@hassangameryt/freeflow 0.3.0 → 0.5.0

package/evals/reports/runtime/eryx-python-proof-spike-2-report.md

@@ -1,151 +0,0 @@
-# Eryx Python Sandbox Proof Spike 2 Report
-
-> **Date:** 2026-06-24
-> **Status:** Passed temp-patched proof spike for Python candidate
-> **Scope:** Proof-only evaluation. No Freeflow script execution path is enabled.
-
-## Candidate
-
-- Package: `@bsull/eryx@0.5.0`
-- License: MIT OR Apache-2.0
-- Package root: `/tmp/freeflow-eryx-proof-run-87KaRW/node_modules/@bsull/eryx`
-- Preview2 shim: `@bytecodealliance/preview2-shim@0.17.9`
-- Preview2 shim root: `/tmp/freeflow-eryx-proof-run-87KaRW/node_modules/@bytecodealliance/preview2-shim`
-- Patched temp copy: `/var/folders/2x/tsrlzqfx3ld_fn5bmr1_3l600000gn/T/freeflow-eryx-proof-0QeDOW`
-- WASM shards: 10
-- WASM total bytes: 44664377
-- Timeout: 500ms via Worker termination
-- Output cap: 4096 bytes across stdout + stderr before Worker result crosses to parent
-- Worker resource limits: `maxOldGenerationSizeMb=256`, `maxYoungGenerationSizeMb=32`
-- Node requirement: parent process started with `--experimental-wasm-jspi`
-
-## Package Files
-
-- `eryx-sandbox.core.wasm` — 14217612 bytes
-- `eryx-sandbox.core10.wasm` — 5014 bytes
-- `eryx-sandbox.core2.wasm` — 66749 bytes
-- `eryx-sandbox.core3.wasm` — 1949270 bytes
-- `eryx-sandbox.core4.wasm` — 5780 bytes
-- `eryx-sandbox.core5.wasm` — 8408 bytes
-- `eryx-sandbox.core6.wasm` — 27258519 bytes
-- `eryx-sandbox.core7.wasm` — 1090852 bytes
-- `eryx-sandbox.core8.wasm` — 10145 bytes
-- `eryx-sandbox.core9.wasm` — 52028 bytes
-- `eryx-sandbox.d.ts` — 4086 bytes
-- `eryx-sandbox.js` — 1069741 bytes
-- `index.d.ts` — 4463 bytes
-- `index.js` — 7898 bytes
-- `interfaces/eryx-net-tcp.d.ts` — 1056 bytes
-- `interfaces/eryx-net-tls.d.ts` — 931 bytes
-- `interfaces/wasi-cli-environment.d.ts` — 209 bytes
-- `interfaces/wasi-cli-exit.d.ts` — 177 bytes
-- `interfaces/wasi-cli-stderr.d.ts` — 163 bytes
-- `interfaces/wasi-cli-stdin.d.ts` — 158 bytes
-- `interfaces/wasi-cli-stdout.d.ts` — 163 bytes
-- `interfaces/wasi-cli-terminal-input.d.ts` — 176 bytes
-- `interfaces/wasi-cli-terminal-output.d.ts` — 178 bytes
-- `interfaces/wasi-cli-terminal-stderr.d.ts` — 207 bytes
-- `interfaces/wasi-cli-terminal-stdin.d.ts` — 201 bytes
-- `interfaces/wasi-cli-terminal-stdout.d.ts` — 207 bytes
-- `interfaces/wasi-clocks-monotonic-clock.d.ts` — 374 bytes
-- `interfaces/wasi-clocks-wall-clock.d.ts` — 200 bytes
-- `interfaces/wasi-filesystem-preopens.d.ts` — 194 bytes
-- `interfaces/wasi-filesystem-types.d.ts` — 5405 bytes
-- `interfaces/wasi-io-error.d.ts` — 185 bytes
-- `interfaces/wasi-io-poll.d.ts` — 254 bytes
-- `interfaces/wasi-io-streams.d.ts` — 1170 bytes
-- `interfaces/wasi-random-insecure-seed.d.ts` — 108 bytes
-- `interfaces/wasi-random-insecure.d.ts` — 166 bytes
-- `interfaces/wasi-random-random.d.ts` — 148 bytes
-- `interfaces/wasi-sockets-instance-network.d.ts` — 173 bytes
-- `interfaces/wasi-sockets-ip-name-lookup.d.ts` — 617 bytes
-- `interfaces/wasi-sockets-network.d.ts` — 2190 bytes
-- `interfaces/wasi-sockets-tcp-create-socket.d.ts` — 360 bytes
-- `interfaces/wasi-sockets-tcp.d.ts` — 1954 bytes
-- `interfaces/wasi-sockets-udp-create-socket.d.ts` — 360 bytes
-- `interfaces/wasi-sockets-udp.d.ts` — 1698 bytes
-- `package.json` — 1135 bytes
-- `python-stdlib.tar.gz` — 3082487 bytes
-- `README.md` — 4505 bytes
-- `shims/callbacks.d.ts` — 1376 bytes
-- `shims/callbacks.js` — 3991 bytes
-- `shims/net.js` — 1074 bytes
-- `shims/sockets.js` — 1068 bytes
-- `stdlib-loader.js` — 5523 bytes
-
-## WASM Shard Hashes
-
-- `eryx-sandbox.core.wasm` — 14217612 bytes — `63083db02cba1b628c5a939458c8e8c374f99b89d113a2c0670f715404944939`
-- `eryx-sandbox.core10.wasm` — 5014 bytes — `66a00b7099832c6cc85d42439e8bed880cdb0912ddb7f82e8b73c54fec89522e`
-- `eryx-sandbox.core2.wasm` — 66749 bytes — `d632b1884e0e376335a101e98d92c2d9279eda8dc8e196d8cf5114036d9512be`
-- `eryx-sandbox.core3.wasm` — 1949270 bytes — `f963fd45a753db5c8b33f8247b3f77aa045aca4ad516c580a6f70930def8d579`
-- `eryx-sandbox.core4.wasm` — 5780 bytes — `d67ce024ccf6d4191760a543888eccc9e1bca7ac4bfd68a794a693d238efd3f4`
-- `eryx-sandbox.core5.wasm` — 8408 bytes — `aa9012bd695b1f9d1bf3a770a547c2a3705be47cf00d4b45898b019c1f937799`
-- `eryx-sandbox.core6.wasm` — 27258519 bytes — `fde75b7a2c2d57630d1966cc0aa64f52fd6e48c17f10236e5c09da11e28ba8cc`
-- `eryx-sandbox.core7.wasm` — 1090852 bytes — `ca9450bf30ecf9243966168e043c72dc1c69208ef8ca5a0d4993b57bbc000b37`
-- `eryx-sandbox.core8.wasm` — 10145 bytes — `c7d356a9a1e71d26a37be99c9ee536d40484e36522b6447a625c6270e95637b0`
-- `eryx-sandbox.core9.wasm` — 52028 bytes — `e13ac26656e8c6fb5862961821a115df02009f1b9bd8b16acda4c1826b5f484d`
-
-## Import Patch
-
-The runner copies `@bsull/eryx` and `@bytecodealliance/preview2-shim` into a temp `node_modules` tree, then rewrites Eryx's generated preview2-shim imports from bare package subpaths to explicit browser/in-memory shim files:
-
-- `@bytecodealliance/preview2-shim/cli` → `../../@bytecodealliance/preview2-shim/lib/browser/cli.js`
-- `@bytecodealliance/preview2-shim/clocks` → `../../@bytecodealliance/preview2-shim/lib/browser/clocks.js`
-- `@bytecodealliance/preview2-shim/filesystem` → `../../@bytecodealliance/preview2-shim/lib/browser/filesystem.js`
-- `@bytecodealliance/preview2-shim/io` → `../../@bytecodealliance/preview2-shim/lib/browser/io.js`
-- `@bytecodealliance/preview2-shim/random` → `../../@bytecodealliance/preview2-shim/lib/browser/random.js`
-
-This avoids Node resolving `@bytecodealliance/preview2-shim/filesystem` to the host-filesystem-oriented Node shim that lacks `_setFileData`.
-
-The runner also replaces the temp-copied Eryx `shims/net.js` with an equivalent deny-only shim that records TCP/TLS attempts and returns `not-permitted`. This makes the network proof check the wrapper denial event instead of accepting any generic socket failure.
-
-## Import Probe
-
-- Status: success
-- Exports: `Sandbox`, `_fileTree`, `execute`, `setCallbackHandler`, `setCallbacks`, `setOutputHandler`, `setResultVariable`, `setTraceHandler`
-- Error: none
-
-## Positive API Probe
-
-- Status: success
-- Output: `INFO setup\nERROR target`
-- Error: none
-
-## Required Proof Results
-
-| Proof | Result | Evidence |
-| --- | --- | --- |
-| env_access_denied | pass | ambient host environment and secret sentinel were not exposed; status=success; exitCode=0; durationMs=82; outputBytes=89; stdoutBytes=89; stderrBytes=0; rawStdoutBytes=89; rawStderrBytes=0; truncated=false; outputFiles=0; networkEvents=none; error=none |
-| home_access_denied | pass | home directory was unavailable and home/secret file contents were not exposed; status=error; exitCode=1; durationMs=128; outputBytes=790; stdoutBytes=460; stderrBytes=330; rawStdoutBytes=460; rawStderrBytes=330; truncated=false; outputFiles=0; networkEvents=none; error=Traceback (most recent call last):\n  File "<string>", line 1, in <module>\n  File "<string>", line 179, in _eryx_exec\n  File "<user>", line 2, in <module>\n  File "/python-stdlib/pathlib/__init__.py", line 1266, in home\n    raise RuntimeError("Could not determine home directory.")\nRuntimeError: Could not determine home directory.\n |
-| repo_access_denied | pass | repo file contents were not exposed; status=error; exitCode=1; durationMs=126; outputBytes=1146; stdoutBytes=483; stderrBytes=663; rawStdoutBytes=483; rawStderrBytes=663; truncated=false; outputFiles=0; networkEvents=none; error=Traceback (most recent call last):\n  File "<string>", line 1, in <module>\n  File "<string>", line 179, in _eryx_exec\n  File "<user>", line 2, in <module>\n  File "/python-stdlib/pathlib/__init__.py", line 792, in read_text\n    with self.open(mode='r', encoding=encoding, errors=errors, newline=newline) as f:\n         ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/pathlib/__init__.py", line 776, in open\n    return io.open(self, mode, buffering, encoding, errors, newline)\n           ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nNotADirectoryError: [Errno 54] Not a directory: '/workspace/package.json'\n |
-| vault_access_denied | pass | vault records were not exposed; status=success; exitCode=0; durationMs=117; outputBytes=462; stdoutBytes=462; stderrBytes=0; rawStdoutBytes=462; rawStderrBytes=0; truncated=false; outputFiles=0; networkEvents=none; error=none |
-| network_access_denied | pass | outbound network attempt reached the instrumented Eryx shim and was denied as not-permitted; status=error; exitCode=1; durationMs=219; outputBytes=4096; stdoutBytes=2048; stderrBytes=2048; rawStdoutBytes=3795; rawStderrBytes=2442; truncated=true; outputFiles=0; networkEvents=tcp.connect:not-permitted,tls.upgrade:not-permitted,tls.write:not-permitted; error=Traceback (most recent call last):\n  File "/python-stdlib/urllib/request.py", line 1321, in do_open\n    h.request(req.get_method(), req.selector, req.data, headers,\n    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n              encode_chunked=req.has_header('Transfer-encoding'))\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/http/client.py", line 1338, in request\n    self._send_request(method, url, body, headers, encode_chunked)\n    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/http/client.py", line 1384, in _send_request\n    self.endheaders(body, encode_chunked=encode_chunked)\n    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/http/client.py", line 1333, in endheaders\n    self._send_output(message_body, encode_chunked=encode_chunked)\n    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/http/client.py", line 1093, in _send_output\n    self.send(msg)\n    ~~~~~~~~~^^^^^\n  File "/python-stdlib/http/client.py", line 1057, in send\n    self.sock.sendall(data)\n    ~~~~~~~~~~~~~~~~~^^^^^^\n  File "<ssl_eryx>", line 220, in sendall\n  File "<socket_eryx>", line 359, in sendall\nsocket.error: Connection closed\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "<string>", line 1, in <module>\n  File "<string>", line 179, in _eryx_exec\n  File "<user>", line 2, in <module>\n  File "/python-stdlib/urllib/request.py", line 187, in urlopen\n    return opener.open(url, data, timeout)\n           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/urllib/request.py", line 487, in open\n    response = self._open(req, data)\n  File "/python-stdlib/urllib/request.py", line 504, in _open\n    result = self._call_chain(self.handle_open, protocol, protocol +\n                              '_open', req)\n  File "/python-stdlib/urllib/request.py", line 464, in _call_chain\n    result = func(*args)\n  File "/python-stdlib/urllib/request.py", line 1369, in https_open\n    return self.do_open(http.client.HTTPSConnection, req,\n           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n                        context=self._context)\n                        ^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/urllib/request.py", line 1324, in do_open\n    raise URLError(err)\nurllib.error.URLError: <urlopen error Connection closed>\n |
-| input_read_only | pass | input mutation was not possible through filesystem paths; status=error; exitCode=1; durationMs=120; outputBytes=1143; stdoutBytes=483; stderrBytes=660; rawStdoutBytes=483; rawStderrBytes=660; truncated=false; outputFiles=0; networkEvents=none; error=Traceback (most recent call last):\n  File "<string>", line 1, in <module>\n  File "<string>", line 179, in _eryx_exec\n  File "<user>", line 2, in <module>\n  File "/python-stdlib/pathlib/__init__.py", line 814, in write_text\n    with self.open(mode='w', encoding=encoding, errors=errors, newline=newline) as f:\n         ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File "/python-stdlib/pathlib/__init__.py", line 776, in open\n    return io.open(self, mode, buffering, encoding, errors, newline)\n           ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nNotADirectoryError: [Errno 54] Not a directory: '/input/test_log.txt'\n |
-| output_escape_denied | pass | output symlink attempt stayed inside ignored in-memory filesystem and no output files were collected; status=success; exitCode=0; durationMs=119; outputBytes=454; stdoutBytes=454; stderrBytes=0; rawStdoutBytes=454; rawStderrBytes=0; truncated=false; outputFiles=0; networkEvents=none; error=none |
-| stdout_stderr_bounded | pass | stdout/stderr flood was capped before crossing from Worker to parent; status=success; exitCode=0; durationMs=103; outputBytes=4096; stdoutBytes=2048; stderrBytes=2048; rawStdoutBytes=100999; rawStderrBytes=100999; truncated=true; outputFiles=0; networkEvents=none; error=none |
-| timeout_enforced | pass | infinite loop was stopped by Worker termination; status=timed_out; exitCode=null; durationMs=502; outputBytes=0; stdoutBytes=0; stderrBytes=0; rawStdoutBytes=0; rawStderrBytes=0; truncated=false; outputFiles=0; networkEvents=none; error=none |
-
-## Notes
-
-- This proof runner uses a temporary installed `@bsull/eryx` package root passed explicitly by the caller.
-- It does not add repo dependencies and does not wire Python into `freeflow_derive` execution.
-- It performs a temp-copy import rewrite and deny-only network-shim replacement. A product adapter would need an explicit package-root wrapper and focused security review before enabling this path.
-- Timeout proof uses Node Worker termination because Eryx's high-level JS API does not expose timeout or fuel controls.
-- Output proof caps what crosses from Worker to parent; Eryx/Python can still materialize large strings inside the Worker before the wrapper truncates them.
-- The runner intentionally collects no output files, matching the current QuickJS/jq product adapters. In-memory filesystem writes and symlink attempts are ignored unless their contents reach stdout/stderr.
-- The runner returns bounded error messages rather than JS host stack traces so proof output does not leak repo/home paths through adapter diagnostics.
-- The runner overrides Worker `console` before importing Eryx so preview2 browser shim debug logs are captured and bounded instead of inherited by host stdout.
-- Passing this spike supports candidate feasibility only. Product execution still requires adapter implementation, probe caching, review, and runtime-status wiring.
-
-## Required Proof Set
-
-- env_access_denied
-- home_access_denied
-- repo_access_denied
-- vault_access_denied
-- network_access_denied
-- input_read_only
-- output_escape_denied
-- stdout_stderr_bounded
-- timeout_enforced

package/evals/reports/runtime/eryx-python-script-derive-execution-1-report.md

@@ -1,233 +0,0 @@
-# Eryx Python Script Derive Execution Report 1
-
-> **Date:** 2026-06-24
-> **Status:** Passed Eryx Python execution smoke
-> **Scope:** Slice 17 execution engine. Python can execute only through an explicitly registered/provided Eryx adapter; script derive remains disabled by default.
-
-## Summary
-
-- Added dependency-free Eryx Python adapter support in router core.
-- Adapter loading is explicit. The Pi adapter discovers Python only when `FREEFLOW_ERYX_ROOT` points to an installed `@bsull/eryx` package root.
-- Eryx requires the parent Node process to run with `--experimental-wasm-jspi`.
-- No `package.json` dependency was added.
-- No runtime artifacts are installed, downloaded, or vendored during execution.
-- Script derive remains disabled by default.
-
-## Adapter Surface
-
-The Eryx adapter runs CPython/WASM inside a Node Worker. The guest Python program receives:
-
-- `read_text(alias)` — reads copied vault-source input by alias,
-- `write_text(text)` — writes to captured stdout,
-- `sources` — a Python dict keyed by source alias.
-
-The adapter does not expose host repo paths, home paths, vault paths, ambient environment variables, process APIs, package loading, direct host filesystem access, or network APIs.
-
-The adapter uses a temp-copied Eryx package tree and rewrites Eryx's preview2-shim imports to browser/in-memory preview2 shims. It also replaces the temp-copied Eryx network shim with a deny-only shim that records TCP/TLS `not-permitted` events during proofs.
-
-Timeouts are enforced by Worker termination. Output is capped before the Worker result crosses to the host. If output is truncated, execution returns a structured `derive_execution_failure`; truncated stdout is not persisted as an exact result.
-
-Residual caveat: Eryx/Python can still generate large strings inside the Worker before wrapper truncation. The Worker uses resource limits and timeout termination, but output cap enforcement is not streaming inside Python itself.
-
-## Product Path
-
-Execution requires all of:
-
-- `scriptDerive.enabled=true`,
-- `scriptDerive.languages` includes `python`,
-- a proof-backed Eryx adapter is registered/provided,
-- Pi can discover `FREEFLOW_ERYX_ROOT`, or the caller passes the adapter directly,
-- the parent Node process has `--experimental-wasm-jspi`,
-- `network="off"`,
-- raw script persistence remains disabled.
-
-## Actual Adapter Proof Selection
-
-With package root:
-
-```text
-/tmp/freeflow-eryx-proof-run-87KaRW/node_modules/@bsull/eryx
-```
-
-`probeScriptSandboxAdapters` reported:
-
-```json
-{
-  "probeStatus": "available",
-  "availableLanguages": ["python"],
-  "passed": 9,
-  "failed": 0
-}
-```
-
-Command evidence: `ffout_b223c00fa8c1f7b82ce6ab15`.
-
-The dedicated proof report is `evals/reports/runtime/eryx-python-proof-spike-2-report.md`.
-
-## Product Execution Smoke
-
-A real `freeflowDerive` smoke used a vaulted stdout source:
-
-```text
-alpha
-```
-
-and Python code:
-
-```python
-write_text(read_text('log').upper())
-```
-
-Result excerpt:
-
-```json
-{
-  "deriveStatus": "ok",
-  "failure": null,
-  "outputId": "ffout_569831f03c6f0d79149a2c58",
-  "raw": "ALPHA",
-  "leakedScript": false
-}
-```
-
-Raw script text was not persisted in the routed result; the operation records only `codeSha256`.
-
-Command evidence: `ffout_b223c00fa8c1f7b82ce6ab15`.
-
-## Output Cap Regression Smoke
-
-A real Eryx product-path smoke used a configured adapter proof cap of `4096` bytes and a per-call `limits.maxOutputBytes=10` with:
-
-```python
-write_text('x' * 100)
-```
-
-Result excerpt:
-
-```json
-{
-  "failure": "derive_execution_failure",
-  "message": "Script derive python failed. Eryx Python execution exceeded maxOutputBytes. stdoutBytes=5 stderrBytes=0.",
-  "outputId": null,
-  "recoverability": "none"
-}
-```
-
-This confirms truncated Python output is not persisted as a successful exact result. The adapter splits the output cap between stdout and stderr so both streams retain bounded evidence under flood conditions.
-
-Command evidence: `ffout_ef09471811902881360f0416`.
-
-## Timeout Smoke
-
-A real Eryx timeout smoke used:
-
-```python
-while True:
-    pass
-```
-
-with per-call `limits.timeoutMs=250`.
-
-Result excerpt:
-
-```json
-{
-  "failure": "derive_execution_failure",
-  "message": "Script derive python timed_out. Eryx Python execution exceeded timeoutMs. stdoutBytes=0 stderrBytes=0.",
-  "outputId": null,
-  "recoverability": "none"
-}
-```
-
-Command evidence: `ffout_ef09471811902881360f0416`.
-
-## Targeted Tests
-
-```text
-npm run build && node --test router/tests/derive.test.js router/tests/script-sandbox.test.js router/tests/pi-extension-derive.test.js router/tests/pi-extension.test.js
-```
-
-Result:
-
-```text
-69 passed, 1 skipped
-```
-
-The skipped test is the optional Eryx integration path, which requires `FREEFLOW_ERYX_ROOT` and Node `--experimental-wasm-jspi`.
-
-Coverage included:
-
-- script derive remains disabled by default through the Pi public tool,
-- invalid `FREEFLOW_ERYX_ROOT` fails closed as adapter unavailable,
-- Pi status and derive wiring still build and pass focused tests,
-- proof fixture coverage remains complete.
-
-## Optional Eryx Integration Test
-
-```text
-FREEFLOW_ERYX_ROOT=/tmp/freeflow-eryx-proof-run-87KaRW/node_modules/@bsull/eryx \
-  node --experimental-wasm-jspi --test router/tests/derive.test.js --test-name-pattern "Eryx adapter"
-```
-
-Result:
-
-```text
-25 tests passed, including:
-✔ freeflowDerive script operation executes Python through discovered Eryx adapter when configured
-```
-
-Command evidence: `ffout_b1fbb65e96d814268c0aa0c2`; post-full-tree-fingerprint rerun evidence: `ffout_f7ccfed70b4323788ce921c7`; post-mutation-check rerun evidence: `ffout_4a0268f37ecc9436804fcab5`.
-
-## Pi Status Smoke
-
-With `FREEFLOW_ERYX_ROOT=/tmp/freeflow-eryx-proof-run-87KaRW/node_modules/@bsull/eryx` and Node `--experimental-wasm-jspi`, `buildFreeflowStatusReport` reports:
-
-```json
-{
-  "enabled": false,
-  "executionStatus": "disabled",
-  "adapterAvailable": true,
-  "adapterStatus": "available",
-  "availableLanguages": ["python"],
-  "registeredAdapters": [
-    { "id": "eryx-python", "version": "0.5.0", "languages": ["python"] }
-  ]
-}
-```
-
-This proves explicit adapter discovery does not enable script execution while `scriptDerive.enabled` remains false.
-
-Command evidence: `ffout_d321f5f2d24d548d935e5a9f`.
-
-## Full Router Suite
-
-```text
-env -u FREEFLOW_ERYX_ROOT npm run test:router
-```
-
-Result:
-
-```text
-278 passed, 1 skipped
-```
-
-The skipped test is the optional Eryx integration path.
-
-Command evidence: `ffout_8b08d9c1893023bb3a74c702`; post-full-tree-fingerprint rerun evidence: `ffout_002c6ed4ff25a713538bb738`; post-mutation-check rerun evidence: `ffout_d88f87f47353dfa6351e22a9`.
-
-## Current Availability
-
-| Language | Status |
-| --- | --- |
-| JavaScript | Product execution path implemented for explicitly registered/provided QuickJS adapter roots; disabled by default. |
-| Python | Product execution path implemented for explicitly registered/provided Eryx adapter roots plus Node JSPI; disabled by default. |
-| jq | Product execution path implemented for explicitly registered/provided jq-wasm adapter roots; disabled by default. |
-
-## Remaining Gates
-
-Before presenting script derive as generally available:
-
-1. Keep setup UX explicit: Freeflow must not install or download adapter packages.
-2. Run full router suite and focused review for this implementation slice.
-3. Document Eryx's JSPI and in-Worker large-output caveats in user-facing docs.
-4. Keep network, raw-script persistence, direct repo inputs, and output-file collection disabled unless separate proof/review approves them.

package/evals/reports/runtime/jq-script-derive-execution-1-report.md

@@ -1,215 +0,0 @@
-# jq Script Derive Execution Report 1
-
-> **Date:** 2026-06-24
-> **Status:** Passed jq execution smoke
-> **Scope:** Partial Slice 17 execution engine. jq can execute only through an explicitly registered/provided jq-wasm adapter; script derive remains disabled by default.
-
-## Summary
-
-- Added dependency-free jq-wasm adapter support in router core.
-- Adapter loading is explicit. The Pi adapter discovers jq only when `FREEFLOW_JQ_WASM_ROOT` points to an installed `jq-wasm` package root.
-- No `package.json` dependency was added.
-- No runtime artifacts are installed, downloaded, or vendored during execution.
-- Python remains unavailable.
-
-## Adapter Surface
-
-The jq adapter runs `jq-wasm` inside a Node Worker. The guest jq program receives a JSON object keyed by source alias. For a source alias `log`, the jq program reads `.log`.
-
-The adapter does not expose host repo paths, home paths, vault paths, ambient process APIs, package loading to guest jq, or network APIs.
-
-Timeouts are enforced by Worker termination. Output is capped before the Worker result crosses to the host. If output is truncated, execution returns a structured `derive_execution_failure`; truncated stdout is not persisted as an exact result.
-
-Residual caveat: `jq-wasm` can still generate large strings inside the Worker before wrapper truncation. The Worker uses resource limits and timeout termination, but output cap enforcement is not streaming inside jq itself.
-
-## Product Path
-
-Execution requires all of:
-
-- `scriptDerive.enabled=true`,
-- `scriptDerive.languages` includes `jq`,
-- a proof-backed jq adapter is registered/provided,
-- Pi can discover `FREEFLOW_JQ_WASM_ROOT`, or the caller passes the adapter directly,
-- `network="off"`,
-- raw script persistence remains disabled.
-
-## Actual Adapter Proof Selection
-
-With package root:
-
-```text
-/tmp/freeflow-sandbox-candidates-xVAJBl/node_modules/jq-wasm
-```
-
-`probeScriptSandboxAdapters` reported:
-
-```json
-{
-  "adapterAvailable": true,
-  "availableLanguages": ["jq"],
-  "failedProofs": [],
-  "passedProofs": [
-    "env_access_denied",
-    "home_access_denied",
-    "repo_access_denied",
-    "vault_access_denied",
-    "network_access_denied",
-    "input_read_only",
-    "output_escape_denied",
-    "stdout_stderr_bounded",
-    "timeout_enforced"
-  ],
-  "reason": "jq-wasm passed every required jq sandbox proof.",
-  "runtime": {
-    "name": "jq-wasm",
-    "version": "1.2.0-jq-1.8.2 entry:4a5bd373cb59"
-  }
-}
-```
-
-## Product Execution Smoke
-
-A real `freeflowDerive` smoke used a vaulted stdout source:
-
-```text
-INFO alpha
-ERROR beta
-```
-
-and jq code:
-
-```jq
-.log | split("\n") | map(select(test("ERROR"))) | .[]
-```
-
-Result excerpt:
-
-```json
-{
-  "toolStatus": "ok",
-  "operation": {
-    "kind": "script",
-    "language": "jq",
-    "codeSha256": "sha256_e5e69ac26a62710aa0313ddaa13e6619c21bd0c1e2adffa0230b63de82c68c0c"
-  },
-  "summary": "Script derive jq completed with 12 stdout bytes and 0 stderr bytes.",
-  "derived": "\"ERROR beta\"",
-  "persistence": {
-    "status": "vaulted",
-    "recoverability": "exact"
-  }
-}
-```
-
-Raw script text was not persisted in the routed result; the operation records only `codeSha256`.
-
-## Output Cap Regression Smoke
-
-A real jq product-path smoke used a configured adapter proof cap of `4096` bytes and a per-call `limits.maxOutputBytes=10` with:
-
-```jq
-range(0; 1000) | "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-```
-
-Result excerpt:
-
-```json
-{
-  "toolStatus": "ok",
-  "failure": {
-    "kind": "derive_execution_failure",
-    "message": "Script derive jq failed. jq-wasm execution exceeded maxOutputBytes. stdoutBytes=10 stderrBytes=0."
-  },
-  "deriveExecution": {
-    "status": "failed",
-    "failureKind": "derive_execution_failure"
-  },
-  "persistence": {
-    "status": "not_persisted",
-    "recoverability": "none"
-  }
-}
-```
-
-This confirms truncated jq output is not persisted as a successful exact result.
-
-## Timeout Smoke
-
-A real jq timeout smoke used:
-
-```jq
-def loop: loop; loop
-```
-
-Result excerpt:
-
-```json
-{
-  "toolStatus": "ok",
-  "failure": {
-    "kind": "derive_execution_failure",
-    "message": "Script derive jq timed_out. jq-wasm execution exceeded timeoutMs. stdoutBytes=0 stderrBytes=0."
-  },
-  "deriveExecution": {
-    "status": "failed",
-    "failureKind": "derive_execution_failure"
-  },
-  "persistence": {
-    "status": "not_persisted",
-    "recoverability": "none"
-  }
-}
-```
-
-## Pi Status Smoke
-
-With `FREEFLOW_JQ_WASM_ROOT=/tmp/freeflow-sandbox-candidates-xVAJBl/node_modules/jq-wasm`, `buildFreeflowStatusReport` reports:
-
-```json
-{
-  "enabled": false,
-  "executionStatus": "disabled",
-  "adapterAvailable": true,
-  "availableLanguages": ["jq"],
-  "registeredAdapters": [
-    { "id": "jq-wasm", "version": "1.2.0-jq-1.8.2", "languages": ["jq"] }
-  ]
-}
-```
-
-This proves explicit adapter discovery does not enable script execution while `scriptDerive.enabled` remains false.
-
-## Tests
-
-Targeted check passed:
-
-```text
-npm run build:router && node --test router/tests/derive.test.js router/tests/script-sandbox.test.js
-```
-
-Result: 32/32 targeted tests passed.
-
-Coverage includes:
-
-- script derive remains disabled by default,
-- jq execution works through a registered proof-backed adapter,
-- adapter timeout/failure returns structured `derive_execution_failure`,
-- output-limit failures return structured `derive_execution_failure` without exact recovery,
-- invalid `FREEFLOW_JQ_WASM_ROOT` fails closed as adapter unavailable.
-
-## Current Availability
-
-| Language | Status |
-| --- | --- |
-| JavaScript | Product execution path implemented for explicitly registered/provided QuickJS adapter roots; disabled by default. |
-| jq | Product execution path implemented for explicitly registered/provided jq-wasm adapter roots; disabled by default. |
-| Python | Unavailable. Eryx candidate blocked before proofs. |
-
-## Remaining Work
-
-Before script derive can be described as complete across target languages:
-
-1. Run focused implementation/security review for jq product execution.
-2. Run the full router suite.
-3. Find or fix a Python WASM candidate.
-4. Keep public docs precise: JavaScript and jq are explicit opt-in; Python remains unavailable; script derive is disabled by default.

package/evals/reports/runtime/jq-wasm-proof-spike-1-report.md

@@ -1,67 +0,0 @@
-# jq-wasm Sandbox Proof Spike Report
-
-> **Date:** 2026-06-24
-> **Status:** Passed proof spike for jq candidate
-> **Scope:** Proof-only evaluation. No Freeflow script execution path is enabled.
-
-## Candidate
-
-- Package: `jq-wasm@1.2.0-jq-1.8.2`
-- License: MIT
-- Package root: `/tmp/freeflow-sandbox-candidates-xVAJBl/node_modules/jq-wasm`
-- Entry point: `/tmp/freeflow-sandbox-candidates-xVAJBl/node_modules/jq-wasm/dist/index.js`
-- Runtime version: `jq-1.8.2-dirty`
-- Timeout: 500ms via Worker termination
-- Output cap: 4096 bytes across stdout + stderr before Worker result crosses to host
-- Worker resource limits: `maxOldGenerationSizeMb=64`, `maxYoungGenerationSizeMb=16`
-
-## Package Files
-
-- `dist/build/jq.d.ts` — 118 bytes
-- `dist/build/jq.js` — 1181780 bytes
-- `dist/index.d.ts` — 1133 bytes
-- `dist/index.js` — 3242 bytes
-- `LICENSE` — 1051 bytes
-- `package.json` — 1981 bytes
-- `README.md` — 3088 bytes
-
-## Positive API Probe
-
-- Status: success
-- Output: `"INFO setup\nERROR target\n"`
-- Error: none
-
-## Required Proof Results
-
-| Proof | Result | Evidence |
-| --- | --- | --- |
-| env_access_denied | pass | jq exposed only fixed runtime env, not ambient host env or secrets; status=success; exitCode=0; durationMs=29; outputBytes=126; stdoutBytes=126; stderrBytes=0; rawStdoutBytes=126; rawStderrBytes=0; truncated=false |
-| home_access_denied | pass | home/secret paths were not exposed; status=success; exitCode=3; durationMs=27; outputBytes=61; stdoutBytes=0; stderrBytes=61; rawStdoutBytes=0; rawStderrBytes=61; truncated=false |
-| repo_access_denied | pass | repo files were not exposed; status=success; exitCode=3; durationMs=29; outputBytes=61; stdoutBytes=0; stderrBytes=61; rawStdoutBytes=0; rawStderrBytes=61; truncated=false |
-| vault_access_denied | pass | vault records were not exposed; status=success; exitCode=3; durationMs=27; outputBytes=62; stdoutBytes=0; stderrBytes=62; rawStdoutBytes=0; rawStderrBytes=62; truncated=false |
-| network_access_denied | pass | jq has no ambient network primitive; synthetic fetch errored boundedly; status=success; exitCode=5; durationMs=30; outputBytes=48; stdoutBytes=0; stderrBytes=48; rawStdoutBytes=0; rawStderrBytes=48; truncated=false |
-| input_read_only | pass | input mutation include was unavailable; status=success; exitCode=3; durationMs=29; outputBytes=71; stdoutBytes=0; stderrBytes=71; rawStdoutBytes=0; rawStderrBytes=71; truncated=false |
-| output_escape_denied | pass | output escape include was unavailable; status=success; exitCode=3; durationMs=28; outputBytes=63; stdoutBytes=0; stderrBytes=63; rawStdoutBytes=0; rawStderrBytes=63; truncated=false |
-| stdout_stderr_bounded | pass | stdout and stderr flood output was truncated before crossing the worker boundary; status=success; exitCode=0; durationMs=353; outputBytes=4096; stdoutBytes=2048; stderrBytes=2048; rawStdoutBytes=5299999; rawStderrBytes=6399999; truncated=true |
-| timeout_enforced | pass | recursive jq loop was interrupted by worker termination; status=timed_out; exitCode=null; durationMs=501; outputBytes=0; stdoutBytes=0; stderrBytes=0; rawStdoutBytes=0; rawStderrBytes=0; truncated=false |
-
-## Notes
-
-- This proof runner uses a temporary installed `jq-wasm` package root passed explicitly by the caller.
-- It does not add repo dependencies and does not wire the adapter into `freeflow_derive` execution.
-- Timeout proof uses Node Worker termination because in-thread recursive jq blocks the event loop.
-- Output proof caps what crosses the Worker boundary; `jq-wasm` itself can still generate large in-Worker strings before the wrapper truncates them.
-- Passing this spike only supports jq adapter feasibility; Python remains unavailable until a Python candidate passes proofs.
-- Before product execution, this must still go through implementation/security review and source-plan update.
-
-## Required Proof Set
-
-- env_access_denied
-- home_access_denied
-- repo_access_denied
-- vault_access_denied
-- network_access_denied
-- input_read_only
-- output_escape_denied
-- stdout_stderr_bounded
-- timeout_enforced