@jstn-sdk/ma 0.1.13 → 0.14.1

package/src/runtime/graphify-core.js

@@ -0,0 +1,167 @@
+import { ensureDir, readJson, writeFileIfMissing, writeJson } from "../fs-utils.js";
+import { getRuntimeSubsystemPath } from "../paths.js";
+
+export const graphifySchemaVersion = "0.1.0";
+
+export function getGraphifyRoot() {
+  return getRuntimeSubsystemPath("context", "graphify");
+}
+
+export function getGraphifyIndexPath() {
+  return getRuntimeSubsystemPath("context", "graphify", "index.json");
+}
+
+export function createDefaultGraphifyIndex() {
+  return {
+    schemaVersion: graphifySchemaVersion,
+    record_type: "derived_graph_index",
+    read_only: true,
+    nodes: [],
+    edges: [],
+    lastRebuiltAt: null,
+  };
+}
+
+export function validateGraphifyIndex(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("graphify index must be an object");
+  }
+  if (value.schemaVersion !== graphifySchemaVersion) {
+    throw new Error(`Unsupported graphify schemaVersion: ${value.schemaVersion}`);
+  }
+  if (value.record_type !== "derived_graph_index" || value.read_only !== true) {
+    throw new Error("graphify index must be a read-only derived_graph_index");
+  }
+  if (!Array.isArray(value.nodes) || !Array.isArray(value.edges)) {
+    throw new Error("graphify index requires nodes and edges arrays");
+  }
+  return value;
+}
+
+export async function seedGraphifyArtifacts() {
+  await ensureDir(getGraphifyRoot());
+  await writeFileIfMissing(
+    getGraphifyIndexPath(),
+    `${JSON.stringify(createDefaultGraphifyIndex(), null, 2)}\n`,
+  );
+}
+
+export async function loadGraphifyIndex() {
+  return validateGraphifyIndex(await readJson(getGraphifyIndexPath()));
+}
+
+function addNode(nodes, seen, id, kind, sourceSubsystem, label) {
+  if (!id || seen.has(id)) return;
+  seen.add(id);
+  nodes.push({ id, kind, sourceSubsystem, label: String(label ?? id) });
+}
+
+function addEdge(edges, seen, from, to, relation) {
+  if (!from || !to || from === to) return;
+  const key = `${from}\0${to}\0${relation}`;
+  if (seen.has(key)) return;
+  seen.add(key);
+  edges.push({ from, to, relation });
+}
+
+function addCollection(nodes, edges, nodeIds, edgeIds, sourceSubsystem, kind, entries, labelKey) {
+  for (const [index, entry] of (Array.isArray(entries) ? entries : []).entries()) {
+    if (!entry || typeof entry !== "object") continue;
+    const id = `${sourceSubsystem}:${kind}:${entry.id ?? entry.name ?? index}`;
+    addNode(
+      nodes,
+      nodeIds,
+      id,
+      kind,
+      sourceSubsystem,
+      entry[labelKey] ?? entry.name ?? entry.id ?? id,
+    );
+    if (entry.projectId) addEdge(edges, edgeIds, id, `project:${entry.projectId}`, "belongs_to");
+  }
+}
+
+export function rebuildGraphifyIndex(runtimeSnapshot = {}) {
+  const nodes = [];
+  const edges = [];
+  const nodeIds = new Set();
+  const edgeIds = new Set();
+  addNode(nodes, nodeIds, "project:root", "project", "project", "Project");
+
+  const continuity = runtimeSnapshot.continuityIndex;
+  if (continuity && typeof continuity === "object") {
+    addNode(nodes, nodeIds, "memory:continuity", "memory", "continuity", "Continuity memory");
+    addEdge(edges, edgeIds, "memory:continuity", "project:root", "supports");
+  }
+  const taskRegistry = runtimeSnapshot.taskRegistry ?? {};
+  addCollection(nodes, edges, nodeIds, edgeIds, "tasks", "task", taskRegistry.tasks, "title");
+  addCollection(nodes, edges, nodeIds, edgeIds, "tasks", "worker", taskRegistry.workers, "name");
+  for (const entry of runtimeSnapshot.mailboxEntries ?? []) {
+    if (typeof entry !== "string") continue;
+    const id = `tasks:mailbox:${entry}`;
+    addNode(nodes, nodeIds, id, "mailbox", "tasks", entry, entry);
+    addEdge(edges, edgeIds, id, "project:root", "supports");
+  }
+  addCollection(
+    nodes,
+    edges,
+    nodeIds,
+    edgeIds,
+    "workspaces",
+    "workspace",
+    runtimeSnapshot.workspaceIndex?.items,
+    "name",
+  );
+  addCollection(
+    nodes,
+    edges,
+    nodeIds,
+    edgeIds,
+    "manager",
+    "run",
+    runtimeSnapshot.managerRuns?.runs,
+    "state",
+  );
+  addCollection(
+    nodes,
+    edges,
+    nodeIds,
+    edgeIds,
+    "decisions",
+    "decision",
+    runtimeSnapshot.decisions?.decisions,
+    "title",
+  );
+
+  const vault = runtimeSnapshot.obsidianVaultIndex;
+  if (vault?.note_count > 0) {
+    addNode(
+      nodes,
+      nodeIds,
+      "obsidian:vault",
+      "vault",
+      "obsidian",
+      vault.vault_path || "Obsidian vault",
+    );
+    addEdge(edges, edgeIds, "obsidian:vault", "project:root", "context");
+  }
+
+  nodes.sort((a, b) => a.id.localeCompare(b.id));
+  edges.sort((a, b) =>
+    `${a.from}:${a.to}:${a.relation}`.localeCompare(`${b.from}:${b.to}:${b.relation}`),
+  );
+  return {
+    schemaVersion: graphifySchemaVersion,
+    record_type: "derived_graph_index",
+    read_only: true,
+    nodes,
+    edges,
+    lastRebuiltAt: new Date().toISOString(),
+  };
+}
+
+export async function writeGraphifyIndex(runtimeSnapshot) {
+  const index = validateGraphifyIndex(rebuildGraphifyIndex(runtimeSnapshot));
+  await ensureDir(getGraphifyRoot());
+  await writeJson(getGraphifyIndexPath(), index);
+  return index;
+}

package/src/runtime/guidance-stack.js

@@ -20,8 +20,8 @@ export async function seedGuidanceStackArtifacts() {
     `${JSON.stringify(
       {
         schemaVersion: "0.1.0",
-        sources: [],
-        content: "",
+        sources: [ponytailGuidanceSource],
+        content: ponytailGuidanceSource.content,
       },
       null,
       2,
@@ -40,3 +40,10 @@ export async function seedGuidanceStackArtifacts() {
     )}\n`,
   );
 }
+
+export const ponytailGuidanceSource = {
+  id: "ponytail",
+  label: "Minimal-diff bias",
+  content:
+    "Apply a minimal-diff bias: prefer reuse over new abstractions, the smallest coherent diff, and deletion before addition. Preserve existing behavior and add complexity only when verification proves it is needed.",
+};

package/src/runtime/handoff-packets.js

@@ -0,0 +1,92 @@
+import path from "node:path";
+import { ensureDir, readJson, writeJson } from "../fs-utils.js";
+import { getRuntimeSubsystemPath } from "../paths.js";
+
+export const handoffPacketSchemaVersion = "0.1.0";
+
+export function getHandoffPacketRoot() {
+  return getRuntimeSubsystemPath("tasks", "handoffs");
+}
+
+function safePacketId(id) {
+  if (String(id ?? "").includes("/") || String(id ?? "").includes("\\"))
+    throw new Error("handoff packet id is required");
+  const safe = String(id ?? "")
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]/g, "-");
+  if (!safe || safe === "." || safe === "..") throw new Error("handoff packet id is required");
+  return safe;
+}
+
+export function createHandoffPacket({
+  goal,
+  currentState,
+  contextUsed = [],
+  decisions = [],
+  blockers = [],
+  risks = [],
+  changedFiles = [],
+  verification = [],
+  nextAction,
+  status = "active",
+}) {
+  if (!goal || !currentState || !nextAction)
+    throw new Error("handoff packet requires goal, currentState, and nextAction");
+  return validateHandoffPacket({
+    schemaVersion: handoffPacketSchemaVersion,
+    record_type: "handoff_packet",
+    goal,
+    current_state: currentState,
+    context_used: contextUsed,
+    decisions,
+    blockers,
+    risks,
+    changed_files: changedFiles,
+    verification,
+    next_action: nextAction,
+    status,
+    created_at: new Date().toISOString(),
+  });
+}
+
+export function validateHandoffPacket(packet) {
+  if (
+    !packet ||
+    packet.schemaVersion !== handoffPacketSchemaVersion ||
+    packet.record_type !== "handoff_packet"
+  )
+    throw new Error("invalid handoff packet schema");
+  for (const field of ["goal", "current_state", "next_action"]) {
+    if (typeof packet[field] !== "string" || packet[field].trim() === "")
+      throw new Error(`handoff packet requires ${field}`);
+  }
+  for (const field of [
+    "context_used",
+    "decisions",
+    "blockers",
+    "risks",
+    "changed_files",
+    "verification",
+  ]) {
+    if (!Array.isArray(packet[field]) || packet[field].some((value) => typeof value !== "string"))
+      throw new Error(`handoff packet requires string array: ${field}`);
+  }
+  if (!["active", "blocked", "verified"].includes(packet.status))
+    throw new Error(`Unsupported handoff packet status: ${packet.status}`);
+  return packet;
+}
+
+export async function writeHandoffPacket(id, packet) {
+  const packetId = safePacketId(id);
+  const validated = validateHandoffPacket(packet);
+  await ensureDir(getHandoffPacketRoot());
+  const packetPath = path.join(getHandoffPacketRoot(), `${packetId}.json`);
+  await writeJson(packetPath, validated);
+  return packetPath;
+}
+
+export async function loadHandoffPacket(id) {
+  return validateHandoffPacket(
+    await readJson(path.join(getHandoffPacketRoot(), `${safePacketId(id)}.json`)),
+  );
+}

package/src/runtime/headroom-core.js

@@ -0,0 +1,104 @@
+import { ensureDir, readJson, writeFileIfMissing, writeJson } from "../fs-utils.js";
+import { getRuntimeSubsystemPath } from "../paths.js";
+
+export const headroomSchemaVersion = "0.1.0";
+
+const defaultBudgets = {
+  pendingMailboxCount: { warn: 3, critical: 8 },
+  taskCount: { warn: 10, critical: 25 },
+  activeManagerRunCount: { warn: 2, critical: 5 },
+  waitingReviewManagerRunCount: { warn: 1, critical: 3 },
+};
+
+export function getHeadroomRoot() {
+  return getRuntimeSubsystemPath("headroom");
+}
+
+export function getHeadroomBudgetsPath() {
+  return getRuntimeSubsystemPath("headroom", "budgets.json");
+}
+
+export function getHeadroomStatusPath() {
+  return getRuntimeSubsystemPath("headroom", "status.json");
+}
+
+export function createDefaultHeadroomBudgets() {
+  return { schemaVersion: headroomSchemaVersion, budgets: structuredClone(defaultBudgets) };
+}
+
+export function createDefaultHeadroomStatus() {
+  return { schemaVersion: headroomSchemaVersion, evaluatedAt: null, signals: [] };
+}
+
+export function validateHeadroomBudgets(value) {
+  if (!value || typeof value !== "object" || value.schemaVersion !== headroomSchemaVersion) {
+    throw new Error("headroom budgets require the current schemaVersion");
+  }
+  if (!value.budgets || typeof value.budgets !== "object" || Array.isArray(value.budgets)) {
+    throw new Error("headroom budgets require a budgets object");
+  }
+  for (const [counter, budget] of Object.entries(value.budgets)) {
+    if (
+      !budget ||
+      !Number.isFinite(budget.warn) ||
+      !Number.isFinite(budget.critical) ||
+      budget.warn < 0 ||
+      budget.critical < budget.warn
+    ) {
+      throw new Error(`Invalid headroom budget for ${counter}`);
+    }
+  }
+  return value;
+}
+
+export function validateHeadroomStatus(value) {
+  if (!value || typeof value !== "object" || value.schemaVersion !== headroomSchemaVersion) {
+    throw new Error("headroom status requires the current schemaVersion");
+  }
+  if (!Array.isArray(value.signals)) throw new Error("headroom status requires signals");
+  return value;
+}
+
+export async function seedHeadroomArtifacts() {
+  await ensureDir(getHeadroomRoot());
+  await writeFileIfMissing(
+    getHeadroomBudgetsPath(),
+    `${JSON.stringify(createDefaultHeadroomBudgets(), null, 2)}\n`,
+  );
+  await writeFileIfMissing(
+    getHeadroomStatusPath(),
+    `${JSON.stringify(createDefaultHeadroomStatus(), null, 2)}\n`,
+  );
+}
+
+export async function loadHeadroomBudgets() {
+  return validateHeadroomBudgets(await readJson(getHeadroomBudgetsPath()));
+}
+
+export async function loadHeadroomStatus() {
+  return validateHeadroomStatus(await readJson(getHeadroomStatusPath()));
+}
+
+export function evaluateHeadroom(
+  runtimeSummary = {},
+  budgetConfig = createDefaultHeadroomBudgets(),
+) {
+  const config = validateHeadroomBudgets(budgetConfig);
+  const signals = Object.entries(config.budgets).map(([counter, budget]) => {
+    const value = Number(runtimeSummary[counter] ?? 0);
+    const level = value >= budget.critical ? "critical" : value >= budget.warn ? "warn" : "ok";
+    return { counter, value, warn: budget.warn, critical: budget.critical, level };
+  });
+  return {
+    schemaVersion: headroomSchemaVersion,
+    evaluatedAt: new Date().toISOString(),
+    signals,
+  };
+}
+
+export async function writeHeadroomStatus(runtimeSummary, budgetConfig) {
+  const status = validateHeadroomStatus(evaluateHeadroom(runtimeSummary, budgetConfig));
+  await ensureDir(getHeadroomRoot());
+  await writeJson(getHeadroomStatusPath(), status);
+  return status;
+}

package/src/runtime/hook-profiles.js

@@ -0,0 +1,20 @@
+export const hookProfiles = {
+  local: { scanScope: "active-project", block: true, writeReceipts: true, readOnly: false },
+  ci: { scanScope: "active-project", block: true, writeReceipts: true, readOnly: false },
+  pr: {
+    scanScope: "active-project",
+    block: true,
+    writeReceipts: true,
+    readOnly: false,
+    requireFreshness: true,
+  },
+  audit: { scanScope: "broad", block: false, writeReceipts: false, readOnly: true },
+};
+
+export function resolveHookProfile(
+  value = process.env.MA_HOOK_PROFILE ?? process.env.MA_PROFILE ?? "local",
+) {
+  return hookProfiles[value]
+    ? { id: value, ...hookProfiles[value] }
+    : { id: "local", ...hookProfiles.local };
+}

package/src/runtime/learning-loop-core.js

@@ -1,5 +1,9 @@
+import fs from "node:fs/promises";
 import { ensureDir, readJson, writeFileIfMissing } from "../fs-utils.js";
 import { getRuntimeSubsystemPath } from "../paths.js";
+import { createFreshness } from "./context-authority.js";
+import { appendObsidianLearningRecord } from "./obsidian-integration-core.js";
+import { maskSensitiveText } from "./redaction-gateway.js";
 
 export const learningLoopCoreSchemaVersion = "0.1.0";
 
@@ -19,6 +23,10 @@ export function getLearningLoopCorePath() {
   return getRuntimeSubsystemPath("context", "learning-loop-core.json");
 }
 
+export function getLearningRecordsPath() {
+  return getRuntimeSubsystemPath("learning", "records.jsonl");
+}
+
 export function createDefaultLearningLoopCore() {
   return {
     schemaVersion: learningLoopCoreSchemaVersion,
@@ -113,11 +121,13 @@ export function createDefaultLearningLoopCore() {
       evidence: ["path_or_command_or_receipt"],
       status: "candidate | verified | rejected | superseded",
       applies_to: ["agent_or_role_or_lane"],
+      fact_ids: ["canonical_project_fact_id"],
       cannot_mutate: ["release_state_without_owning_lane", "source_evidence", "security_boundary"],
       next_verification: "string",
     },
     hard_rules: [
       "Learning records require domain, claim, source, evidence, status, applies_to, and next_verification.",
+      "fact_ids may reference only canonical source-truth project facts.",
       "Candidate learnings can inform context but cannot mutate gates, release state, or durable policy.",
       "Verified learnings must preserve lane authority and semantic channel boundaries.",
       "Obsidian and memory context can inform planning but do not become build evidence without owning-lane promotion.",
@@ -169,9 +179,17 @@ export function createLearningRecord({
   claim,
   source,
   evidence = [],
+  filesInvolved = [],
+  decisionsMade = [],
+  knownRisks = [],
+  userPreferences = {},
   status = "candidate",
   appliesTo = ["all_applicable_agents", "all_applicable_roles"],
   nextVerification,
+  factIds = [],
+  failureState,
+  attemptedFixes = [],
+  resolutionStatus,
 }) {
   if (!learningLoopDomains.includes(domain)) {
     throw new Error(`Unsupported learning domain: ${domain}`);
@@ -179,19 +197,54 @@ export function createLearningRecord({
   if (!claim || !source || !nextVerification) {
     throw new Error("Learning record requires domain, claim, source, and nextVerification");
   }
+  if (
+    !Array.isArray(factIds) ||
+    factIds.some((entry) => typeof entry !== "string" || !/^fact-[a-f0-9]{16}$/.test(entry))
+  ) {
+    throw new Error("Learning record factIds must use canonical fact IDs");
+  }
+  const createdAt = new Date().toISOString();
   return {
     domain,
-    claim,
-    source,
-    evidence: evidence.filter((entry) => typeof entry === "string" && entry.trim()),
+    claim: sanitizeLearningText(claim),
+    source: sanitizeLearningText(source),
+    evidence: evidence
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map(sanitizeLearningText),
+    files_involved: filesInvolved
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map(sanitizeLearningText),
+    decisions_made: decisionsMade
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map(sanitizeLearningText),
+    known_risks: knownRisks
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map(sanitizeLearningText),
+    user_preferences: userPreferences && typeof userPreferences === "object" ? userPreferences : {},
     status,
+    authority: "learning_memory",
+    freshness: createFreshness({ checkedAt: createdAt }),
     applies_to: appliesTo.filter((entry) => typeof entry === "string" && entry.trim()),
+    fact_ids: factIds.filter((entry) => typeof entry === "string" && entry.trim()),
     cannot_mutate: ["release_state_without_owning_lane", "source_evidence", "security_boundary"],
     next_verification: nextVerification,
-    created_at: new Date().toISOString(),
+    created_at: createdAt,
+    ...(failureState
+      ? {
+          failure_state: failureState,
+          attempted_fixes: attemptedFixes
+            .filter((entry) => typeof entry === "string")
+            .map(sanitizeLearningText),
+          resolution_status: resolutionStatus ?? "active",
+        }
+      : {}),
   };
 }
 
+function sanitizeLearningText(value) {
+  return maskSensitiveText(String(value)).sanitizedText;
+}
+
 export function addLearningRecord(core, record) {
   const validated = validateLearningLoopCore(core);
   if (!learningLoopDomains.includes(record.domain)) {
@@ -236,3 +289,56 @@ export async function seedLearningLoopCoreArtifacts() {
 export async function loadLearningLoopCore() {
   return validateLearningLoopCore(await readJson(getLearningLoopCorePath()));
 }
+
+export async function appendLearningRecord(record) {
+  const validated = createLearningRecord(record);
+  await ensureDir(getRuntimeSubsystemPath("learning"));
+  await fs.appendFile(getLearningRecordsPath(), `${JSON.stringify(validated)}\n`, "utf8");
+  return validated;
+}
+
+export async function recordWorkLearning({ vaultPath, ...record }) {
+  const validated = await appendLearningRecord(record);
+  if (vaultPath) await appendObsidianLearningRecord({ vaultPath, record: validated });
+  return validated;
+}
+
+export async function recordFailureMemory({
+  cause,
+  source = "workflow",
+  evidence = [],
+  attemptedFixes = [],
+  resolutionStatus = "active",
+  filesInvolved = [],
+  vaultPath,
+} = {}) {
+  if (!cause) throw new Error("failure memory requires cause");
+  if (!["active", "resolved", "stale"].includes(resolutionStatus)) {
+    throw new Error(`Unsupported failure resolution status: ${resolutionStatus}`);
+  }
+  return recordWorkLearning({
+    vaultPath,
+    domain: "code_quality_testing",
+    claim: `Failure: ${cause}`,
+    source,
+    evidence,
+    filesInvolved,
+    knownRisks: [cause],
+    status: resolutionStatus === "resolved" ? "verified" : "candidate",
+    nextVerification:
+      resolutionStatus === "resolved" ? "Monitor for recurrence" : "Re-run the failing workflow",
+    failureState: resolutionStatus,
+    attemptedFixes,
+    resolutionStatus,
+  });
+}
+
+export async function loadLearningRecords({ limit = 20 } = {}) {
+  const raw = await fs.readFile(getLearningRecordsPath(), "utf8").catch(() => "");
+  return raw
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => JSON.parse(line))
+    .slice(-Math.max(1, Math.min(100, limit)))
+    .reverse();
+}

package/src/runtime/live-agent-verification.js

@@ -0,0 +1,122 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { agentRegistry as executableAgents, resolveAgentCommand } from "../agents.js";
+import { safeSpawn } from "../process-utils.js";
+import {
+  agentRegistry,
+  createSkillCompatibilityPayload,
+  verifyCrossAgentInstallMatrix,
+} from "./skills-registry-export.js";
+
+const defaultTimeoutMs = 5000;
+
+function runVersionProbe(command, timeoutMs, args = ["--version"]) {
+  return new Promise((resolve) => {
+    const child = safeSpawn(command, args, {
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "version probe timed out" });
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", (error) => finish({ ok: false, reason: error.message }));
+    child.once("close", (code) =>
+      finish({
+        ok: code === 0,
+        version: stdout.trim(),
+        reason: code === 0 ? null : stderr.trim() || `exited with code ${code}`,
+      }),
+    );
+  });
+}
+
+function normalizeProbeCommand(command) {
+  return [".js", ".mjs", ".cjs"].includes(path.extname(command))
+    ? { command: process.execPath, args: [command, "--version"] }
+    : { command, args: ["--version"] };
+}
+
+export async function verifyLiveAgentMatrix({
+  cwd = process.cwd(),
+  targets = Object.keys(agentRegistry),
+  timeoutMs = defaultTimeoutMs,
+} = {}) {
+  const root = path.resolve(cwd);
+  const tempRoot = await fsTempDirectory();
+  try {
+    const payload = createSkillCompatibilityPayload({
+      name: "live-agent-verification",
+      capabilities: ["maestro", "agent-compatibility"],
+    });
+    const distribution = await verifyCrossAgentInstallMatrix({
+      payload,
+      cwd: tempRoot,
+      targets,
+      existingAgentRoots: targets,
+    });
+    const results = [];
+    for (const [index, target] of targets.entries()) {
+      const distributionResult = distribution.results[index];
+      const command = executableAgents[target]?.probeable ? resolveAgentCommand(target) : null;
+      if (!command) {
+        results.push({
+          target,
+          status: distributionResult?.ok ? "distribution-only" : "blocked",
+          version: null,
+          command: null,
+          distribution: distributionResult?.ok === true,
+          reason: "No safe non-interactive host command is registered for this target.",
+        });
+        continue;
+      }
+      const normalized = normalizeProbeCommand(command);
+      const probe = await runVersionProbe(normalized.command, timeoutMs, normalized.args);
+      results.push({
+        target,
+        status: probe.ok && distributionResult?.ok ? "runtime-verified" : "blocked",
+        version: probe.version ?? null,
+        command,
+        distribution: distributionResult?.ok === true,
+        reason: probe.ok ? null : probe.reason,
+      });
+    }
+    return {
+      schemaVersion: "0.1.0",
+      record_type: "live_agent_verification",
+      cwd: root,
+      target_count: results.length,
+      runtime_verified: results.filter((result) => result.status === "runtime-verified").length,
+      distribution_only: results.filter((result) => result.status === "distribution-only").length,
+      blocked: results.filter((result) => result.status === "blocked").length,
+      results,
+      production_evidence: false,
+    };
+  } finally {
+    await fsTempRemove(tempRoot);
+  }
+}
+
+async function fsTempDirectory() {
+  return fs.mkdtemp(path.join(os.tmpdir(), "ma-live-agents-"));
+}
+
+async function fsTempRemove(directory) {
+  await fs.rm(directory, { recursive: true, force: true });
+}