@getbourdon/conformance 0.1.0

package/LICENSE

@@ -0,0 +1,157 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer, and
+      charge a fee for, acceptance of support, warranty, indemnity, or
+      other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 RADLAB LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,26 @@
+# @getbourdon/conformance
+
+Language-neutral **cross-implementation parity fixtures** for [Bourdon](https://bourdon.ai).
+
+Python (`pip install bourdon`) is the **oracle**. The `@getbourdon/*` TypeScript mirror is conformant iff it
+reproduces the oracle's output on these exact fixtures — byte-for-byte where the contract is bytes (redaction,
+recognition strings, MCP wire), value-for-value where it's structured (F1, schema validity, tool I/O).
+
+The fixtures are generated by the Python repo's `tools/gen_conformance.py` (the single writer) and consumed by
+both the Python test suite and the TS `vitest` suite. This package ships them with typed loaders.
+
+```ts
+import { loadRedactionBattery, assembleSecret } from "@getbourdon/conformance";
+
+const battery = loadRedactionBattery();
+for (const secret of battery.secrets) {
+  // a faithful TS redaction port must produce battery's expected output:
+  expect(redactText(assembleSecret(secret))).toBe(secret.expect_redacted);
+}
+```
+
+**Resolution (Phase 0–1):** `BOURDON_CONFORMANCE_DIR`, else the sibling Python checkout
+`../bourdon/conformance`. Once published, the fixtures ship inside this package.
+
+License: Apache-2.0 (the wire-contract surface is permissive so third parties can build conformant
+implementations). The Bourdon engine is BUSL-1.1.

package/dist/index.cjs

@@ -0,0 +1,65 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  assembleSecret: () => assembleSecret,
+  conformanceDir: () => conformanceDir,
+  loadManifest: () => loadManifest,
+  loadRedactionBattery: () => loadRedactionBattery
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_node_url = require("url");
+var import_meta = {};
+function moduleDir() {
+  if (typeof import_meta !== "undefined" && import_meta.url) {
+    return (0, import_node_path.dirname)((0, import_node_url.fileURLToPath)(import_meta.url));
+  }
+  return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+}
+function conformanceDir() {
+  const override = process.env.BOURDON_CONFORMANCE_DIR;
+  if (override) return override;
+  const bundled = (0, import_node_path.resolve)(moduleDir(), "..", "fixtures");
+  if ((0, import_node_fs.existsSync)((0, import_node_path.resolve)(bundled, "manifest.json"))) return bundled;
+  return (0, import_node_path.resolve)(process.cwd(), "..", "..", "bourdon", "conformance");
+}
+function loadJson(name) {
+  return JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.resolve)(conformanceDir(), name), "utf8"));
+}
+function loadManifest() {
+  return loadJson("manifest.json");
+}
+function loadRedactionBattery() {
+  return loadJson("redaction_battery.json");
+}
+function assembleSecret(secret) {
+  return secret.fragments.join("");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assembleSecret,
+  conformanceDir,
+  loadManifest,
+  loadRedactionBattery
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAyC;AACzC,uBAAiC;AACjC,sBAA8B;AAF9B;AAyBA,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,eAAO,8BAAQ,+BAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAkCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,cAAU,0BAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,UAAI,+BAAW,0BAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,aAAO,0BAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,UAAM,iCAAa,0BAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,36 @@
+interface RedactionSecretCase {
+    /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */
+    fragments: string[];
+    expect_redacted: string;
+    expect_contains_secret: boolean;
+}
+interface RedactionBenignCase {
+    text: string;
+    expect_redacted: string;
+    expect_contains_secret: boolean;
+}
+interface RedactionBattery {
+    redacted_sentinel: string;
+    benign_limit: number;
+    secrets: RedactionSecretCase[];
+    benign: RedactionBenignCase[];
+}
+interface ConformanceFixtureMeta {
+    path: string;
+    sha256: string;
+    producer: string;
+}
+interface ConformanceManifest {
+    conformance_version: string;
+    produced_against: {
+        bourdon_version: string;
+    };
+    fixtures: ConformanceFixtureMeta[];
+}
+declare function conformanceDir(): string;
+declare function loadManifest(): ConformanceManifest;
+declare function loadRedactionBattery(): RedactionBattery;
+/** Reconstruct a secret case's runtime string from its fragments. */
+declare function assembleSecret(secret: RedactionSecretCase): string;
+
+export { type ConformanceFixtureMeta, type ConformanceManifest, type RedactionBattery, type RedactionBenignCase, type RedactionSecretCase, assembleSecret, conformanceDir, loadManifest, loadRedactionBattery };

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+interface RedactionSecretCase {
+    /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */
+    fragments: string[];
+    expect_redacted: string;
+    expect_contains_secret: boolean;
+}
+interface RedactionBenignCase {
+    text: string;
+    expect_redacted: string;
+    expect_contains_secret: boolean;
+}
+interface RedactionBattery {
+    redacted_sentinel: string;
+    benign_limit: number;
+    secrets: RedactionSecretCase[];
+    benign: RedactionBenignCase[];
+}
+interface ConformanceFixtureMeta {
+    path: string;
+    sha256: string;
+    producer: string;
+}
+interface ConformanceManifest {
+    conformance_version: string;
+    produced_against: {
+        bourdon_version: string;
+    };
+    fixtures: ConformanceFixtureMeta[];
+}
+declare function conformanceDir(): string;
+declare function loadManifest(): ConformanceManifest;
+declare function loadRedactionBattery(): RedactionBattery;
+/** Reconstruct a secret case's runtime string from its fragments. */
+declare function assembleSecret(secret: RedactionSecretCase): string;
+
+export { type ConformanceFixtureMeta, type ConformanceManifest, type RedactionBattery, type RedactionBenignCase, type RedactionSecretCase, assembleSecret, conformanceDir, loadManifest, loadRedactionBattery };

package/dist/index.js

@@ -0,0 +1,36 @@
+// src/index.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+function moduleDir() {
+  if (typeof import.meta !== "undefined" && import.meta.url) {
+    return dirname(fileURLToPath(import.meta.url));
+  }
+  return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+}
+function conformanceDir() {
+  const override = process.env.BOURDON_CONFORMANCE_DIR;
+  if (override) return override;
+  const bundled = resolve(moduleDir(), "..", "fixtures");
+  if (existsSync(resolve(bundled, "manifest.json"))) return bundled;
+  return resolve(process.cwd(), "..", "..", "bourdon", "conformance");
+}
+function loadJson(name) {
+  return JSON.parse(readFileSync(resolve(conformanceDir(), name), "utf8"));
+}
+function loadManifest() {
+  return loadJson("manifest.json");
+}
+function loadRedactionBattery() {
+  return loadJson("redaction_battery.json");
+}
+function assembleSecret(secret) {
+  return secret.fragments.join("");
+}
+export {
+  assembleSecret,
+  conformanceDir,
+  loadManifest,
+  loadRedactionBattery
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Typed loaders for the language-neutral parity fixtures produced by the Python\n * oracle (`~/repos/bourdon/tools/gen_conformance.py`). Python is the source of\n * truth; the @getbourdon/* TypeScript mirror asserts against these exact bytes.\n *\n * Resolution order:\n *   1. `BOURDON_CONFORMANCE_DIR` env var — the oracle checkout (parity tests +\n *      oracle dev use this; highest priority so a build always asserts against\n *      the live oracle).\n *   2. the fixtures BUNDLED in this package (`<pkg>/fixtures`, shipped in the\n *      tarball) — what an installed `@getbourdon/conformance` consumer gets.\n *   3. the sibling Python checkout `../../bourdon/conformance` — dev fallback.\n *\n * The bundled copy is a vendored snapshot refreshed from the oracle by\n * `pnpm --filter @getbourdon/conformance sync-fixtures` (and in the release\n * workflow before publish), so the published package is self-contained.\n */\n\n// `import.meta.url` in ESM; esbuild empties it in the CJS bundle, where the\n// native `__dirname` global is the real directory — fall back to it.\ndeclare const __dirname: string | undefined;\nfunction moduleDir(): string {\n  if (typeof import.meta !== \"undefined\" && import.meta.url) {\n    return dirname(fileURLToPath(import.meta.url));\n  }\n  return typeof __dirname !== \"undefined\" ? __dirname : process.cwd();\n}\n\nexport interface RedactionSecretCase {\n  /** Joined at load (`assembleSecret`) so no contiguous secret literal lands in git. */\n  fragments: string[];\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBenignCase {\n  text: string;\n  expect_redacted: string;\n  expect_contains_secret: boolean;\n}\n\nexport interface RedactionBattery {\n  redacted_sentinel: string;\n  benign_limit: number;\n  secrets: RedactionSecretCase[];\n  benign: RedactionBenignCase[];\n}\n\nexport interface ConformanceFixtureMeta {\n  path: string;\n  sha256: string;\n  producer: string;\n}\n\nexport interface ConformanceManifest {\n  conformance_version: string;\n  produced_against: { bourdon_version: string };\n  fixtures: ConformanceFixtureMeta[];\n}\n\nexport function conformanceDir(): string {\n  const override = process.env.BOURDON_CONFORMANCE_DIR;\n  if (override) return override;\n  // Bundled snapshot: <pkg>/fixtures, one level up from src/ or dist/.\n  const bundled = resolve(moduleDir(), \"..\", \"fixtures\");\n  if (existsSync(resolve(bundled, \"manifest.json\"))) return bundled;\n  // Dev fallback: the sibling Python oracle checkout.\n  return resolve(process.cwd(), \"..\", \"..\", \"bourdon\", \"conformance\");\n}\n\nfunction loadJson<T>(name: string): T {\n  return JSON.parse(readFileSync(resolve(conformanceDir(), name), \"utf8\")) as T;\n}\n\nexport function loadManifest(): ConformanceManifest {\n  return loadJson<ConformanceManifest>(\"manifest.json\");\n}\n\nexport function loadRedactionBattery(): RedactionBattery {\n  return loadJson<RedactionBattery>(\"redaction_battery.json\");\n}\n\n/** Reconstruct a secret case's runtime string from its fragments. */\nexport function assembleSecret(secret: RedactionSecretCase): string {\n  return secret.fragments.join(\"\");\n}\n"],"mappings":";AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;AAuB9B,SAAS,YAAoB;AAC3B,MAAI,OAAO,gBAAgB,eAAe,YAAY,KAAK;AACzD,WAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAAA,EAC/C;AACA,SAAO,OAAO,cAAc,cAAc,YAAY,QAAQ,IAAI;AACpE;AAkCO,SAAS,iBAAyB;AACvC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,QAAQ,UAAU,GAAG,MAAM,UAAU;AACrD,MAAI,WAAW,QAAQ,SAAS,eAAe,CAAC,EAAG,QAAO;AAE1D,SAAO,QAAQ,QAAQ,IAAI,GAAG,MAAM,MAAM,WAAW,aAAa;AACpE;AAEA,SAAS,SAAY,MAAiB;AACpC,SAAO,KAAK,MAAM,aAAa,QAAQ,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AACzE;AAEO,SAAS,eAAoC;AAClD,SAAO,SAA8B,eAAe;AACtD;AAEO,SAAS,uBAAyC;AACvD,SAAO,SAA2B,wBAAwB;AAC5D;AAGO,SAAS,eAAe,QAAqC;AAClE,SAAO,OAAO,UAAU,KAAK,EAAE;AACjC;","names":[]}

package/fixtures/README.md

@@ -0,0 +1,61 @@
+# `conformance/` — cross-implementation parity fixtures
+
+**Python is the oracle.** These language-neutral fixtures are the contract that the
+TypeScript mirror (`getbourdon/bourdon-js`, published as `@bourdon/*`) must reproduce
+exactly. The TS mirror is *conformant* iff it produces the same output as Python on
+these fixtures — byte-for-byte where the contract is bytes (redaction, recognition
+strings, MCP wire), value-for-value where it's structured (F1, schema validity, tool I/O).
+
+This directory is **generated** by `tools/gen_conformance.py` (the single writer) — it
+imports the live oracle modules and emits their actual output, so expectations can never
+be hand-typed out of sync with the code. Two mechanical suites assert against the *same
+bytes*: `tests/test_redaction.py` (Python, characterization) and the TS `vitest`
+conformance suite (parity). A CI drift gate runs the generator and fails on an
+uncommitted diff (`git diff --exit-code -- conformance/`).
+
+## Regenerate
+
+```bash
+python tools/gen_conformance.py     # rewrites conformance/ + manifest.json
+```
+
+After changing a pattern in `core.redaction` (or any oracle), regenerate, review the
+diff, and bump `conformance_version` in `tools/gen_conformance.py` (patch = added cases,
+minor = new family, major = a changed expected-output = a reviewed behavior change).
+
+## Contents
+
+| File | Family | Source (extracted from) | Phase |
+|------|--------|-------------------------|-------|
+| `redaction_battery.json` | redaction | `tests/test_redaction.py` SECRETS/BENIGN | ✅ wired |
+| `manifest.json` | index | (generated) | ✅ |
+| `recognition_vectors.json` | recognition | `test_recognition_{contract,parity}.py` | ✅ wired |
+| `l5_schema.json` + `l5_manifests/` | schema | `spec/L5_schema.json` | ✅ wired |
+| `tier_matrix.json` | trust (D4) | `create_l6_server` enforcement over the seed | ✅ wired |
+| `fed_seed_library/agents/*.l5.yaml` | seed input | 2-agent library, public/team/private | ✅ wired |
+| `on_disk/federation.yaml` + `audit.jsonl` + `auth_vectors.json` | on-disk trust state | real `FederationRegistry` + `FederationAudit` | ✅ wired |
+| `mcp_snapshots/` | wire | live `create_l6_server` tool closures over `fed_seed_library` | ✅ wired |
+
+The L6 **federation** families are the cross-machine trust boundary. `tier_matrix.json` drives
+the live `create_l6_server` enforcement (a quarantined `openclaw` granted only `claude-code`) and
+pins, per `tool x trust-tier x granted`, the allow/deny decision plus the verbatim structured-denial
+dict. `on_disk/` holds Python-written artifacts the TS side must parse identically: a registry with
+**sha256-only** rows for **synthetic** `bdn_` tokens (stored as fragment arrays in `auth_vectors.json`,
+never a contiguous literal), and an append-only audit log produced by the real `record()` with frozen
+timestamps. Both pytest (`tests/test_federation_conformance.py`) and the TS vitest suite assert these.
+
+The `mcp_snapshots/` family pins the **JSON-in-TextContent wire contract** for all 10 L6
+MCP tools. Each `*.res.json` is the live tool's payload (as `RemoteL6Client` recovers it:
+`json.loads` of the single `TextContent.text` = `json.dumps(payload)`) run through one codified
+NORMALIZER — sort object keys, round floats to 4dp, drop null/empty-list fields (to_dict
+omission), freeze `last_updated`/`generated_at`/`generated_from`/`path`, drop latency fields,
+and decode base64 `next_cursor` to its `{offset}` payload. The normalizer is itself fixture-tested
+in `mcp_snapshots/_normalizer.json`. `compile_codex_turn` is the **deferred P7 stub** (its brief is
+environment-bound — live cwd + git repo identity — so it is not a portable parity fixture yet).
+
+Token-shaped secrets are stored as **fragment arrays** joined at load time, so no
+contiguous secret literal ever lands in git (GitHub push-protection scans literals).
+Both loaders `"".join(fragments)`.
+
+See the master plan: `claude-brain/PROJECTS/NEUROLAYER/PLAN_TS_MIRROR_2026-06-29.md` and
+the `bourdon-parity-fixture-harness` / `bourdon-py-to-ts-port` skills.

package/fixtures/fed_seed_library/agents/claude-code.l5.yaml

@@ -0,0 +1,63 @@
+spec_version: '0.1'
+agent:
+  id: claude-code
+  type: code-assistant
+  instance: pc-threadripper
+  role_narrative: Lead code-assistant on the federation substrate.
+last_updated: '2026-06-29T12:00:00+00:00'
+capabilities:
+- code-read
+- code-write
+known_entities:
+- name: Bourdon
+  type: project
+  aliases:
+  - NeuroLayer
+  - Continuo
+  summary: Cross-agent memory federation (granted side).
+  tags:
+  - infra
+  visibility: public
+- name: Roadmap
+  type: concept
+  summary: Phase 1.7 federation roadmap.
+  tags:
+  - team
+  visibility: team
+- name: Quarterly Revenue
+  type: concept
+  summary: Q2 numbers.
+  tags:
+  - financial
+  visibility: private
+recent_sessions:
+- date: '2026-06-08'
+  cwd: /c/Users/cumul/repos/bourdon
+  project_focus:
+  - Bourdon
+  key_actions:
+  - wired tier matrix fixtures
+  files_touched:
+  - tools/gen_conformance.py
+  visibility: public
+- date: '2026-06-07'
+  cwd: /c/Users/cumul/repos/bourdon
+  project_focus:
+  - Roadmap
+  key_actions:
+  - team planning
+  visibility: team
+- date: '2026-06-06'
+  cwd: /c/Users/cumul/repos/bourdon
+  project_focus:
+  - Quarterly Revenue
+  key_actions:
+  - private review
+  visibility: private
+visibility_policy:
+  default: public
+  private_tags:
+  - financial
+  - personal
+  team_tags:
+  - team

package/fixtures/fed_seed_library/agents/codex.l5.yaml

@@ -0,0 +1,35 @@
+spec_version: '0.1'
+agent:
+  id: codex
+  type: code-assistant
+last_updated: '2026-06-29T12:00:00+00:00'
+known_entities:
+- name: SecretProj
+  type: project
+  summary: Known only by codex (ungranted namespace).
+  visibility: public
+- name: Bourdon
+  type: project
+  summary: Federation, codex view.
+  visibility: public
+- name: Internal Notes
+  type: concept
+  summary: codex private.
+  tags:
+  - personal
+  visibility: private
+recent_sessions:
+- date: '2026-06-08'
+  cwd: /y
+  project_focus:
+  - SecretProj
+  key_actions:
+  - codex work
+  visibility: public
+- date: '2026-06-05'
+  cwd: /y
+  project_focus:
+  - Internal Notes
+  key_actions:
+  - codex private
+  visibility: team

package/fixtures/l5_manifests/invalid/bad-agent-type-enum.json

@@ -0,0 +1,8 @@
+{
+  "spec_version": "0.1",
+  "agent": {
+    "id": "clyde",
+    "type": "wizard"
+  },
+  "last_updated": "2026-06-29T12:00:00+00:00"
+}

package/fixtures/l5_manifests/invalid/bad-spec-version-pattern.json

@@ -0,0 +1,8 @@
+{
+  "spec_version": "0.1.0",
+  "agent": {
+    "id": "clyde",
+    "type": "note-capture"
+  },
+  "last_updated": "2026-06-29T12:00:00+00:00"
+}

package/fixtures/l5_manifests/invalid/entity-bad-visibility-enum.json

@@ -0,0 +1,14 @@
+{
+  "spec_version": "0.1",
+  "agent": {
+    "id": "clyde",
+    "type": "note-capture"
+  },
+  "last_updated": "2026-06-29T12:00:00+00:00",
+  "known_entities": [
+    {
+      "name": "X",
+      "visibility": "secret"
+    }
+  ]
+}

package/fixtures/l5_manifests/invalid/entity-missing-name.json

@@ -0,0 +1,13 @@
+{
+  "spec_version": "0.1",
+  "agent": {
+    "id": "clyde",
+    "type": "note-capture"
+  },
+  "last_updated": "2026-06-29T12:00:00+00:00",
+  "known_entities": [
+    {
+      "type": "project"
+    }
+  ]
+}

package/fixtures/l5_manifests/invalid/missing-required-last_updated.json

@@ -0,0 +1,7 @@
+{
+  "spec_version": "0.1",
+  "agent": {
+    "id": "clyde",
+    "type": "note-capture"
+  }
+}