@holdyourvoice/hyv 3.6.1 → 4.0.0

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@holdyourvoice/hyv",
-  "version": "3.6.1",
-  "description": "A local-first dual-engine writing gate that protects voice and catches generic AI patterns.",
+  "version": "4.0.0",
+  "description": "Local writing checks, voice profiles, and verified editing workflows for humans and agents.",
   "type": "module",
   "bin": {
     "hyv": "dist/cli.js"
   },
   "files": [
     "dist",
+    "!dist/**/*.test.js",
     "skills",
     "Readme.md",
     "LICENSE"
@@ -17,6 +18,7 @@
     "bundle:claude": "esbuild src/mcp.ts --bundle --platform=node --format=esm --target=node20 --outfile=mcpb/server/index.js",
     "build:claude": "npm run build && npm run bundle:claude",
     "pack:claude": "npm run build:claude && node scripts/pack-claude.mjs",
+    "pack:chatgpt-plugin": "node scripts/pack-chatgpt-plugin.mjs",
     "scorecard": "node scripts/public-scorecard.mjs benchmarks",
     "validate:rule-contributions": "node scripts/validate-rule-contributions.mjs",
     "stage1:evaluate": "node scripts/evaluate-rewrite-benchmark.mjs",
@@ -25,7 +27,8 @@
     "stage2:human-packet": "npm run build && node scripts/run-stage2-human-packet.mjs",
     "test": "npm run build && node --test \"dist/**/*.test.js\"",
     "check:release": "node scripts/release-audit.mjs",
-    "prepack": "npm run check:release && npm test && npm run pack:claude"
+    "prepack": "npm run check:release && npm test && npm run pack:claude",
+    "check:compatibility": "node scripts/verify-compatibility.mjs"
   },
   "engines": {
     "node": ">=20"

package/skills/hyv-prepare-judgment/SKILL.md

@@ -19,6 +19,10 @@ hyv prepare-judgment pre-edit|post-candidate kind draft.md profile.json task.jso
 - Commands that write use an explicit output path. Confirm that path before running the command.
 - This agent describes how to invoke the command and what it returns. It does not change command behavior or exit codes.
 
+## Word economy review
+
+For a post-candidate form judgment, review whether every word earns its place before final verification and delivery. Name the phrase and sentence range, propose a cut, and explain why meaning, evidence, clarity, and voice survive it. Preserve necessary uncertainty, attribution, emphasis, rhythm, and transitions. Do not use a word-count target. Record unresolved cuts as findings and use ESCALATE; do not return CLEAR merely because the candidate is shorter. Report concerns outside the authorized edit scope without changing text. The local command prepares the task; it does not perform this editorial judgment.
+
 ## Handoff
 
 Run `hyv prepare-judgment` directly to execute the operation. Follow-on agents: hyv-reduce-judgment.

package/dist/agents/catalog.test.js

@@ -1,60 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { resolveHost, listHosts, runtime } from './catalog.js';
-import { AGENT_SCHEMA_VERSION } from './types.js';
-function minimalDescriptor(id, permissions) {
-    return {
-        schema_version: AGENT_SCHEMA_VERSION,
-        id,
-        title: id,
-        description: 'test',
-        instruction_file: 'SKILL.md',
-        role: 'Tester',
-        workflow_phase: 'test',
-        input: { required: ['draft'], optional: [] },
-        output: { required: ['report'], optional: [] },
-        evidence_requirements: ['evidence'],
-        permissions,
-        stop_conditions: ['stop'],
-        tool_free_mode: { available: true, behavior: 'report', unavailable_statuses: ['NOT_AVAILABLE'] },
-        handoff_to: [],
-    };
-}
-test('resolves known hosts and falls back to generic for unknown ids', () => {
-    assert.equal(resolveHost('codex').id, 'codex');
-    assert.equal(resolveHost('future-ide').id, 'generic');
-    assert.equal(resolveHost('future-ide').native_skills, false);
-    assert.equal(resolveHost('future-ide').cli, true);
-});
-test('catalog has unique host ids and includes generic', () => {
-    const hosts = listHosts();
-    const ids = hosts.map((host) => host.id);
-    assert.ok(ids.includes('generic'));
-    assert.equal(new Set(ids).size, ids.length);
-});
-test('runtime marks unsupported permissions unavailable and switches to prompt-only', () => {
-    const descriptor = minimalDescriptor('hyv-verify', ['read_repository', 'network', 'subagents']);
-    const resolved = runtime(descriptor, 'generic');
-    assert.deepEqual(resolved.available_capabilities, []);
-    assert.deepEqual(resolved.unavailable_capabilities, [
-        { capability: 'read_repository', status: 'NOT_AVAILABLE' },
-        { capability: 'network', status: 'NOT_AVAILABLE' },
-        { capability: 'subagents', status: 'NOT_AVAILABLE' },
-    ]);
-    assert.equal(resolved.execution_mode, 'prompt-only');
-});
-test('runtime uses native mode when the host supports every permission', () => {
-    const descriptor = minimalDescriptor('hyv-verify', ['read_repository', 'execute_commands']);
-    const resolved = runtime(descriptor, 'codex');
-    assert.deepEqual(resolved.available_capabilities, ['read_repository', 'execute_commands']);
-    assert.deepEqual(resolved.unavailable_capabilities, []);
-    assert.equal(resolved.execution_mode, 'native');
-});
-test('network is never available on any host', () => {
-    for (const host of listHosts()) {
-        const resolved = runtime(minimalDescriptor('hyv-verify', ['network']), host.id);
-        assert.deepEqual(resolved.available_capabilities, []);
-        assert.deepEqual(resolved.unavailable_capabilities, [{ capability: 'network', status: 'NOT_AVAILABLE' }]);
-        assert.equal(resolved.execution_mode, 'prompt-only');
-    }
-});

package/dist/agents/emit.test.js

@@ -1,64 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { describe, emitJson, emitPrompt } from './emit.js';
-import { AGENT_SCHEMA_VERSION } from './types.js';
-function makePackage(id) {
-    return {
-        directory: '/pkg',
-        instructions: 'Usage: hyv verify original.md candidate.md profile.json',
-        descriptor: {
-            schema_version: AGENT_SCHEMA_VERSION,
-            id,
-            title: 'hyv-verify',
-            description: 'verify a candidate',
-            instruction_file: 'SKILL.md',
-            role: 'Verifier',
-            workflow_phase: 'verify',
-            input: { required: ['original', 'candidate'], optional: ['writing brief'] },
-            output: { required: ['verification report'], optional: [] },
-            evidence_requirements: ['preserve revision evidence'],
-            permissions: ['read_repository', 'network'],
-            stop_conditions: ['stop when evidence is stale'],
-            tool_free_mode: {
-                available: true,
-                behavior: 'report the decision and exact unavailable capability',
-                unavailable_statuses: ['NOT_AVAILABLE', 'NOT_CONFIGURED', 'NOT_RUN', 'STALE', 'ERROR'],
-            },
-            handoff_to: ['hyv-lifecycle'],
-        },
-    };
-}
-test('describe resolves a host and returns a runtime descriptor', () => {
-    const resolved = describe(makePackage('hyv-verify'), 'codex');
-    assert.equal(resolved.agent.id, 'hyv-verify');
-    assert.equal(resolved.host.id, 'codex');
-    assert.ok(resolved.available_capabilities.includes('read_repository'));
-    assert.deepEqual(resolved.unavailable_capabilities, [{ capability: 'network', status: 'NOT_AVAILABLE' }]);
-    assert.equal(resolved.execution_mode, 'prompt-only');
-});
-test('emitJson renders a valid JSON runtime descriptor', () => {
-    const body = emitJson(makePackage('hyv-verify'), 'generic');
-    const parsed = JSON.parse(body);
-    assert.equal(parsed.agent.id, 'hyv-verify');
-    assert.equal(parsed.host.id, 'generic');
-    assert.ok(Array.isArray(parsed.unavailable_capabilities));
-    assert.deepEqual(parsed.unavailable_capabilities, [
-        { capability: 'read_repository', status: 'NOT_AVAILABLE' },
-        { capability: 'network', status: 'NOT_AVAILABLE' },
-    ]);
-});
-test('emitPrompt includes instructions, capability boundary, and required statuses', () => {
-    const prompt = emitPrompt(makePackage('hyv-verify'), 'codex');
-    assert.match(prompt, /# hyv-verify/);
-    assert.match(prompt, /Role: Verifier/);
-    assert.match(prompt, /Usage: hyv verify original\.md candidate\.md profile\.json/);
-    assert.match(prompt, /Available: read_repository/);
-    assert.match(prompt, /Unavailable: network \(NOT_AVAILABLE\)/);
-    assert.match(prompt, /NOT_AVAILABLE, NOT_CONFIGURED, NOT_RUN, STALE, ERROR/);
-    assert.match(prompt, /Next agents: hyv-lifecycle/);
-});
-test('emitPrompt reports no available capabilities for a fully unavailable host', () => {
-    const prompt = emitPrompt(makePackage('hyv-verify'), 'generic');
-    assert.match(prompt, /Available: none/);
-    assert.match(prompt, /Execution mode: prompt-only/);
-});

package/dist/agents/load.test.js

@@ -1,149 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { loadAll, loadAllFrom, validateAll, validateId, sortedIds } from './load.js';
-import { AGENT_SCHEMA_VERSION } from './types.js';
-function makePackage(dir, id, overrides = {}) {
-    const packageDir = join(dir, 'skills', id);
-    mkdirSync(join(packageDir, 'agents'), { recursive: true });
-    const descriptor = {
-        schema_version: AGENT_SCHEMA_VERSION,
-        id,
-        title: id,
-        description: 'test agent',
-        instruction_file: 'SKILL.md',
-        role: 'Tester',
-        workflow_phase: 'test',
-        input: { required: ['draft'], optional: [] },
-        output: { required: ['report'], optional: [] },
-        evidence_requirements: ['preserve evidence'],
-        permissions: ['read_repository'],
-        stop_conditions: ['stop when evidence missing'],
-        tool_free_mode: {
-            available: true,
-            behavior: 'report NOT_AVAILABLE',
-            unavailable_statuses: ['NOT_AVAILABLE', 'NOT_RUN'],
-        },
-        handoff_to: [],
-        ...overrides,
-    };
-    writeFileSync(join(packageDir, 'agent.json'), JSON.stringify(descriptor));
-    writeFileSync(join(packageDir, 'SKILL.md'), `# ${id}\n\nUsage: hyv ${id} draft.md\n`);
-    writeFileSync(join(packageDir, 'agents', 'openai.yaml'), `interface:\n  display_name: "${id}"\n  short_description: "test agent"\n  default_prompt: "Use ${id}"\n`);
-    return packageDir;
-}
-function makeTempRoot() {
-    return mkdtempSync(join(tmpdir(), 'hyv-agents-'));
-}
-test('loads all valid packages and rejects unknown schema version', () => {
-    const root = makeTempRoot();
-    try {
-        const first = makePackage(root, 'hyv-alpha');
-        makePackage(root, 'hyv-beta', { handoff_to: ['hyv-alpha'] });
-        const packages = loadAllFrom(root);
-        assert.deepEqual(sortedIds(packages), ['hyv-alpha', 'hyv-beta']);
-        assert.equal(packages.get('hyv-alpha').directory, first);
-        assert.match(packages.get('hyv-alpha').instructions, /^# hyv-alpha/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('rejects a package whose id does not match its directory name', () => {
-    const root = makeTempRoot();
-    try {
-        makePackage(root, 'hyv-alpha', { id: 'hyv-mismatch' });
-        assert.throws(() => loadAllFrom(root), /id must match skill directory/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('rejects a handoff target that does not exist', () => {
-    const root = makeTempRoot();
-    try {
-        makePackage(root, 'hyv-alpha', { handoff_to: ['hyv-ghost'] });
-        assert.throws(() => loadAllFrom(root), /hands off to unknown agent/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('rejects an unsupported permission and an unsupported status', () => {
-    const root = makeTempRoot();
-    try {
-        makePackage(root, 'hyv-alpha', { permissions: ['definitely-not-real'] });
-        assert.throws(() => loadAllFrom(root), /unsupported permission/);
-        rmSync(root, { recursive: true, force: true });
-        const root2 = makeTempRoot();
-        makePackage(root2, 'hyv-beta', {
-            tool_free_mode: { available: true, behavior: 'x', unavailable_statuses: ['NOPE'] },
-        });
-        assert.throws(() => loadAllFrom(root2), /tool_free_mode requires/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('validateAll and validateId report PASS or unknown id', () => {
-    const root = makeTempRoot();
-    try {
-        makePackage(root, 'hyv-alpha');
-        const packages = loadAllFrom(root);
-        validateAll(packages);
-        validateId(packages, 'hyv-alpha');
-        assert.throws(() => validateId(packages, 'hyv-missing'), /unknown agent/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('rejects a malformed agent.json', () => {
-    const root = makeTempRoot();
-    try {
-        const packageDir = join(root, 'skills', 'hyv-alpha');
-        mkdirSync(join(packageDir, 'agents'), { recursive: true });
-        writeFileSync(join(packageDir, 'agent.json'), '{ not json');
-        writeFileSync(join(packageDir, 'SKILL.md'), '# x');
-        assert.throws(() => loadAllFrom(root), /not valid JSON/);
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('rejects unknown contract fields and invalid OpenAI interface metadata', () => {
-    const root = makeTempRoot();
-    try {
-        makePackage(root, 'hyv-alpha', { unsupported: true });
-        assert.throws(() => loadAllFrom(root), /supported contract fields/);
-        rmSync(root, { recursive: true, force: true });
-        const root2 = makeTempRoot();
-        const packageDir = makePackage(root2, 'hyv-beta');
-        rmSync(join(packageDir, 'agents', 'openai.yaml'));
-        assert.throws(() => loadAllFrom(root2), /openai\.yaml/);
-        rmSync(root2, { recursive: true, force: true });
-        const root3 = makeTempRoot();
-        const invalidPackageDir = makePackage(root3, 'hyv-gamma');
-        writeFileSync(join(invalidPackageDir, 'agents', 'openai.yaml'), 'interface:\n  display_name: "unterminated\n  short_description: "test"\n  default_prompt: "Use hyv-gamma"\n');
-        assert.throws(() => loadAllFrom(root3), /supported interface metadata/);
-        rmSync(root3, { recursive: true, force: true });
-    }
-    finally {
-        rmSync(root, { recursive: true, force: true });
-    }
-});
-test('published packages declare command execution and required writes', () => {
-    const packages = loadAll();
-    const writers = new Set(['hyv-profile', 'hyv-ingest', 'hyv-hygiene', 'hyv-apply-hidden-text-policy', 'hyv-prepare-rewrite', 'hyv-prepare-judgment', 'hyv-prepare-rebuild', 'hyv-rebuild-writer-request', 'hyv-lifecycle', 'hyv-learning']);
-    for (const [id, pkg] of packages) {
-        assert.ok(pkg.descriptor.permissions.includes('execute_commands'), `${id} must require command execution`);
-        assert.equal(pkg.descriptor.permissions.includes('write_repository'), writers.has(id), `${id} write permission mismatch`);
-    }
-});
-test('published instructions document command-specific argument requirements', () => {
-    const packages = loadAll();
-    assert.match(packages.get('hyv-reduce-judgment').instructions, /hyv reduce-judgment envelope\.json envelope\.json envelope\.json \[envelope\.json\.\.\.\]/);
-    assert.match(packages.get('hyv-learning').instructions, /record-approved/);
-});

package/dist/ai-editor.test.js

@@ -1,265 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { analyzeAiEditor, maskNonProse, RULESET_VERSION, rules, serializedRules } from './ai-editor.js';
-import { createHash } from 'node:crypto';
-import { AI_SHADOW_FAIL_SET_V1 } from './ai-shadow-fixtures.js';
-import { generateAiShadowFailSetV1 } from './ai-shadow-generator.js';
-test('publishes executable rules with stable IDs and repair directions', () => {
-    assert.equal(RULESET_VERSION, '3.5.0-local.3');
-    assert.equal(rules.length, 182);
-    assert.equal(createHash('sha256').update(JSON.stringify(rules.map((rule) => rule.id))).digest('hex'), '172563cd3f55b363c895bb97c37f636dd718253799c369f329bb943dad416f16');
-    assert.equal(createHash('sha256').update(JSON.stringify(serializedRules())).digest('hex'), '542534f1223d65e7ae7d4c3da8ba22bd31b4ddae2dfe399f7672ca9e6a9cee6b');
-    assert.equal(new Set(rules.map((rule) => rule.id)).size, rules.length);
-    for (const rule of rules) {
-        assert.match(rule.id, /^(ai|formula|hedge|struct|punct|bait|cringe|insider|ogilvy|format)\./);
-        assert.ok(rule.reason.length > 0);
-        assert.ok(rule.suggestion.length > 0);
-        assert.equal(rule.expression.global, false, rule.id);
-        assert.equal(rule.expression.sticky, false, rule.id);
-    }
-});
-function profileWithPolicies(rulePolicy) {
-    return {
-        version: '3', id: 'founder.test', revision: 1, revisionDigest: '0'.repeat(64), sampleCount: 2,
-        metrics: { sentenceLength: 5, sentenceVariation: 1, sentenceStructure: [], rhythm: 1, paragraphLength: 1, openingMoves: [], vocabulary: [], lexicalDensity: 0.5, pointOfView: 'mixed', punctuation: {}, caseStyle: 'mixed', questionRate: 0, transitions: [] },
-        avoid: [], provenance: { source: 'test', rights: 'test', createdAt: '2026-08-13T00:00:00.000Z' }, rulePolicy,
-        fingerprint: { contractionRate: 0, sentenceLengthDistribution: { short: 1, medium: 0, long: 0 }, bulletRate: 0, enDashRate: 0 },
-        tolerances: { contractionRate: { absolute: 0, calibrated: false }, sentenceLengthDistribution: { absolute: 0, calibrated: false }, bulletRate: { absolute: 0, calibrated: false }, enDashRate: { absolute: 0, calibrated: false } },
-        metricFixtures: { contractionRate: ['test'], sentenceLengthDistribution: ['test'], bulletRate: ['test'], enDashRate: ['test'] },
-    };
-}
-test('applies all four v3 policy states after matching and preserves catalog order', () => {
-    const report = analyzeAiEditor('Firstly, perhaps we leverage a holistic plan.', profileWithPolicies({
-        'formula.firstly': 'blocking',
-        'hedge.perhaps': 'advisory',
-        'ai.leverage': 'judgment-required',
-        'ai.holistic': 'disabled',
-    }));
-    assert.deepEqual(report.findings.map((finding) => [finding.id, finding.appliedPolicy, finding.severity]), [
-        ['ai.leverage', 'judgment-required', 'yellow'],
-        ['formula.firstly', 'blocking', 'red'],
-        ['hedge.perhaps', 'advisory', 'yellow'],
-    ]);
-    assert.equal(report.passed, false);
-});
-test('fails closed when a v3 policy names a rule outside the catalog', () => {
-    assert.throws(() => analyzeAiEditor('Plain text.', profileWithPolicies({ 'ai.missing': 'blocking' })), /unknown rule ID/);
-});
-test('allows a sample-derived punctuation exception only when no explicit policy exists', () => {
-    const profile = profileWithPolicies({});
-    profile.ruleAllowances = { 'punct.em-dash': { sampleCount: 2, evidenceDigest: 'a'.repeat(64) } };
-    assert.equal(analyzeAiEditor('The scheduler failed — retry later.', profile).findings.some((finding) => finding.id === 'punct.em-dash'), false);
-    profile.rulePolicy['punct.em-dash'] = 'blocking';
-    assert.equal(analyzeAiEditor('The scheduler failed — retry later.', profile).findings.find((finding) => finding.id === 'punct.em-dash')?.appliedPolicy, 'blocking');
-});
-test('keeps non-prose regions out of AI Editor while scanning adjacent prose', () => {
-    const tick = String.fromCharCode(96);
-    const fence = tick.repeat(3);
-    const draft = [
-        '---',
-        'title: We leverage the launch',
-        '---',
-        'We leverage the launch.',
-        fence + 'ts',
-        'const message = "We leverage logs";',
-        fence,
-        'Use ' + tick + 'we leverage logs' + tick + ' only as an example.',
-        '[A link](https://example.com/we-leverage) stays useful.',
-    ].join('\n');
-    const report = analyzeAiEditor(draft);
-    assert.deepEqual(report.findings.filter((finding) => finding.id === 'ai.leverage').map((finding) => finding.sentence), [1]);
-    assert.equal(maskNonProse(draft).includes('https://example.com/we-leverage'), false);
-});
-test('preserves protected-region offsets after a supplementary Unicode character', () => {
-    const tick = String.fromCharCode(96);
-    const draft = '🚀 We leverage the launch. Use ' + tick + 'we leverage logs' + tick + ' as an example.';
-    const report = analyzeAiEditor(draft);
-    assert.deepEqual(report.findings.filter((finding) => finding.id === 'ai.leverage').map((finding) => [finding.sentence, finding.excerpt]), [
-        [1, '🚀 We leverage the launch.'],
-    ]);
-});
-test('uses reconciled defaults for v2 profiles and suppresses inherited duplicate emissions', () => {
-    const report = analyzeAiEditor("It's worth noting: in other words, I think the same plan. Better results.");
-    assert.equal(report.findings.some((finding) => finding.id === 'hedge.worth-noting'), false);
-    assert.equal(report.findings.some((finding) => finding.id === 'struct.in-other-words'), false);
-    assert.equal(report.findings.some((finding) => finding.id === 'hedge.i-think'), false);
-    assert.equal(report.findings.some((finding) => finding.id === 'struct.same-better'), false);
-    assert.ok(report.findings.every((finding) => finding.appliedPolicy !== undefined));
-});
-test('treats bare red vocabulary as pending judgment and clear sincerity or dashes as blocking', () => {
-    const vocabulary = analyzeAiEditor('We leverage the existing scheduler.');
-    assert.deepEqual(vocabulary.findings.find((finding) => finding.id === 'ai.leverage')?.appliedPolicy, 'judgment-required');
-    assert.equal(vocabulary.passed, true);
-    const blocked = analyzeAiEditor('To be honest, the scheduler failed — twice.');
-    assert.ok(blocked.findings.some((finding) => finding.id === 'formula.performative-sincerity' && finding.appliedPolicy === 'blocking'));
-    assert.ok(blocked.findings.some((finding) => finding.id === 'punct.em-dash' && finding.appliedPolicy === 'blocking'));
-    assert.equal(blocked.passed, false);
-    const advisory = analyzeAiEditor('Honestly, the scheduler failed twice.');
-    assert.ok(advisory.findings.some((finding) => finding.id === 'hedge.performative-sincerity-adverb' && finding.appliedPolicy === 'advisory'));
-    assert.equal(advisory.passed, true);
-});
-test('only applies the question-hook policy to document sentence one', () => {
-    assert.ok(analyzeAiEditor('Have you checked the invoice? It is overdue.').findings.some((finding) => finding.id === 'ai.question-hook'));
-    assert.equal(analyzeAiEditor('The invoice is overdue. Have you checked it?').findings.some((finding) => finding.id === 'ai.question-hook'), false);
-});
-test('detects representative rules from every inherited rule family', () => {
-    const examples = [
-        ['ai.delve', 'we will delve into it.'],
-        ['ai.leverage', 'we leverage the existing logs.'],
-        ['ai.tapestry', 'the tapestry explains the work.'],
-        ['ai.holistic', 'a holistic review starts today.'],
-        ['ai.robust', 'robust evidence supports the claim.'],
-        ['ai.landscape', 'the market landscape changed.'],
-        ['ai.game-changer', 'this is a game-changer.'],
-        ['formula.firstly', 'Firstly, check the invoice.'],
-        ['hedge.perhaps', 'Perhaps the invoice is late.'],
-        ['struct.this-is-why', 'This is why the invoice matters.'],
-        ['struct.not-just-but-also', 'this is not just fast but reliable.'],
-        ['struct.rhetorical-truth', 'the hard truth is in the logs.'],
-        ['punct.em-dash', 'the logs failed — retry later.'],
-        ['bait.let-that-sink', 'Let that sink in.'],
-        ['cringe.10x', 'The change delivered a 10x result.'],
-        ['insider.nobody-tells', 'What nobody tells you is in the report.'],
-        ['ogilvy.bandwidth', 'We lack the bandwidth this week.'],
-    ];
-    for (const [id, example] of examples) {
-        const report = analyzeAiEditor(example);
-        assert.ok(report.findings.some((finding) => finding.id === id && finding.sentence === 1), id);
-    }
-});
-test('covers the narrow 3.5 pattern additions with an editorial example for each rule', () => {
-    const examples = [
-        ['ai.inflated-significance', 'This marks a pivotal moment for the project.'],
-        ['ai.notability-name-drop', 'The renowned Ada Lovelace writer changed the field.'],
-        ['ai.shallow-participle-analysis', 'The result matters, highlighting its importance.'],
-        ['ai.promotional-scene-setting', 'In today’s changing technology landscape, the work starts.'],
-        ['ai.vague-attribution', 'Experts say the change will help.'],
-        ['ai.challenges-outlook', 'Despite these challenges, the future remains open.'],
-        ['ai.copula-avoidance', 'The launch is serving as a testament to patience.'],
-        ['ai.false-range', 'The course runs from the Big Bang to dark matter.'],
-        ['ai.actorless-claim', 'It is important that we check the source.'],
-        ['ai.chatbot-offer', 'Let me know if you would like another draft.'],
-        ['ai.knowledge-limit-disclaimer', 'As an AI, I cannot verify that.'],
-        ['ai.agreement-preamble', 'Absolutely, the invoice is overdue.'],
-        ['ai.qualifier-stack', 'This is very important for the launch.'],
-        ['ai.generic-positive-ending', 'The possibilities are endless.'],
-        ['ai.at-its-core', 'At its core, the work is a queue.'],
-        ['ai.section-announcement', 'Let us now explore the next step.'],
-        ['ai.historical-implementation-aside', 'The tool was once known as Alpha and now has a new name.'],
-        ['ai.unraised-objection', 'Some might argue that the queue is unnecessary.'],
-        ['ai.fake-alternative', 'Whether you choose email or chat, start today.'],
-        ['format.bold-bullet-label', '- **Decision:** Ship Tuesday.'],
-        ['format.title-case-heading', '# Generic Title Case Heading'],
-        ['format.emoji-heading', '# 🚀 Launch plan'],
-        ['format.curly-quotes', 'The operator wrote “ship Tuesday” in the release note.'],
-        ['format.hyphenated-modifier-stack', 'Use a high-trust-low-friction process.'],
-    ];
-    for (const [id, example] of examples)
-        assert.ok(analyzeAiEditor(example).findings.some((finding) => finding.id === id), id);
-});
-test('keeps bounded Humanizer and Ghostwriter document cues advisory', () => {
-    const examples = [
-        ['ai.forced-triplet', 'The template promises speed, scale, and alignment.'],
-        ['ai.repeated-sentence-opening', 'We checked the logs. We checked the queue. We checked the retry.'],
-        ['format.bold-density', '**Plan** stays visible. **Owner** checks it. **Proof** ships. **Next** is Tuesday.'],
-        ['format.repeated-heading-body', '# Release plan\n\nRelease plan explains the verified rollback.'],
-        ['ai.clipped-fragment-run', 'No demos. No decks. No distractions. The owner checked the logs.'],
-        ['ai.formulaic-aphorism', 'Quality over quantity is the whole lesson.'],
-        ['ai.fake-candid-opener', "I'm going to be honest: the queue failed."],
-        ['ai.metric-theater', 'At 3:47 AM, the slide promised a 23.6x ROI.'],
-        ['ai.jargon-stack', 'The scalable ecosystem needs alignment, leverage, and a holistic framework.'],
-        ['ai.sentence-length-cluster', 'The release owner carefully checks each visible rollback instruction before the scheduled production deployment window opens this morning. The release operator carefully records each visible rollback instruction before the scheduled production deployment window opens this morning. The release reviewer carefully reviews each visible rollback instruction before the scheduled production deployment window opens this morning. The release manager carefully confirms each visible rollback instruction before the scheduled production deployment window opens this morning.'],
-    ];
-    for (const [id, example] of examples) {
-        const finding = analyzeAiEditor(example).findings.find((item) => item.id === id);
-        assert.ok(finding, id);
-        assert.equal(finding.appliedPolicy, 'advisory', id);
-    }
-    assert.equal(analyzeAiEditor('Three source IDs appear in the manifest.').findings.some((finding) => finding.id === 'ai.forced-triplet'), false);
-    assert.equal(analyzeAiEditor('Owners checked the queue. Operators checked the log. Reviewers checked the proof.').findings.some((finding) => finding.id === 'ai.repeated-sentence-opening'), false);
-});
-test('keeps the frozen synthetic AI-shadow fail set generated in CI and executable without runtime generation', () => {
-    assert.deepEqual(generateAiShadowFailSetV1(), AI_SHADOW_FAIL_SET_V1);
-    for (const fixture of AI_SHADOW_FAIL_SET_V1)
-        assert.ok(analyzeAiEditor(fixture.text).findings.some((finding) => finding.id === fixture.rule), fixture.id);
-});
-test('keeps counterexamples for representative inherited rules', () => {
-    const counterexamples = [
-        ['ai.delve', 'we inspect the logs.'],
-        ['ai.leverage', 'we use the existing logs.'],
-        ['ai.tapestry', 'the report explains the work.'],
-        ['ai.holistic', 'the review covers the named files.'],
-        ['ai.robust', 'the evidence includes three dated reports.'],
-        ['ai.landscape', 'the market changed after the price cut.'],
-        ['ai.game-changer', 'the release removed a manual step.'],
-        ['formula.firstly', 'next, check the invoice.'],
-        ['hedge.perhaps', 'the invoice is late.'],
-        ['struct.this-is-why', 'the invoice matters because it is overdue.'],
-        ['struct.not-just-but-also', 'the service is fast and reliable.'],
-        ['struct.rhetorical-truth', 'the logs show the service failed.'],
-        ['punct.em-dash', 'the logs failed; retry later.'],
-        ['bait.let-that-sink', 'The invoice is overdue.'],
-        ['cringe.10x', 'The result rose from 2 to 20.'],
-        ['insider.nobody-tells', 'The report explains the missing step.'],
-        ['ogilvy.bandwidth', 'We lack time this week.'],
-    ];
-    for (const [id, example] of counterexamples) {
-        assert.equal(analyzeAiEditor(example).findings.some((finding) => finding.id === id), false, id);
-    }
-});
-test('keeps yellow findings as review cues rather than release blockers', () => {
-    const report = analyzeAiEditor('Firstly, the editor checked the invoice.');
-    assert.ok(report.findings.every((finding) => finding.severity === 'yellow'));
-    assert.equal(report.passed, true);
-});
-test('restores the benchmark signals from the 2.9.24 executable catalog', () => {
-    const report = analyzeAiEditor("This work is meaningful. Here's the part nobody is talking about. The change delivered a 10x result.");
-    assert.deepEqual(report.findings.map((finding) => [finding.id, finding.sentence]), [
-        ['ai.meaningful', 1],
-        ['struct.heres-where', 2],
-        ['cringe.10x', 3],
-    ]);
-});
-test('returns the same findings across repeated sentence and line analysis', () => {
-    for (const text of ['We leverage logs. We leverage traces.', 'No demos. No decks. No distractions. Same team. Better results.']) {
-        assert.deepEqual(analyzeAiEditor(text), analyzeAiEditor(text));
-    }
-});
-test('reports the same rule in multiple sentences', () => {
-    const report = analyzeAiEditor('We leverage logs. We leverage traces.');
-    assert.deepEqual(report.findings.filter((finding) => finding.id === 'ai.leverage').map((finding) => finding.sentence), [1, 2]);
-});
-test('executes inherited cross-sentence rules and maps them to the first sentence', () => {
-    const report = analyzeAiEditor('No demos. No decks. No distractions. Same team. Better results.');
-    assert.deepEqual(report.findings
-        .filter((finding) => finding.id === 'struct.negation-cascade' || finding.id === 'struct.same-better')
-        .map((finding) => [finding.id, finding.sentence]), [['struct.negation-cascade', 1]]);
-});
-test('preserves inherited physical-line matching and line-start anchors', () => {
-    const sameLine = analyzeAiEditor("This isn't positioning. This is proof. Forget vanity metrics. You need retention.");
-    assert.ok(sameLine.findings.some((finding) => finding.id === 'struct.this-isnt-x-this-is-y'));
-    assert.ok(sameLine.findings.some((finding) => finding.id === 'struct.forget-x'));
-    assert.equal(analyzeAiEditor("This isn't positioning.\nThis is proof.").findings.some((finding) => finding.id === 'struct.this-isnt-x-this-is-y'), false);
-    assert.equal(analyzeAiEditor('The logs failed. Of course we can retry.').findings.some((finding) => finding.id === 'cringe.of-course'), false);
-    assert.ok(analyzeAiEditor('The logs failed.\nOf course we can retry.').findings.some((finding) => finding.id === 'cringe.of-course'));
-});
-test('retains the current question-hook and abstract-cluster detectors', () => {
-    assert.ok(analyzeAiEditor('Have you checked the invoice?').findings.some((finding) => finding.id === 'ai.question-hook'));
-    assert.ok(analyzeAiEditor('Clarity and strategy are missing.').findings.some((finding) => finding.id === 'ai.abstract-cluster'));
-});
-test('serializes reconstructable regular expressions and explicit scopes', () => {
-    const catalog = serializedRules();
-    assert.equal(catalog.length, 182);
-    assert.ok(catalog.every((rule) => rule.scope === 'sentence' || rule.scope === 'line' || rule.scope === 'document'));
-    const meaningful = catalog.find((rule) => rule.id === 'ai.meaningful');
-    assert.ok(meaningful);
-    assert.equal(new RegExp(meaningful.expression.source, meaningful.expression.flags).test('Meaningful work.'), true);
-});
-test('suppresses intentional inherited overlaps before scoring', () => {
-    const report = analyzeAiEditor('In other words, use logs.');
-    assert.deepEqual(report.findings.map((finding) => finding.id), ['formula.in-other-words']);
-    assert.equal(report.score, 82);
-});
-test('returns zero AI findings for clean input', () => {
-    assert.deepEqual(analyzeAiEditor('The launch starts Tuesday. The owner signed the release checklist.').findings, []);
-});

package/dist/approval-capability.test.js

@@ -1,52 +0,0 @@
-import assert from 'node:assert/strict';
-import { generateKeyPairSync, sign } from 'node:crypto';
-import test from 'node:test';
-import { canonicalJsonBytes } from './canonical-json.js';
-import { verifyApprovalCapability } from './approval-capability.js';
-const binding = {
-    rewriteTaskFingerprint: '1'.repeat(64), rewriteResponseFingerprint: '2'.repeat(64), deterministicArtifactFingerprint: '3'.repeat(64),
-    sourceHash: '4'.repeat(64), candidateHash: '5'.repeat(64), profileId: 'founder.primary', profileRevisionDigest: '6'.repeat(64),
-    rulesetVersion: '3.2.0', schemaVersion: '1',
-};
-const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-const publicKeySpki = publicKey.export({ format: 'der', type: 'spki' }).toString('base64url');
-const trustStore = { version: '1', audience: '@holdyourvoice/hyv', maxCapabilityLifetimeSeconds: 300, keys: [{ issuer: 'host.example', keyId: 'key-1', publicKeySpki, status: 'active' }] };
-function envelope(overrides = {}, signer = privateKey) {
-    const claims = {
-        version: '1', purpose: 'hyv.final-approval', issuer: 'host.example', audience: '@holdyourvoice/hyv',
-        subjectArtifactFingerprint: '7'.repeat(64), sourceHash: binding.sourceHash, candidateHash: binding.candidateHash,
-        profileId: binding.profileId, profileRevisionDigest: binding.profileRevisionDigest, keyId: 'key-1',
-        issuedAt: 100, notBefore: 100, expiresAt: 200, nonce: 'nonce-1', ...overrides,
-    };
-    const payload = canonicalJsonBytes(claims);
-    return { payload: payload.toString('base64url'), signature: sign(null, payload, signer).toString('base64url') };
-}
-test('verifies one canonical bound Ed25519 final-approval capability', () => {
-    const result = verifyApprovalCapability(envelope(), trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' });
-    assert.equal(result.ok, true);
-    if (result.ok)
-        assert.match(result.capabilityFingerprint, /^[a-f0-9]{64}$/);
-});
-test('fails closed for purpose, binding, trust, time, signature, and canonical encoding', () => {
-    assert.deepEqual(verifyApprovalCapability(envelope({ purpose: 'hyv.rebuild-authorization' }), trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'wrong_purpose' });
-    assert.deepEqual(verifyApprovalCapability(envelope({ candidateHash: '8'.repeat(64) }), trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'binding_mismatch' });
-    assert.deepEqual(verifyApprovalCapability(envelope(), { ...trustStore, keys: [{ ...trustStore.keys[0], status: 'revoked' }] }, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'revoked_key' });
-    assert.deepEqual(verifyApprovalCapability(envelope(), trustStore, { now: 201, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'expired' });
-    const forged = envelope();
-    const forgedBytes = Buffer.from(forged.signature, 'base64url');
-    forgedBytes[0] = forgedBytes[0] ^ 1;
-    forged.signature = forgedBytes.toString('base64url');
-    assert.deepEqual(verifyApprovalCapability(forged, trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'invalid_signature' });
-    const nonCanonical = envelope();
-    nonCanonical.payload = Buffer.from(` ${Buffer.from(nonCanonical.payload, 'base64url').toString('utf8')}`).toString('base64url');
-    assert.deepEqual(verifyApprovalCapability(nonCanonical, trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'non_canonical' });
-});
-test('rejects malformed envelopes and invalid trust stores without returning secret material', () => {
-    const result = verifyApprovalCapability({ payload: `${envelope().payload}=`, signature: envelope().signature }, trustStore, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' });
-    assert.deepEqual(result, { ok: false, error: 'invalid_encoding' });
-    assert.doesNotMatch(JSON.stringify(result), /nonce-1|signature|publicKeySpki/);
-    assert.deepEqual(verifyApprovalCapability(envelope(), { ...trustStore, keys: [...trustStore.keys, trustStore.keys[0]] }, { now: 150, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'invalid_schema' });
-});
-test('rejects an invalid host clock', () => {
-    assert.deepEqual(verifyApprovalCapability(envelope(), trustStore, { now: Number.NaN, expectedSubjectArtifactFingerprint: '7'.repeat(64), binding, expectedPurpose: 'hyv.final-approval' }), { ok: false, error: 'invalid_schema' });
-});