@guilz-dev/belay 0.8.0 → 0.8.1

package/dist/bundle/claude-runtime.mjs

@@ -16408,7 +16408,7 @@ function resolveStandingAllowMatch(params) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.0";
+var PACKAGE_VERSION = "0.8.1";
 
 // src/adapters/layouts/protected-paths.ts
 import path47 from "node:path";

package/dist/bundle/codex-runtime.mjs

@@ -16403,7 +16403,7 @@ function resolveStandingAllowMatch(params) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.0";
+var PACKAGE_VERSION = "0.8.1";
 
 // src/adapters/layouts/protected-paths.ts
 import path47 from "node:path";

package/dist/bundle/cursor-runtime.mjs

@@ -16403,7 +16403,7 @@ function resolveStandingAllowMatch(params) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.0";
+var PACKAGE_VERSION = "0.8.1";
 
 // src/adapters/layouts/protected-paths.ts
 import path47 from "node:path";

package/dist/commands/doctor.js

@@ -20,26 +20,13 @@ import { recoveryApprovalSetupNotes, recoveryNotificationConfigured, recoveryNot
 import { probeFileCloneStrategy } from '../core/transactional/file-clone.js';
 import { getManagedHookEntries } from '../defaults.js';
 import { resolveNodeBinary } from '../node-resolution.js';
+import { readInstalledRuntimeProvenance } from '../runtime-provenance.js';
 import { egressStatus } from '../services/egress-service.js';
 import { sandboxStatus } from '../services/sandbox-service.js';
 import { PACKAGE_VERSION } from '../version.js';
 import { loadAuditRecords } from './audit.js';
 import { collectHealthSnapshot } from './health-snapshot.js';
 import { metricsProject } from './metrics.js';
-async function readRuntimeVersion(corePath) {
-    try {
-        const content = await readFile(corePath, 'utf8');
-        const stampMatch = content.match(/RUNTIME_BUILD_STAMP\s*=\s*"([^"]+)"/);
-        const versionMatch = content.match(/RUNTIME_PACKAGE_VERSION\s*=\s*"([^"]+)"/);
-        return {
-            stamp: stampMatch?.[1],
-            version: versionMatch?.[1],
-        };
-    }
-    catch {
-        return {};
-    }
-}
 function resolveDoctorAdapter(options, configAdapter) {
     if (options.adapter) {
         return options.adapter;
@@ -234,7 +221,7 @@ export async function doctorProject(options = {}) {
         notes.push(`Node resolved at ${nodeResolution.path}`);
     }
     if (existsSync(corePath)) {
-        const runtimeVersions = await readRuntimeVersion(corePath);
+        const runtimeVersions = await readInstalledRuntimeProvenance(corePath);
         if (runtimeVersions.stamp && !runtimeVersions.stamp.startsWith(`${PACKAGE_VERSION}@`)) {
             warnings.push(`Installed runtime stamp (${runtimeVersions.stamp}) differs from package (${PACKAGE_VERSION}). Run belay upgrade.`);
         }
@@ -269,25 +256,34 @@ export async function doctorProject(options = {}) {
     let dogfood = null;
     if (loadedConfig) {
         const auditRecords = await loadAuditRecords(repoRoot);
-        const auditVisibility = summarizeAuditVisibility(auditRecords);
+        const metrics = await metricsProject({ targetDir: repoRoot });
+        const cohortIdentity = metrics.currentCohort.identity;
+        const cohortAuditRecords = cohortIdentity
+            ? auditRecords.filter((record) => record.runtimeBuildStamp === cohortIdentity.runtimeBuildStamp &&
+                record.configFingerprint === cohortIdentity.configFingerprint)
+            : [];
+        const auditVisibility = summarizeAuditVisibility(cohortAuditRecords);
         const drift = detectFenceDrift(auditVisibility, {
             threshold: loadedConfig.policy.fenceWarnThreshold,
         });
         warnings.push(...drift.warnings);
         notes.push(...drift.notes);
-        const metrics = await metricsProject({ targetDir: repoRoot });
+        const cohort = metrics.currentCohort;
         dogfood = {
             active: loadedConfig.mode === 'audit' && loadedConfig.policy.unknownLocalEffect === 'deny',
             mode: loadedConfig.mode,
             unknownLocalEffect: loadedConfig.policy.unknownLocalEffect,
             readyForEnforce: metrics.dogfood.readyForEnforce,
-            gateEvents: metrics.gateEvents,
-            wouldBlockCount: metrics.wouldBlockCount,
-            wouldBlockRate: metrics.wouldBlockRate,
+            gateEvents: cohort.gateEvents,
+            wouldBlockCount: cohort.wouldBlockCount,
+            wouldBlockRate: cohort.wouldBlockRate,
+            excludedGateEvents: cohort.excludedGateEvents,
+            runtimeBuildStamp: cohort.identity?.runtimeBuildStamp,
+            configFingerprint: cohort.identity?.configFingerprint,
             notes: metrics.dogfood.notes,
         };
         if (dogfood.active) {
-            notes.push(`Dogfood active: ${dogfood.gateEvents} gate events, ${dogfood.wouldBlockCount} would-block (${(dogfood.wouldBlockRate * 100).toFixed(1)}%).`);
+            notes.push(`Dogfood active cohort: ${dogfood.gateEvents} gate events, ${dogfood.wouldBlockCount} would-block (${(dogfood.wouldBlockRate * 100).toFixed(1)}%); ${dogfood.excludedGateEvents} historical/mismatched event(s) excluded.`);
             if (dogfood.readyForEnforce) {
                 notes.push('Dogfood metrics suggest enforce mode is ready (belay dogfood --enforce).');
             }

package/dist/commands/metrics.js

@@ -2,6 +2,7 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { loadConfigFile } from '../config-io.js';
 import { computeAuditMetrics, parseAuditNdjson } from '../core/audit-metrics.js';
+import { resolveActiveAuditCohort } from '../runtime-provenance.js';
 function formatFingerprintPreview(fingerprint) {
     if (fingerprint.length <= 12) {
         return fingerprint;
@@ -20,21 +21,49 @@ export async function metricsProject(options = {}) {
         raw = '';
     }
     const records = parseAuditNdjson(raw);
+    const activeCohort = await resolveActiveAuditCohort(repoRoot, config);
     return computeAuditMetrics(records, {
         auditLogPath: config.audit.logPath,
         mode: config.mode,
         unknownLocalEffect: config.policy.unknownLocalEffect,
+        activeCohort,
     });
 }
 export function formatMetricsReport(report) {
     const lines = [
         `belay metrics for ${report.auditLogPath}`,
         `Schema: v${report.schemaVersion}`,
-        `Gate events: ${report.gateEvents}`,
-        `Would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
-        `Classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
-        `Approvals recorded during audit: ${report.approvalRecordedCount}`,
+        `All-time gate events: ${report.gateEvents}`,
+        `All-time would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
+        `All-time classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
+        `All-time approvals recorded during audit: ${report.approvalRecordedCount}`,
     ];
+    lines.push('', 'Current readiness cohort:');
+    if (report.currentCohort.identity) {
+        lines.push(`- runtime build: ${report.currentCohort.identity.runtimeBuildStamp}`);
+        lines.push(`- config fingerprint: ${formatFingerprintPreview(report.currentCohort.identity.configFingerprint)}`);
+    }
+    else {
+        lines.push('- identity: unavailable');
+    }
+    lines.push(`- matching gate events: ${report.currentCohort.gateEvents}`);
+    lines.push(`- excluded historical/mismatched gate events: ${report.currentCohort.excludedGateEvents}`);
+    lines.push(`- would-block: ${report.currentCohort.wouldBlockCount} (${(report.currentCohort.wouldBlockRate * 100).toFixed(1)}%)`);
+    lines.push(`- classifier-quality would-block: ${report.currentCohort.classifierWouldBlockCount} (${(report.currentCohort.classifierWouldBlockRate * 100).toFixed(1)}%)`);
+    lines.push(`- approvals recorded during audit: ${report.currentCohort.approvalRecordedCount}`);
+    lines.push(`- availability-caused asks: ${report.currentCohort.availabilityAsks.total}`);
+    if (Object.keys(report.currentCohort.wouldBlockByReason).length > 0) {
+        lines.push('', 'Current-cohort would-block by reason:');
+        for (const [reason, count] of Object.entries(report.currentCohort.wouldBlockByReason).sort((left, right) => right[1] - left[1])) {
+            lines.push(`- ${reason}: ${count}`);
+        }
+    }
+    if (report.currentCohort.topWouldBlockSummaries.length > 0) {
+        lines.push('', 'Current-cohort top would-block summaries:');
+        for (const entry of report.currentCohort.topWouldBlockSummaries) {
+            lines.push(`- [${entry.reason}] x${entry.count}: ${entry.summary}`);
+        }
+    }
     if (report.approvalLatency.count > 0) {
         lines.push(`Approval latency: median ${report.approvalLatency.medianMs ?? 0}ms, p95 ${report.approvalLatency.p95Ms ?? 0}ms (${report.approvalLatency.count} samples)`);
     }

package/dist/commands/quality.js

@@ -1,10 +1,10 @@
 import path from 'node:path';
 import { loadConfigFile } from '../config-io.js';
-import { computeAuditMetrics } from '../core/audit-metrics.js';
 import { runCorpusEvaluation } from '../corpus/evaluate.js';
 import { passesHardGates } from '../corpus/gates.js';
 import { loadAuditRecords } from './audit.js';
 import { harvestReportFromRecords } from './harvest.js';
+import { metricsProject } from './metrics.js';
 export const QUALITY_REPORT_SCHEMA_VERSION = 1;
 export async function qualityCheck(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
@@ -13,11 +13,7 @@ export async function qualityCheck(options = {}) {
     const corpusMetrics = await runCorpusEvaluation(corpusDir);
     const hardGatesOk = passesHardGates(corpusMetrics.gates);
     const auditRecords = await loadAuditRecords(repoRoot);
-    const metrics = computeAuditMetrics(auditRecords, {
-        auditLogPath: config.audit.logPath,
-        mode: config.mode,
-        unknownLocalEffect: config.policy.unknownLocalEffect,
-    });
+    const metrics = await metricsProject({ targetDir: repoRoot });
     const harvest = harvestReportFromRecords(auditRecords);
     const notes = [
         'Overall ok reflects corpus hard gates only; audit and harvest signals are advisory.',

package/dist/commands/status.js

@@ -54,7 +54,7 @@ export function formatStatusReport(report) {
         `Approved (awaiting use): ${report.approved.length}`,
         `Expired pending (not yet compacted): ${report.expiredPendingCount}`,
         `Dogfood: ${report.dogfood.active ? 'active' : 'inactive'} (mode=${report.dogfood.mode}, unknownLocalEffect=${report.dogfood.unknownLocalEffect})`,
-        `Metrics: ${report.dogfood.gateEvents} gate events, ${report.dogfood.wouldBlockCount} would-block (${(report.dogfood.wouldBlockRate * 100).toFixed(1)}%)`,
+        `Current cohort metrics: ${report.dogfood.gateEvents} gate events, ${report.dogfood.wouldBlockCount} would-block (${(report.dogfood.wouldBlockRate * 100).toFixed(1)}%), ${report.dogfood.excludedGateEvents} historical/mismatched excluded`,
         `Ready for enforce: ${report.dogfood.readyForEnforce ? 'yes' : 'not yet'}`,
         `File checkpoint: ${report.fileCheckpoint.enabled ? 'enabled' : 'disabled'} (transactional=${report.fileCheckpoint.transactionalEnabled}, durable=${report.fileCheckpoint.durableCheckpointEnabled}, nonGit=${report.fileCheckpoint.allowNonGit})`,
         `File checkpoint limits: files=${report.fileCheckpoint.maxFiles}, sourceBytes=${report.fileCheckpoint.maxSourceBytes}, workspaceBytes=${report.fileCheckpoint.maxWorkspaceBytes}, prepareTimeoutMs=${report.fileCheckpoint.prepareTimeoutMs}, copyConcurrency=${report.fileCheckpoint.copyConcurrency}`,

package/dist/core/audit-metrics.d.ts

@@ -2,6 +2,27 @@ import { buildApprovalRoundTrips, filterAuditRecords, toAuditRecord } from './au
 import type { AvailabilityAskCounts, ReasonApprovalRatio, RepeatedFingerprintAsk } from './audit-types.js';
 /** Minimum gate events before recommending enforce with zero would-block rate. */
 export declare const MIN_GATE_EVENTS_FOR_ENFORCE = 20;
+export interface AuditCohortIdentity {
+    runtimeBuildStamp: string;
+    configFingerprint: string;
+}
+export interface AuditMetricsCohort {
+    identity: AuditCohortIdentity | null;
+    gateEvents: number;
+    excludedGateEvents: number;
+    wouldBlockCount: number;
+    wouldBlockRate: number;
+    classifierWouldBlockCount: number;
+    classifierWouldBlockRate: number;
+    approvalRecordedCount: number;
+    availabilityAsks: AvailabilityAskCounts;
+    wouldBlockByReason: Record<string, number>;
+    topWouldBlockSummaries: Array<{
+        summary: string;
+        reason: string;
+        count: number;
+    }>;
+}
 export interface AuditMetricsReport {
     schemaVersion: number;
     auditLogPath: string;
@@ -24,6 +45,7 @@ export interface AuditMetricsReport {
     byEffect: Record<string, number>;
     byConfidence: Record<string, number>;
     gateEventsByRuntime: Record<string, number>;
+    currentCohort: AuditMetricsCohort;
     approvalRecordedCount: number;
     topWouldBlockSummaries: Array<{
         summary: string;
@@ -55,5 +77,6 @@ export declare function computeAuditMetrics(records: Record<string, unknown>[],
     auditLogPath?: string;
     mode?: string;
     unknownLocalEffect?: string;
+    activeCohort?: AuditCohortIdentity | null;
 }): AuditMetricsReport;
 export { buildApprovalRoundTrips, filterAuditRecords, toAuditRecord };

package/dist/core/audit-metrics.js

@@ -95,33 +95,90 @@ export function computeAuditMetrics(records, options = {}) {
     const topWouldBlockSummaries = [...summaryCounts.values()]
         .sort((left, right) => right.count - left.count)
         .slice(0, 10);
+    const activeCohort = options.activeCohort ?? null;
+    const cohortRecords = activeCohort
+        ? auditRecords.filter((record) => record.runtimeBuildStamp === activeCohort.runtimeBuildStamp &&
+            record.configFingerprint === activeCohort.configFingerprint)
+        : [];
+    const cohortGateRecords = cohortRecords.filter((record) => {
+        const event = typeof record.event === 'string' ? record.event : '';
+        return GATE_EVENTS.has(event) && !isApprovalRecorded(record);
+    });
+    const cohortGateEvents = cohortGateRecords.length;
+    const cohortWouldBlockCount = cohortGateRecords.filter(inferWouldBlock).length;
+    const cohortWouldBlockRate = cohortGateEvents > 0 ? cohortWouldBlockCount / cohortGateEvents : 0;
+    const cohortApprovalRecordedCount = cohortRecords.filter(isApprovalRecorded).length;
+    const cohortAvailabilityAsks = computeAvailabilityAskCounts(cohortRecords);
+    const cohortClassifierWouldBlockCount = Math.max(0, cohortWouldBlockCount - cohortAvailabilityAsks.total);
+    const cohortClassifierWouldBlockRate = cohortGateEvents > 0 ? cohortClassifierWouldBlockCount / cohortGateEvents : 0;
+    const cohortRoundTrips = buildApprovalRoundTrips(cohortRecords);
+    const cohortRepeatedFingerprintAsks = computeRepeatedFingerprintAsks(cohortRecords);
+    const cohortNoisyRuleCandidates = detectNoisyRules(cohortRecords, cohortRoundTrips);
+    const cohortWouldBlockByReason = computeWouldBlockByReason(cohortRecords);
+    const cohortSummaryCounts = new Map();
+    for (const record of cohortGateRecords) {
+        if (!inferWouldBlock(record)) {
+            continue;
+        }
+        const reason = typeof record.reason === 'string' ? record.reason : 'unknown';
+        const summary = typeof record.summary === 'string' ? record.summary : '';
+        const key = `${reason}::${summary}`;
+        const existing = cohortSummaryCounts.get(key);
+        if (existing) {
+            existing.count += 1;
+        }
+        else {
+            cohortSummaryCounts.set(key, { summary, reason, count: 1 });
+        }
+    }
+    const cohortTopWouldBlockSummaries = [...cohortSummaryCounts.values()]
+        .sort((left, right) => right.count - left.count)
+        .slice(0, 10);
+    const currentCohort = {
+        identity: activeCohort,
+        gateEvents: cohortGateEvents,
+        excludedGateEvents: gateEvents - cohortGateEvents,
+        wouldBlockCount: cohortWouldBlockCount,
+        wouldBlockRate: cohortWouldBlockRate,
+        classifierWouldBlockCount: cohortClassifierWouldBlockCount,
+        classifierWouldBlockRate: cohortClassifierWouldBlockRate,
+        approvalRecordedCount: cohortApprovalRecordedCount,
+        availabilityAsks: cohortAvailabilityAsks,
+        wouldBlockByReason: cohortWouldBlockByReason,
+        topWouldBlockSummaries: cohortTopWouldBlockSummaries,
+    };
     const mode = options.mode ?? null;
     const unknownLocalEffect = options.unknownLocalEffect ?? null;
     const notes = [];
     let readyForEnforce = false;
     if (mode === 'audit' && unknownLocalEffect === 'deny') {
         notes.push('Dogfood config detected: audit mode with fail-closed shell policy.');
-        if (gateEvents === 0) {
-            notes.push('No gate events yet — run normal agent work, then re-check metrics.');
+        if (!activeCohort) {
+            notes.push('Active runtime provenance is unavailable — readiness cannot use historical audit evidence.');
+        }
+        else if (cohortGateEvents === 0) {
+            notes.push('No gate events for the active runtime/config cohort — run normal agent work, then re-check metrics.');
         }
-        else if (wouldBlockRate === 0) {
-            if (gateEvents >= MIN_GATE_EVENTS_FOR_ENFORCE) {
+        else if (cohortWouldBlockRate === 0) {
+            if (cohortGateEvents >= MIN_GATE_EVENTS_FOR_ENFORCE) {
                 readyForEnforce = true;
                 notes.push('No would-block events recorded — safe to try mode: "enforce".');
             }
             else {
-                notes.push(`Only ${gateEvents} gate event(s) recorded — collect at least ${MIN_GATE_EVENTS_FOR_ENFORCE} before enforce.`);
+                notes.push(`Only ${cohortGateEvents} active-cohort gate event(s) recorded — collect at least ${MIN_GATE_EVENTS_FOR_ENFORCE} before enforce.`);
             }
         }
         else {
-            notes.push(`${wouldBlockCount} would-block event(s) (${(wouldBlockRate * 100).toFixed(1)}% of gate traffic; classifier-quality ${(classifierWouldBlockRate * 100).toFixed(1)}%). Review top summaries and correct EffectPlan semantics or resource scope; use exact approval only when the modeled effects are correct.`);
-            if (approvalRecordedCount > 0) {
-                notes.push(`${approvalRecordedCount} approval(s) recorded — these likely indicate actions operators wanted.`);
+            notes.push(`${cohortWouldBlockCount} active-cohort would-block event(s) (${(cohortWouldBlockRate * 100).toFixed(1)}% of gate traffic; classifier-quality ${(cohortClassifierWouldBlockRate * 100).toFixed(1)}%). Review top summaries and correct EffectPlan semantics or resource scope; use exact approval only when the modeled effects are correct.`);
+            if (cohortApprovalRecordedCount > 0) {
+                notes.push(`${cohortApprovalRecordedCount} active-cohort approval(s) recorded — these likely indicate actions operators wanted.`);
             }
             else {
                 notes.push('Review top would-block summaries and correct EffectPlan semantics or resource scope before switching to enforce.');
             }
-            if (classifierWouldBlockRate < 0.05 && gateEvents >= 20 && availabilityAsks.total === 0) {
+            if (cohortClassifierWouldBlockRate < 0.05 &&
+                cohortGateEvents >= 20 &&
+                cohortAvailabilityAsks.total === 0) {
                 readyForEnforce = true;
                 notes.push('Classifier-quality would-block rate is below 5% with sufficient sample size — consider enforce mode.');
             }
@@ -133,16 +190,16 @@ export function computeAuditMetrics(records, options = {}) {
     else {
         notes.push('Set policy.unknownLocalEffect to "deny" to dogfood fail-closed defaults.');
     }
-    if (availabilityAsks.total > 0) {
+    if (cohortAvailabilityAsks.total > 0) {
         readyForEnforce = false;
-        notes.push(`${availabilityAsks.total} availability-caused ask(s) — tune infrastructure before changing Effect semantics.`);
+        notes.push(`${cohortAvailabilityAsks.total} active-cohort availability-caused ask(s) — tune infrastructure before changing Effect semantics.`);
         notes.push('Ready for enforce withheld while availability-caused asks are present.');
     }
-    if (repeatedFingerprintAsks.length > 0) {
-        notes.push(`${repeatedFingerprintAsks.length} repeated fingerprint ask pattern(s) — review EffectPlan semantics and exact approval history.`);
+    if (cohortRepeatedFingerprintAsks.length > 0) {
+        notes.push(`${cohortRepeatedFingerprintAsks.length} active-cohort repeated fingerprint ask pattern(s) — review EffectPlan semantics and exact approval history.`);
     }
-    if (noisyRuleCandidates.length > 0) {
-        notes.push(`${noisyRuleCandidates.length} noisy rule candidate(s) — high deny-then-approve rate.`);
+    if (cohortNoisyRuleCandidates.length > 0) {
+        notes.push(`${cohortNoisyRuleCandidates.length} active-cohort noisy rule candidate(s) — high deny-then-approve rate.`);
     }
     return {
         schemaVersion: AUDIT_METRICS_SCHEMA_VERSION,
@@ -166,6 +223,7 @@ export function computeAuditMetrics(records, options = {}) {
         byEffect,
         byConfidence,
         gateEventsByRuntime,
+        currentCohort,
         approvalRecordedCount,
         topWouldBlockSummaries,
         approvalLatency,

package/dist/operational-insights.d.ts

@@ -7,6 +7,9 @@ export interface DogfoodStatus {
     gateEvents: number;
     wouldBlockCount: number;
     wouldBlockRate: number;
+    excludedGateEvents: number;
+    runtimeBuildStamp?: string;
+    configFingerprint?: string;
     notes: string[];
 }
 export interface OperationalInsights {

package/dist/operational-insights.js

@@ -8,6 +8,7 @@ export async function loadOperationalInsights(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const config = await loadConfigFile(repoRoot);
     const metrics = await metricsProject({ targetDir: repoRoot });
+    const cohort = metrics.currentCohort;
     return {
         repoRoot,
         dogfood: {
@@ -15,9 +16,12 @@ export async function loadOperationalInsights(options = {}) {
             mode: config.mode,
             unknownLocalEffect: config.policy.unknownLocalEffect,
             readyForEnforce: metrics.dogfood.readyForEnforce,
-            gateEvents: metrics.gateEvents,
-            wouldBlockCount: metrics.wouldBlockCount,
-            wouldBlockRate: metrics.wouldBlockRate,
+            gateEvents: cohort.gateEvents,
+            wouldBlockCount: cohort.wouldBlockCount,
+            wouldBlockRate: cohort.wouldBlockRate,
+            excludedGateEvents: cohort.excludedGateEvents,
+            runtimeBuildStamp: cohort.identity?.runtimeBuildStamp,
+            configFingerprint: cohort.identity?.configFingerprint,
             notes: metrics.dogfood.notes,
         },
     };

package/dist/runtime-provenance.d.ts

@@ -0,0 +1,8 @@
+import type { AuditCohortIdentity } from './core/audit-metrics.js';
+import type { BelayConfigV3 } from './core/config.js';
+export interface InstalledRuntimeProvenance {
+    stamp?: string;
+    version?: string;
+}
+export declare function readInstalledRuntimeProvenance(corePath: string): Promise<InstalledRuntimeProvenance>;
+export declare function resolveActiveAuditCohort(repoRoot: string, config: BelayConfigV3): Promise<AuditCohortIdentity | null>;

package/dist/runtime-provenance.js

@@ -0,0 +1,34 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { getAdapterLayout } from './adapters/layouts/index.js';
+import { resolveScopedPaths } from './adapters/layouts/scope.js';
+import { resolveAdapterName } from './config-io.js';
+import { canonicalStringify, hashValue } from './core/fingerprint.js';
+export async function readInstalledRuntimeProvenance(corePath) {
+    try {
+        const content = await readFile(corePath, 'utf8');
+        const stampMatch = content.match(/RUNTIME_BUILD_STAMP\s*=\s*"([^"]+)"/);
+        const versionMatch = content.match(/RUNTIME_PACKAGE_VERSION\s*=\s*"([^"]+)"/);
+        return {
+            stamp: stampMatch?.[1],
+            version: versionMatch?.[1],
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export async function resolveActiveAuditCohort(repoRoot, config) {
+    const adapter = resolveAdapterName(config);
+    const layout = getAdapterLayout(adapter);
+    const installScope = config.installScope === 'global' ? 'global' : 'project';
+    const scopedPaths = resolveScopedPaths(layout, installScope, repoRoot);
+    const runtime = await readInstalledRuntimeProvenance(path.join(scopedPaths.runtimeDir, 'core.mjs'));
+    if (!runtime.stamp) {
+        return null;
+    }
+    return {
+        runtimeBuildStamp: runtime.stamp,
+        configFingerprint: hashValue(canonicalStringify(config)),
+    };
+}

package/dist/types.d.ts

@@ -56,6 +56,9 @@ export interface DogfoodStatus {
     gateEvents: number;
     wouldBlockCount: number;
     wouldBlockRate: number;
+    excludedGateEvents: number;
+    runtimeBuildStamp?: string;
+    configFingerprint?: string;
     notes: string[];
 }
 export interface ConfigProvenanceNote {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.8.0";
+export declare const PACKAGE_VERSION = "0.8.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.8.0';
+export const PACKAGE_VERSION = '0.8.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",