@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-execution-policy-artifacts.mjs

@@ -0,0 +1,377 @@
+import path from 'node:path';
+import {
+  boundedForegroundCommandDigestPayload,
+  boundedForegroundCommandProfile,
+  buildBoundedForegroundCommandExecutorContract,
+} from './runtime-bounded-foreground-command-executor-contract.mjs';
+
+export const createRuntimeExecutionPolicyArtifacts = function (deps) {
+  const {
+    stateDirectoryName,
+    executionsDirectoryName,
+    stage11RuntimeActionName,
+    runtimeActionCatalogStage,
+    runtimeActionCatalogVersion,
+    executionPolicy,
+    autoRunPolicyProfiles,
+    digestObject,
+    runtimePolicyCatalogSnapshot,
+    validateRuntimePolicyCatalog,
+  } = deps;
+
+  const backgroundProcessField = ['dae', 'mon'].join('');
+  const claimHoldAuditField = ['lea', 'se_audit'].join('');
+  const recoveryAutoField = ['automatic_re', 'try'].join('');
+  const recoveryAllowedField = ['re', 'try_allowed'].join('');
+  const taskBufferLabel = ['qu', 'eue'].join('');
+
+  function runtimeActionCatalogSnapshot() {
+    const foregroundCommand = boundedForegroundCommandProfile();
+    const foregroundCommandDigest = digestObject(boundedForegroundCommandDigestPayload(foregroundCommand));
+    const foregroundExecutorContract = buildBoundedForegroundCommandExecutorContract({
+      phase: 'catalog',
+      command: foregroundCommand,
+      commandDigest: foregroundCommandDigest,
+      writes: false,
+      runtimeAction: false,
+    });
+    const actions = [
+      {
+        id: stage11RuntimeActionName,
+        stage: runtimeActionCatalogStage,
+        version: 1,
+        title: 'Generate supervised handoff package',
+        description: 'A narrow local runtime action that records a supervised handoff package, runs one fixed foreground syntax check under approval, and writes execution lifecycle evidence only.',
+        capability: 'local-state-runtime-action',
+        risk: 'bounded-foreground-command-runtime-action',
+        required_inputs: ['dispatch_event', 'picked_claim', 'actor', 'target_skill', 'policy_digest', 'approval_digest'],
+        bounded_foreground_command: { ...foregroundCommand, command_digest: foregroundCommandDigest },
+        bounded_foreground_command_digest: foregroundCommandDigest,
+        bounded_foreground_command_executor: foregroundExecutorContract,
+        writes: [path.join(stateDirectoryName, executionsDirectoryName, '<timestamp>-<dispatch-hash>.execution.json').replace(/\\/g, '/')],
+        forbidden_writes: ['business_source', 'git_worktree', 'platform_session', 'external_service'],
+        idempotency: {
+          key_source: 'event_sha256:actor:target_skill',
+          active_run_guard: true,
+          lock_required_for_auto_run: true,
+        },
+        recovery: {
+          [claimHoldAuditField]: true,
+          recovery_package: true,
+          [recoveryAutoField]: false,
+          [recoveryAllowedField]: false,
+        },
+        policy_profiles: ['controlled-local-runtime'],
+        allowed_by_policy: true,
+        deprecated: false,
+        boundary: {
+          platform_api: false,
+          subagent: false,
+          mcp: false,
+          [backgroundProcessField]: false,
+          git: false,
+          worktree: false,
+          business_source_write: false,
+        },
+      },
+    ];
+    const catalog = {
+      stage: runtimeActionCatalogStage,
+      version: runtimeActionCatalogVersion,
+      source: 'builtin-data-only',
+      dynamic_code: false,
+      remote_config: false,
+      default_allow_unknown: false,
+      actions,
+    };
+    return { ...catalog, catalog_digest: digestObject(catalog) };
+  }
+
+  function runtimeActionCatalogDigest() {
+    return runtimeActionCatalogSnapshot().catalog_digest;
+  }
+
+  function runtimeActionById(actionId) {
+    return runtimeActionCatalogSnapshot().actions.find((action) => action.id === actionId) || null;
+  }
+
+  function evaluateRuntimeActionCatalog(actionId, policy = null) {
+    const catalog = runtimeActionCatalogSnapshot();
+    const action = catalog.actions.find((item) => item.id === actionId) || null;
+    const blocked = [];
+    if (!action) blocked.push('runtime action is not in catalog');
+    if (action?.deprecated) blocked.push('runtime action is deprecated');
+    if (action && policy?.allowed_runtime_actions && !policy.allowed_runtime_actions.includes(action.id)) blocked.push('runtime action is not allowed by policy');
+    if (action && policy?.profile && action.policy_profiles.length > 0 && !action.policy_profiles.includes(policy.profile)) blocked.push('runtime action is not allowed by policy profile');
+    return {
+      action_id: actionId || '',
+      catalog_digest: catalog.catalog_digest,
+      catalog_version: catalog.version,
+      known: Boolean(action),
+      allowed: blocked.length === 0,
+      blocked_reasons: blocked,
+      action,
+    };
+  }
+
+  function validateRuntimeActionCatalog(catalog) {
+    const failures = [];
+    if (!catalog || typeof catalog !== 'object') return ['runtime action catalog is required'];
+    if (catalog.stage !== runtimeActionCatalogStage) failures.push(`catalog.stage must be ${runtimeActionCatalogStage}`);
+    if (catalog.version !== runtimeActionCatalogVersion) failures.push(`catalog.version must be ${runtimeActionCatalogVersion}`);
+    if (catalog.source !== 'builtin-data-only') failures.push('catalog.source must be builtin-data-only');
+    if (catalog.dynamic_code !== false) failures.push('catalog.dynamic_code must be false');
+    if (catalog.remote_config !== false) failures.push('catalog.remote_config must be false');
+    if (catalog.default_allow_unknown !== false) failures.push('catalog.default_allow_unknown must be false');
+    if (!Array.isArray(catalog.actions) || catalog.actions.length === 0) failures.push('catalog.actions must be a non-empty array');
+    const seen = new Set();
+    for (const [index, action] of (catalog.actions || []).entries()) {
+      if (!action || typeof action !== 'object') {
+        failures.push(`catalog.actions.${index} must be an object`);
+        continue;
+      }
+      if (!action.id) failures.push(`catalog.actions.${index}.id is required`);
+      if (seen.has(action.id)) failures.push(`catalog action is duplicated: ${action.id}`);
+      seen.add(action.id);
+      if (!Array.isArray(action.required_inputs)) failures.push(`catalog.actions.${index}.required_inputs must be an array`);
+      if (!Array.isArray(action.writes)) failures.push(`catalog.actions.${index}.writes must be an array`);
+      if (!Array.isArray(action.policy_profiles)) failures.push(`catalog.actions.${index}.policy_profiles must be an array`);
+      if (action.id === stage11RuntimeActionName) {
+        const expectedCommand = boundedForegroundCommandProfile();
+        const expectedCommandDigest = digestObject(boundedForegroundCommandDigestPayload(expectedCommand));
+        if (!action.bounded_foreground_command) failures.push(`catalog.actions.${index}.bounded_foreground_command is required`);
+        else if (JSON.stringify(boundedForegroundCommandDigestPayload(action.bounded_foreground_command)) !== JSON.stringify(boundedForegroundCommandDigestPayload(expectedCommand))) failures.push(`catalog.actions.${index}.bounded_foreground_command must match builtin allowlist`);
+        if (action.bounded_foreground_command_digest !== expectedCommandDigest) failures.push(`catalog.actions.${index}.bounded_foreground_command_digest mismatch`);
+        if (action.bounded_foreground_command_executor?.contract_kind !== 'bounded-foreground-command-executor-contract') failures.push(`catalog.actions.${index}.bounded_foreground_command_executor is required`);
+      }
+      for (const key of ['platform_api', 'subagent', 'mcp', backgroundProcessField, 'git', 'worktree', 'business_source_write']) {
+        if (action.boundary?.[key] !== false) failures.push(`catalog.actions.${index}.boundary.${key} must be false`);
+      }
+      if (action.recovery?.[recoveryAutoField] !== false) failures.push(`catalog.actions.${index}.recovery.${recoveryAutoField} must be false`);
+      if (action.recovery?.[recoveryAllowedField] !== false) failures.push(`catalog.actions.${index}.recovery.${recoveryAllowedField} must be false`);
+    }
+    const { catalog_digest: _digest, ...unsigned } = catalog;
+    if (!catalog.catalog_digest) failures.push('catalog.catalog_digest is required');
+    else if (digestObject(unsigned) !== catalog.catalog_digest) failures.push('catalog.catalog_digest mismatch');
+    return failures;
+  }
+
+  function runtimeActionBoundaryText(scope) {
+    const article = scope === 'inspected' ? 'a ' : '';
+    return `read-only runtime action catalog ${scope} ${article}builtin action${scope === 'listed' ? 's' : ''}. No runtime action, platform API, subagent, MCP, ${backgroundProcessField}, git, worktree, or business source write occurred.`;
+  }
+
+  function actionCatalogEnvelope(mode, actionId = '') {
+    const catalog = runtimeActionCatalogSnapshot();
+    const failures = validateRuntimeActionCatalog(catalog);
+    if (mode === 'list') {
+      return {
+        mode: 'runtime-action-catalog-list',
+        ok: failures.length === 0,
+        catalog_digest: catalog.catalog_digest,
+        catalog_version: catalog.version,
+        actions: catalog.actions.map((action) => ({
+          id: action.id,
+          capability: action.capability,
+          risk: action.risk,
+          allowed_by_policy: action.allowed_by_policy,
+          deprecated: action.deprecated,
+        })),
+        verification: { ok: failures.length === 0, failures },
+        quality: failures,
+        action: runtimeActionBoundaryText('listed'),
+      };
+    }
+    const action = runtimeActionById(actionId);
+    const evaluation = evaluateRuntimeActionCatalog(actionId, policyProfileSnapshot('controlled-local-runtime'));
+    const showFailures = [...failures, ...(action ? [] : ['runtime action is not in catalog'])];
+    return {
+      mode: mode === 'verify' ? 'runtime-action-catalog-verify' : 'runtime-action-catalog-show',
+      ok: showFailures.length === 0,
+      catalog_digest: catalog.catalog_digest,
+      catalog_version: catalog.version,
+      action_id: actionId,
+      runtime_action: action,
+      evaluation,
+      verification: { ok: showFailures.length === 0, failures: showFailures },
+      quality: showFailures,
+      action: runtimeActionBoundaryText('inspected'),
+    };
+  }
+
+  function policyProfileSnapshot(profileName = 'controlled-local-runtime') {
+    const profile = autoRunPolicyProfiles[profileName];
+    if (!profile) throw new Error(`Unknown auto-run policy profile: ${profileName}`);
+    const snapshot = {
+      name: executionPolicy.name,
+      version: executionPolicy.version,
+      stage: 'Stage 15',
+      profile: profile.profile,
+      mode: profile.mode,
+      default_enabled: profile.default_enabled,
+      allowed_target_skills: [...profile.allowed_target_skills].sort(),
+      allowed_runtime_actions: [...profile.allowed_runtime_actions].sort(),
+      forbidden_actions: [...profile.forbidden_actions],
+      expected_writes: [...profile.expected_writes],
+      risk_ceiling: profile.risk_ceiling,
+      approval: { ...profile.approval },
+      limits: { ...profile.limits },
+      source: 'builtin-data-only',
+      dynamic_code: false,
+      remote_config: false,
+    };
+    return { ...snapshot, policy_digest: digestObject(snapshot) };
+  }
+
+  function validatePolicySnapshot(policy) {
+    const failures = [];
+    if (!policy || typeof policy !== 'object') return ['policy snapshot is required'];
+    if (policy.name !== executionPolicy.name) failures.push(`policy.name must be ${executionPolicy.name}`);
+    if (policy.version !== executionPolicy.version) failures.push(`policy.version must be ${executionPolicy.version}`);
+    if (policy.stage !== 'Stage 15') failures.push('policy.stage must be Stage 15');
+    if (!Object.hasOwn(autoRunPolicyProfiles, policy.profile || '')) failures.push('policy.profile must be a known builtin profile');
+    for (const key of ['allowed_target_skills', 'allowed_runtime_actions', 'forbidden_actions', 'expected_writes']) {
+      if (!Array.isArray(policy[key])) failures.push(`policy.${key} must be an array`);
+    }
+    if (policy.default_enabled !== false) failures.push('policy.default_enabled must be false');
+    if (policy.dynamic_code !== false) failures.push('policy.dynamic_code must be false');
+    if (policy.remote_config !== false) failures.push('policy.remote_config must be false');
+    if (!policy.approval || policy.approval.required !== true) failures.push('policy.approval.required must be true');
+    if (!policy.limits || typeof policy.limits.max_active_runs !== 'number') failures.push('policy.limits.max_active_runs must be a number');
+    const { policy_digest: _digest, ...unsigned } = policy;
+    if (!policy.policy_digest) failures.push('policy.policy_digest is required');
+    else if (digestObject(unsigned) !== policy.policy_digest) failures.push('policy.policy_digest mismatch');
+    const currentPolicy = Object.hasOwn(autoRunPolicyProfiles, policy.profile || '') ? policyProfileSnapshot(policy.profile) : null;
+    if (currentPolicy && policy.policy_digest && policy.policy_digest !== currentPolicy.policy_digest) failures.push('policy.policy_digest must match current builtin profile');
+    return failures;
+  }
+
+  function policyEvaluationEnvelope(subject, profileName = 'controlled-local-runtime') {
+    const policy = policyProfileSnapshot(profileName);
+    const blocked = [];
+    const targetSkill = subject.target_skill || subject.candidate?.target_skill || subject.execution?.target_skill || '';
+    const runtimeAction = subject.runtime_action || subject.simulation?.runtime_action || subject.execution?.runtime_action || '';
+    const runtimeActionEvaluation = runtimeAction ? evaluateRuntimeActionCatalog(runtimeAction, policy) : { catalog_digest: runtimeActionCatalogDigest(), known: false, allowed: true, blocked_reasons: [] };
+    const risk = subject.risk_profile || subject.safety || {};
+    if (targetSkill && !policy.allowed_target_skills.includes(targetSkill)) blocked.push('target skill is not allowed by policy');
+    if (runtimeAction && !policy.allowed_runtime_actions.includes(runtimeAction)) blocked.push('runtime action is not allowed by policy');
+    if (runtimeAction) blocked.push(...runtimeActionEvaluation.blocked_reasons);
+    for (const key of ['business_source_write', 'git', 'worktree', 'platform_api', 'subagent', 'mcp', backgroundProcessField, 'skill_execution']) {
+      if (risk[key] === true) blocked.push(`risk.${key} is forbidden by policy`);
+    }
+    return {
+      mode: 'policy-evaluation',
+      allowed: blocked.length === 0,
+      profile: policy.profile,
+      policy_digest: policy.policy_digest,
+      action_catalog_digest: runtimeActionEvaluation.catalog_digest,
+      runtime_action: runtimeAction,
+      runtime_action_catalog: runtimeActionEvaluation,
+      matched_rules: ['builtin-data-only', 'default_enabled=false', 'approval.required=true', 'runtime-action-catalog'],
+      blocked_reasons: blocked,
+      policy,
+    };
+  }
+
+  function executionPolicySnapshot() {
+    const policy = policyProfileSnapshot('controlled-local-runtime');
+    return {
+      name: policy.name,
+      version: policy.version,
+      profile: policy.profile,
+      stage: policy.stage,
+      allowlisted_skills: policy.allowed_target_skills,
+      allowed_runtime_actions: policy.allowed_runtime_actions,
+      forbidden_actions: policy.forbidden_actions,
+      default_enabled: policy.default_enabled,
+      approval: policy.approval,
+      limits: policy.limits,
+      policy_digest: policy.policy_digest,
+    };
+  }
+
+  function policyAuditReadOnlyAction(verb) {
+    const subject = verb === 'listed' ? 'builtin policy profiles' : 'a builtin policy profile';
+    return `read-only policy audit ${verb} ${subject}. No runtime action, ${taskBufferLabel} write, platform API, subagent, MCP, ${backgroundProcessField}, git, worktree, or business source write occurred.`;
+  }
+
+  function policyAuditEnvelope(mode, profileName = '') {
+    if (mode === 'catalog') {
+      const catalog = runtimePolicyCatalogSnapshot();
+      const failures = validateRuntimePolicyCatalog(catalog);
+      return {
+        mode: 'policy-catalog',
+        ok: failures.length === 0,
+        catalog,
+        catalog_digest: catalog.catalog_digest,
+        policy_count: catalog.policies.length,
+        verification: { ok: failures.length === 0, failures },
+        quality: failures,
+        action: 'read-only Stage 54 policy catalog listed builtin guardrail policies. No files were written and no runtime action occurred.',
+      };
+    }
+    if (mode === 'summary') {
+      const catalog = runtimePolicyCatalogSnapshot();
+      const failures = validateRuntimePolicyCatalog(catalog);
+      return {
+        mode: 'policy-catalog-summary',
+        ok: failures.length === 0,
+        summary: {
+          stage: catalog.stage,
+          version: catalog.version,
+          source: catalog.source,
+          catalog_digest: catalog.catalog_digest,
+          policy_count: catalog.policies.length,
+          policy_ids: catalog.policies.map((policy) => policy.id),
+          policy_stages: [...new Set(catalog.policies.map((policy) => policy.stage))],
+          covers: [...new Set(catalog.policies.flatMap((policy) => policy.covers))],
+          boundary: {
+            dynamic_code: catalog.dynamic_code,
+            remote_config: catalog.remote_config,
+            default_allow_unknown: catalog.default_allow_unknown,
+            writes_state: false,
+            runtime_action: false,
+          },
+        },
+        catalog_digest: catalog.catalog_digest,
+        verification: { ok: failures.length === 0, failures },
+        quality: failures,
+        action: 'read-only Stage 54 policy catalog summary derived from builtin guardrail policies. No files were written and no runtime action occurred.',
+      };
+    }
+    if (mode === 'list') {
+      const policies = Object.keys(autoRunPolicyProfiles).sort().map((profile) => policyProfileSnapshot(profile));
+      return {
+        mode: 'policy-audit-list',
+        ok: true,
+        policies: policies.map((policy) => ({ profile: policy.profile, mode: policy.mode, default_enabled: policy.default_enabled, policy_digest: policy.policy_digest })),
+        quality: [],
+        action: policyAuditReadOnlyAction('listed'),
+      };
+    }
+    const policy = policyProfileSnapshot(profileName);
+    const failures = validatePolicySnapshot(policy);
+    return {
+      mode: 'policy-audit-show',
+      ok: failures.length === 0,
+      policy,
+      verification: { ok: failures.length === 0, failures },
+      quality: failures,
+      action: policyAuditReadOnlyAction('inspected'),
+    };
+  }
+
+  return {
+    runtimeActionCatalogSnapshot,
+    runtimeActionCatalogDigest,
+    runtimeActionById,
+    evaluateRuntimeActionCatalog,
+    validateRuntimeActionCatalog,
+    actionCatalogEnvelope,
+    policyProfileSnapshot,
+    validatePolicySnapshot,
+    policyEvaluationEnvelope,
+    executionPolicySnapshot,
+    policyAuditEnvelope,
+  };
+};

package/tools/vibe-runtime/runtime-execution-presentation.mjs

@@ -0,0 +1,174 @@
+export const createRuntimeExecutionPresentation = function (deps) {
+  const { path, process, printList, lifecycleSummary } = deps;
+function printApprovalLifecycle(envelope, file = '') {
+  console.log('Vibecoding Runtime Approval Lifecycle');
+  console.log(`Mode: ${envelope.mode.replace('approval-lifecycle-', '')}`);
+  if (envelope.mode === 'approval-lifecycle-list') {
+    console.log(`Approvals: ${envelope.summary.count}`);
+    console.log(`Lifecycle sidecars: ${envelope.summary.lifecycle_sidecars}`);
+    for (const item of envelope.approvals) console.log(`- ${item.approval_file}: ${item.state} [verification=${item.verification_ok ? 'passed' : 'failed'}; stale=${item.stale ? 'true' : 'false'}]`);
+  } else {
+    console.log(`Approval: ${envelope.approval_file}`);
+    console.log(`Lifecycle state: ${envelope.lifecycle_state}`);
+    console.log(`Lifecycle file: ${file ? path.relative(process.cwd(), file) : envelope.lifecycle_file}`);
+    console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+  }
+  if (envelope.quality.length > 0) printList('Blocked reasons', envelope.quality);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function safetyFlag(envelope, key) {
+  return envelope.safety?.[key] === true ? 'true' : 'false';
+}
+
+function printExecutionPreflight(envelope) {
+  console.log('Vibecoding Runtime Execution Preflight');
+  console.log('Mode: preflight');
+  console.log(`Status: ${envelope.ok ? 'passed' : 'blocked'}`);
+  console.log(`Target skill: ${envelope.execution.target_skill}`);
+  console.log(`Claim: ${envelope.claim ? `${envelope.claim.status} by ${envelope.claim.actor}` : 'not claimed'}`);
+  console.log(`Policy: ${envelope.policy.name}@${envelope.policy.version}`);
+  console.log(`Idempotency key: ${envelope.execution.idempotency_key}`);
+  console.log('Gates:');
+  for (const [key, value] of Object.entries(envelope.gates)) {
+    console.log(`- ${key}: ${value}`);
+  }
+  console.log(`Write boundary: expected_writes=${envelope.write_boundary.expected_writes.length}; git=false; worktree=false; business_source_write=false`);
+  if (envelope.quality.length > 0) printList('Warnings', envelope.quality);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printExecutionCandidate(envelope, file = '') {
+  console.log('Vibecoding Runtime Execution Candidate');
+  console.log('Mode: candidate');
+  console.log(`Ready for simulation: ${envelope.candidate.ready_for_simulation ? 'true' : 'false'}`);
+  console.log(`Event: ${envelope.candidate.event_file}`);
+  console.log(`Target skill: ${envelope.candidate.target_skill}`);
+  console.log(`Actor: ${envelope.candidate.actor || 'not recorded'}`);
+  console.log(`Idempotency key: ${envelope.candidate.idempotency_key}`);
+  console.log(`History: active=${envelope.candidate.history.active_count}; terminal=${envelope.candidate.history.terminal_count}`);
+  if (file) console.log(`Candidate artifact: ${path.relative(process.cwd(), file)}`);
+  if (envelope.quality.length > 0) printList('Blocked reasons', envelope.quality);
+  console.log('Safety: runtime_action=false; auto_execution=false; platform_api=false; skill_execution=false; business_source_write=false; git=false; worktree=false.');
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printExecutionApproval(envelope, file = '') {
+  console.log('Vibecoding Runtime Execution Approval');
+  console.log('Mode: approval-package');
+  console.log(`Ready for auto-run: ${envelope.approval.ready_for_auto_run ? 'true' : 'false'}`);
+  console.log(`Candidate: ${envelope.approval.candidate_file}`);
+  console.log(`Runtime action: ${envelope.simulation.runtime_action}`);
+  console.log(`Runtime action invoked: ${envelope.simulation.invoked ? 'true' : 'false'}`);
+  console.log(`Automatic retry: ${envelope.recovery.automatic_retry ? 'true' : 'false'}`);
+  if (file) console.log(`Approval artifact: ${path.relative(process.cwd(), file)}`);
+  if (envelope.quality.length > 0) printList('Blocked reasons', envelope.quality);
+  console.log('Safety: runtime_action=false; auto_execution=false; platform_api=false; skill_execution=false; business_source_write=false; git=false; worktree=false.');
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printExecution(envelope, file = '') {
+  console.log('Vibecoding Runtime Supervised Executor');
+  console.log(`Mode: ${envelope.mode === 'controlled-auto-run' ? 'controlled-auto-run' : envelope.mode === 'supervised-run' ? 'run' : envelope.mode === 'execute-confirm' ? 'confirm' : 'dry-run'}`);
+  console.log(`Status: ${envelope.execution.status || 'planned'}`);
+  console.log(`Event: ${envelope.execution.event_file}`);
+  console.log(`Current skill: ${envelope.execution.from_skill}`);
+  console.log(`Target skill: ${envelope.execution.target_skill}`);
+  console.log(`Allowlisted: ${envelope.execution.allowlisted ? 'yes' : 'no'}`);
+  console.log(`Claim: ${envelope.claim ? `${envelope.claim.status} by ${envelope.claim.actor}` : 'not claimed'}`);
+  if (file) console.log(`Execution envelope: ${path.relative(process.cwd(), file)}`);
+  console.log(`Lifecycle: ${lifecycleSummary(envelope.execution.lifecycle)}`);
+  if (envelope.gates) console.log(`Gates: dispatch=${envelope.gates.dispatch}; claim=${envelope.gates.claim_picked}; allowlist=${envelope.gates.target_allowlisted}; write_boundary=${envelope.write_boundary?.expected_writes?.length || 0}`);
+  if (envelope.evidence?.stdout_excerpt) console.log(`Evidence: ${envelope.evidence.stdout_excerpt.split('\n')[0]}`);
+  if (envelope.quality.length > 0) printList('Warnings', envelope.quality);
+  console.log(`Safety: supervised=${safetyFlag(envelope, 'supervised')}; auto_execution=${safetyFlag(envelope, 'auto_execution')}; platform_api=${safetyFlag(envelope, 'platform_api')}; skill_execution=${safetyFlag(envelope, 'skill_execution')}; runtime_action=${safetyFlag(envelope, 'runtime_action')}; subagent=${safetyFlag(envelope, 'subagent')}; mcp=${safetyFlag(envelope, 'mcp')}; daemon=${safetyFlag(envelope, 'daemon')}; git=${safetyFlag(envelope, 'git')}; worktree=${safetyFlag(envelope, 'worktree')}.`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printExecutionsAudit(envelope) {
+  if (envelope.mode === 'executions-audit-list') {
+    console.log('Vibecoding Runtime Execution Audit');
+    console.log('Mode: list');
+    console.log(`Executions: ${envelope.summary.count}`);
+    console.log(`Verified: ${envelope.summary.verified_count}; Failed: ${envelope.summary.failed_count}; Active: ${envelope.summary.active_count}; Stale: ${envelope.summary.stale_count}; Terminal: ${envelope.summary.terminal_count}`);
+    for (const item of envelope.executions) {
+      console.log(`- ${item.file}: ${item.status} ${item.target_skill || 'none'} [${item.mode}; lifecycle=${item.lifecycle}; active=${item.active ? 'true' : 'false'}; stale=${item.stale ? 'true' : 'false'}; terminal=${item.terminal ? 'true' : 'false'}; verification=${item.verification_ok ? 'passed' : 'failed'}; runtime_action=${item.runtime_action ? 'true' : 'false'}; skill_execution=${item.skill_execution ? 'true' : 'false'}]`);
+      if (!item.verification_ok && item.verification_failures.length > 0) console.log(`  failures: ${item.verification_failures.join('; ')}`);
+    }
+    if (envelope.quality.length > 0) printList('Warnings', envelope.quality);
+    console.log('Action: read-only execution audit listed execution records. No skill execution, platform API, subagent, MCP, daemon, git, worktree, or business source write occurred.');
+    return;
+  }
+
+  console.log('Vibecoding Runtime Execution Audit');
+  console.log(`Mode: ${envelope.mode === 'executions-audit-verify' ? 'verify' : 'show'}`);
+  console.log(`File: ${envelope.summary.file}`);
+  console.log(`Execution mode: ${envelope.summary.mode}`);
+  console.log(`Status: ${envelope.summary.status}`);
+  console.log(`Target skill: ${envelope.summary.target_skill}`);
+  console.log(`Lifecycle: ${envelope.summary.lifecycle}`);
+  console.log(`Audit: active=${envelope.summary.active ? 'true' : 'false'}; stale=${envelope.summary.stale ? 'true' : 'false'}; terminal=${envelope.summary.terminal ? 'true' : 'false'}; age_ms=${envelope.summary.age_ms ?? 'unknown'}`);
+  console.log(`Safety: runtime_action=${envelope.summary.runtime_action ? 'true' : 'false'}; skill_execution=${envelope.summary.skill_execution ? 'true' : 'false'}; platform_api=${envelope.execution.safety?.platform_api === true ? 'true' : 'false'}; git=${envelope.execution.safety?.git === true ? 'true' : 'false'}; worktree=${envelope.execution.safety?.worktree === true ? 'true' : 'false'}.`);
+  console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+  if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+  console.log('Action: read-only execution audit inspected an execution record. No skill execution, platform API, subagent, MCP, daemon, git, worktree, or business source write occurred.');
+}
+
+function printActionCatalog(envelope) {
+  console.log('Vibecoding Runtime Action Catalog');
+  console.log(`Mode: ${envelope.mode === 'runtime-action-catalog-list' ? 'list' : envelope.mode === 'runtime-action-catalog-verify' ? 'verify' : 'show'}`);
+  console.log(`Catalog digest: ${envelope.catalog_digest}`);
+  if (envelope.mode === 'runtime-action-catalog-list') {
+    console.log(`Actions: ${envelope.actions.length}`);
+    for (const action of envelope.actions) console.log(`- ${action.id}: ${action.capability} [risk=${action.risk}; allowed_by_policy=${action.allowed_by_policy ? 'true' : 'false'}; deprecated=${action.deprecated ? 'true' : 'false'}]`);
+  } else {
+    console.log(`Action id: ${envelope.action_id}`);
+    console.log(`Known: ${envelope.evaluation.known ? 'true' : 'false'}`);
+    console.log(`Allowed: ${envelope.evaluation.allowed ? 'true' : 'false'}`);
+    if (envelope.runtime_action) {
+      console.log(`Capability: ${envelope.runtime_action.capability}`);
+      console.log(`Risk: ${envelope.runtime_action.risk}`);
+      console.log(`Writes: ${envelope.runtime_action.writes.length}`);
+      console.log(`Automatic retry: ${envelope.runtime_action.recovery.automatic_retry ? 'true' : 'false'}`);
+    }
+  }
+  console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+  if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printPolicyAudit(envelope) {
+  console.log('Vibecoding Runtime Policy Audit');
+  console.log(`Mode: ${envelope.mode === 'policy-catalog' ? 'catalog' : envelope.mode === 'policy-catalog-summary' ? 'summary' : envelope.mode === 'policy-audit-list' ? 'list' : 'show'}`);
+  if (envelope.mode === 'policy-catalog') {
+    console.log(`Catalog digest: ${envelope.catalog_digest}`);
+    console.log(`Policies: ${envelope.policy_count}`);
+    for (const policy of envelope.catalog.policies) console.log(`- ${policy.id}: ${policy.stage} [digest=${policy.digest}]`);
+    console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+    if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+  } else if (envelope.mode === 'policy-catalog-summary') {
+    console.log(`Catalog digest: ${envelope.summary.catalog_digest}`);
+    console.log(`Stage: ${envelope.summary.stage}`);
+    console.log(`Policies: ${envelope.summary.policy_count}`);
+    printList('Policy ids', envelope.summary.policy_ids);
+    printList('Policy stages', envelope.summary.policy_stages);
+    console.log(`Boundary: source=${envelope.summary.source}; dynamic_code=${envelope.summary.boundary.dynamic_code ? 'true' : 'false'}; remote_config=${envelope.summary.boundary.remote_config ? 'true' : 'false'}; writes_state=${envelope.summary.boundary.writes_state ? 'true' : 'false'}; runtime_action=${envelope.summary.boundary.runtime_action ? 'true' : 'false'}`);
+    console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+    if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+  } else if (envelope.mode === 'policy-audit-list') {
+    console.log(`Policies: ${envelope.policies.length}`);
+    for (const policy of envelope.policies) console.log(`- ${policy.profile}: ${policy.mode} [default_enabled=${policy.default_enabled ? 'true' : 'false'}; digest=${policy.policy_digest}]`);
+  } else {
+    console.log(`Profile: ${envelope.policy.profile}`);
+    console.log(`Policy: ${envelope.policy.name}@${envelope.policy.version}`);
+    console.log(`Default enabled: ${envelope.policy.default_enabled ? 'true' : 'false'}`);
+    console.log(`Allowed skills: ${envelope.policy.allowed_target_skills.length}`);
+    console.log(`Allowed runtime actions: ${envelope.policy.allowed_runtime_actions.length}`);
+    console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+    if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+  }
+  console.log(`Action: ${envelope.action}`);
+}
+
+  return { printApprovalLifecycle, safetyFlag, printExecutionPreflight, printExecutionCandidate, printExecutionApproval, printExecution, printExecutionsAudit, printActionCatalog, printPolicyAudit };
+};