point a durable
+ * adapter pair runs to earn a Schema-encoded certificate.
+ *
+ * - **Tier 1 — port contract**: the two shared conformance case arrays, verbatim, through
+ *   `certifyPorts` (TEST-004/STORE-010).
+ * - **Tier 2 — coordinator protocol + failpoint convergence**: the durable coordinator is
+ *   assembled over the CANDIDATE Layer pair with a scripted deterministic model; every
+ *   `DurableRuntimeFailpointLocation` is armed one-shot across the six scenario shapes
+ *   (plain / uncertain-tool / durable-steps / approval / join / delegation). After the injected
+ *   fault the runner asserts the state stays CLASSIFIABLE (recovery + the public unblocking
+ *   operations `resolveUnknown`/`resolveApproval` are the only levers used) and that the
+ *   re-drive CONVERGES to `verifyThreadInvariants` with `requireAllSettled` — including a
+ *   fully discharged digest-chain check, because the runner captures per-batch producer
+ *   identity at append time.
+ * - **Tier 3 — real loss lever**: recorded honestly. A durable adapter either supplies a
+ *   `CertificationCrashLever` executed in this run, cites its committed real-loss evidence
+ *   (process-kill / eviction suites), or the certificate says `not-exercised`. A non-durable
+ *   reference adapter records `not-applicable`.
+ *
+ * The runner is adapter-neutral and platform-neutral: it imports nothing Node-only, so the
+ * same entry point runs under `@effect/vitest` on Node and inside workerd (storage-cloudflare's
+ * in-workerd runner). It must run under a TestClock (Tier 1 drives lease expiry through
+ * virtual time), and requires only `Crypto.Crypto` from the environment.
+ */
+/**
+ * A real-loss lever supplied by an adapter that wants Tier 3 exercised IN this certification
+ * run (kill/evict/reopen around a designated row subset). Rows report with
+ * `suite: "real-loss"`. Failures must be captured per-row — the lever's error channel is
+ * `never` so a certificate is always produced.
+ */
+type CertificationCrashLever = Effect.Effect<ReadonlyArray<CertificationCaseResult>>;
+interface CertifyDurableAdaptersOptions<LedgerE = never, StoreE = never> {
+  /** Adapter pair identity named by the certificate (durability is read from the ledger). */
+  readonly adapter: {
+    readonly name: string;
+    readonly version?: string | undefined;
+  };
+  /**
+   * The candidate Layer pair. When both ports must share one connection root (the ADR-0011
+   * "same file" rule), pass the SAME combined Layer instance for both fields — Layer
+   * memoization builds it once. A candidate may require `Crypto.Crypto` (the memory reference
+   * does); the certification's own environment supplies nothing else.
+   */
+  readonly submissionLedger: Layer.Layer<SubmissionLedger, LedgerE, Crypto.Crypto>;
+  readonly threadStore: Layer.Layer<ThreadStore, StoreE, Crypto.Crypto>;
+  /** Defaults to `WakeScheduler.layerNoop`; the runner re-drives lanes explicitly. */
+  readonly wakeScheduler?: Layer.Layer<WakeScheduler> | undefined;
+  /** Executes Tier 3 in this run; takes precedence over `tierThreeEvidence`. */
+  readonly crashLever?: CertificationCrashLever | undefined;
+  /** Repository-relative citations of committed real-loss suites (Tier 3 `recorded-evidence`). */
+  readonly tierThreeEvidence?: ReadonlyArray<string> | undefined;
+  /**
+   * The candidate ledger's configured ownership lease (defaults to the D5 default, 30s).
+   * Every Tier-2 re-drive round advances the TestClock past this lease before reclaiming:
+   * a live lease may block ALL new claims (the SQL adapters do; the memory reference also
+   * allows same-producer reclaim), so the adapter-NEUTRAL recovery lever after a mid-Attempt
+   * fault is lease expiry — exactly the documented D5 liveness mechanism, driven through
+   * virtual time.
+   */
+  readonly ownershipLeaseDuration?: Duration.Duration | undefined;
+}
+/** The six Tier-2 scenario shapes in sweep order. */
+declare const CERTIFICATION_SCENARIOS: ReadonlyArray<CertificationScenario>;
+/**
+ * Coordinator failpoint locations that none of the six scenario shapes can reach, recorded
+ * honestly instead of silently claimed: all three sit on operator/abort paths the shapes do
+ * not take. They are pinned in-process by the P5/S2 suites
+ * (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
+ * intent failpoint", `durable-runtime.test.ts` abort rows,
+ * `durable-subagents.test.ts` abort propagation) and by the process-kill/eviction crash
+ * matrices. Runner tests assert the observed never-fired set equals EXACTLY this list, so a
+ * protocol change that silently stops exercising a location fails the certification.
+ */
+declare const TIER2_UNREACHED_LOCATIONS: ReadonlyArray<DurableRuntimeFailpointLocation>;
+/** Locations of `tier2` rows whose armed fault never fired in ANY scenario, sorted. */
+declare const tier2NeverFiredLocations: (tier2: ReadonlyArray<CertificationSweepResult>) => ReadonlyArray<DurableRuntimeFailpointLocation>;
+/**
+ * Resolve the Tier-3 record honestly (plan §1): a non-durable reference adapter has no real
+ * loss to exercise (`not-applicable`); a supplied lever runs NOW (`exercised`); committed
+ * real-loss citations are recorded (`recorded-evidence`); otherwise the certificate says
+ * `not-exercised` — a scoped statement, never a silent claim.
+ */
+declare const resolveTierThree: (durability: "durable-cloudflare" | "durable-node" | "non-durable", options: {
+  readonly crashLever?: CertificationCrashLever | undefined;
+  readonly tierThreeEvidence?: ReadonlyArray<string> | undefined;
+}) => Effect.Effect<CertificationTierThreeReport, never, never>;
+/**
+ * Certify one durable adapter pair (plan §1, §8 WP2). Runs Tier 2 FIRST over pristine
+ * storage (each cell converges to all-settled before the next starts, so the recovery scan
+ * never sees foreign leftovers), then Tier 1's port contract cases (whose lanes deliberately
+ * end in every nonterminal shape), then records Tier 3. Requires `Crypto.Crypto` and a
+ * TestClock-backed environment; the candidate Layers are built exactly once.
+ */
+declare const certifyDurableAdapters: <LedgerE = never, StoreE = never>(options: CertifyDurableAdaptersOptions<LedgerE, StoreE>) => Effect.Effect<CertificationReport, LedgerE | StoreE, Crypto.Crypto>;
+//#endregion
+export { CERTIFICATION_SCENARIOS, CertificationCrashLever, CertifyDurableAdaptersOptions, TIER2_UNREACHED_LOCATIONS, certifyDurableAdapters, resolveTierThree, tier2NeverFiredLocations };
+//# sourceMappingURL=certification.d.mts.map

package/dist/certification.mjs

@@ -0,0 +1,561 @@
+import { Cause, Clock, DateTime, Duration, Effect, Exit, Layer, Option, Ref, Schema, Stream } from "effect";
+import { LanguageModel, Model, Tool, Toolkit } from "effect/unstable/ai";
+import { Subagent, SubagentPolicy, SubagentReservationsMemoryLive, SubagentRuntime } from "@effect-agent/capabilities";
+import { Agent, AgentPolicy, IdGenerator, RunId, ThreadId, ToolCallId, TurnId } from "@effect-agent/core";
+import { DurableStep, DurableStepError } from "@effect-agent/engine";
+import { ApprovalDecisionCommand, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, Digest, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpointError, DurableRuntimeFailpointLocation, DurableWorkerBinding, IdempotencyKey, LoadCheckpointRequest, Principal, ProducerId, ResolutionSafeToRetry, SubmissionLedger, SubmissionLookupById, ThreadExportRequest, ThreadStore, ToolReconciler, UnknownResolutionCommand, WakeScheduler, childThreadIdFor, verifyThreadInvariants } from "@effect-agent/thread";
+import { CertificationReport, CertificationSweepResult, CertificationTierThreeReport, CertifiedAdapterIdentity, DurableRuntimeFailpointTestControl, certifyPorts } from "@effect-agent/thread/testing";
+import { TestClock } from "effect/testing";
+//#region src/certification.ts
+/** The six Tier-2 scenario shapes in sweep order. */
+const CERTIFICATION_SCENARIOS = [
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+];
+/**
+* Coordinator failpoint locations that none of the six scenario shapes can reach, recorded
+* honestly instead of silently claimed: all three sit on operator/abort paths the shapes do
+* not take. They are pinned in-process by the P5/S2 suites
+* (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
+* intent failpoint", `durable-runtime.test.ts` abort rows,
+* `durable-subagents.test.ts` abort propagation) and by the process-kill/eviction crash
+* matrices. Runner tests assert the observed never-fired set equals EXACTLY this list, so a
+* protocol change that silently stops exercising a location fails the certification.
+*/
+const TIER2_UNREACHED_LOCATIONS = [
+	"abort:after-intent",
+	"compaction:after-canonical-append",
+	"policy:before-reservation-append",
+	"policy:after-reservation-append",
+	"resolve:after-intent",
+	"subagent:after-child-abort-intent"
+];
+/** Locations of `tier2` rows whose armed fault never fired in ANY scenario, sorted. */
+const tier2NeverFiredLocations = (tier2) => {
+	const fired = /* @__PURE__ */ new Set();
+	for (const row of tier2) if (row.failpointFired) fired.add(row.location);
+	return DurableRuntimeFailpointLocation.literals.filter((location) => !fired.has(location)).sort();
+};
+const SHA_A = Schema.decodeSync(Digest)("a".repeat(64));
+const DIGESTS = DefinitionDigests.make({
+	agent: SHA_A,
+	model: SHA_A,
+	tools: SHA_A
+});
+const CHILD_DIGEST_STRINGS = {
+	agent: "b".repeat(64),
+	model: "c".repeat(64),
+	tools: "d".repeat(64)
+};
+const CHILD_DIGESTS = DefinitionDigests.make({
+	agent: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.agent),
+	model: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.model),
+	tools: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.tools)
+});
+const PRINCIPAL = Schema.decodeSync(Principal)("principal-certification");
+const decodeThreadId = Schema.decodeSync(ThreadId);
+const decodeIdempotencyKey = Schema.decodeSync(IdempotencyKey);
+const decodeToolCallId = Schema.decodeSync(ToolCallId);
+const usage = {
+	inputTokens: {},
+	outputTokens: {}
+};
+const finalParts = (text) => [
+	{
+		type: "text-start",
+		id: "answer"
+	},
+	{
+		type: "text-delta",
+		id: "answer",
+		delta: text
+	},
+	{
+		type: "text-end",
+		id: "answer"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage
+	}
+];
+const toolCallPart = (id, name, params) => ({
+	type: "tool-call",
+	id,
+	name,
+	params,
+	providerExecuted: false
+});
+const toolTurn = (...calls) => [...calls, {
+	type: "finish",
+	reason: "tool-calls",
+	usage
+}];
+/**
+* Stateless scripted model that decides by PROMPT SHAPE instead of call count: while the
+* prompt carries no committed tool result the model declares `toolParts` (when given),
+* otherwise it answers with the final text. Deciding on the canonical prompt keeps every cell
+* deterministic regardless of where the injected fault fell — a re-invoked Turn re-declares
+* the same batch and a resumed batch flows into the final answer, so every scenario always
+* exercises its tool path and always converges.
+*/
+const promptShapeModel = (name, finalText, toolParts) => Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (request) => {
+		const hasToolResult = request.prompt.content.some((message) => message.role === "tool");
+		const parts = toolParts === void 0 || hasToolResult ? finalParts(finalText) : toolParts;
+		return Stream.fromIterable(parts);
+	}
+})));
+const CERTIFICATION_MAX_DURATION = "10 minutes";
+const policy = AgentPolicy.make({
+	maxTurns: 4,
+	maxToolCalls: 4,
+	maxDuration: CERTIFICATION_MAX_DURATION,
+	toolConcurrency: 2
+});
+const QuestionInput = Schema.Struct({ question: Schema.String });
+const AnswerOutput = Schema.Struct({ answer: Schema.String });
+/** plain / join: no tools — the pure Turn/submission/join seams. */
+const plainDefinition = Agent.make("certify-plain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy
+});
+/** uncertain-tool: unannotated → fail-closed `uncertain`, enters the prepared/settled protocol. */
+const Book = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String })
+});
+const bookToolkit = Toolkit.make(Book);
+const uncertainDefinition = Agent.make("certify-uncertain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book it.",
+	toolkit: bookToolkit,
+	policy
+});
+/** durable-steps: declaring `DurableStep` as a dependency is what makes the Tool durable. */
+const Itinerary = Tool.make("itinerary", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ state: Schema.String }),
+	failure: DurableStepError,
+	dependencies: [DurableStep]
+});
+const itineraryToolkit = Toolkit.make(Itinerary);
+const stepsDefinition = Agent.make("certify-steps", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Reserve the itinerary.",
+	toolkit: itineraryToolkit,
+	policy
+});
+/** approval: fail-closed — no `DurableApprovalResolver` Layer, so undecided approvals suspend. */
+const BookApproval = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String }),
+	needsApproval: true
+});
+const approvalToolkit = Toolkit.make(BookApproval);
+const approvalDefinition = Agent.make("certify-approval", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book after approval.",
+	toolkit: approvalToolkit,
+	policy
+});
+/** delegation: durable attached child plus an ordinary uncertain sibling in ONE batch. */
+const childDefinition = Agent.make("certify-child", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: CERTIFICATION_MAX_DURATION,
+		toolConcurrency: 1
+	})
+});
+var CertifyDelegationFailed = class extends Schema.TaggedError()("CertifyDelegationFailed", { childErrorTag: Schema.String }) {};
+const researchDelegation = Subagent.define("delegate_research", {
+	description: "Research one bounded question and return findings.",
+	target: childDefinition,
+	parameters: Schema.Struct({ topic: Schema.String }),
+	success: Schema.Struct({ summary: Schema.String }),
+	failure: CertifyDelegationFailed,
+	prepareInput: ({ topic }) => Effect.succeed({ question: `research:${topic}` }),
+	projectResult: (output) => Effect.succeed({ summary: `finding:${output.answer}` }),
+	policy: SubagentPolicy.make({
+		maxChildren: 2,
+		maxConcurrency: 2,
+		maxTurns: 4,
+		maxToolCalls: 4,
+		maxDuration: CERTIFICATION_MAX_DURATION
+	})
+});
+const Lookup = Tool.make("lookup", {
+	parameters: Schema.Struct({ key: Schema.String }),
+	success: Schema.Struct({ value: Schema.String })
+});
+const coordinatorDefinition = Agent.make("certify-coordinator", {
+	input: Schema.Struct({ mission: Schema.String }),
+	output: Schema.Struct({ report: Schema.String }),
+	instructions: "Delegate and look up, then answer as JSON.",
+	toolkit: Toolkit.make(researchDelegation.tool, Lookup),
+	policy: AgentPolicy.make({
+		maxTurns: 4,
+		maxToolCalls: 3,
+		maxDuration: CERTIFICATION_MAX_DURATION,
+		toolConcurrency: 2
+	})
+});
+const mapChildFailure = (failure) => CertifyDelegationFailed.make({ childErrorTag: failure._tag });
+const DELEGATE_CALL = decodeToolCallId("delegate-1");
+/** Fixture-only identity source consumed by the delegation Layer's ephemeral capture. */
+const identifiers = Layer.effect(IdGenerator, Effect.gen(function* () {
+	const counter = yield* Ref.make(0);
+	const next = (decode, prefix) => Ref.getAndUpdate(counter, (value) => value + 1).pipe(Effect.map((value) => decode(`${prefix}-${value}`)));
+	return {
+		nextThreadId: next(decodeThreadId, "certify-fixture-thread"),
+		nextRunId: next(Schema.decodeSync(RunId), "certify-fixture-run"),
+		nextTurnId: next(Schema.decodeSync(TurnId), "certify-fixture-turn")
+	};
+}));
+const delegationSupport = Layer.mergeAll(SubagentReservationsMemoryLive, identifiers);
+const submitOptionsFor = (slug, threadId) => ({
+	threadId,
+	principal: PRINCIPAL,
+	idempotencyKey: decodeIdempotencyKey(`certify-key-${slug}`),
+	definitions: DIGESTS
+});
+/** One single-agent cell: one lane, one Submission, one registered exact-digest binding. */
+const makeSingleAgentCell = (definition, resolved, slug) => {
+	const threadId = decodeThreadId(`certify-${slug}`);
+	const submit = Effect.gen(function* () {
+		return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+			id: definition.id,
+			input: definition.input
+		} }, { question: `certify ${slug}` }, submitOptionsFor(slug, threadId))];
+	});
+	return {
+		bindings: [resolved],
+		submit,
+		lanes: () => [threadId]
+	};
+};
+const makeCell = Effect.fn("Certification.makeCell")(function* (scenario, slug) {
+	switch (scenario) {
+		case "plain": {
+			const binding = Agent.withModel(plainDefinition, promptShapeModel("certify-plain", "{\"answer\":\"done\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			return makeSingleAgentCell(plainDefinition, resolved, slug);
+		}
+		case "uncertain-tool": {
+			const binding = Agent.withModel(uncertainDefinition, promptShapeModel("certify-uncertain", "{\"answer\":\"booked\"}", toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = bookToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(uncertainDefinition, resolved, slug);
+		}
+		case "durable-steps": {
+			const binding = Agent.withModel(stepsDefinition, promptShapeModel("certify-steps", "{\"answer\":\"reserved\"}", toolTurn(toolCallPart("itinerary-1", "itinerary", { ref: `trip-${slug}` }))));
+			const toolLayer = itineraryToolkit.toLayer({ itinerary: ({ ref }) => Effect.gen(function* () {
+				const step = yield* DurableStep;
+				return { state: `${yield* step.do("reserve-flight", Schema.String, Effect.succeed(`flight-${ref}`))}+${yield* step.do("reserve-lodging", Schema.String, Effect.succeed(`lodging-${ref}`))}` };
+			}) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(stepsDefinition, resolved, slug);
+		}
+		case "approval": {
+			const binding = Agent.withModel(approvalDefinition, promptShapeModel("certify-approval", "{\"answer\":\"approved\"}", toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = approvalToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(approvalDefinition, resolved, slug);
+		}
+		case "join": {
+			const binding = Agent.withModel(plainDefinition, promptShapeModel("certify-join", "{\"answer\":\"host answer\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			const threadId = decodeThreadId(`certify-${slug}`);
+			const submitOne = (key, question) => Effect.gen(function* () {
+				return yield* (yield* DurableAgentRuntime).submit({ definition: {
+					id: plainDefinition.id,
+					input: plainDefinition.input
+				} }, { question }, {
+					threadId,
+					principal: PRINCIPAL,
+					idempotencyKey: decodeIdempotencyKey(key),
+					definitions: DIGESTS
+				});
+			});
+			return {
+				bindings: [resolved],
+				submit: Effect.gen(function* () {
+					return [yield* submitOne(`certify-key-${slug}-host`, "host question"), yield* submitOne(`certify-key-${slug}-queued`, "queued question")];
+				}),
+				lanes: () => [threadId]
+			};
+		}
+		case "delegation": {
+			const childBinding = Agent.withModel(childDefinition, promptShapeModel("certify-child", "{\"answer\":\"child-answer\"}"));
+			const parentBinding = Agent.withModel(coordinatorDefinition, promptShapeModel("certify-parent", "{\"report\":\"done\"}", toolTurn(toolCallPart("delegate-1", "delegate_research", { topic: "paris" }), toolCallPart("lookup-1", "lookup", { key: "hotels" }))));
+			const delegationLayer = SubagentRuntime.layer(researchDelegation, childBinding, {
+				mapChildFailure,
+				durable: { targetDigests: CHILD_DIGEST_STRINGS }
+			}).pipe(Layer.provide(delegationSupport));
+			const lookupLayer = Toolkit.make(Lookup).toLayer({ lookup: ({ key }) => Effect.succeed({ value: `found-${key}` }) });
+			const parentResolved = yield* DurableWorkerBinding.make(parentBinding, DIGESTS).pipe(Effect.provide(Layer.mergeAll(delegationLayer, lookupLayer)));
+			const childResolved = yield* DurableWorkerBinding.make(childBinding, CHILD_DIGESTS);
+			const threadId = decodeThreadId(`certify-${slug}`);
+			return {
+				bindings: [parentResolved, childResolved],
+				submit: Effect.gen(function* () {
+					return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+						id: coordinatorDefinition.id,
+						input: coordinatorDefinition.input
+					} }, { mission: "plan" }, submitOptionsFor(slug, threadId))];
+				}),
+				lanes: (receipts) => {
+					const parent = receipts.at(0);
+					return parent === void 0 ? [threadId] : [threadId, childThreadIdFor(parent.submissionId, DELEGATE_CALL)];
+				}
+			};
+		}
+	}
+});
+/** Maximum recovery/drive/unblock rounds before a cell is reported non-convergent. */
+const MAX_REDRIVE_ROUNDS = 8;
+/**
+* Verify one lane after convergence: canonical export + every lane Submission the ledger or
+* the log names (the same collection rule as the admin `verify` member), fed to the shared
+* invariant checker in convergence mode WITH the captured per-batch producer directory, so
+* the digest chain is fully recomputed instead of skipped.
+*/
+const verifyLane = Effect.fn("Certification.verifyLane")(function* (lane, batchProducers) {
+	const store = yield* ThreadStore;
+	const ledger = yield* SubmissionLedger;
+	const exported = yield* store.export(ThreadExportRequest.make({ threadId: lane }));
+	const rows = /* @__PURE__ */ new Map();
+	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+	for (const submission of nonterminal) if (submission.threadId === lane) rows.set(submission.submissionId, submission);
+	const named = /* @__PURE__ */ new Set();
+	for (const envelope of exported.records) {
+		const payload = envelope.record.payload;
+		if (payload._tag === "UserInputRecorded" || payload._tag === "SubmissionSettled" || payload._tag === "AbortRequested") {
+			if (payload.submissionId !== void 0) named.add(payload.submissionId);
+		}
+	}
+	for (const submissionId of named) {
+		if (rows.has(submissionId)) continue;
+		const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId }));
+		if (Option.isSome(found) && found.value.threadId === lane) rows.set(submissionId, found.value);
+	}
+	const checkpoint = store.checkpoints === void 0 ? Option.none() : yield* store.checkpoints.load(LoadCheckpointRequest.make({ threadId: lane }));
+	return yield* verifyThreadInvariants({
+		export: exported,
+		submissions: [...rows.values()],
+		batchProducers,
+		checkpoint: Option.getOrUndefined(checkpoint),
+		checkpointsSupported: store.checkpoints !== void 0,
+		requireAllSettled: true
+	});
+});
+const failureTagOf = (cause) => {
+	const failure = Cause.findErrorOption(cause);
+	if (Option.isSome(failure)) {
+		const error = failure.value;
+		if (typeof error === "object" && error !== null && "_tag" in error) return String(error._tag);
+		return String(error).slice(0, 256);
+	}
+	return "defect";
+};
+/** One Tier-2 sweep cell: arm `location` one-shot, drive `scenario`, converge, verify. */
+const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (scenario, location, batchProducers, leaseAdvance) {
+	const runtime = yield* DurableAgentRuntime;
+	const ledger = yield* SubmissionLedger;
+	const control = yield* DurableRuntimeFailpointTestControl;
+	const slug = `${scenario}-${location.replaceAll(":", "-")}`;
+	const failed = (detail, fired) => CertificationSweepResult.make({
+		scenario,
+		location,
+		failpointFired: fired,
+		status: "failed",
+		digestChainVerified: false,
+		detail: detail.slice(0, 4096)
+	});
+	const cell = yield* makeCell(scenario, slug);
+	const fired = yield* Ref.make(false);
+	yield* control.setHandler((hit) => hit !== location ? Effect.void : Ref.getAndSet(fired, true).pipe(Effect.flatMap((already) => already ? Effect.void : Effect.fail(DurableRuntimeFailpointError.make({ location: hit })))));
+	let receipts;
+	const firstSubmit = yield* Effect.exit(cell.submit);
+	if (Exit.isSuccess(firstSubmit)) receipts = firstSubmit.value;
+	else {
+		const secondSubmit = yield* Effect.exit(cell.submit);
+		if (Exit.isFailure(secondSubmit)) {
+			yield* control.clear;
+			return failed(`submission replay did not recover: ${failureTagOf(secondSubmit.cause)}`, yield* Ref.get(fired));
+		}
+		receipts = secondSubmit.value;
+	}
+	const lanes = cell.lanes(receipts);
+	const driveLane = (lane) => runtime.processThreadResolved(lane, cell.bindings);
+	const allSettled = Effect.gen(function* () {
+		for (const receipt of receipts) {
+			const snapshot = yield* ledger.lookup(SubmissionLookupById.make({ submissionId: receipt.submissionId }));
+			if (Option.isNone(snapshot) || snapshot.value.state !== "settled") return false;
+		}
+		return true;
+	});
+	let converged = false;
+	for (let round = 0; round < MAX_REDRIVE_ROUNDS && !converged; round++) {
+		yield* TestClock.adjust(leaseAdvance);
+		yield* Effect.exit(runtime.runRecovery);
+		for (const lane of lanes) yield* Effect.exit(driveLane(lane));
+		for (const lane of lanes) {
+			const explains = yield* Effect.exit(runtime.explainThread(lane));
+			if (Exit.isFailure(explains)) continue;
+			for (const explanation of explains.value) {
+				for (const unknown of explanation.evidence.unknownCalls) {
+					if (unknown.resolved) continue;
+					yield* Effect.exit(runtime.resolveUnknown(UnknownResolutionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: unknown.toolCallId,
+						author: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`,
+						resolution: ResolutionSafeToRetry.make()
+					})));
+				}
+				for (const pending of explanation.evidence.approvalsPending) {
+					if (explanation.evidence.approvalDecisions.some((decision) => decision.toolCallId === pending.toolCallId)) continue;
+					yield* Effect.exit(runtime.resolveApproval(ApprovalDecisionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: pending.toolCallId,
+						decision: "approved",
+						resolver: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`
+					})));
+				}
+			}
+		}
+		const settled = yield* Effect.exit(allSettled);
+		converged = Exit.isSuccess(settled) && settled.value;
+	}
+	yield* control.clear;
+	const wasFired = yield* Ref.get(fired);
+	if (!converged) return failed(`did not converge within ${MAX_REDRIVE_ROUNDS} re-drive rounds`, wasFired);
+	let digestChainVerified = true;
+	const failedChecks = [];
+	for (const lane of lanes) {
+		const verdict = yield* Effect.exit(verifyLane(lane, batchProducers));
+		if (Exit.isFailure(verdict)) return failed(`lane ${lane} could not be verified: ${failureTagOf(verdict.cause)}`, wasFired);
+		for (const check of verdict.value.checks) {
+			if (check.status === "failed") failedChecks.push(`${lane}:${check.name}${check.detail === void 0 ? "" : ` (${check.detail})`}`);
+			if (check.name === "digest-chain" && check.status !== "passed") digestChainVerified = false;
+		}
+	}
+	if (failedChecks.length > 0 || !digestChainVerified) return failed(failedChecks.length > 0 ? `invariant checks failed: ${failedChecks.join("; ")}` : "the digest chain was not fully recomputed", wasFired);
+	return CertificationSweepResult.make({
+		scenario,
+		location,
+		failpointFired: wasFired,
+		status: wasFired ? "converged" : "not-triggered",
+		digestChainVerified
+	});
+});
+/**
+* Resolve the Tier-3 record honestly (plan §1): a non-durable reference adapter has no real
+* loss to exercise (`not-applicable`); a supplied lever runs NOW (`exercised`); committed
+* real-loss citations are recorded (`recorded-evidence`); otherwise the certificate says
+* `not-exercised` — a scoped statement, never a silent claim.
+*/
+const resolveTierThree = Effect.fn("Certification.resolveTierThree")(function* (durability, options) {
+	if (durability === "non-durable") return CertificationTierThreeReport.make({
+		status: "not-applicable",
+		evidence: [],
+		cases: [],
+		detail: "the adapter declares non-durable state (reference/conformance adapter); there is no real loss to exercise"
+	});
+	if (options.crashLever !== void 0) {
+		const cases = yield* options.crashLever;
+		return CertificationTierThreeReport.make({
+			status: cases.length === 0 ? "not-exercised" : "exercised",
+			evidence: options.tierThreeEvidence ?? [],
+			cases,
+			...cases.length === 0 ? { detail: "the supplied crash lever executed no real-loss cases" } : {}
+		});
+	}
+	if (options.tierThreeEvidence !== void 0 && options.tierThreeEvidence.length > 0) return CertificationTierThreeReport.make({
+		status: "recorded-evidence",
+		evidence: options.tierThreeEvidence,
+		cases: []
+	});
+	return CertificationTierThreeReport.make({
+		status: "not-exercised",
+		evidence: [],
+		cases: [],
+		detail: "no crash lever was supplied and no committed real-loss evidence was cited; Tier 3 is NOT discharged for this adapter"
+	});
+});
+const nowUtc = Effect.map(Clock.currentTimeMillis, (millis) => DateTime.toUtc(DateTime.makeUnsafe(millis)));
+/**
+* Certify one durable adapter pair (plan §1, §8 WP2). Runs Tier 2 FIRST over pristine
+* storage (each cell converges to all-settled before the next starts, so the recovery scan
+* never sees foreign leftovers), then Tier 1's port contract cases (whose lanes deliberately
+* end in every nonterminal shape), then records Tier 3. Requires `Crypto.Crypto` and a
+* TestClock-backed environment; the candidate Layers are built exactly once.
+*/
+const certifyDurableAdapters = (options) => {
+	const batchProducers = /* @__PURE__ */ new Map();
+	const capturingStore = Layer.effect(ThreadStore)(Effect.gen(function* () {
+		const inner = yield* ThreadStore;
+		return ThreadStore.of({
+			...inner,
+			append: (request) => Effect.sync(() => {
+				batchProducers.set(request.batch.batchId, request.batch.producerId);
+			}).pipe(Effect.andThen(inner.append(request)))
+		});
+	})).pipe(Layer.provide(options.threadStore));
+	const support = Layer.mergeAll(options.submissionLedger, capturingStore, options.wakeScheduler ?? WakeScheduler.layerNoop, DurableRuntimeFailpointTestControl.layer, ToolReconciler.uncertain, DurableRuntimeConfig.layer({
+		deploymentId: Schema.decodeSync(DeploymentId)("deployment-certification"),
+		producerId: Schema.decodeSync(ProducerId)("producer-certification"),
+		settlementPollInterval: Duration.millis(50),
+		leaseRenewalInterval: Duration.seconds(5),
+		abortPollInterval: Duration.millis(50)
+	}));
+	const environment = DurableAgentRuntime.layer.pipe(Layer.provideMerge(support));
+	const leaseAdvance = Duration.millis(Duration.toMillis(options.ownershipLeaseDuration ?? DEFAULT_OWNERSHIP_LEASE_DURATION) + 1e3);
+	return Effect.gen(function* () {
+		const ledger = yield* SubmissionLedger;
+		const tier2 = [];
+		for (const scenario of CERTIFICATION_SCENARIOS) for (const location of DurableRuntimeFailpointLocation.literals) tier2.push(yield* runSweepCell(scenario, location, batchProducers, leaseAdvance));
+		const tier1 = yield* certifyPorts();
+		const capabilities = yield* ledger.capabilities;
+		const tier3 = yield* resolveTierThree(capabilities.durability, options);
+		const generatedAt = yield* nowUtc;
+		const ok = tier1.every((result) => result.status === "passed") && tier2.every((result) => result.status !== "failed") && tier3.cases.every((result) => result.status === "passed");
+		return CertificationReport.make({
+			format: "effect-agent/certification@2",
+			adapter: CertifiedAdapterIdentity.make({
+				name: options.adapter.name,
+				...options.adapter.version === void 0 ? {} : { version: options.adapter.version },
+				durability: capabilities.durability
+			}),
+			generatedAt,
+			tier1,
+			tier2,
+			tier3,
+			ok,
+			fullyCertified: ok && capabilities.durability !== "non-durable" && tier3.status === "exercised" && tier3.cases.length > 0 && tier3.cases.every((result) => result.suite === "real-loss")
+		});
+	}).pipe(Effect.provide(environment));
+};
+//#endregion
+export { CERTIFICATION_SCENARIOS, TIER2_UNREACHED_LOCATIONS, certifyDurableAdapters, resolveTierThree, tier2NeverFiredLocations };
+
+//# sourceMappingURL=certification.mjs.map