@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-task-commit-gates.mjs

@@ -0,0 +1,62 @@
+function gate(id, pass, reason) {
+  return { id, status: pass ? 'ready' : 'blocked', reason: pass ? '' : reason, runtime_git_execution_authorized: false, execution_evidence_authorizes_git: false };
+}
+
+function reviewIsClean(payload, artifact) {
+  const review = payload.review || artifact.review || {};
+  const verdict = String(payload.review_verdict || artifact.review_verdict || review.verdict || '').toLowerCase();
+  if (payload.review_clean === true || artifact.review_clean === true || ['clean', 'pass', 'passed', 'approved', 'no-findings'].includes(verdict)) return true;
+  const critical = Number(review.critical_count ?? payload.critical_count ?? artifact.critical_count ?? 0);
+  const important = Number(review.important_count ?? payload.important_count ?? artifact.important_count ?? 0);
+  return review.clean === true && critical === 0 && important === 0;
+}
+
+function testsPassed(payload, artifact) {
+  const chain = artifact.sdd_evidence_chain || artifact.evidence_chain || {};
+  const status = String(payload.tests?.status || payload.test_evidence?.status || artifact.test_evidence?.status || chain.test_evidence?.runtime_test_run?.status || '').toLowerCase();
+  return payload.required_tests_passed === true || artifact.required_tests_passed === true || chain.test_evidence?.ok === true || ['pass', 'passed'].includes(status);
+}
+
+function isolatedWorkspacePresent(payload, artifact) {
+  const workspace = payload.workspace || artifact.workspace || {};
+  const contract = payload.workspace_contract || artifact.workspace_contract || workspace.contract || {};
+  const policy = contract.isolation_policy || workspace.isolation_policy || {};
+  return payload.isolated_workspace === true
+    || payload.isolated_worktree === true
+    || artifact.isolated_workspace === true
+    || artifact.isolated_worktree === true
+    || (policy.main_worktree_write_allowed === false && policy.isolated_workspace_required_for_source_write === true);
+}
+
+function branchAllowed(payload, artifact) {
+  const branch = String(payload.branch || artifact.branch || payload.workspace?.branch || artifact.workspace?.branch || '').trim().toLowerCase();
+  return Boolean(branch) && branch !== 'main' && branch !== 'master';
+}
+
+export function taskCommitSummary(artifact) {
+  const chain = artifact.sdd_evidence_chain || artifact.evidence_chain || {};
+  const payload = artifact.task_result || artifact.sdd_task_result || artifact.result || artifact;
+  const task = chain.task || payload.task || {};
+  return {
+    task: {
+      task_id: String(task.task_id || payload.task_id || ''),
+      title: String(task.title || payload.title || ''),
+    },
+    review_clean: reviewIsClean(payload, artifact),
+    tests_passed: testsPassed(payload, artifact),
+    isolated_workspace: isolatedWorkspacePresent(payload, artifact),
+    branch_allowed: branchAllowed(payload, artifact),
+    commit_subject_present: Boolean(String(payload.commit_subject || artifact.commit_subject || '').trim()),
+  };
+}
+
+export function taskCommitGates(summary) {
+  return [
+    gate('task-bound', summary.task.task_id || summary.task.title, 'task id or title is required'),
+    gate('isolated-workspace', summary.isolated_workspace, 'isolated workspace/worktree evidence is required'),
+    gate('review-clean', summary.review_clean, 'clean review verdict is required'),
+    gate('required-tests-passed', summary.tests_passed, 'required test evidence must pass'),
+    gate('branch-not-main-master', summary.branch_allowed, 'task commit evidence must not target main/master'),
+    gate('commit-subject', summary.commit_subject_present, 'commit_subject is required in the task result'),
+  ];
+}

package/tools/vibe-runtime/runtime-task-commit-readiness.mjs

@@ -0,0 +1,66 @@
+export function taskCommitBoundary(writes) {
+  return {
+    task_commit_gate_artifact: Boolean(writes),
+    state_directory_created: Boolean(writes),
+    sidecar_write: Boolean(writes),
+    command_execution: false,
+    test_execution: false,
+    source_write: false,
+    business_source_write: false,
+    git: false,
+    git_write: false,
+    commit: false,
+    push: false,
+    pr: false,
+    merge: false,
+    tag: false,
+    history_rewrite: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    subagent: false,
+    mcp: false,
+  };
+}
+
+export function taskCommitReadinessGate({ source, summary, gates, blocked, digestObject, statePresent }) {
+  const core = {
+    version: 1,
+    stage: 'Stage 151',
+    readiness_kind: 'task-commit-readiness-gate',
+    automation_profile: 'superpowers-parity-task-commits',
+    source_task_result: { file: source.relative, digest: source.digest },
+    task: summary.task,
+    gates,
+    gate_pass: blocked.length === 0,
+    blocked_reasons: blocked,
+    commit_policy: {
+      isolated_workspace_required: true,
+      review_clean_required: true,
+      passing_required_tests_required: true,
+      main_or_master_rejected_by_evidence: true,
+      runtime_git_execution_authorized: false,
+      task_commit_sidecar_required: true,
+      push_allowed: false,
+      pr_allowed: false,
+      merge_allowed: false,
+    },
+    allowed_followup: ['task commit sidecar gate with explicit confirmation', 'manual git commit only after human review outside runtime'],
+    forbidden_actions: ['runtime git add/commit/push/PR/merge/tag/reset/checkout', 'main/master task commit', 'commit without clean review', 'commit without passing required tests', 'commit outside isolated workspace evidence', 'platform API, external network, model, MCP, or subagent invocation'],
+    boundary_assertions: taskCommitBoundary(false),
+    writes: false,
+    state_directory_created: false,
+    local_only: true,
+    deterministic: true,
+  };
+  const readiness = { ...core, task_commit_readiness_digest: digestObject(core) };
+  return {
+    mode: 'task-commit-readiness-gate',
+    ok: readiness.gate_pass,
+    state_present: statePresent,
+    task_commit_readiness: readiness,
+    safety: { stage: 'Stage 151', ...taskCommitBoundary(false) },
+    quality: blocked,
+    action: 'task commit readiness was computed read-only from one local task result artifact. No git command, commit, push, PR, merge, command execution, test execution, source write, platform API, model invocation, MCP, subagent, or state write occurred.',
+  };
+}

package/tools/vibe-runtime/runtime-task-commit-sidecar.mjs

@@ -0,0 +1,65 @@
+import { taskCommitBoundary } from './runtime-task-commit-readiness.mjs';
+
+export function printTaskCommitGate(envelope, file = '') {
+  const readiness = envelope.task_commit_readiness;
+  const gateEnvelope = envelope.task_commit_gate;
+  console.log('Vibecoding Runtime Task Commit Gate');
+  console.log(`Mode: ${envelope.mode}; ok=${envelope.ok}`);
+  if (readiness?.task) console.log(`Task: ${readiness.task.task_id || 'unknown'}; gate_pass=${readiness.gate_pass}`);
+  if (gateEnvelope?.task) console.log(`Task: ${gateEnvelope.task.task_id || 'unknown'}; status=${gateEnvelope.gate_status}`);
+  if (file) console.log(`Task commit gate: ${file}`);
+  if (envelope.quality?.length > 0) console.log(`Blocked: ${envelope.quality.join('; ')}`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+export function verifyTaskCommitReadiness(readiness, digestObject) {
+  const digestPayload = { ...readiness };
+  delete digestPayload.task_commit_readiness_digest;
+  const failures = [
+    ...(readiness.stage === 'Stage 151' ? [] : ['stage must be Stage 151']),
+    ...(readiness.readiness_kind === 'task-commit-readiness-gate' ? [] : ['readiness_kind must be task-commit-readiness-gate']),
+    ...(readiness.automation_profile === 'superpowers-parity-task-commits' ? [] : ['automation_profile must be superpowers-parity-task-commits']),
+    ...(readiness.gate_pass === true ? [] : ['gate_pass must be true']),
+    ...(readiness.writes === false ? [] : ['readiness must be read-only']),
+    ...(readiness.commit_policy?.runtime_git_execution_authorized === false ? [] : ['runtime git execution must remain false']),
+    ...(Array.isArray(readiness.gates) && readiness.gates.every((item) => item.status === 'ready') ? [] : ['all readiness gates must be ready']),
+    ...(readiness.task_commit_readiness_digest === digestObject(digestPayload) ? [] : ['task commit readiness digest mismatch']),
+  ];
+  return { ok: failures.length === 0, failures };
+}
+
+export function taskCommitSidecarGate({ source, readiness, verification, digestObject, statePresent }) {
+  const core = {
+    version: 1,
+    stage: 'Stage 151',
+    gate_kind: 'task-commit-sidecar-gate',
+    automation_profile: 'superpowers-parity-task-commits',
+    created_at: new Date().toISOString(),
+    writes: true,
+    readiness_file: source.relative,
+    readiness_digest: source.digest,
+    task: readiness.task || {},
+    gate_status: 'task-commit-sidecar-recorded-manual-git-required',
+    runtime_git_execution_authorized: false,
+    commit_created_by_runtime: false,
+    push_allowed: false,
+    pr_allowed: false,
+    merge_allowed: false,
+    allowed_followup: ['manual human-approved git commit in isolated workspace only'],
+    planned_writes: ['local task-commit gate sidecar under runtime state area'],
+    boundary_assertions: taskCommitBoundary(true),
+    local_only: true,
+    deterministic: true,
+  };
+  const gate = { ...core, task_commit_gate_digest: digestObject(core) };
+  return {
+    mode: 'task-commit-sidecar-gate',
+    ok: true,
+    state_present: statePresent,
+    task_commit_gate: gate,
+    task_commit_readiness: { file: source.relative, digest: source.digest, verification },
+    safety: { stage: 'Stage 151', ...taskCommitBoundary(true) },
+    quality: [],
+    action: 'task commit gate sidecar was written locally as a manual git decision record. The runtime did not run git add, git commit, push, PR, merge, tag, reset, checkout, tests, source writes, platform APIs, models, MCP, or subagents.',
+  };
+}

package/tools/vibe-runtime/runtime-tdd-trace-contract.mjs

@@ -0,0 +1,277 @@
+import crypto from 'node:crypto';
+import { verificationGateFromTddTrace } from './runtime-verification-gate-chain-model.mjs';
+
+const tddTraceStage = 'Stage 113';
+const tddTraceKind = 'tdd-trace-contract';
+const cycleOrder = ['red', 'green', 'refactor'];
+
+export function runtimeTddTraceContract({
+  trace = {},
+  traceSource = {},
+  planActionManifest = null,
+  registry = {},
+  registryDigest = '',
+} = {}) {
+  const boundaryAssertions = runtimeTddTraceBoundaryAssertions();
+  const cycle = Object.fromEntries(cycleOrder.map((phase) => [phase, normalizePhase(trace?.[phase], phase)]));
+  const coveredActionItems = normalizeList(trace.covered_action_items || trace.action_items || trace.coverage).sort();
+  const planActionItemIds = Array.isArray(planActionManifest?.action_items)
+    ? planActionManifest.action_items.map((item) => item.id || item.title).filter(Boolean)
+    : [];
+  const coverage = coverageFor(coveredActionItems, planActionItemIds);
+  const structureFindings = structureFindingsFor(trace, cycle, coveredActionItems);
+  const sequence = cycleSequence(cycle);
+  const blockedReasons = [
+    ...structureFindings,
+    ...(sequence.valid ? [] : sequence.findings),
+    ...(coverage.unknown_action_items.map((item) => `unknown covered action item: ${item}`)),
+  ];
+  const contract = {
+    version: 1,
+    stage: tddTraceStage,
+    trace_kind: tddTraceKind,
+    source_trace: {
+      file: traceSource.relative || traceSource.file || '',
+      digest: traceSource.digest || '',
+      created_at: String(trace.created_at || ''),
+    },
+    source_bindings: {
+      plan_action_manifest_stage: planActionManifest?.stage || '',
+      plan_action_manifest_digest: planActionManifest?.plan_action_manifest_digest || '',
+      registry_stage: registry.registry_stage || '',
+      registry_kind: registry.registry_kind || '',
+      registry_version: registry.registry_version || 0,
+      registry_digest: registryDigest,
+    },
+    tdd_trace_contract: {
+      trace_file_read: Boolean(traceSource.digest),
+      cycle_order_valid: sequence.valid,
+      red_verified: cycle.red.verified,
+      green_verified: cycle.green.verified,
+      refactor_verified: cycle.refactor.verified,
+      covered_action_item_count: coveredActionItems.length,
+      test_execution_by_stage_113: false,
+      command_execution_by_stage_113: false,
+      execution_authorized: false,
+    },
+    cycle_order: sequence,
+    red_verified: cycle.red,
+    green_verified: cycle.green,
+    refactor_verified: cycle.refactor,
+    covered_action_items: coveredActionItems,
+    coverage,
+    blocked: blockedReasons.length > 0,
+    blocked_reasons: blockedReasons,
+    allowed_followup: [
+      'manual TDD evidence repair outside Stage 113',
+      'manual evidence intake outside Stage 113',
+      'Stage 114 human-friendly runtime aliases may summarize missing evidence without executing checks',
+    ],
+    forbidden_actions: [
+      'executing red, green, refactor, test, check, lint, or verification commands',
+      'repairing code, formatting, generating code, or mutating business source',
+      'creating or rewriting TDD trace artifacts',
+      'git command, commit, push, PR, merge, tag, reset, checkout, or history rewrite',
+      'sidecar or .vibecoding-state write',
+      'platform API, external network, model, MCP, or subagent invocation',
+      'treating TDD trace pass as execution permission',
+    ],
+    boundary_assertions: boundaryAssertions,
+    writes: false,
+    state_directory_created: false,
+    local_only: true,
+    deterministic: true,
+  };
+  const invariants = runtimeTddTraceInvariants(contract);
+  const withGate = {
+    ...contract,
+    tdd_trace_invariants: invariants,
+  };
+  return {
+    ...withGate,
+    verification_gate_chain: verificationGateFromTddTrace(withGate),
+    manual_action: invariants.pass
+      ? 'TDD trace contract is structurally usable. Stage 113 only read local trace evidence and did not run tests or commands.'
+      : 'Resolve the listed TDD trace blockers before using this trace as RED-GREEN-REFACTOR evidence.',
+  };
+}
+
+export function runtimeTddTraceInvariants(contract) {
+  const writableBoundaries = Object.entries(contract.boundary_assertions || {})
+    .filter(([, value]) => value !== false)
+    .map(([key]) => key);
+  const forbiddenMissing = ['tdd_trace_artifact', 'command_execution', 'check_execution', 'test_execution', 'repair_execution', 'git', 'git_write', 'commit', 'push', 'pr', 'merge', 'platform_api', 'external_network', 'model_invocation', 'subagent', 'mcp', 'business_source_write']
+    .filter((key) => contract.boundary_assertions?.[key] !== false);
+  const executablePhases = [contract.red_verified, contract.green_verified, contract.refactor_verified]
+    .filter((item) => item.command_executed_by_stage_113 !== false || item.execution_authorized !== false)
+    .map((item) => item.phase || item.command || 'unknown');
+  const findings = [
+    ...(contract.source_trace?.digest ? [] : ['missing TDD trace source digest']),
+    ...(contract.tdd_trace_contract?.cycle_order_valid ? [] : ['RED -> GREEN -> REFACTOR order must be provable']),
+    ...(contract.tdd_trace_contract?.red_verified ? [] : ['RED phase must be verified as expected failure']),
+    ...(contract.tdd_trace_contract?.green_verified ? [] : ['GREEN phase must be verified as passing']),
+    ...(contract.tdd_trace_contract?.refactor_verified ? [] : ['REFACTOR phase must be verified as passing or explicitly skipped']),
+    ...(contract.covered_action_items?.length > 0 ? [] : ['covered_action_items must not be empty']),
+    ...((contract.blocked_reasons || []).map((item) => `blocked: ${item}`)),
+    ...executablePhases.map((item) => `execution boundary must remain false for TDD phase: ${item}`),
+    ...writableBoundaries.map((item) => `boundary assertion must remain false: ${item}`),
+    ...forbiddenMissing.map((item) => `forbidden boundary missing or not false: ${item}`),
+  ];
+  return {
+    pass: findings.length === 0,
+    checked: ['local_tdd_trace_source_digest', 'red_green_refactor_order', 'red_expected_failure', 'green_pass', 'refactor_pass_or_skipped', 'covered_action_items', 'no_test_execution', 'read_only_boundary_assertions'],
+    findings,
+  };
+}
+
+export function runtimeTddTraceBoundaryAssertions() {
+  return {
+    tdd_trace_artifact: false,
+    test_result_artifact: false,
+    evidence_artifact_write: false,
+    sidecar_write: false,
+    state_directory_created: false,
+    command_execution: false,
+    check_execution: false,
+    test_execution: false,
+    verification_execution: false,
+    repair_execution: false,
+    formatting_execution: false,
+    code_generation: false,
+    runtime_action: false,
+    workflow_execution: false,
+    scheduler: false,
+    daemon: false,
+    retry: false,
+    git: false,
+    git_write: false,
+    commit: false,
+    pr: false,
+    push: false,
+    merge: false,
+    tag: false,
+    history_rewrite: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    subagent: false,
+    mcp: false,
+    worktree: false,
+    business_source_write: false,
+  };
+}
+
+export function runtimeTddTraceDigestPayload(contract) {
+  return {
+    stage: contract.stage,
+    trace_kind: contract.trace_kind,
+    source_trace: contract.source_trace,
+    source_bindings: contract.source_bindings,
+    tdd_trace_contract: contract.tdd_trace_contract,
+    cycle_order: contract.cycle_order,
+    red_verified: contract.red_verified,
+    green_verified: contract.green_verified,
+    refactor_verified: contract.refactor_verified,
+    covered_action_items: contract.covered_action_items,
+    coverage: contract.coverage,
+    blocked: contract.blocked,
+    blocked_reasons: contract.blocked_reasons,
+    allowed_followup: contract.allowed_followup,
+    forbidden_actions: contract.forbidden_actions,
+    boundary_assertions: contract.boundary_assertions,
+    tdd_trace_invariants: contract.tdd_trace_invariants,
+  };
+}
+
+export function digestTddTraceContract(value) {
+  return crypto.createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+
+function normalizePhase(value, phase) {
+  const source = value && typeof value === 'object' ? value : {};
+  const exitStatus = Number.isInteger(source.exit_status) ? source.exit_status : Number(source.exit_status);
+  const status = String(source.status || source.state || '').trim().toLowerCase();
+  const skipped = source.skipped === true || /skipped|not[_ -]?applicable/.test(status);
+  const command = String(source.command || '').trim();
+  const keyOutput = String(source.key_output || source.output || '').trim().slice(0, 1200);
+  const expectedFailure = source.expected_failure === true || /expected[_ -]?failure|red/.test(status);
+  const passed = Number.isFinite(exitStatus) && exitStatus === 0;
+  const failed = Number.isFinite(exitStatus) && exitStatus !== 0;
+  const verified = phase === 'red'
+    ? Boolean(command && keyOutput && expectedFailure && failed)
+    : phase === 'refactor'
+      ? Boolean(skipped || (command && keyOutput && passed))
+      : Boolean(command && keyOutput && passed);
+  return {
+    phase,
+    command,
+    exit_status: Number.isFinite(exitStatus) ? exitStatus : null,
+    expected_failure: phase === 'red' ? expectedFailure : false,
+    key_output: keyOutput,
+    skipped,
+    verified,
+    command_executed_by_stage_113: false,
+    execution_authorized: false,
+  };
+}
+
+function cycleSequence(cycle) {
+  const phaseIndexes = Object.fromEntries(cycleOrder.map((phase, index) => [phase, phaseIndex(cycle[phase], index)]));
+  const valid = phaseIndexes.red < phaseIndexes.green && phaseIndexes.green < phaseIndexes.refactor;
+  return {
+    expected: 'RED -> GREEN -> REFACTOR',
+    observed: cycleOrder,
+    phase_indexes: phaseIndexes,
+    valid,
+    findings: valid ? [] : ['cycle order must be RED before GREEN before REFACTOR'],
+    execution_authorized: false,
+  };
+}
+
+function phaseIndex(phaseItem, fallback) {
+  const explicit = Number(phaseItem?.order ?? phaseItem?.sequence);
+  return Number.isFinite(explicit) ? explicit : fallback;
+}
+
+function coverageFor(coveredActionItems, planActionItemIds) {
+  const expected = [...new Set(planActionItemIds)].sort();
+  const covered = [...new Set(coveredActionItems)].sort();
+  const expectedSet = new Set(expected);
+  return {
+    expected_action_items: expected,
+    covered_action_items: covered,
+    covered_expected_action_items: expected.length > 0 ? covered.filter((item) => expectedSet.has(item)) : [],
+    missing_expected_action_items: expected.length > 0 ? expected.filter((item) => !covered.includes(item)) : [],
+    unknown_action_items: expected.length > 0 ? covered.filter((item) => !expectedSet.has(item)) : [],
+    plan_bound: expected.length > 0,
+    coverage_complete: expected.length === 0 ? covered.length > 0 : expected.every((item) => covered.includes(item)),
+    execution_authorized: false,
+  };
+}
+
+function structureFindingsFor(trace, cycle, coveredActionItems) {
+  const findings = [];
+  if (!trace || typeof trace !== 'object' || Array.isArray(trace)) findings.push('TDD trace root must be a JSON object');
+  for (const phase of cycleOrder) {
+    if (!trace?.[phase] || typeof trace[phase] !== 'object') findings.push(`${phase}.command, ${phase}.exit_status, and ${phase}.key_output are required`);
+    if (!cycle[phase].verified) findings.push(`${phase} phase is not verified`);
+  }
+  if (!cycle.red.expected_failure) findings.push('red.expected_failure must be true');
+  if (coveredActionItems.length === 0) findings.push('covered_action_items must be a non-empty array');
+  return findings;
+}
+
+function normalizeList(value) {
+  if (Array.isArray(value)) return value.flatMap((item) => normalizeList(item));
+  if (value === undefined || value === null) return [];
+  if (typeof value === 'string') return value.split(/[,\n]/).map((item) => item.trim()).filter(Boolean);
+  return [String(value).trim()].filter(Boolean);
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+  if (value && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}

package/tools/vibe-runtime/runtime-test-evidence-model.mjs

@@ -0,0 +1,196 @@
+import crypto from 'node:crypto';
+
+const testRunStage = 'P4';
+const testRunKind = 'allowlisted-test-run-evidence';
+
+export function runtimeTestEvidenceEnvelope({ profile = {}, result = {}, createdAt = new Date().toISOString() } = {}) {
+  const status = Number.isInteger(result.exit_code) && result.exit_code === 0 ? 'pass' : 'fail';
+  const run = testEvidenceRun(profile, result, createdAt, status);
+  const boundaryAssertions = runtimeTestEvidenceBoundaryAssertions();
+  const evidence = {
+    ok: status === 'pass',
+    version: 1,
+    artifact_kind: 'test-evidence',
+    status: 'provided',
+    stage: testRunStage,
+    evidence_kind: testRunKind,
+    test_evidence_ref: profile.id || 'unknown-profile',
+    runs: [run],
+    runtime_executed_command: true,
+    runtime_run_test: true,
+    allowlisted_profile: true,
+    confirmation_required: true,
+    confirmation_received: true,
+    command_execution: true,
+    test_execution: true,
+    git: false,
+    git_write: false,
+    worktree_write: false,
+    commit: false,
+    push: false,
+    pr: false,
+    merge: false,
+    tag: false,
+    history_rewrite: false,
+    boundary_assertions: boundaryAssertions,
+  };
+  const runtimeTestRun = {
+    version: 1,
+    stage: testRunStage,
+    run_kind: testRunKind,
+    profile_id: profile.id || 'unknown-profile',
+    command: profile.command || '',
+    argv_digest: digestText(JSON.stringify(profile.argv || [])),
+    timeout_ms: profile.timeout_ms || 0,
+    exit_code: run.exit_code,
+    status,
+    stdout_digest: digestText(result.stdout || ''),
+    stderr_digest: digestText(result.stderr || ''),
+    stdout_line_count: lineCount(result.stdout || ''),
+    stderr_line_count: lineCount(result.stderr || ''),
+    output_digest: run.output_digest,
+    started_at: result.started_at || createdAt,
+    completed_at: result.completed_at || createdAt,
+    duration_ms: Number.isFinite(result.duration_ms) ? result.duration_ms : 0,
+    allowlist: {
+      fixed_profile: true,
+      arbitrary_shell: false,
+      user_command_string: false,
+      foreground: true,
+    },
+    boundary_assertions: boundaryAssertions,
+  };
+  const invariants = runtimeTestEvidenceInvariants(evidence, runtimeTestRun);
+  return {
+    ...evidence,
+    runtime_test_run: runtimeTestRun,
+    test_evidence_invariants: invariants,
+    test_evidence_digest: digestTestEvidence(runtimeTestEvidenceDigestPayload({ ...evidence, runtime_test_run: runtimeTestRun, test_evidence_invariants: invariants })),
+    blocked_reasons: status === 'pass' ? [] : [`test profile ${profile.id || 'unknown-profile'} exited with ${run.exit_code}`],
+    manual_action: status === 'pass'
+      ? 'Allowlisted foreground test run passed; bind this evidence only after reviewing the command profile and output digest.'
+      : 'Allowlisted foreground test run failed; keep the failure evidence and inspect output before making code changes.',
+  };
+}
+
+export function runtimeTestEvidenceInvariants(evidence, runtimeTestRun) {
+  const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
+  const findings = [
+    ...(evidence.artifact_kind === 'test-evidence' ? [] : ['artifact_kind must be test-evidence']),
+    ...(evidence.runtime_executed_command === true ? [] : ['runtime_executed_command must be true']),
+    ...(evidence.runtime_run_test === true ? [] : ['runtime_run_test must be true']),
+    ...(evidence.allowlisted_profile === true ? [] : ['allowlisted_profile must be true']),
+    ...(evidence.confirmation_received === true ? [] : ['confirmation_received must be true']),
+    ...(evidence.command_execution === true ? [] : ['command_execution must be true for P4 runtime test evidence']),
+    ...(evidence.test_execution === true ? [] : ['test_execution must be true for P4 runtime test evidence']),
+    ...(evidence.git === false && evidence.git_write === false && evidence.worktree_write === false ? [] : ['git and worktree boundaries must remain false']),
+    ...(runs.length === 1 ? [] : ['runs must contain exactly one run']),
+    ...runs.flatMap(testRunFindings),
+    ...(runtimeTestRun.allowlist?.arbitrary_shell === false ? [] : ['arbitrary shell must remain false']),
+    ...(runtimeTestRun.allowlist?.foreground === true ? [] : ['foreground must be true']),
+  ];
+  return {
+    pass: findings.length === 0,
+    checked: ['test_evidence_shape', 'explicit_confirmation', 'fixed_profile_allowlist', 'foreground_run', 'git_boundaries', 'output_digest'],
+    findings,
+  };
+}
+
+export function runtimeTestEvidenceDigestPayload(envelope) {
+  return {
+    stage: envelope.stage,
+    ok: envelope.ok,
+    evidence_kind: envelope.evidence_kind,
+    test_evidence_ref: envelope.test_evidence_ref,
+    runs: envelope.runs,
+    runtime_executed_command: envelope.runtime_executed_command,
+    runtime_run_test: envelope.runtime_run_test,
+    allowlisted_profile: envelope.allowlisted_profile,
+    confirmation_required: envelope.confirmation_required,
+    confirmation_received: envelope.confirmation_received,
+    command_execution: envelope.command_execution,
+    test_execution: envelope.test_execution,
+    git: envelope.git,
+    git_write: envelope.git_write,
+    worktree_write: envelope.worktree_write,
+    boundary_assertions: envelope.boundary_assertions,
+    runtime_test_run: envelope.runtime_test_run,
+    test_evidence_invariants: envelope.test_evidence_invariants,
+  };
+}
+
+export function digestTestEvidence(value) {
+  return crypto.createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+
+export function runtimeTestEvidenceBoundaryAssertions() {
+  return {
+    test_evidence_artifact: false,
+    sidecar_write: false,
+    state_directory_created: false,
+    runtime_run_test: true,
+    allowlisted_profile: true,
+    foreground: true,
+    arbitrary_shell: false,
+    user_command_string: false,
+    git: false,
+    git_write: false,
+    worktree_write: false,
+    commit: false,
+    push: false,
+    pr: false,
+    merge: false,
+    tag: false,
+    history_rewrite: false,
+    repair_execution: false,
+    formatting_execution: false,
+    code_generation: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    mcp: false,
+    business_source_write: false,
+  };
+}
+
+function testEvidenceRun(profile, result, timestamp, status) {
+  const exitCode = Number.isInteger(result.exit_code) ? result.exit_code : 1;
+  return {
+    id: profile.id || 'allowlisted-test-run',
+    command: profile.command || '',
+    exit_code: exitCode,
+    timestamp,
+    output_digest: digestText(`${result.stdout || ''}\n${result.stderr || ''}`),
+    task_refs: profile.task_refs || ['manual-test-run'],
+    scenario_refs: profile.scenario_refs || [`profile:${profile.id || 'unknown'}`],
+    status,
+  };
+}
+
+function testRunFindings(run, index) {
+  const id = String(run?.id || `run-${index}`).trim();
+  return [
+    ...(id ? [] : [`runs[${index}].id is required`]),
+    ...(String(run?.command || '').trim() ? [] : [`run.${id}.command is required`]),
+    ...(Number.isInteger(run?.exit_code) ? [] : [`run.${id}.exit_code must be an integer`]),
+    ...(String(run?.timestamp || '').trim() ? [] : [`run.${id}.timestamp is required`]),
+    ...(String(run?.output_digest || '').trim() ? [] : [`run.${id}.output_digest is required`]),
+    ...(Array.isArray(run?.task_refs) && run.task_refs.length > 0 ? [] : [`run.${id}.task_refs must not be empty`]),
+    ...(Array.isArray(run?.scenario_refs) && run.scenario_refs.length > 0 ? [] : [`run.${id}.scenario_refs must not be empty`]),
+  ];
+}
+
+function digestText(value) {
+  return `sha256:${crypto.createHash('sha256').update(String(value || '')).digest('hex')}`;
+}
+
+function lineCount(value) {
+  const text = String(value || '');
+  return text.trim() ? text.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n').length : 0;
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  return JSON.stringify(value);
+}

package/tools/vibe-runtime/runtime-test-run-command-deps.mjs

@@ -0,0 +1,7 @@
+export function runtimeTestRunCommandDeps(deps) {
+  return {
+    ensureRoot: deps.ensureRoot,
+    spawnSync: deps.spawnSync,
+    emitJson: deps.writeJsonEnvelope,
+  };
+}