@getbourdon/conformance 0.3.0 → 0.5.0

package/fixtures/cursor_vectors.json

@@ -0,0 +1,98 @@
+{
+  "_doc": "Sealed pagination-cursor parity vectors. Envelope: 'v1.' + urlsafe_b64(payload) + '.' + urlsafe_b64(mac); payload is compact JSON (field order offset,since,agent,access; separators ',',':'); both base64 legs padded urlsafe; mac = HMAC-SHA256(key, context + 0x00 + payload). All tokens here are sealed under the fixed TEST key below; production keys come from BOURDON_CURSOR_KEY or a per-process default.",
+  "envelope_version": "v1",
+  "context": "bourdon-cursor-v1",
+  "test_key": "bourdon-conformance-cursor-fixed-test-key",
+  "mint": [
+    {
+      "name": "offset_only",
+      "fields": {
+        "offset": 0
+      },
+      "token": "v1.eyJvZmZzZXQiOjB9.O23LHICHKQMnyCchY2JObFFfEUmxkXHiJJOgvtKzAes="
+    },
+    {
+      "name": "offset_paged",
+      "fields": {
+        "offset": 40
+      },
+      "token": "v1.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8="
+    },
+    {
+      "name": "with_since",
+      "fields": {
+        "offset": 20,
+        "since": "2026-06-01"
+      },
+      "token": "v1.eyJvZmZzZXQiOjIwLCJzaW5jZSI6IjIwMjYtMDYtMDEifQ==.YedXuS8RgmB7QLM5dkL6k1lSeBD7RrXxowshIw4ZKu0="
+    },
+    {
+      "name": "with_since_agent",
+      "fields": {
+        "offset": 3,
+        "since": "2026-06-01",
+        "agent": "claude-code"
+      },
+      "token": "v1.eyJvZmZzZXQiOjMsInNpbmNlIjoiMjAyNi0wNi0wMSIsImFnZW50IjoiY2xhdWRlLWNvZGUifQ==.18KRIPGR6SKF2wkzBTb9u7ZwK7Jfe61bZuSrlVG--cU="
+    },
+    {
+      "name": "fully_sealed",
+      "fields": {
+        "offset": 7,
+        "since": "2026-01-31",
+        "agent": "codex",
+        "access": "team"
+      },
+      "token": "v1.eyJvZmZzZXQiOjcsInNpbmNlIjoiMjAyNi0wMS0zMSIsImFnZW50IjoiY29kZXgiLCJhY2Nlc3MiOiJ0ZWFtIn0=.pfsyw9cnfF-efyMDQbDXS0LDWXz2kDqCJ242O9K9K3M="
+    },
+    {
+      "name": "boundary_offset",
+      "fields": {
+        "offset": 100000
+      },
+      "token": "v1.eyJvZmZzZXQiOjEwMDAwMH0=.m5lcihdSLILlvCU5wSpDqRxt48BO3J5yjJOjyBi-LFA="
+    }
+  ],
+  "reject": [
+    {
+      "name": "tampered_payload",
+      "token": "v1.eyJvZmZzZXQiOjB9.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8=",
+      "reason": "payload altered after sealing"
+    },
+    {
+      "name": "truncated_seal",
+      "token": "v1.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2",
+      "reason": "seal leg truncated"
+    },
+    {
+      "name": "wrong_key",
+      "token": "v1.eyJvZmZzZXQiOjF9.MTVm4fQjNF6apa7Xtn1hmQB368lDgU757p8EYweNSZI=",
+      "reason": "sealed under a different key"
+    },
+    {
+      "name": "unknown_version",
+      "token": "v2.eyJvZmZzZXQiOjQwfQ==.tHYiB6G2_nevaLGCHNs9msqGER3dQmkE8NbkYn4qqK8=",
+      "reason": "unrecognized envelope version"
+    },
+    {
+      "name": "unsealed_legacy",
+      "token": "eyJvZmZzZXQiOjQwfQ==",
+      "reason": "pre-seal token format has no acceptance path"
+    },
+    {
+      "name": "sealed_unknown_field",
+      "token": "v1.eyJvZmZzZXQiOjAsImV2aWwiOnRydWV9.InPILvmi50rNO9SwE5Iv0nyl_yrWJYtow38xWL2F3fA=",
+      "reason": "seal verifies but the payload carries an unknown field"
+    },
+    {
+      "name": "sealed_negative_offset",
+      "token": "v1.eyJvZmZzZXQiOi0xfQ==.TeSILWl7vbNY75xoxmqEv0SLqaAGv_99Wv5fzLq3GL0=",
+      "reason": "seal verifies but the offset is negative"
+    },
+    {
+      "name": "sealed_offset_over_bound",
+      "token": "v1.eyJvZmZzZXQiOjEwMDAwMX0=.hWPH08t5lNmBLzAVG63azOgFJXxCVw2rJtQX9Xn5I1E=",
+      "reason": "seal verifies but the offset exceeds the pagination bound"
+    }
+  ]
+}

package/fixtures/manifest.json

@@ -1,8 +1,8 @@
 {
   "_doc": "Index of cross-impl parity fixtures. conformance_version bumps on any fixture change (patch=added cases, minor=new family, major=changed expected-output = a reviewed behavior change). Python is the oracle; this file is generated by tools/gen_conformance.py.",
-  "conformance_version": "2.1.0",
+  "conformance_version": "2.3.0",
   "produced_against": {
-    "bourdon_version": "0.13.0"
+    "bourdon_version": "0.16.1"
   },
   "fixtures": [
     {
@@ -100,6 +100,11 @@
       "sha256": "963f9eb6c68cd8897650f098c241ebbff34ab23603bf9fee92e5431ae2db78af",
       "producer": "tools/gen_conformance.py::l5_schema_and_manifests"
     },
+    {
+      "path": "merge_vectors.json",
+      "sha256": "9a1d105d6c2b0bc00e419b318ae4d802457241cca0cbbe87f1a87c529a11e923",
+      "producer": "tools/gen_conformance.py::merge_vectors"
+    },
     {
       "path": "fed_seed_library/agents/claude-code.l5.yaml",
       "sha256": "efe5467ee41bfe807098f2339dda7295f236c1ae7f575016b2402f9ba1988f7c",
@@ -115,6 +120,11 @@
       "sha256": "9753ad1fd4a092bdf4110b3b24576f2bfe7001d6d6758ef55047ee5da851e25c",
       "producer": "tools/gen_conformance.py::tier_matrix"
     },
+    {
+      "path": "cursor_vectors.json",
+      "sha256": "433e7a1c8f87f5544b8a0a3a8df1be89b6f53199f0295a458564bf53a9bf8029",
+      "producer": "tools/gen_conformance.py::cursor_vectors"
+    },
     {
       "path": "on_disk/federation.yaml",
       "sha256": "7a3795961d369ec57a6caa6af15e250d016c98e883077e82d7d103bd0c016cfe",
@@ -167,7 +177,7 @@
     },
     {
       "path": "mcp_snapshots/prepare_recognition_context_drifting.res.json",
-      "sha256": "665c149473ce295b22970f072483de4d3f93bc4affb022752a0251a5852e4567",
+      "sha256": "2d217ba56593bf6593216546c223adf0b972470632adb326bb82eb5d5996acc8",
       "producer": "tools/gen_conformance.py::mcp_snapshots"
     },
     {
@@ -267,7 +277,7 @@
     },
     {
       "path": "mcp_snapshots/prepare_recognition_context.res.json",
-      "sha256": "fed8be60118cc027654ce8c2d1bb072482808c62e7997fd236ba276d5a50a580",
+      "sha256": "dfb2d73ddb812d41dfe8e0b17dddeb1399373904972c09cf80e0bf9daa65941f",
       "producer": "tools/gen_conformance.py::mcp_snapshots"
     },
     {
@@ -287,7 +297,7 @@
     },
     {
       "path": "mcp_snapshots/get_deeper_context.res.json",
-      "sha256": "842926cd013275692fd11daab8553a329f2685c870b59389ee5b075544d5ed49",
+      "sha256": "c92ec338c23f2cdc3f1215751812c7f5c2c08aa86fb3ff097288e4c831313053",
       "producer": "tools/gen_conformance.py::mcp_snapshots"
     },
     {
@@ -327,7 +337,7 @@
     },
     {
       "path": "mcp_snapshots/_normalizer.json",
-      "sha256": "7b9eef3ee22267274657117243086ea52403d33ceb2509f7be314d025fd0872b",
+      "sha256": "438071a3b1de83fb23083fd9ad2d4a734a27032d84faabf9d5772f14779a1721",
       "producer": "tools/gen_conformance.py::mcp_snapshots"
     },
     {
@@ -387,7 +397,7 @@
     },
     {
       "path": "native_stores/claude_code/expected_l5.json",
-      "sha256": "9235bd39863934d3ce6686218ab0b535b6c7a6d94348ffdde2f132517da03b8d",
+      "sha256": "a352c29e299c50322f28e9250df1642ab7f1ae285cdfc3b794f13c1335e19899",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {

package/fixtures/mcp_snapshots/_normalizer.json

@@ -84,7 +84,7 @@
       }
     },
     {
-      "_doc": "decodes a base64 next_cursor to its {offset} payload; null cursor drops",
+      "_doc": "decodes a sealed next_cursor to its {offset} payload (token sealed under the conformance test key from cursor_vectors.json; replaying this case requires injecting that key); null cursor drops",
       "normalized": {
         "has_more": true,
         "next_cursor": {
@@ -93,7 +93,7 @@
       },
       "raw": {
         "has_more": true,
-        "next_cursor": "eyJvZmZzZXQiOjJ9"
+        "next_cursor": "v1.eyJvZmZzZXQiOjJ9.Kq1CqjJ2bx9GKxUve6An2fcBMxcGu9Ledn3C1V_6oZI="
       }
     },
     {

package/fixtures/mcp_snapshots/get_deeper_context.res.json

@@ -1,7 +1,18 @@
 {
   "access_level": "team",
-  "context": "",
-  "context_chars": 0,
+  "context": "## Bourdon (project)\nknown by: claude-code, codex\nConformance fixture synopsis. L1 hydration is byte-checkable, so this text is\npinned verbatim into the interop vectors -- which is exactly why it must be\nfixture-owned rather than real documentation. A second implementation has to\nreproduce THIS, not whatever the project's docs happen to say today.",
+  "context_chars": 349,
+  "doors": [
+    "recognition"
+  ],
+  "entities": [
+    "Bourdon"
+  ],
+  "hydration_hint": "Local retrieval only -- these are stored bytes, not generated prose. Synthesize with your own model if you want a narrative answer; Bourdon does not call one.",
   "include_private": false,
-  "prompt": "what about Bourdon"
+  "l1_documents": 1,
+  "prompt": "what about Bourdon",
+  "reason": "",
+  "source": "local-store",
+  "truncated": false
 }

package/fixtures/mcp_snapshots/prepare_recognition_context.res.json

@@ -1,6 +1,8 @@
 {
   "access_level": "team",
   "confidence": "medium",
+  "hydration": "# Bourdon\n\nConformance fixture synopsis. L1 hydration is byte-checkable, so this text is\npinned verbatim into the interop vectors -- which is exactly why it must be\nfixture-owned rather than real documentation. A second implementation has to\nreproduce THIS, not whatever the project's docs happen to say today.",
+  "hydration_chars": 310,
   "hydration_scheduled": true,
   "include_private": false,
   "matched_entities": [

package/fixtures/mcp_snapshots/prepare_recognition_context_drifting.res.json

@@ -8,6 +8,8 @@
       "reason": "yielded nothing this run - last yielded 400 record(s) at 2026-06-29T09:00:00Z"
     }
   ],
+  "hydration": "# Bourdon\n\nConformance fixture synopsis. L1 hydration is byte-checkable, so this text is\npinned verbatim into the interop vectors -- which is exactly why it must be\nfixture-owned rather than real documentation. A second implementation has to\nreproduce THIS, not whatever the project's docs happen to say today.",
+  "hydration_chars": 310,
   "hydration_scheduled": true,
   "include_private": false,
   "matched_entities": [

package/fixtures/merge_vectors.json

@@ -0,0 +1,325 @@
+{
+  "_doc": "merge_family parity vectors: run each (family, existing, incoming) through the mirror's merge and compare to expected.merged/added/updated/clamped. Caps are schema-derived, restated here for assertion only.",
+  "caps_from_schema": {
+    "recent_sessions": {
+      "key_actions": 10,
+      "files_touched": 50
+    },
+    "known_entities": {
+      "aliases": 16
+    },
+    "known_workstreams": {
+      "related_entities": 32
+    },
+    "notes": {
+      "related_entities": 16
+    }
+  },
+  "cases": [
+    {
+      "id": "session-union-under-cap-preserves-order",
+      "family": "recent_sessions",
+      "existing": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "key_actions": [
+            "a",
+            "b"
+          ]
+        }
+      ],
+      "incoming": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "key_actions": [
+            "b",
+            "c"
+          ]
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-01",
+            "cwd": "/w",
+            "key_actions": [
+              "a",
+              "b",
+              "c"
+            ]
+          }
+        ],
+        "added": 0,
+        "updated": 1,
+        "clamped": 0
+      }
+    },
+    {
+      "id": "session-union-clamps-to-cap-keeping-newest",
+      "family": "recent_sessions",
+      "existing": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "key_actions": [
+            "first-0",
+            "first-1",
+            "first-2",
+            "first-3",
+            "first-4",
+            "first-5",
+            "first-6",
+            "first-7",
+            "first-8",
+            "first-9"
+          ]
+        }
+      ],
+      "incoming": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "key_actions": [
+            "second-0",
+            "second-1",
+            "second-2",
+            "second-3",
+            "second-4",
+            "second-5",
+            "second-6",
+            "second-7",
+            "second-8",
+            "second-9"
+          ]
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-01",
+            "cwd": "/w",
+            "key_actions": [
+              "second-0",
+              "second-1",
+              "second-2",
+              "second-3",
+              "second-4",
+              "second-5",
+              "second-6",
+              "second-7",
+              "second-8",
+              "second-9"
+            ]
+          }
+        ],
+        "added": 0,
+        "updated": 1,
+        "clamped": 10
+      }
+    },
+    {
+      "id": "session-dupe-non-none-scalar-wins-none-ignored",
+      "family": "recent_sessions",
+      "existing": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "visibility": "team"
+        }
+      ],
+      "incoming": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "visibility": null
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-01",
+            "cwd": "/w",
+            "visibility": "team"
+          }
+        ],
+        "added": 0,
+        "updated": 1,
+        "clamped": 0
+      }
+    },
+    {
+      "id": "session-incoming-scalar-list-coerces-not-chars",
+      "family": "recent_sessions",
+      "existing": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "project_focus": [
+            "Bourdon"
+          ]
+        }
+      ],
+      "incoming": [
+        {
+          "date": "2026-08-01",
+          "cwd": "/w",
+          "project_focus": "OXbeat"
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-01",
+            "cwd": "/w",
+            "project_focus": [
+              "Bourdon",
+              "OXbeat"
+            ]
+          }
+        ],
+        "added": 0,
+        "updated": 1,
+        "clamped": 0
+      }
+    },
+    {
+      "id": "entity-alias-union-clamps-case-insensitive-name-key",
+      "family": "known_entities",
+      "existing": [
+        {
+          "name": "Bourdon",
+          "aliases": [
+            "alias-0",
+            "alias-1",
+            "alias-2",
+            "alias-3",
+            "alias-4",
+            "alias-5",
+            "alias-6",
+            "alias-7",
+            "alias-8",
+            "alias-9",
+            "alias-10",
+            "alias-11",
+            "alias-12",
+            "alias-13",
+            "alias-14",
+            "alias-15"
+          ]
+        }
+      ],
+      "incoming": [
+        {
+          "name": "bourdon",
+          "aliases": [
+            "fresh-alias"
+          ]
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "name": "bourdon",
+            "aliases": [
+              "alias-1",
+              "alias-2",
+              "alias-3",
+              "alias-4",
+              "alias-5",
+              "alias-6",
+              "alias-7",
+              "alias-8",
+              "alias-9",
+              "alias-10",
+              "alias-11",
+              "alias-12",
+              "alias-13",
+              "alias-14",
+              "alias-15",
+              "fresh-alias"
+            ]
+          }
+        ],
+        "added": 0,
+        "updated": 1,
+        "clamped": 1
+      }
+    },
+    {
+      "id": "fresh-row-scalar-list-normalized-on-add",
+      "family": "recent_sessions",
+      "existing": [],
+      "incoming": [
+        {
+          "date": "2026-08-02",
+          "cwd": "/n",
+          "project_focus": "solo"
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-02",
+            "cwd": "/n",
+            "project_focus": [
+              "solo"
+            ]
+          }
+        ],
+        "added": 1,
+        "updated": 0,
+        "clamped": 0
+      }
+    },
+    {
+      "id": "fresh-row-over-cap-passes-through-unclamped",
+      "family": "recent_sessions",
+      "existing": [],
+      "incoming": [
+        {
+          "date": "2026-08-03",
+          "cwd": "/o",
+          "key_actions": [
+            "x-0",
+            "x-1",
+            "x-2",
+            "x-3",
+            "x-4",
+            "x-5",
+            "x-6",
+            "x-7",
+            "x-8",
+            "x-9",
+            "x-10"
+          ]
+        }
+      ],
+      "expected": {
+        "merged": [
+          {
+            "date": "2026-08-03",
+            "cwd": "/o",
+            "key_actions": [
+              "x-0",
+              "x-1",
+              "x-2",
+              "x-3",
+              "x-4",
+              "x-5",
+              "x-6",
+              "x-7",
+              "x-8",
+              "x-9",
+              "x-10"
+            ]
+          }
+        ],
+        "added": 1,
+        "updated": 0,
+        "clamped": 0
+      }
+    }
+  ]
+}

package/fixtures/native_stores/claude_code/expected_l5.json

@@ -44,7 +44,8 @@
       "summary": "A retired experiment.",
       "tags": [
         "archived"
-      ]
+      ],
+      "valid_to": "2026-01-15"
     },
     {
       "name": "Zephyr",

package/fixtures.pin.json

@@ -1,5 +1,5 @@
 {
   "_doc": "The recorded fixture pin. CI and the package tests assert the vendored fixtures/manifest.json hashes to exactly this value, so the fixture set in any build is provably the reviewed one. Refresh via the re-pin ritual in README.md.",
-  "conformance_version": "2.1.0",
-  "manifest_sha256": "f854d2a75d4616554e97e5c746f5ca9ae30ff23ed21a6d023424922e2e70813e"
+  "conformance_version": "2.3.0",
+  "manifest_sha256": "8887c3db998a7062c5ef991edc1ddb8af20bc8a8d448228cb78000b3f8c4dfa5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getbourdon/conformance",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.",
   "license": "Apache-2.0",
   "type": "module",