@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-testing-files.js

@@ -0,0 +1,2356 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductTestingFiles = renderProductTestingFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductTestingFiles(name, pascalName) {
+    return {
+        'database/test-compose.yml': `services:
+  database:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: ebk_test
+      POSTGRES_USER: ebk_test
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U ebk_test -d postgres"]
+      interval: 1s
+      timeout: 3s
+      retries: 30
+    labels:
+      dev.empirebuilderkit.owner: test-integration
+      dev.empirebuilderkit.run: \${EBK_TEST_RUN_ID}
+      dev.empirebuilderkit.slice: ${name}
+    ports:
+      - '127.0.0.1::5432'
+    tmpfs:
+      - /var/lib/postgresql/data
+`,
+        'docs/testing.md': `# ${name} testing
+
+Use the narrowest proof layer that can establish the behavior. Source tests are
+hermetic and credential-free. The \`test-integration\` target owns a disposable
+PostgreSQL container, creates one database per worker, applies the committed
+migrations, runs deterministic fixtures, and removes every resource it creates.
+It never uses the persistent database started by \`ebk dev\`.
+
+Every fixture run records its seed and run scope. Keep fixture data synthetic.
+Do not copy customer data, credentials, browser storage, tokens, request bodies,
+or protected identifiers into source, test output, or retained artifacts.
+
+The published testing-evidence JSON Schemas validate structural interchange
+only. Promotion and quarantine decisions must use
+\`validateTestingEvidenceResult\` and \`validateTestingEvidenceQuarantine\`;
+those validators enforce cross-field outcome rules and trusted time/workflow
+context that JSON Schema cannot establish alone.
+
+\`smoke-deployed-check\` only proves that Playwright can discover the suite. It
+does not contact or prove a deployment. Governed staging smoke runs through the
+protected \`Deployed smoke\` GitHub workflow and emits a candidate-, commit-,
+stage-, and cleanup-attributed result. Configure each protected environment's
+\`EBK_SMOKE_TARGETS\` variable as a JSON object from exact Slice name to its
+credential-free HTTPS \`webUrl\` and \`apiUrl\`, Cognito \`userPoolId\`, and
+\`clientId\`. Set \`EBK_SMOKE_AUTHORITY_VERSION\` to
+\`cognito-admin-cloudwatch-observe-v1\` only after the protected role is reviewed for
+\`DescribeUserPoolClient\`, \`AdminCreateUser\`, \`AdminSetUserPassword\`,
+\`AdminAddUserToGroup\`, and \`AdminDeleteUser\` on those pools and
+\`FilterLogEvents\` on each exact
+\`/ebk/<stage>/<slice>/event-consumer\` log group. The workflow creates one
+run-scoped synthetic customer in the Slice's narrow \`<slice>-test-writer\`
+group and one distinct synthetic reviewer in \`<slice>-admin\`. It never grants
+the customer administrator authority, strips AWS credentials from the browser
+child,
+observes the published event only from the credential-bearing parent, removes
+both principals and all raw browser and log state, and retains only allowlisted
+sanitized evidence.
+
+The environment-only \`AWS_SMOKE_ROLE_ARN\` is a setup/observation role, never
+a deployment role. Its GitHub OIDC trust is limited to this repository and the
+matching protected environment. Its policy names only the reviewed user-pool
+ARNs for the five Cognito actions above and the exact generated event-consumer
+log-group ARNs for \`logs:FilterLogEvents\`. It has no CloudFormation, SST,
+application mutation, wildcard Logs query, \`GetLogEvents\`, \`StartQuery\`, or
+\`logs:Unmask\` authority. GitHub bootstrap verifies that the secret name exists
+only in each protected environment; it never creates the secret or role and
+cannot attest to the hidden role policy. Review that policy before setting the
+authority-version acknowledgement.
+
+A successful \`develop\` deployment automatically starts staging smoke for
+every registered Slice target at that exact commit. The credential-free
+\`staging-evidence\` promotion check downloads only artifacts from the managed
+smoke workflow and rejects missing, mismatched, flaky, failed, incomplete, or
+cleanup-deficient evidence.
+
+One optional evidence-level retry replays the complete, identical browser or
+live-integration proof. Consequently \`counts.retried\` is always zero or one.
+The evidence adapter retains both attempts; any pass-after-fail outcome is
+\`flaky\`, never \`passed\`. Runner-internal retries are forbidden. Source and
+contract tests receive no automatic retry.
+
+Skipped integration and Playwright tests fail unless their stable hashed test
+ID matches one active runner-specific quarantine record. Matched skips count as
+quarantined, and a record that is not observed by its runner also fails closed.
+Local quarantine uses reviewed date expiry. A run-count record binds an
+absolute \`.github/workflows/*.yml\` path and \`expiresAfterRun\`; it is accepted
+only when GitHub supplies a matching \`GITHUB_WORKFLOW_REF\` and positive
+\`GITHUB_RUN_NUMBER\`, and it must expire within 25 trusted workflow runs.
+`,
+        'integration/record.spec.ts': `import { Client } from 'pg';
+import { describe, expect, it } from 'vitest';
+import { build${pascalName}RecordFixture } from '../testing/fixtures/records.js';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) {
+  throw new Error('DATABASE_URL is required for ${name} local integration proof.');
+}
+const seed = process.env.EBK_TEST_SEED;
+if (!seed) {
+  throw new Error('EBK_TEST_SEED is required for reproducible integration fixtures.');
+}
+
+describe('${name} database integration', () => {
+  it('writes and reads one deterministic record in its worker database', async () => {
+    const fixture = build${pascalName}RecordFixture(seed);
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+      await client.query(
+        \`INSERT INTO records
+           (id, name, owner_id, run_scope, test_expires_at)
+         VALUES ($1::uuid, $2, $3, $4, now() + INTERVAL '1 day')\`,
+        [fixture.id, fixture.name, 'synthetic-test-owner', seed],
+      );
+      const result = await client.query(
+        'SELECT id::text AS id, name FROM records WHERE id = $1::uuid',
+        [fixture.id],
+      );
+      expect(result.rows).toEqual([fixture]);
+    } finally {
+      await client.end();
+    }
+  });
+});
+`,
+        'integration/migrations.spec.ts': `import { Client } from 'pg';
+import { describe, expect, it } from 'vitest';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) {
+  throw new Error('DATABASE_URL is required for ${name} local integration proof.');
+}
+
+describe('${name} migration integration', () => {
+  it('exposes the committed records table contract', async () => {
+    const requiredColumns = [
+      { column_name: 'id', data_type: 'uuid' },
+      { column_name: 'name', data_type: 'text' },
+      { column_name: 'owner_id', data_type: 'text' },
+      { column_name: 'run_scope', data_type: 'text' },
+      { column_name: 'created_at', data_type: 'timestamp with time zone' },
+    ];
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+      const result = await client.query(
+        \`SELECT column_name, data_type
+           FROM information_schema.columns
+          WHERE table_schema = 'public'
+            AND table_name = 'records'
+            AND column_name = ANY($1::text[])
+          ORDER BY ordinal_position\`,
+        [requiredColumns.map(({ column_name }) => column_name)],
+      );
+      expect(result.rows).toEqual(requiredColumns);
+    } finally {
+      await client.end();
+    }
+  });
+});
+`,
+        'testing/fixtures/records.ts': `import { createTypedFixtureBuilder } from '@empire-builder-kit/nx/testing-evidence';
+
+export interface ${pascalName}RecordFixture {
+  id: string;
+  name: string;
+}
+
+export const build${pascalName}RecordFixture =
+  createTypedFixtureBuilder<${pascalName}RecordFixture>((fixture) => {
+    const token = fixture.token('record-id', 32);
+    return {
+      id: [
+        token.slice(0, 8),
+        token.slice(8, 12),
+        '4' + token.slice(13, 16),
+        '8' + token.slice(17, 20),
+        token.slice(20, 32),
+      ].join('-'),
+      name: \`Synthetic ${pascalName} \${fixture.token('record-name', 12)}\`,
+    };
+  });
+`,
+        'testing/quarantine.json': (0, built_in_plan_shared_js_1.json)({
+            records: [],
+            schemaVersion: 1,
+        }),
+        'testing/quarantine-runtime.mjs': `import { createHash } from 'node:crypto';
+import { isAbsolute, relative } from 'node:path';
+
+function portableTestPath(projectRoot, value) {
+  const path = isAbsolute(value)
+    ? relative(projectRoot, value)
+    : value;
+  const normalized = path.replaceAll('\\\\', '/').replace(/^\\.\\//, '');
+  if (
+    !normalized ||
+    normalized === '..' ||
+    normalized.startsWith('../') ||
+    normalized.includes('/../')
+  ) {
+    throw new Error('Runner report contains a test outside the Product Slice.');
+  }
+  return normalized;
+}
+
+function testId(runner, parts, classification = 'general') {
+  return (
+    runner +
+    ':' +
+    classification +
+    ':' +
+    createHash('sha256').update(parts.join('\\0')).digest('hex')
+  );
+}
+
+export function githubWorkflowRun(environment = process.env) {
+  const reference = environment.GITHUB_WORKFLOW_REF;
+  const number = Number(environment.GITHUB_RUN_NUMBER);
+  if (!reference || !Number.isSafeInteger(number) || number < 1) {
+    return undefined;
+  }
+  const match =
+    /\\/(\\.github\\/workflows\\/[A-Za-z0-9._/-]+\\.ya?ml)@/.exec(reference);
+  return match ? { number, workflow: match[1] } : undefined;
+}
+
+export function playwrightSkippedTestIds(report, projectRoot) {
+  const ids = [];
+  const visit = (suite, titles = []) => {
+    const nextTitles = suite.title ? [...titles, suite.title] : titles;
+    for (const spec of suite.specs ?? []) {
+      const file = portableTestPath(
+        projectRoot,
+        spec.file ?? suite.file ?? '',
+      );
+      for (const test of spec.tests ?? []) {
+        const results = test.results ?? [];
+        if (
+          test.expectedStatus === 'skipped' ||
+          (results.length > 0 &&
+            results.every(({ status }) => status === 'skipped'))
+        ) {
+          ids.push(
+            testId('playwright', [
+              file,
+              ...nextTitles,
+              spec.title ?? '',
+              test.projectName ?? test.projectId ?? '',
+            ], file === 'e2e/frontend-accessibility.spec.ts'
+              ? 'accessibility'
+              : 'general'),
+          );
+        }
+      }
+    }
+    for (const child of suite.suites ?? []) visit(child, nextTitles);
+  };
+  for (const suite of report?.suites ?? []) visit(suite);
+  return [...new Set(ids)].sort();
+}
+
+export function vitestIntegrationSkippedTestIds(reports, projectRoot) {
+  const ids = [];
+  for (const report of reports) {
+    for (const fileResult of report?.testResults ?? []) {
+      const file = portableTestPath(
+        projectRoot,
+        fileResult.name ?? '',
+      );
+      for (const assertion of fileResult.assertionResults ?? []) {
+        if (['pending', 'skipped', 'todo'].includes(assertion.status)) {
+          ids.push(
+            testId('vitest-integration', [
+              file,
+              assertion.fullName ?? assertion.title ?? '',
+            ]),
+          );
+        }
+      }
+    }
+  }
+  return [...new Set(ids)].sort();
+}
+
+export function reconcileRunnerQuarantine(options) {
+  const prefix = options.runner + ':';
+  const records = options.records.filter(({ testId }) =>
+    testId.startsWith(prefix),
+  );
+  const declared = new Map(records.map((record) => [record.testId, record]));
+  const skipped = [...new Set(options.skippedTestIds)].sort();
+  const matched = skipped.filter((id) => declared.has(id));
+  const unmatched = skipped.filter((id) => !declared.has(id));
+  const observed = new Set(skipped);
+  const unobserved = [...declared.keys()]
+    .filter((id) => !observed.has(id))
+    .sort();
+  const findings = [];
+  if (unmatched.length > 0) {
+    findings.push({
+      classification: 'environment-drift',
+      summary:
+        'Skipped tests lack active quarantine records: ' +
+        unmatched.slice(0, 8).join(', ') +
+        (unmatched.length > 8 ? ', ...' : ''),
+    });
+  }
+  if (unobserved.length > 0) {
+    findings.push({
+      classification: 'environment-drift',
+      summary:
+        'Active quarantine records did not match skipped tests: ' +
+        unobserved.slice(0, 8).join(', ') +
+        (unobserved.length > 8 ? ', ...' : ''),
+    });
+  }
+  return {
+    findings,
+    quarantined: matched.length,
+    skipped: unmatched.length,
+  };
+}
+`,
+        'scripts/run-integration-tests.mjs': `import { spawn, spawnSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { TextDecoder } from 'node:util';
+import pg from 'pg';
+import {
+  githubWorkflowRun,
+  reconcileRunnerQuarantine,
+  vitestIntegrationSkippedTestIds,
+} from '../testing/quarantine-runtime.mjs';
+
+const require = createRequire(import.meta.url);
+const {
+  createLocalTestScope,
+  createTestingEvidenceFromRunnerAttempts,
+  inspectTestingEvidenceArtifact,
+  normalizeEbkIntegrationEvidenceAttempt,
+  sanitizeTestingEvidenceSummary,
+  validateTestingEvidenceQuarantine,
+} = require('@empire-builder-kit/nx/testing-evidence');
+const { Client } = pg;
+const fatalUtf8Decoder = new TextDecoder('utf-8', { fatal: true });
+const projectRoot = process.cwd();
+const workspaceRoot = resolve(projectRoot, '../..');
+const evidenceRoot = join(projectRoot, '.ebk', 'evidence');
+const rawRoot = join(evidenceRoot, 'raw');
+rmSync(rawRoot, { force: true, recursive: true });
+mkdirSync(rawRoot, { recursive: true });
+const sanitizedIntegrationReportPath = join(
+  evidenceRoot,
+  'test-integration-report.json',
+);
+rmSync(sanitizedIntegrationReportPath, { force: true });
+
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const run = (command, args, options = {}) => {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd ?? projectRoot,
+    encoding: 'utf8',
+    env: options.env ?? process.env,
+    shell: false,
+    stdio: options.stdio ?? ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      sanitizeTestingEvidenceSummary(
+        result.error?.message ||
+          result.stderr ||
+          result.stdout ||
+          command + ' failed.',
+      ),
+    );
+  }
+  return result.stdout.trim();
+};
+const gitCommit =
+  process.env.EBK_SOURCE_COMMIT ??
+  run('git', ['rev-parse', 'HEAD'], { cwd: workspaceRoot });
+const workspacePackage = readJson(join(workspaceRoot, 'package.json'));
+const ownership = readJson(join(projectRoot, '.ebk', 'ownership.json'));
+const frameworkCandidate =
+  workspacePackage.dependencies?.['@empire-builder-kit/runtime'];
+if (typeof frameworkCandidate !== 'string' || !frameworkCandidate) {
+  throw new Error('The workspace runtime candidate is unavailable.');
+}
+const blueprintCandidates = [
+  ownership.blueprint.name + '@' + ownership.blueprint.version,
+];
+const requestedRunId = process.env.EBK_TEST_RUN_ID;
+const runId = requestedRunId ?? randomUUID().replaceAll('-', '');
+const seed = process.env.EBK_TEST_SEED ?? runId;
+const validRunId = /^[a-z0-9]{1,32}$/.test(runId);
+const validSeed = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(seed);
+const evidenceRunId = validRunId ? runId : 'invalid-run-id';
+const evidenceSeed = validSeed ? seed : 'invalid-seed';
+const workers = Number(process.env.EBK_TEST_WORKERS ?? 1);
+const validWorkers =
+  Number.isSafeInteger(workers) && workers >= 1 && workers <= 8;
+const composeProject = 'ebk-test-${name}-' + runId;
+const composeArgs = [
+  'compose',
+  '-f',
+  'database/test-compose.yml',
+  '--project-name',
+  composeProject,
+];
+const resultPath = join(evidenceRoot, 'test-integration.json');
+const source = {
+  blueprintCandidates,
+  commit: gitCommit,
+  frameworkCandidate,
+};
+const operation = {
+  commandVersion: '1',
+  project: '${name}',
+  proofLayer: 'local-integration',
+  target: 'test-integration',
+};
+let quarantineRecords = [];
+
+function writeResult(result) {
+  writeFileSync(resultPath, JSON.stringify(result, null, 2) + '\\n', 'utf8');
+  process.stdout.write(JSON.stringify(result) + '\\n');
+}
+
+function preflightFailure(classification, summary, startedAt) {
+  const completedAt = new Date().toISOString();
+  const result = createTestingEvidenceFromRunnerAttempts({
+    attempts: [],
+    cleanup: { outcome: 'not-required' },
+    environment: { class: 'local-docker', deployed: false },
+    operation,
+    preflight: {
+      completedAt,
+      findings: [{ classification, summary }],
+      startedAt,
+    },
+    proofStarted: false,
+    runScope: evidenceRunId,
+    seed: evidenceSeed,
+    slice: '${name}',
+    source,
+    workspace: workspacePackage.name,
+  });
+  rmSync(sanitizedIntegrationReportPath, { force: true });
+  rmSync(rawRoot, { force: true, recursive: true });
+  writeResult(result);
+  process.exitCode = 1;
+}
+
+function pruneStaleTestProjects() {
+  const candidateIds = run('docker', [
+    'ps',
+    '-aq',
+    '--filter',
+    'label=dev.empirebuilderkit.owner=test-integration',
+    '--filter',
+    'label=dev.empirebuilderkit.slice=${name}',
+  ]);
+  if (!candidateIds) return;
+  const candidates = JSON.parse(
+    run('docker', ['inspect', ...candidateIds.split(/\\s+/)]),
+  );
+  const now = Date.now();
+  const cutoff = now - 24 * 60 * 60 * 1000;
+  const projects = new Set();
+  for (const observation of candidates) {
+    const labels = observation.Config?.Labels ?? {};
+    const project = labels['com.docker.compose.project'];
+    const observedRunId = labels['dev.empirebuilderkit.run'];
+    const createdAt = Date.parse(observation.Created);
+    if (
+      labels['dev.empirebuilderkit.owner'] !== 'test-integration' ||
+      labels['dev.empirebuilderkit.slice'] !== '${name}' ||
+      typeof project !== 'string' ||
+      typeof observedRunId !== 'string' ||
+      !/^[a-z0-9]{1,32}$/.test(observedRunId) ||
+      project !== 'ebk-test-${name}-' + observedRunId ||
+      !Number.isFinite(createdAt) ||
+      createdAt > now ||
+      project === composeProject
+    ) {
+      throw new Error(
+        'A stale integration resource has ambiguous ownership or age.',
+      );
+    }
+    projects.add(project);
+  }
+  for (const project of [...projects].sort()) {
+    const memberIds = run('docker', [
+      'ps',
+      '-aq',
+      '--filter',
+      'label=com.docker.compose.project=' + project,
+    ]);
+    if (!memberIds) {
+      throw new Error(
+        'A stale integration project has no inspectable members.',
+      );
+    }
+    const members = JSON.parse(
+      run('docker', ['inspect', ...memberIds.split(/\\s+/)]),
+    );
+    const ages = [];
+    let running = false;
+    for (const observation of members) {
+      const labels = observation.Config?.Labels ?? {};
+      const observedRunId = labels['dev.empirebuilderkit.run'];
+      const createdAt = Date.parse(observation.Created);
+      if (
+        labels['com.docker.compose.project'] !== project ||
+        labels['dev.empirebuilderkit.owner'] !== 'test-integration' ||
+        labels['dev.empirebuilderkit.slice'] !== '${name}' ||
+        typeof observedRunId !== 'string' ||
+        !/^[a-z0-9]{1,32}$/.test(observedRunId) ||
+        project !== 'ebk-test-${name}-' + observedRunId ||
+        project === composeProject ||
+        !Number.isFinite(createdAt) ||
+        createdAt > now ||
+        typeof observation.State?.Running !== 'boolean'
+      ) {
+        throw new Error(
+          'A stale integration project has ambiguous members or age.',
+        );
+      }
+      ages.push(createdAt);
+      running ||= observation.State.Running;
+    }
+    const oldMembers = ages.filter((createdAt) => createdAt <= cutoff).length;
+    if (oldMembers > 0 && oldMembers !== ages.length) {
+      throw new Error(
+        'A stale integration project contains mixed-age members.',
+      );
+    }
+    if (oldMembers === 0 || running) continue;
+    run('docker', [
+      'compose',
+      '-f',
+      'database/test-compose.yml',
+      '--project-name',
+      project,
+      'down',
+      '--remove-orphans',
+      '--volumes',
+    ]);
+  }
+}
+
+async function prepareDatabase(adminUrl, databaseName) {
+  const admin = new Client({ connectionString: adminUrl });
+  await admin.connect();
+  try {
+    await admin.query('CREATE DATABASE "' + databaseName + '"');
+  } finally {
+    await admin.end();
+  }
+  const databaseUrl = adminUrl.replace(/\\/postgres$/, '/' + databaseName);
+  const client = new Client({ connectionString: databaseUrl });
+  await client.connect();
+  try {
+    for (const file of readdirSync(join(projectRoot, 'database', 'migrations'))
+      .filter((path) => path.endsWith('.sql'))
+      .sort()) {
+      await client.query(
+        readFileSync(join(projectRoot, 'database', 'migrations', file), 'utf8'),
+      );
+    }
+  } finally {
+    await client.end();
+  }
+  return databaseUrl;
+}
+
+function runWorker(worker, databaseUrl, reportPath, attempt) {
+  const executable = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
+  const arguments_ = [
+    'exec',
+    'vitest',
+    'run',
+    '--config',
+    'vitest.integration.config.ts',
+    '--maxWorkers=1',
+    '--reporter=./testing/strict-json-reporter.mjs',
+    '--outputFile=' + reportPath,
+    ...(workers > 1 ? ['--shard=' + (worker + 1) + '/' + workers] : []),
+  ];
+  return new Promise((resolveWorker) => {
+    const workerEnvironmentNames = new Set([
+      'APPDATA',
+      'CI',
+      'ComSpec',
+      'COMSPEC',
+      'HOME',
+      'LANG',
+      'LC_ALL',
+      'LOCALAPPDATA',
+      'PATH',
+      'PATHEXT',
+      'SystemRoot',
+      'SYSTEMROOT',
+      'TEMP',
+      'TMP',
+      'TMPDIR',
+      'TZ',
+      'USERPROFILE',
+    ]);
+    const childEnvironment = Object.fromEntries(
+      Object.entries(process.env).filter(
+        ([name, value]) =>
+          workerEnvironmentNames.has(name) && typeof value === 'string',
+      ),
+    );
+    const child = spawn(executable, arguments_, {
+      cwd: projectRoot,
+      env: {
+        ...childEnvironment,
+        DATABASE_URL: databaseUrl,
+        EBK_TEST_ATTEMPT: String(attempt),
+        EBK_TEST_RUN_ID: runId,
+        EBK_TEST_SEED: seed,
+        EBK_TEST_WORKER: String(worker),
+      },
+      shell: false,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      windowsHide: true,
+    });
+    const maximumDiagnosticCharacters = 64 * 1024;
+    let diagnostic = '';
+    const appendDiagnostic = (chunk) => {
+      if (diagnostic.length >= maximumDiagnosticCharacters) return;
+      diagnostic += chunk
+        .toString()
+        .slice(0, maximumDiagnosticCharacters - diagnostic.length);
+    };
+    child.stdout.on('data', (chunk) => {
+      appendDiagnostic(chunk);
+    });
+    child.stderr.on('data', (chunk) => {
+      appendDiagnostic(chunk);
+    });
+    child.once('error', (error) => {
+      resolveWorker({ diagnostic: error.message, status: 1, worker });
+    });
+    child.once('close', (status) => {
+      resolveWorker({ diagnostic, status: status ?? 1, worker });
+    });
+  });
+}
+
+function readBoundedVitestReport(reportPath) {
+  if (!existsSync(reportPath)) {
+    return {
+      finding: {
+        classification: 'evidence-incomplete',
+        summary: 'A Vitest worker did not emit its machine-readable report.',
+      },
+    };
+  }
+  const size = statSync(reportPath).size;
+  if (!Number.isSafeInteger(size) || size < 2 || size > 5 * 1024 * 1024) {
+    return {
+      finding: {
+        classification: 'evidence-incomplete',
+        summary:
+          'A Vitest worker report was empty or exceeded the five-megabyte inspection bound.',
+      },
+    };
+  }
+  let report;
+  try {
+    const bytes = readFileSync(reportPath);
+    if (bytes.byteLength !== size) {
+      throw new Error('vitest-report-size-changed');
+    }
+    report = JSON.parse(fatalUtf8Decoder.decode(bytes));
+  } catch {
+    return {
+      finding: {
+        classification: 'evidence-incomplete',
+        summary: 'A Vitest worker emitted malformed machine-readable output.',
+      },
+    };
+  }
+  const counts = [
+    report?.numTotalTests,
+    report?.numFailedTests,
+    report?.numPassedTests,
+    report?.numPendingTests,
+    report?.numTodoTests,
+  ];
+  if (
+    !report ||
+    typeof report !== 'object' ||
+    Array.isArray(report) ||
+    !Array.isArray(report.testResults) ||
+    !report.ebkPolicy ||
+    typeof report.ebkPolicy !== 'object' ||
+    Array.isArray(report.ebkPolicy) ||
+    JSON.stringify(Object.keys(report.ebkPolicy).sort()) !==
+      JSON.stringify([
+        'expectedFailures',
+        'focusedTests',
+        'retryConfiguredTests',
+      ]) ||
+    counts.some(
+      (count) =>
+        !Number.isSafeInteger(count) ||
+        count < 0,
+    ) ||
+    !Number.isSafeInteger(report.ebkPolicy.expectedFailures) ||
+    report.ebkPolicy.expectedFailures < 0 ||
+    !Number.isSafeInteger(report.ebkPolicy.focusedTests) ||
+    report.ebkPolicy.focusedTests < 0 ||
+    !Number.isSafeInteger(report.ebkPolicy.retryConfiguredTests) ||
+    report.ebkPolicy.retryConfiguredTests < 0
+  ) {
+    return {
+      finding: {
+        classification: 'evidence-incomplete',
+        summary:
+          'A Vitest worker report did not satisfy the bounded JSON result contract.',
+      },
+    };
+  }
+  const observed = {
+    failed: 0,
+    passed: 0,
+    pending: 0,
+    todo: 0,
+    total: 0,
+  };
+  for (const testResult of report.testResults) {
+    if (
+      !testResult ||
+      typeof testResult !== 'object' ||
+      Array.isArray(testResult) ||
+      !Array.isArray(testResult.assertionResults)
+    ) {
+      return {
+        finding: {
+          classification: 'evidence-incomplete',
+          summary:
+            'A Vitest worker report did not contain inspectable assertion results.',
+        },
+      };
+    }
+    for (const assertion of testResult.assertionResults) {
+      const status = assertion?.status;
+      if (
+        !assertion ||
+        typeof assertion !== 'object' ||
+        Array.isArray(assertion) ||
+        !['failed', 'passed', 'pending', 'skipped', 'todo'].includes(status)
+      ) {
+        return {
+          finding: {
+            classification: 'evidence-incomplete',
+            summary:
+              'A Vitest worker report contained an unsupported assertion result.',
+          },
+        };
+      }
+      observed.total += 1;
+      if (status === 'failed') observed.failed += 1;
+      if (status === 'passed') observed.passed += 1;
+      if (status === 'pending' || status === 'skipped') observed.pending += 1;
+      if (status === 'todo') observed.todo += 1;
+    }
+  }
+  if (
+    observed.total !== report.numTotalTests ||
+    observed.failed !== report.numFailedTests ||
+    observed.passed !== report.numPassedTests ||
+    observed.pending !== report.numPendingTests ||
+    observed.todo !== report.numTodoTests
+  ) {
+    return {
+      finding: {
+        classification: 'evidence-incomplete',
+        summary:
+          'A Vitest worker report aggregate did not reconcile to its assertion results.',
+      },
+    };
+  }
+  if (
+    report.ebkPolicy.expectedFailures > 0 ||
+    report.ebkPolicy.focusedTests > 0 ||
+    report.ebkPolicy.retryConfiguredTests > 0
+  ) {
+    return {
+      finding: {
+        classification: 'assertion-failed',
+        summary:
+          'Vitest focused tests, expected-failure semantics, and runner-internal retries are forbidden in integration proof.',
+      },
+      report,
+    };
+  }
+  return { report };
+}
+
+async function runAttempt(attempt, adminUrl) {
+  const attemptStartedAt = new Date().toISOString();
+  const findings = [];
+  const reports = [];
+  const reportPaths = [];
+  let workerResults = [];
+  try {
+    const databaseUrls = [];
+    for (let worker = 0; worker < workers; worker += 1) {
+      const scope = createLocalTestScope({
+        capabilities: {
+          canCreateDatabase: true,
+          canForceDropDatabase: true,
+          migrationSchemaIsolationProven: false,
+        },
+        identity: {
+          attempt,
+          commit: gitCommit,
+          runId,
+          seed,
+          stage: 'development',
+          worker,
+          workspace: workspacePackage.name,
+        },
+        sharedDatabaseName: 'postgres',
+      });
+      databaseUrls.push(
+        await prepareDatabase(adminUrl, scope.databaseName),
+      );
+    }
+    workerResults = await Promise.all(
+      databaseUrls.map((databaseUrl, worker) => {
+        const reportPath = join(
+          rawRoot,
+          'vitest-attempt-' + attempt + '-worker-' + worker + '.json',
+        );
+        reportPaths.push(reportPath);
+        return runWorker(worker, databaseUrl, reportPath, attempt);
+      }),
+    );
+    const workerDiagnostics = [];
+    for (const workerResult of workerResults) {
+      const reportPath = join(
+        rawRoot,
+        'vitest-attempt-' +
+          attempt +
+          '-worker-' +
+          workerResult.worker +
+          '.json',
+      );
+      const observedReport = readBoundedVitestReport(reportPath);
+      if (observedReport.report) reports.push(observedReport.report);
+      if (observedReport.finding) findings.push(observedReport.finding);
+      if (workerResult.status !== 0) {
+        workerDiagnostics.push({
+          classification: 'assertion-failed',
+          summary: sanitizeTestingEvidenceSummary(workerResult.diagnostic),
+        });
+      }
+    }
+    const failedTestNames = [
+      ...new Set(
+        reports
+          .flatMap((report) => report.testResults ?? [])
+          .flatMap((fileResult) => fileResult.assertionResults ?? [])
+          .filter(({ status }) => status === 'failed')
+          .map(
+            ({ fullName, title }) => fullName || title || 'unnamed test',
+          ),
+      ),
+    ].sort();
+    // The named finding must precede worker diagnostics: retained evidence
+    // keeps the first finding per classification, so a leading raw-report
+    // pointer would mask the test identities.
+    if (failedTestNames.length > 0) {
+      findings.push({
+        classification: 'assertion-failed',
+        summary: sanitizeTestingEvidenceSummary(
+          'Failed integration tests: ' + failedTestNames.join(' | '),
+        ),
+      });
+    }
+    findings.push(...workerDiagnostics);
+    if (
+      reports.some(
+        (report) =>
+          !inspectTestingEvidenceArtifact({
+            contents: JSON.stringify(report),
+          }).safe,
+      )
+    ) {
+      findings.push({
+        classification: 'sensitive-artifact',
+        summary:
+          'A raw runner report matched protected artifact data and was not retained.',
+      });
+    }
+  } catch (error) {
+    findings.push({
+      classification: 'infrastructure-unavailable',
+      summary: error instanceof Error ? error.message : String(error),
+    });
+  }
+  const totals = reports.reduce(
+    (sum, report) => ({
+      failed: sum.failed + Number(report.numFailedTests ?? 0),
+      passed: sum.passed + Number(report.numPassedTests ?? 0),
+      skipped:
+        sum.skipped +
+        Number(report.numPendingTests ?? 0) +
+        Number(report.numTodoTests ?? 0),
+    }),
+    { failed: 0, passed: 0, skipped: 0 },
+  );
+  const reportedSkipped = totals.skipped;
+  const quarantine = reconcileRunnerQuarantine({
+    records: quarantineRecords,
+    runner: 'vitest-integration',
+    skippedTestIds: vitestIntegrationSkippedTestIds(
+      reports,
+      projectRoot,
+    ),
+  });
+  findings.push(...quarantine.findings);
+  if (reportedSkipped !== quarantine.quarantined + quarantine.skipped) {
+    findings.push({
+      classification: 'evidence-incomplete',
+      summary:
+        'Vitest skipped-test counts could not be reconciled to stable test identities.',
+    });
+  }
+  totals.skipped = quarantine.skipped;
+  if (
+    (workerResults.some(({ status }) => status !== 0) ||
+      findings.length > 0) &&
+    totals.failed === 0
+  ) {
+    totals.failed = 1;
+  }
+  return {
+    normalized: normalizeEbkIntegrationEvidenceAttempt({
+      attempt,
+      completedAt: new Date().toISOString(),
+      failed: totals.failed,
+      findings,
+      ...(attempt === 2 ? { identicalToPrevious: true } : {}),
+      passed: totals.passed,
+      quarantined: quarantine.quarantined,
+      skipped: totals.skipped,
+      startedAt: attemptStartedAt,
+    }),
+    reportPaths,
+    reports,
+  };
+}
+
+function failClosedArtifact(attempts, classification, sanitizedSummary) {
+  const last = attempts.at(-1);
+  if (!last) {
+    throw new Error('A proof artifact failed without an owning attempt.');
+  }
+  const findings = [
+    ...last.findings.filter(
+      (finding) => finding.classification !== classification,
+    ),
+    { classification, sanitizedSummary },
+  ];
+  if (
+    !findings.some(({ classification: observed }) =>
+      [
+        'assertion-failed',
+        'authorization-denied',
+        'contract-incompatible',
+        'environment-drift',
+        'infrastructure-unavailable',
+        'prerequisite-missing',
+        'sensitive-artifact',
+      ].includes(observed),
+    )
+  ) {
+    findings.push({
+      classification: 'assertion-failed',
+      sanitizedSummary: 'The bounded runner artifact was not retained.',
+    });
+  }
+  attempts[attempts.length - 1] = {
+    ...last,
+    failed: Math.max(last.failed, 1),
+    findings: findings.sort((left, right) =>
+      left.classification < right.classification
+        ? -1
+        : left.classification > right.classification
+          ? 1
+          : 0,
+    ),
+  };
+}
+
+const startedAt = new Date().toISOString();
+if (!validRunId || !validSeed || !validWorkers) {
+  preflightFailure(
+    'prerequisite-missing',
+    'Integration proof requires a non-empty normalized run id, bounded printable seed, and one through eight workers.',
+    startedAt,
+  );
+}
+if (process.exitCode === undefined) {
+  let quarantine;
+  try {
+    quarantine = validateTestingEvidenceQuarantine(
+      readJson(join(projectRoot, 'testing', 'quarantine.json')),
+      {
+        now: startedAt,
+        workflowRun: githubWorkflowRun(),
+      },
+    );
+  } catch {
+    preflightFailure(
+      'environment-drift',
+      'The testing quarantine file is missing or malformed.',
+      startedAt,
+    );
+  }
+  if (process.exitCode === undefined && quarantine && !quarantine.valid) {
+    preflightFailure(
+      'environment-drift',
+      quarantine.issues
+        .map(({ message, path }) => path + ' ' + message)
+        .join('; '),
+      startedAt,
+    );
+  }
+  if (process.exitCode === undefined && quarantine?.valid) {
+    quarantineRecords = quarantine.value.records;
+    try {
+      run('docker', ['version', '--format', '{{.Server.Version}}']);
+      pruneStaleTestProjects();
+    } catch (error) {
+      preflightFailure(
+        'prerequisite-missing',
+        error instanceof Error ? error.message : String(error),
+        startedAt,
+      );
+    }
+  }
+}
+
+if (process.exitCode === undefined) {
+  let cleanup = { outcome: 'not-required' };
+  let proofStarted = false;
+  let preflightSummary = 'The integration proof did not start.';
+  const attempts = [];
+  const reports = [];
+  const reportPaths = [];
+  try {
+    run('docker', [...composeArgs, 'up', '--detach', '--wait'], {
+      env: { ...process.env, EBK_TEST_RUN_ID: runId },
+    });
+    proofStarted = true;
+    const address = run('docker', [
+      ...composeArgs,
+      'port',
+      'database',
+      '5432',
+    ]);
+    const port = /:(\\d+)\\s*$/.exec(address)?.[1];
+    if (!port) throw new Error('Docker did not report the integration port.');
+    const adminUrl =
+      'postgresql://ebk_test:ebk_test@127.0.0.1:' + port + '/postgres';
+    const first = await runAttempt(1, adminUrl);
+    attempts.push(first.normalized);
+    reports.push(...first.reports);
+    reportPaths.push(...first.reportPaths);
+    if (first.normalized.failed > 0) {
+      const second = await runAttempt(2, adminUrl);
+      attempts.push(second.normalized);
+      reports.push(...second.reports);
+      reportPaths.push(...second.reportPaths);
+    }
+  } catch (error) {
+    if (proofStarted) {
+      attempts.push(
+        normalizeEbkIntegrationEvidenceAttempt({
+          attempt: 1,
+          completedAt: new Date().toISOString(),
+          failed: 1,
+          findings: [
+            {
+              classification: 'infrastructure-unavailable',
+              summary: error instanceof Error ? error.message : String(error),
+            },
+          ],
+          passed: 0,
+          quarantined: 0,
+          skipped: 0,
+          startedAt,
+        }),
+      );
+    } else {
+      preflightSummary =
+        error instanceof Error ? error.message : String(error);
+    }
+  } finally {
+    try {
+      if (proofStarted) {
+        run('docker', [
+          ...composeArgs,
+          'down',
+          '--remove-orphans',
+          '--volumes',
+        ]);
+        cleanup = { outcome: 'passed' };
+      }
+    } catch (error) {
+      cleanup = {
+        outcome: 'failed',
+        sanitizedSummary:
+          error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  if (!proofStarted) {
+    preflightFailure(
+      'prerequisite-missing',
+      preflightSummary,
+      startedAt,
+    );
+  } else {
+    const artifacts = [];
+    try {
+      if (reports.length > 0) {
+        const combinedReport = JSON.stringify({ reports }, null, 2) + '\\n';
+        const combinedReportBytes = Buffer.byteLength(
+          combinedReport,
+          'utf8',
+        );
+        if (combinedReportBytes > 5 * 1024 * 1024) {
+          failClosedArtifact(
+            attempts,
+            'evidence-incomplete',
+            'The combined Vitest report exceeded the five-megabyte retention bound.',
+          );
+          rmSync(sanitizedIntegrationReportPath, { force: true });
+        } else {
+          let inspection;
+          try {
+            inspection = inspectTestingEvidenceArtifact({
+              contents: combinedReport,
+            });
+          } catch {
+            inspection = { safe: false };
+          }
+          if (!inspection.safe) {
+            failClosedArtifact(
+              attempts,
+              'sensitive-artifact',
+              'The combined Vitest report matched protected artifact data and was removed.',
+            );
+            rmSync(sanitizedIntegrationReportPath, { force: true });
+          } else {
+          writeFileSync(
+            sanitizedIntegrationReportPath,
+            combinedReport,
+            'utf8',
+          );
+          artifacts.push({
+            digest:
+              'sha256:' +
+              createHash('sha256').update(combinedReport).digest('hex'),
+            name: relative(projectRoot, sanitizedIntegrationReportPath)
+              .replaceAll('\\\\', '/'),
+            retentionClass: 'source-result',
+          });
+          }
+        }
+      }
+    } finally {
+      for (const reportPath of reportPaths) {
+        rmSync(reportPath, { force: true });
+      }
+      rmSync(rawRoot, { force: true, recursive: true });
+    }
+    const result = createTestingEvidenceFromRunnerAttempts({
+      artifacts,
+      attempts,
+      cleanup,
+      environment: { class: 'local-docker', deployed: false },
+      operation,
+      proofStarted: true,
+      runScope: runId,
+      seed,
+      slice: '${name}',
+      source,
+      workspace: workspacePackage.name,
+    });
+    writeResult(result);
+    if (result.outcome !== 'passed') process.exitCode = 1;
+  }
+}
+`,
+        'scripts/run-smoke-deployed.mjs': `import {
+  AdminAddUserToGroupCommand,
+  AdminCreateUserCommand,
+  AdminDeleteUserCommand,
+  AdminSetUserPasswordCommand,
+  CognitoIdentityProviderClient,
+  DescribeUserPoolClientCommand,
+} from '@aws-sdk/client-cognito-identity-provider';
+import {
+  CloudWatchLogsClient,
+  FilterLogEventsCommand,
+} from '@aws-sdk/client-cloudwatch-logs';
+import { spawnSync } from 'node:child_process';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { TextDecoder } from 'node:util';
+import {
+  githubWorkflowRun,
+  playwrightSkippedTestIds,
+  reconcileRunnerQuarantine,
+} from '../testing/quarantine-runtime.mjs';
+
+const require = createRequire(import.meta.url);
+const {
+  createTestingEvidenceFromRunnerAttempts,
+  inspectTestingEvidenceArtifact,
+  normalizePlaywrightEvidenceAttempt,
+  sanitizeTestingEvidenceSummary,
+  validateTestingEvidenceQuarantine,
+} = require('@empire-builder-kit/nx/testing-evidence');
+const fatalUtf8Decoder = new TextDecoder('utf-8', { fatal: true });
+const projectRoot = process.cwd();
+const workspaceRoot = resolve(projectRoot, '../..');
+const evidenceRoot = join(projectRoot, '.ebk', 'evidence');
+const rawRoot = join(evidenceRoot, 'raw');
+rmSync(rawRoot, { force: true, recursive: true });
+mkdirSync(rawRoot, { recursive: true });
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const run = (command, args, options = {}) => {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd ?? projectRoot,
+    encoding: 'utf8',
+    env: options.env ?? process.env,
+    shell: false,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      sanitizeTestingEvidenceSummary(
+        result.error?.message ||
+          result.stderr ||
+          result.stdout ||
+          command + ' failed.',
+      ),
+    );
+  }
+  return result.stdout.trim();
+};
+const gitCommit =
+  process.env.EBK_SOURCE_COMMIT ??
+  run('git', ['rev-parse', 'HEAD'], { cwd: workspaceRoot });
+const workspacePackage = readJson(join(workspaceRoot, 'package.json'));
+const ownership = readJson(join(projectRoot, '.ebk', 'ownership.json'));
+const frameworkCandidate =
+  workspacePackage.dependencies?.['@empire-builder-kit/runtime'];
+if (typeof frameworkCandidate !== 'string' || !frameworkCandidate) {
+  throw new Error('The workspace runtime candidate is unavailable.');
+}
+const stage = process.env.EBK_STAGE ?? '';
+const validSourceCommit =
+  /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(gitCommit);
+const smokeUrl = process.env.EBK_SMOKE_URL ?? '';
+const smokeApiUrl = process.env.EBK_SMOKE_API_URL ?? '';
+const userPoolId = process.env.EBK_SMOKE_USER_POOL_ID ?? '';
+const clientId = process.env.EBK_SMOKE_CLIENT_ID ?? '';
+const smokeAuthority =
+  process.env.EBK_SMOKE_AUTHORITY_VERSION ?? '';
+const requestedRunId = process.env.EBK_TEST_RUN_ID;
+const runId = requestedRunId ?? randomUUID().replaceAll('-', '');
+const seed = process.env.EBK_TEST_SEED ?? runId;
+const validRunId = /^[a-z0-9]{1,32}$/.test(runId);
+const validSeed = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(seed);
+const evidenceRunId = validRunId ? runId : 'invalid-run-id';
+const evidenceSeed = validSeed ? seed : 'invalid-seed';
+const resultPath = join(evidenceRoot, 'smoke-deployed.json');
+const sanitizedReportPath = join(evidenceRoot, 'playwright-smoke.json');
+rmSync(resultPath, { force: true });
+rmSync(sanitizedReportPath, { force: true });
+const rawPath = (attempt) =>
+  join(rawRoot, 'playwright-smoke-' + attempt + '.json');
+const dataCleanupPath = (attempt) =>
+  join(rawRoot, 'data-cleanup-' + attempt + '.json');
+const source = {
+  blueprintCandidates: [
+    ownership.blueprint.name + '@' + ownership.blueprint.version,
+  ],
+  commit: validSourceCommit ? gitCommit : '0'.repeat(40),
+  frameworkCandidate,
+};
+const operation = {
+  commandVersion: '1',
+  project: '${name}',
+  proofLayer: 'deployed-smoke',
+  target: 'smoke-deployed',
+};
+const startedAt = new Date().toISOString();
+let quarantineRecords = [];
+
+function writeResult(result) {
+  writeFileSync(resultPath, JSON.stringify(result, null, 2) + '\\n', 'utf8');
+  process.stdout.write(JSON.stringify(result) + '\\n');
+}
+
+function readBoundedUtf8(path, minimumBytes, maximumBytes) {
+  const size = statSync(path).size;
+  if (
+    !Number.isSafeInteger(size) ||
+    size < minimumBytes ||
+    size > maximumBytes
+  ) {
+    throw new Error('invalid-bounded-file-size');
+  }
+  const bytes = readFileSync(path);
+  if (bytes.byteLength !== size) {
+    throw new Error('bounded-file-size-changed');
+  }
+  return fatalUtf8Decoder.decode(bytes);
+}
+
+function readDataCleanupOutcome(path) {
+  try {
+    if (!existsSync(path)) throw new Error('missing-cleanup-outcome');
+    const value = JSON.parse(readBoundedUtf8(path, 2, 1024));
+    if (
+      !value ||
+      typeof value !== 'object' ||
+      Array.isArray(value) ||
+      JSON.stringify(Object.keys(value).sort()) !==
+        JSON.stringify(['outcome', 'schemaVersion']) ||
+      value.schemaVersion !== 1 ||
+      !['not-required', 'passed'].includes(value.outcome)
+    ) {
+      throw new Error('invalid-cleanup-outcome');
+    }
+    return { outcome: value.outcome };
+  } catch {
+    return {
+      outcome: 'failed',
+      sanitizedSummary:
+        'The deployed smoke record cleanup was not proved.',
+    };
+  }
+}
+
+function failPreflight(
+  classification,
+  summary,
+  cleanup = { outcome: 'not-required' },
+) {
+  const result = createTestingEvidenceFromRunnerAttempts({
+    attempts: [],
+    cleanup,
+    environment: {
+      class: 'protected-github',
+      deployed: true,
+      stage: stage || 'unresolved',
+    },
+    operation,
+    preflight: {
+      completedAt: new Date().toISOString(),
+      findings: [{ classification, summary }],
+      startedAt,
+    },
+    proofStarted: false,
+    runScope: evidenceRunId,
+    seed: evidenceSeed,
+    slice: '${name}',
+    source,
+    workspace: workspacePackage.name,
+  });
+  rmSync(sanitizedReportPath, { force: true });
+  rmSync(rawRoot, { force: true, recursive: true });
+  writeResult(result);
+  process.exitCode = 1;
+}
+
+function credentialFreeHttpsUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return undefined;
+  }
+  return parsed.protocol === 'https:' &&
+    !parsed.username &&
+    !parsed.password &&
+    !parsed.search &&
+    !parsed.hash
+    ? parsed
+    : undefined;
+}
+
+function permissionFailure(error, operation, authority = 'Cognito principal') {
+  const name =
+    error && typeof error === 'object' && 'name' in error
+      ? String(error.name)
+      : 'UnknownAwsError';
+  const denied = [
+    'AccessDeniedException',
+    'NotAuthorizedException',
+    'UnauthorizedException',
+  ].includes(name);
+  return {
+    classification: denied
+      ? 'authorization-denied'
+      : 'infrastructure-unavailable',
+    summary: denied
+      ? 'The protected smoke role lacks the declared ' +
+        authority +
+        ' permission for ' +
+        operation +
+        '.'
+      : authority +
+        ' ' +
+        operation +
+        ' failed with ' +
+        name.replace(/[^A-Za-z0-9_-]/g, '').slice(0, 80) +
+        '.',
+  };
+}
+
+function isCognitoUserAbsent(error) {
+  return (
+    error &&
+    typeof error === 'object' &&
+    'name' in error &&
+    error.name === 'UserNotFoundException'
+  );
+}
+
+function structuredLogRecord(message) {
+  let candidate = message;
+  for (let depth = 0; depth < 4; depth += 1) {
+    if (typeof candidate === 'string') {
+      try {
+        candidate = JSON.parse(candidate);
+      } catch {
+        return undefined;
+      }
+    }
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+      return undefined;
+    }
+    if (
+      candidate.schemaVersion === 1 &&
+      typeof candidate.component === 'string'
+    ) {
+      return candidate;
+    }
+    candidate = candidate.message ?? candidate.record;
+  }
+  return undefined;
+}
+
+function validObservationIntent(value) {
+  return (
+    value &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    JSON.stringify(Object.keys(value).sort()) ===
+      JSON.stringify(['correlationId', 'eventId', 'schemaVersion']) &&
+    value.schemaVersion === 1 &&
+    /^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(value.eventId) &&
+    /^synthetic-[0-9a-f]{32}$/.test(value.correlationId)
+  );
+}
+
+function inspectPlaywrightReportPolicy(report) {
+  const config = report?.config;
+  const stats = report?.stats;
+  const countNames = ['expected', 'flaky', 'skipped', 'unexpected'];
+  if (
+    !report ||
+    typeof report !== 'object' ||
+    Array.isArray(report) ||
+    !Array.isArray(report.suites) ||
+    !config ||
+    typeof config !== 'object' ||
+    Array.isArray(config) ||
+    typeof config.forbidOnly !== 'boolean' ||
+    !stats ||
+    typeof stats !== 'object' ||
+    Array.isArray(stats) ||
+    countNames.some(
+      (name) =>
+        !Number.isSafeInteger(stats[name]) ||
+        stats[name] < 0,
+    )
+  ) {
+    return { invalid: true };
+  }
+  const observed = {
+    expected: 0,
+    flaky: 0,
+    skipped: 0,
+    unexpected: 0,
+  };
+  let expectedFailureCount = 0;
+  let testCount = 0;
+  const suites = [...report.suites];
+  while (suites.length > 0) {
+    const suite = suites.pop();
+    if (
+      !suite ||
+      typeof suite !== 'object' ||
+      Array.isArray(suite) ||
+      (suite.suites !== undefined && !Array.isArray(suite.suites)) ||
+      (suite.specs !== undefined && !Array.isArray(suite.specs))
+    ) {
+      return { invalid: true };
+    }
+    suites.push(...(suite.suites ?? []));
+    for (const spec of suite.specs ?? []) {
+      if (
+        !spec ||
+        typeof spec !== 'object' ||
+        Array.isArray(spec) ||
+        !Array.isArray(spec.tests)
+      ) {
+        return { invalid: true };
+      }
+      for (const testCase of spec.tests) {
+        if (
+          !testCase ||
+          typeof testCase !== 'object' ||
+          Array.isArray(testCase) ||
+          !['expected', 'flaky', 'skipped', 'unexpected'].includes(
+            testCase.status,
+          ) ||
+          !['failed', 'passed', 'skipped', 'timedOut'].includes(
+            testCase.expectedStatus,
+          )
+        ) {
+          return { invalid: true };
+        }
+        observed[testCase.status] += 1;
+        testCount += 1;
+        if (
+          testCase.expectedStatus === 'failed' ||
+          testCase.expectedStatus === 'timedOut'
+        ) {
+          expectedFailureCount += 1;
+        }
+      }
+    }
+  }
+  if (
+    testCount === 0 ||
+    countNames.some((name) => observed[name] !== stats[name])
+  ) {
+    return { invalid: true };
+  }
+  return {
+    expectedFailureCount,
+    flakyCount: stats.flaky,
+    focusedConfiguration: !config.forbidOnly,
+    invalid: false,
+  };
+}
+
+async function observePublishedEvent(logs, observationPath, attemptStartedAt) {
+  let intent;
+  try {
+    const contents = readBoundedUtf8(observationPath, 2, 1024);
+    intent = JSON.parse(contents);
+  } catch {
+    return {
+      classification: 'evidence-incomplete',
+      summary:
+        'The browser did not emit a valid credential-free event observation intent.',
+    };
+  }
+  if (!validObservationIntent(intent)) {
+    return {
+      classification: 'evidence-incomplete',
+      summary:
+        'The browser emitted an invalid credential-free event observation intent.',
+    };
+  }
+  const logGroupName = '/ebk/' + stage + '/${name}/event-consumer';
+  const startTime = Math.max(0, Date.parse(attemptStartedAt) - 5_000);
+  for (let poll = 0; poll < 8; poll += 1) {
+    let response;
+    try {
+      response = await logs.send(
+        new FilterLogEventsCommand({
+          filterPattern: '"' + intent.eventId + '"',
+          limit: 100,
+          logGroupName,
+          startTime,
+        }),
+      );
+    } catch (error) {
+      return permissionFailure(
+        error,
+        'event-consumer observation',
+        'CloudWatch Logs',
+      );
+    }
+    const observed = (response.events ?? []).some(({ message }) => {
+      const record = structuredLogRecord(message);
+      return (
+        record?.component === 'event-consumer' &&
+        record?.correlationId === intent.correlationId &&
+        record?.eventId === intent.eventId &&
+        record?.eventType === '${pascalName}Created' &&
+        record?.feature === 'events' &&
+        record?.operation === 'consume-created' &&
+        record?.outcome === 'success' &&
+        record?.slice === '${name}' &&
+        record?.stage === stage
+      );
+    });
+    if (observed) return undefined;
+    if (poll < 7) {
+      await new Promise((resolveDelay) => setTimeout(resolveDelay, 3_000));
+    }
+  }
+  return {
+    classification: 'assertion-failed',
+    summary:
+      'The exact published event and correlation were not observed in the managed event-consumer log group within the bounded window.',
+  };
+}
+
+const url = credentialFreeHttpsUrl(smokeUrl);
+const apiUrl = credentialFreeHttpsUrl(smokeApiUrl);
+const expectedProductPath = '/${name}';
+const normalizedProductPath = url?.pathname.replace(/\\/$/, '') || '/';
+const validIdentity =
+  /^[A-Za-z0-9_-]{1,128}_[A-Za-z0-9]{1,128}$/.test(userPoolId) &&
+  /^[a-z0-9]{1,128}$/.test(clientId);
+if (
+  !['staging', 'production'].includes(stage) ||
+  !url ||
+  !apiUrl ||
+  normalizedProductPath !== expectedProductPath ||
+  apiUrl.pathname !== '/' ||
+  !validIdentity ||
+  !validSourceCommit ||
+  !validRunId ||
+  !validSeed ||
+  smokeAuthority !== 'cognito-admin-cloudwatch-observe-v1' ||
+  !process.env.AWS_REGION
+) {
+  failPreflight(
+    'prerequisite-missing',
+    'Protected smoke requires staging or production, one exact source commit, reviewed credential-free HTTPS web and API targets, exact Cognito identity, bounded run/seed identity, AWS region, and cognito-admin-cloudwatch-observe-v1 authority acknowledgement.',
+  );
+}
+if (process.exitCode === undefined) {
+  let quarantine;
+  try {
+    quarantine = validateTestingEvidenceQuarantine(
+      readJson(join(projectRoot, 'testing', 'quarantine.json')),
+      {
+        now: startedAt,
+        workflowRun: githubWorkflowRun(),
+      },
+    );
+  } catch {
+    failPreflight(
+      'environment-drift',
+      'The testing quarantine file is missing or malformed.',
+    );
+  }
+  if (process.exitCode === undefined && quarantine && !quarantine.valid) {
+    failPreflight(
+      'environment-drift',
+      quarantine.issues
+        .map(({ message, path }) => path + ' ' + message)
+        .join('; '),
+    );
+  }
+  if (process.exitCode === undefined && quarantine?.valid) {
+    quarantineRecords = quarantine.value.records;
+  }
+}
+
+if (process.exitCode === undefined) {
+  const cognito = new CognitoIdentityProviderClient({
+    region: process.env.AWS_REGION,
+  });
+  const logs = new CloudWatchLogsClient({
+    region: process.env.AWS_REGION,
+  });
+  const principalEmail =
+    ('ebk-smoke-${name}-' + runId).slice(0, 60) + '@example.invalid';
+  const reviewerEmail =
+    ('ebk-review-${name}-' + runId).slice(0, 60) + '@example.invalid';
+  let principalPassword =
+    'Ebk!' + randomBytes(30).toString('base64url') + '9aA';
+  let reviewerPassword =
+    'Ebk!' + randomBytes(30).toString('base64url') + '9aA';
+  let principalCleanupRequired = false;
+  let reviewerCleanupRequired = false;
+  let setupFailure;
+  let preflightCleanup = { outcome: 'not-required' };
+  try {
+    await cognito.send(
+      new DescribeUserPoolClientCommand({
+        ClientId: clientId,
+        UserPoolId: userPoolId,
+      }),
+    );
+    principalCleanupRequired = true;
+    await cognito.send(
+      new AdminCreateUserCommand({
+        MessageAction: 'SUPPRESS',
+        UserAttributes: [
+          { Name: 'email', Value: principalEmail },
+          { Name: 'email_verified', Value: 'true' },
+        ],
+        Username: principalEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+    await cognito.send(
+      new AdminSetUserPasswordCommand({
+        Password: principalPassword,
+        Permanent: true,
+        Username: principalEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+    await cognito.send(
+      new AdminAddUserToGroupCommand({
+        GroupName: '${name}-test-writer',
+        Username: principalEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+    reviewerCleanupRequired = true;
+    await cognito.send(
+      new AdminCreateUserCommand({
+        MessageAction: 'SUPPRESS',
+        UserAttributes: [
+          { Name: 'email', Value: reviewerEmail },
+          { Name: 'email_verified', Value: 'true' },
+        ],
+        Username: reviewerEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+    await cognito.send(
+      new AdminSetUserPasswordCommand({
+        Password: reviewerPassword,
+        Permanent: true,
+        Username: reviewerEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+    await cognito.send(
+      new AdminAddUserToGroupCommand({
+        GroupName: '${name}-admin',
+        Username: reviewerEmail,
+        UserPoolId: userPoolId,
+      }),
+    );
+  } catch (error) {
+    setupFailure = permissionFailure(error, 'setup');
+  }
+  if (setupFailure && reviewerCleanupRequired) {
+    try {
+      await cognito.send(
+        new AdminDeleteUserCommand({
+          Username: reviewerEmail,
+          UserPoolId: userPoolId,
+        }),
+      );
+      reviewerCleanupRequired = false;
+      if (preflightCleanup.outcome !== 'failed') {
+        preflightCleanup = { outcome: 'passed' };
+      }
+    } catch (error) {
+      if (isCognitoUserAbsent(error)) {
+        reviewerCleanupRequired = false;
+        if (preflightCleanup.outcome !== 'failed') {
+          preflightCleanup = { outcome: 'passed' };
+        }
+      } else {
+        preflightCleanup = {
+          outcome: 'failed',
+          sanitizedSummary: permissionFailure(error, 'cleanup').summary,
+        };
+      }
+    }
+  }
+  if (setupFailure && principalCleanupRequired) {
+    try {
+      await cognito.send(
+        new AdminDeleteUserCommand({
+          Username: principalEmail,
+          UserPoolId: userPoolId,
+        }),
+      );
+      principalCleanupRequired = false;
+      if (preflightCleanup.outcome !== 'failed') {
+        preflightCleanup = { outcome: 'passed' };
+      }
+    } catch (error) {
+      if (isCognitoUserAbsent(error)) {
+        principalCleanupRequired = false;
+        if (preflightCleanup.outcome !== 'failed') {
+          preflightCleanup = { outcome: 'passed' };
+        }
+      } else {
+        preflightCleanup = {
+          outcome: 'failed',
+          sanitizedSummary: permissionFailure(error, 'cleanup').summary,
+        };
+      }
+    }
+  }
+  if (setupFailure) {
+    principalPassword = undefined;
+    reviewerPassword = undefined;
+    failPreflight(
+      setupFailure.classification,
+      setupFailure.summary,
+      preflightCleanup,
+    );
+  }
+
+  if (process.exitCode !== undefined) {
+    rmSync(rawRoot, { force: true, recursive: true });
+  } else {
+    const executable =
+      process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
+    const executeAttempt = async (attempt) => {
+      const attemptStartedAt = new Date().toISOString();
+      const path = rawPath(attempt);
+      const observationPath = join(
+        rawRoot,
+        'event-observation-' + attempt + '.json',
+      );
+      const cleanupPath = dataCleanupPath(attempt);
+      rmSync(observationPath, { force: true });
+      rmSync(cleanupPath, { force: true });
+      let dataCleanup = {
+        outcome: 'failed',
+        sanitizedSummary:
+          'The deployed smoke record cleanup was not proved.',
+      };
+      let execution;
+      let observationFinding;
+      let reportPolicyFinding;
+      let report;
+      let reportCredentialLeak = false;
+      let reportInvalid = false;
+      try {
+        const browserEnvironmentNames = new Set([
+          'APPDATA',
+          'CI',
+          'ComSpec',
+          'COMSPEC',
+          'HOME',
+          'LANG',
+          'LC_ALL',
+          'LOCALAPPDATA',
+          'PATH',
+          'PATHEXT',
+          'PLAYWRIGHT_BROWSERS_PATH',
+          'SystemRoot',
+          'SYSTEMROOT',
+          'TEMP',
+          'TMP',
+          'TMPDIR',
+          'USERPROFILE',
+        ]);
+        const childEnvironment = Object.fromEntries(
+          Object.entries(process.env).filter(
+            ([name, value]) =>
+              browserEnvironmentNames.has(name) &&
+              typeof value === 'string',
+          ),
+        );
+        execution = spawnSync(
+          executable,
+          ['exec', 'playwright', 'test', '--reporter=json'],
+          {
+            cwd: projectRoot,
+            encoding: 'utf8',
+            env: {
+              ...childEnvironment,
+              EBK_SOURCE_COMMIT: gitCommit,
+              EBK_STAGE: stage,
+              EBK_SMOKE_API_URL: apiUrl.href,
+              EBK_SMOKE_DATA_CLEANUP_PATH: cleanupPath,
+              EBK_SMOKE_EMAIL: principalEmail,
+              EBK_SMOKE_PASSWORD: principalPassword,
+              EBK_SMOKE_REVIEWER_EMAIL: reviewerEmail,
+              EBK_SMOKE_REVIEWER_PASSWORD: reviewerPassword,
+              EBK_SMOKE_OBSERVATION_PATH: observationPath,
+              EBK_SMOKE_URL: url.href,
+              EBK_TEST_RUN_ID: runId,
+              EBK_TEST_SEED: seed,
+              PLAYWRIGHT_JSON_OUTPUT_NAME: path,
+            },
+            shell: false,
+            stdio: ['ignore', 'ignore', 'ignore'],
+            windowsHide: true,
+          },
+        );
+        if (existsSync(path)) {
+          try {
+            const reportContents = readBoundedUtf8(
+              path,
+              2,
+              5 * 1024 * 1024,
+            );
+            if (
+              (typeof principalPassword === 'string' &&
+                reportContents.includes(principalPassword)) ||
+              (typeof reviewerPassword === 'string' &&
+                reportContents.includes(reviewerPassword))
+            ) {
+              reportCredentialLeak = true;
+            } else {
+              report = JSON.parse(reportContents);
+              const policy = inspectPlaywrightReportPolicy(report);
+              if (policy.invalid) {
+                report = undefined;
+                reportInvalid = true;
+              } else if (policy.flakyCount > 0) {
+                reportPolicyFinding = {
+                  classification: 'assertion-failed',
+                  summary:
+                    'Playwright runner-internal retries are forbidden in deployed proof.',
+                };
+              } else if (
+                policy.expectedFailureCount > 0 ||
+                policy.focusedConfiguration
+              ) {
+                reportPolicyFinding = {
+                  classification: 'assertion-failed',
+                  summary:
+                    'Playwright focused tests and expected-failure semantics are forbidden in deployed proof.',
+                };
+              }
+            }
+          } catch {
+            reportInvalid = true;
+          }
+        } else {
+          reportInvalid = true;
+        }
+        if (execution?.status === 0) {
+          observationFinding = await observePublishedEvent(
+            logs,
+            observationPath,
+            attemptStartedAt,
+          );
+        }
+      } finally {
+        dataCleanup = readDataCleanupOutcome(cleanupPath);
+        rmSync(path, { force: true });
+        rmSync(observationPath, { force: true });
+        rmSync(cleanupPath, { force: true });
+        rmSync(join(projectRoot, 'test-results'), {
+          force: true,
+          recursive: true,
+        });
+        rmSync(join(projectRoot, 'playwright-report'), {
+          force: true,
+          recursive: true,
+        });
+      }
+      const stats = report?.stats ?? {};
+      const reportedSkipped = Number(stats.skipped ?? 0);
+      const quarantine = reconcileRunnerQuarantine({
+        records: quarantineRecords,
+        runner: 'playwright',
+        skippedTestIds: report
+          ? playwrightSkippedTestIds(report, projectRoot)
+          : [],
+      });
+      const reportedUnexpected = Number(stats.unexpected ?? 0);
+      const processSucceeded =
+        execution?.status === 0 &&
+        execution.signal === null &&
+        execution.error === undefined;
+      const runnerFailed = Math.max(
+        Number.isSafeInteger(reportedUnexpected) &&
+          reportedUnexpected >= 0
+          ? reportedUnexpected
+          : 1,
+        processSucceeded &&
+          !reportCredentialLeak &&
+          !reportInvalid &&
+          report
+          ? 0
+          : 1,
+      );
+      const failed = Math.max(
+        runnerFailed,
+        observationFinding ? 1 : 0,
+        reportPolicyFinding ? 1 : 0,
+      );
+      return {
+        attempt,
+        completedAt: new Date().toISOString(),
+        dataCleanup,
+        diagnostic:
+          (reportInvalid
+            ? 'Playwright emitted malformed machine-readable output.'
+            : undefined) ||
+          (reportCredentialLeak
+            ? 'Playwright output contained the synthetic principal credential and was removed.'
+            : undefined) ||
+          (execution?.error
+            ? 'The Playwright process could not start.'
+            : 'Playwright smoke assertions failed.'),
+        failed,
+        artifactSensitive: reportCredentialLeak,
+        observationFindings: observationFinding
+          ? [observationFinding]
+          : [],
+        policyFindings: reportPolicyFinding
+          ? [reportPolicyFinding]
+          : [],
+        passed: Number(stats.expected ?? 0),
+        report,
+        reportInvalid,
+        runnerFailed,
+        quarantineFindings: [
+          ...quarantine.findings,
+          ...(reportedSkipped !==
+          quarantine.quarantined + quarantine.skipped
+            ? [
+                {
+                  classification: 'evidence-incomplete',
+                  summary:
+                    'Playwright skipped-test counts could not be reconciled to stable test identities.',
+                },
+              ]
+            : []),
+        ],
+        quarantined: quarantine.quarantined,
+        skipped: quarantine.skipped,
+        startedAt: attemptStartedAt,
+      };
+    };
+    const executions = [];
+    const artifacts = [];
+    let cleanup = { outcome: 'passed' };
+    try {
+      executions.push(await executeAttempt(1));
+      if (executions[0].failed > 0) {
+        executions.push(await executeAttempt(2));
+      }
+      const reports = executions
+        .filter(({ report }) => report !== undefined)
+        .map(({ attempt, report }) => ({ attempt, report }));
+      if (reports.length > 0) {
+        const raw = JSON.stringify({ reports }, null, 2) + '\\n';
+        let inspection;
+        try {
+          inspection =
+            (typeof principalPassword === 'string' &&
+              raw.includes(principalPassword)) ||
+            (typeof reviewerPassword === 'string' &&
+              raw.includes(reviewerPassword))
+              ? { safe: false }
+              : inspectTestingEvidenceArtifact({
+                  contents: raw,
+                });
+        } catch {
+          inspection = { safe: false };
+        }
+        if (inspection.safe) {
+          writeFileSync(sanitizedReportPath, raw, 'utf8');
+          artifacts.push({
+            digest:
+              'sha256:' + createHash('sha256').update(raw).digest('hex'),
+            name: relative(projectRoot, sanitizedReportPath)
+              .replaceAll('\\\\', '/'),
+            retentionClass: 'protected-promotion-proof',
+          });
+        } else {
+          rmSync(sanitizedReportPath, { force: true });
+          executions[executions.length - 1].artifactSensitive = true;
+        }
+      }
+    } catch {
+      rmSync(sanitizedReportPath, { force: true });
+      const execution = executions.at(-1);
+      if (execution) {
+        execution.diagnostic =
+          'The deployed browser runner failed before producing safe evidence.';
+        execution.failed = Math.max(execution.failed, 1);
+        execution.reportInvalid = true;
+      } else {
+        const failedAt = new Date().toISOString();
+        executions.push({
+          attempt: 1,
+          completedAt: failedAt,
+          dataCleanup: {
+            outcome: 'failed',
+            sanitizedSummary:
+              'The deployed smoke record cleanup was not proved.',
+          },
+          diagnostic:
+            'The deployed browser runner failed before producing safe evidence.',
+          failed: 1,
+          passed: 0,
+          reportInvalid: true,
+          skipped: 0,
+          startedAt: failedAt,
+        });
+      }
+    } finally {
+      principalPassword = undefined;
+      reviewerPassword = undefined;
+      if (artifacts.length === 0) {
+        rmSync(sanitizedReportPath, { force: true });
+      }
+      rmSync(rawRoot, { force: true, recursive: true });
+      rmSync(join(projectRoot, 'test-results'), {
+        force: true,
+        recursive: true,
+      });
+      rmSync(join(projectRoot, 'playwright-report'), {
+        force: true,
+        recursive: true,
+      });
+      if (principalCleanupRequired) {
+        try {
+          await cognito.send(
+            new AdminDeleteUserCommand({
+              Username: principalEmail,
+              UserPoolId: userPoolId,
+            }),
+          );
+          principalCleanupRequired = false;
+        } catch (error) {
+          if (isCognitoUserAbsent(error)) {
+            principalCleanupRequired = false;
+          } else {
+            cleanup = {
+              outcome: 'failed',
+              sanitizedSummary: permissionFailure(error, 'cleanup').summary,
+            };
+          }
+        }
+      }
+      if (reviewerCleanupRequired) {
+        try {
+          await cognito.send(
+            new AdminDeleteUserCommand({
+              Username: reviewerEmail,
+              UserPoolId: userPoolId,
+            }),
+          );
+          reviewerCleanupRequired = false;
+        } catch (error) {
+          if (isCognitoUserAbsent(error)) {
+            reviewerCleanupRequired = false;
+          } else {
+            cleanup = {
+              outcome: 'failed',
+              sanitizedSummary: permissionFailure(error, 'cleanup').summary,
+            };
+          }
+        }
+      }
+    }
+    if (
+      executions.some(
+        ({ dataCleanup }) => dataCleanup?.outcome === 'failed',
+      )
+    ) {
+      cleanup = {
+        outcome: 'failed',
+        sanitizedSummary:
+          cleanup.outcome === 'failed'
+            ? 'Synthetic principal or deployed record cleanup failed.'
+            : 'The deployed smoke record cleanup was not proved.',
+      };
+    }
+    const attempts = executions.map((execution) =>
+      normalizePlaywrightEvidenceAttempt({
+      attempt: execution.attempt,
+      completedAt: execution.completedAt,
+      failed: execution.failed,
+      findings: [
+        ...(execution.runnerFailed > 0
+          ? [
+              {
+                classification: 'assertion-failed',
+                summary: sanitizeTestingEvidenceSummary(
+                  execution.diagnostic,
+                ),
+              },
+            ]
+          : []),
+        ...(execution.artifactSensitive
+          ? [
+              {
+                classification: 'sensitive-artifact',
+                summary:
+                  'The Playwright report matched protected artifact data and was not retained.',
+              },
+            ]
+          : []),
+        ...(execution.reportInvalid
+          ? [
+              {
+                classification: 'evidence-incomplete',
+                summary:
+                  'Playwright emitted malformed machine-readable output; raw output was removed.',
+              },
+            ]
+          : []),
+        ...(execution.quarantineFindings ?? []),
+        ...(execution.observationFindings ?? []),
+        ...(execution.policyFindings ?? []),
+      ],
+      ...(execution.attempt === 2
+        ? { identicalToPrevious: true }
+        : {}),
+      passed: execution.passed,
+      quarantined: execution.quarantined ?? 0,
+      skipped: execution.skipped,
+      startedAt: execution.startedAt,
+      }),
+    );
+    const result = createTestingEvidenceFromRunnerAttempts({
+      artifacts,
+      attempts,
+      cleanup,
+      environment: {
+        class: 'protected-github',
+        deployed: true,
+        stage,
+      },
+      operation,
+      proofStarted: true,
+      runScope: runId,
+      seed,
+      slice: '${name}',
+      source,
+      workspace: workspacePackage.name,
+    });
+    writeResult(result);
+    if (result.outcome !== 'passed') process.exitCode = 1;
+  }
+}
+`,
+        'testing/strict-json-reporter.mjs': `import { JsonReporter } from 'vitest/node';
+
+export default class StrictJsonReporter extends JsonReporter {
+  expectedFailures = 0;
+  focusedTests = 0;
+  retryConfiguredTests = 0;
+
+  async onTestRunEnd(testModules, unhandledErrors, reason) {
+    for (const testModule of testModules) {
+      for (const testCase of testModule.children.allTests()) {
+        if (testCase.options.fails) this.expectedFailures += 1;
+        if (testCase.options.mode === 'only') this.focusedTests += 1;
+        if ((testCase.options.retry ?? 0) > 0) {
+          this.retryConfiguredTests += 1;
+        }
+      }
+      for (const testSuite of testModule.children.allSuites()) {
+        if (testSuite.options.mode === 'only') this.focusedTests += 1;
+      }
+    }
+    await super.onTestRunEnd(testModules, unhandledErrors, reason);
+    if (
+      this.expectedFailures > 0 ||
+      this.focusedTests > 0 ||
+      this.retryConfiguredTests > 0
+    ) {
+      process.exitCode = 1;
+    }
+  }
+
+  async writeReport(serializedReport) {
+    const report = JSON.parse(serializedReport);
+    report.ebkPolicy = {
+      expectedFailures: this.expectedFailures,
+      focusedTests: this.focusedTests,
+      retryConfiguredTests: this.retryConfiguredTests,
+    };
+    await super.writeReport(JSON.stringify(report));
+  }
+}
+`,
+        'vitest.integration.config.ts': `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    allowOnly: false,
+    environment: 'node',
+    env: { EBK_STAGE: 'development' },
+    // Hosted runners share four cores between Vitest, the proof registry,
+    // and the dockerized database; rendezvous-orchestrated integration
+    // proofs need a loaded-host budget, not the five-second idle default.
+    hookTimeout: 30_000,
+    include: ['integration/**/*.spec.ts'],
+    maxWorkers: 1,
+    retry: 0,
+    testTimeout: 30_000,
+  },
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-testing-files.js.map