@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-trace-command.mjs

@@ -0,0 +1,283 @@
+import { readonlyLocalStatePresent } from './runtime-readonly-local-json-output-envelope.mjs';
+import {
+  runtimeTraceGroup as resolveRuntimeTraceGroup,
+  runtimeTraceGroups as buildRuntimeTraceGroups,
+  runtimeTraceSafety,
+} from './runtime-trace-source-registry.mjs';
+
+const runtimeTraceContractSurfaces = Object.freeze(['runtime-cli-usage', 'tools/vibe-runtime-check/index.mjs']);
+
+export function createRuntimeTraceCommand(deps) {
+  const {
+    path,
+    process,
+    jsonSchemaVersion,
+    stateDirectoryName,
+    ensureRoot,
+    writeJsonEnvelope,
+    printList,
+    readJsonArtifact,
+    writeStateArtifact,
+    listStateFiles,
+    fileDigest,
+    digestObject,
+    validateCommonArtifactSafety,
+    safeStateArtifactFilePath,
+    runtimeTracesDirectory,
+    runtimeTraceFilePath,
+  } = deps;
+  const {
+    validateSubagentResultArtifact,
+    validateSubagentReviewArtifact,
+    validateHookRunArtifact,
+    validateSubagentSingleShotRunArtifact,
+    validateSubagentDispatchArtifact,
+    validatePlatformCapabilityArtifact,
+    validatePlatformSessionApprovalArtifact,
+    validatePlatformSessionArtifact,
+    validatePlatformSessionCancelArtifact,
+    validatePlatformSessionIntakeArtifact,
+    validatePlatformSessionReviewArtifact,
+    validateSourceChangeCandidateArtifact,
+    validateSourceSandboxRunArtifact,
+    validateSourceVerificationArtifact,
+    validateMergeReadinessArtifact,
+    validateMergeApprovalArtifact,
+    validateMergeApplyArtifact,
+    validatePlannerArtifact,
+    validateRouterArtifact,
+    validateOrchestratorArtifact,
+    validateEvalArtifact,
+    validateReleaseGateArtifact,
+    validateFeedbackLedgerArtifact,
+  } = deps;
+
+  if (!runtimeTraceContractSurfaces.includes('tools/vibe-runtime-check/index.mjs')) throw new Error('runtime trace contract marker missing');
+
+  function runtimeTraceSnapshotPath(root) {
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    return path.join(runtimeTracesDirectory(root), `${timestamp}.runtime-trace.json`);
+  }
+
+  function runtimeTraceGroups() {
+    return buildRuntimeTraceGroups(deps);
+  }
+
+  function runtimeTraceGroup(type) {
+    return resolveRuntimeTraceGroup(deps, type);
+  }
+
+  function runtimeTraceReferences(root) {
+    return runtimeTraceGroups().flatMap(([type, directory, extension, label]) => listStateFiles(root, directory, extension).map((fileName) => {
+      const file = path.join(directory(root), fileName);
+      let command = '';
+      let mode = '';
+      try {
+        const artifact = readJsonArtifact(file, label);
+        command = artifact.command || '';
+        mode = artifact.mode || '';
+      } catch {
+        command = 'invalid';
+        mode = 'invalid';
+      }
+      const descriptor = {
+        type,
+        file: fileName,
+        state_path: `${stateDirectoryName}/${path.basename(directory(root))}/${fileName}`.replace(/\\/g, '/'),
+        digest: fileDigest(file),
+        command,
+        mode,
+      };
+      return { ...descriptor, source_descriptor_digest: digestObject(descriptor) };
+    })).sort((left, right) => left.type.localeCompare(right.type) || left.file.localeCompare(right.file));
+  }
+
+  function runtimeTraceEnvelope(root, { persist = false } = {}) {
+    const sources = runtimeTraceReferences(root);
+    const byType = Object.fromEntries(runtimeTraceGroups().map(([type]) => [type, sources.filter((source) => source.type === type).length]));
+    const trace = {
+      version: 1,
+      stage: 'Stage 29',
+      created_at: new Date().toISOString(),
+      source_count: sources.length,
+      source_types: byType,
+      sources,
+      source_digest: digestObject(sources),
+      no_execution: true,
+      source_mutation: false,
+      external_delivery: false,
+    };
+    return {
+      mode: 'runtime-trace-build',
+      ok: true,
+      state_present: readonlyLocalStatePresent(root),
+      runtime_trace: { ...trace, trace_digest: digestObject(trace) },
+      safety: runtimeTraceSafety({ writes: persist }),
+      quality: [],
+      action: persist
+        ? 'runtime trace ledger was written locally. No source artifact was modified and no runtime action occurred.'
+        : 'runtime trace ledger was previewed read-only. No files were written and no runtime action occurred.',
+    };
+  }
+
+  function runtimeTraceSourcePath(root, source) {
+    const group = runtimeTraceGroup(source?.type || '');
+    if (!group) throw new Error(`unknown trace source type: ${source?.type || ''}`);
+    const [, directory, extension, label] = group;
+    return safeStateArtifactFilePath(root, directory, source.file, extension, label);
+  }
+
+  function validateRuntimeTraceSourceArtifact(root, source) {
+    const sourcePath = runtimeTraceSourcePath(root, source);
+    const artifact = readJsonArtifact(sourcePath, `Runtime trace source ${source.type}`);
+    if (source.type === 'subagent_results') return validateSubagentResultArtifact(root, artifact, source.file);
+    if (source.type === 'subagent_reviews') return validateSubagentReviewArtifact(root, artifact, source.file);
+    if (source.type === 'hook_runs' || source.type === 'hook_heartbeats') return validateHookRunArtifact(root, artifact, source.file);
+    if (source.type === 'subagent_run_results') return validateSubagentSingleShotRunArtifact(root, artifact, source.file);
+    if (source.type === 'subagent_dispatches') return validateSubagentDispatchArtifact(root, artifact);
+    if (source.type === 'platform_capabilities') return validatePlatformCapabilityArtifact(artifact, source.file);
+    if (source.type === 'platform_session_approvals') return validatePlatformSessionApprovalArtifact(root, artifact, source.file);
+    if (source.type === 'platform_sessions' || source.type === 'platform_session_leases' || source.type === 'platform_session_results') return validatePlatformSessionArtifact(root, artifact, source.file);
+    if (source.type === 'platform_session_cancellations') return validatePlatformSessionCancelArtifact(root, artifact, source.file);
+    if (source.type === 'platform_session_intake') return validatePlatformSessionIntakeArtifact(root, artifact, source.file);
+    if (source.type === 'platform_session_reviews') return validatePlatformSessionReviewArtifact(root, artifact, source.file);
+    if (source.type === 'source_change_candidates') return validateSourceChangeCandidateArtifact(root, artifact, source.file);
+    if (source.type === 'source_sandbox_runs') return validateSourceSandboxRunArtifact(root, artifact, source.file);
+    if (source.type === 'source_verifications') return validateSourceVerificationArtifact(root, artifact, source.file);
+    if (source.type === 'merge_readiness') return validateMergeReadinessArtifact(root, artifact, source.file);
+    if (source.type === 'merge_approvals') return validateMergeApprovalArtifact(root, artifact, source.file);
+    if (source.type === 'merge_applies') return validateMergeApplyArtifact(root, artifact, source.file);
+    if (source.type === 'planner_routes' || source.type === 'planner_plans' || source.type === 'planner_briefs') return validatePlannerArtifact(root, artifact, source.file);
+    if (source.type === 'router_plans' || source.type === 'router_approvals') return validateRouterArtifact(root, artifact, source.file);
+    if (source.type === 'orchestrator_plans' || source.type === 'orchestrator_dispatch_plans') return validateOrchestratorArtifact(root, artifact, source.file);
+    if (source.type === 'eval_suites' || source.type === 'eval_runs' || source.type === 'eval_reports') return validateEvalArtifact(root, artifact, source.file);
+    if (source.type === 'release_gates') return validateReleaseGateArtifact(root, artifact, source.file);
+    if (source.type === 'feedback_ledgers') return validateFeedbackLedgerArtifact(root, artifact, source.file);
+    return { ok: true, failures: [] };
+  }
+
+  function validateRuntimeTraceArtifact(root, artifact) {
+    const failures = [];
+    if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+    if (artifact.command !== 'traces') failures.push('command must be traces');
+    if (artifact.mode !== 'runtime-trace-build') failures.push('mode must be runtime-trace-build');
+    if (artifact.runtime_trace?.stage !== 'Stage 29') failures.push('runtime_trace.stage must be Stage 29');
+    if (artifact.runtime_trace?.version !== 1) failures.push('runtime_trace.version must be 1');
+    if (!Array.isArray(artifact.runtime_trace?.sources)) failures.push('runtime_trace.sources must be an array');
+    else {
+      for (const [index, source] of artifact.runtime_trace.sources.entries()) {
+        if (!source || typeof source !== 'object' || Array.isArray(source)) {
+          failures.push(`runtime_trace.sources.${index} must be an object`);
+          continue;
+        }
+        for (const key of ['type', 'file', 'state_path', 'digest', 'command', 'mode', 'source_descriptor_digest']) {
+          if (typeof source[key] !== 'string') failures.push(`runtime_trace.sources.${index}.${key} must be a string`);
+        }
+        if (String(source.file || '').includes('/') || String(source.file || '').includes('\\') || String(source.file || '').includes('..')) failures.push(`runtime_trace.sources.${index}.file must be a safe local file name`);
+        const { source_descriptor_digest: _descriptorDigest, ...unsignedSource } = source;
+        if (source.source_descriptor_digest && digestObject(unsignedSource) !== source.source_descriptor_digest) failures.push(`runtime_trace.sources.${index}.source_descriptor_digest mismatch`);
+        try {
+          const sourcePath = runtimeTraceSourcePath(root, source);
+          if (fileDigest(sourcePath) !== source.digest) failures.push(`runtime_trace.sources.${index}.digest mismatch`);
+          const sourceVerification = validateRuntimeTraceSourceArtifact(root, source);
+          if (!sourceVerification.ok) failures.push(...sourceVerification.failures.map((failure) => `runtime_trace.sources.${index}.artifact verification failed: ${failure}`));
+        } catch (error) {
+          failures.push(`runtime_trace.sources.${index}.${error.message}`);
+        }
+      }
+      if (artifact.runtime_trace.source_count !== artifact.runtime_trace.sources.length) failures.push('runtime_trace.source_count mismatch');
+      if (artifact.runtime_trace.source_digest !== digestObject(artifact.runtime_trace.sources)) failures.push('runtime_trace.source_digest mismatch');
+    }
+    const { trace_digest: _traceDigest, ...unsignedTrace } = artifact.runtime_trace || {};
+    if (artifact.runtime_trace?.trace_digest && digestObject(unsignedTrace) !== artifact.runtime_trace.trace_digest) failures.push('runtime_trace.trace_digest mismatch');
+    failures.push(...validateCommonArtifactSafety(artifact.safety, 'Stage 29'));
+    if (artifact.safety?.trace_artifact !== true) failures.push('safety.trace_artifact must be true');
+    if (artifact.safety?.source_mutation !== false) failures.push('safety.source_mutation must be false');
+    if (artifact.safety?.external_delivery !== false) failures.push('safety.external_delivery must be false');
+    return { ok: failures.length === 0, failures };
+  }
+
+  function writeRuntimeTrace(root, envelope) {
+    const file = runtimeTraceSnapshotPath(root);
+    const payload = { schema_version: jsonSchemaVersion, command: 'traces', ...envelope, safety: { ...envelope.safety, trace_artifact: true } };
+    const verification = validateRuntimeTraceArtifact(root, payload);
+    if (!verification.ok) throw new Error(`runtime trace verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+
+  function runtimeTraceAuditEnvelope(root, mode, traceFile = '') {
+    if (mode === 'list') {
+      const traces = listStateFiles(root, runtimeTracesDirectory, '.runtime-trace.json').map((fileName) => {
+        try {
+          const trace = readJsonArtifact(path.join(runtimeTracesDirectory(root), fileName), 'Runtime trace');
+          const verification = validateRuntimeTraceArtifact(root, trace);
+          return { file: fileName, source_count: trace.runtime_trace?.source_count || 0, trace_digest: trace.runtime_trace?.trace_digest || '', verification_ok: verification.ok, verification_failures: verification.failures };
+        } catch (error) {
+          return { file: fileName, source_count: 0, trace_digest: '', verification_ok: false, verification_failures: [error.message] };
+        }
+      });
+      return { mode: 'runtime-trace-list', ok: true, summary: { count: traces.length, failed_count: traces.filter((item) => !item.verification_ok).length }, traces, quality: [], action: 'read-only runtime trace audit listed trace artifacts. No source artifact was modified.' };
+    }
+    const file = runtimeTraceFilePath(root, traceFile);
+    const trace = readJsonArtifact(file, 'Runtime trace');
+    const verification = validateRuntimeTraceArtifact(root, trace);
+    if (mode === 'verify' && !verification.ok) throw new Error(`runtime trace verification failed: ${verification.failures.join('; ')}`);
+    return { mode: mode === 'verify' ? 'runtime-trace-verify' : 'runtime-trace-show', ok: verification.ok, summary: { file: path.basename(file), source_count: trace.runtime_trace?.source_count || 0, trace_digest: trace.runtime_trace?.trace_digest || '' }, verification, trace, quality: verification.failures, action: 'read-only runtime trace audit inspected one trace artifact. No source artifact was modified.' };
+  }
+
+  function printRuntimeTrace(envelope, file = '') {
+    console.log('Vibecoding Runtime Trace Ledger');
+    console.log(`Mode: ${envelope.mode.replace('runtime-trace-', '')}`);
+    if (envelope.runtime_trace) {
+      console.log(`Sources: ${envelope.runtime_trace.source_count}; Digest: ${envelope.runtime_trace.source_digest}`);
+      if (file) console.log(`Runtime trace: ${path.relative(process.cwd(), file)}`);
+    } else if (envelope.mode === 'runtime-trace-list') {
+      console.log(`Traces: ${envelope.summary.count}; Failed: ${envelope.summary.failed_count}`);
+      for (const trace of envelope.traces) console.log(`- ${trace.file}: sources=${trace.source_count}; verification=${trace.verification_ok ? 'passed' : 'failed'}`);
+    } else {
+      console.log(`File: ${envelope.summary.file}`);
+      console.log(`Sources: ${envelope.summary.source_count}`);
+      console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+      if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+    }
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function runTraces(options) {
+    if (options.write || options.scan || options.once || options.fromDispatch || options.actor || options.approval || options.run || options.autoRun) throw new Error('traces supports build and read-only audit only');
+    ensureRoot(options.root);
+    const modes = [options.traceBuild, options.traceList, options.traceShow, options.traceVerify].filter(Boolean);
+    if (modes.length !== 1) throw new Error('traces requires exactly one of --build, --list, --show, or --verify');
+    if (options.traceBuild) {
+      if (options.confirm && options.dryRun) throw new Error('traces --build accepts either --dry-run or --confirm, not both');
+      const envelope = runtimeTraceEnvelope(options.root, { persist: options.confirm });
+      if (options.confirm) {
+        const file = writeRuntimeTrace(options.root, envelope);
+        if (options.json) writeJsonEnvelope('traces', { ...envelope, runtime_trace_file: path.basename(file) });
+        else printRuntimeTrace(envelope, file);
+        return;
+      }
+      if (options.json) writeJsonEnvelope('traces', envelope);
+      else printRuntimeTrace(envelope);
+      return;
+    }
+    if (options.confirm || options.dryRun) throw new Error('trace audit is read-only');
+    const mode = options.traceList ? 'list' : options.traceVerify ? 'verify' : 'show';
+    const envelope = runtimeTraceAuditEnvelope(options.root, mode, options.traceFile);
+    if (options.json) writeJsonEnvelope('traces', envelope);
+    else printRuntimeTrace(envelope);
+  }
+
+  return {
+    runtimeTraceSnapshotPath,
+    runtimeTraceGroups,
+    runtimeTraceGroup,
+    runtimeTraceReferences,
+    runtimeTraceEnvelope,
+    validateRuntimeTraceArtifact,
+    writeRuntimeTrace,
+    runtimeTraceAuditEnvelope,
+    printRuntimeTrace,
+    runTraces,
+  };
+}

package/tools/vibe-runtime/runtime-trace-source-registry.mjs

@@ -0,0 +1,132 @@
+export function runtimeTraceGroups(deps) {
+  const {
+    schedulerPlansDirectory,
+    schedulerHookPlansDirectory,
+    schedulerRunsDirectory,
+    recoveryClassificationsDirectory,
+    recoveryRunsDirectory,
+    retryPackagesDirectory,
+    retryRunsDirectory,
+    daemonLoopsDirectory,
+    daemonHeartbeatsDirectory,
+    replyDraftsDirectory,
+    replyReviewsDirectory,
+    replyApprovalsDirectory,
+    replyOutboxDirectory,
+    replySendRunsDirectory,
+    observabilityDirectory,
+    methodologyGatesDirectory,
+    hookIntentsDirectory,
+    hookRunsDirectory,
+    hookHeartbeatsDirectory,
+    subagentDispatchesDirectory,
+    subagentRunResultsDirectory,
+    subagentResultsDirectory,
+    subagentReviewsDirectory,
+    platformCapabilitiesDirectory,
+    platformSessionApprovalsDirectory,
+    platformSessionsDirectory,
+    platformSessionLeasesDirectory,
+    platformSessionResultsDirectory,
+    platformSessionCancellationsDirectory,
+    platformSessionIntakeDirectory,
+    platformSessionReviewsDirectory,
+    sourceChangeCandidatesDirectory,
+    sourceSandboxRunsDirectory,
+    sourceVerificationsDirectory,
+    mergeReadinessDirectory,
+    mergeApprovalsDirectory,
+    mergeAppliesDirectory,
+    plannerRoutesDirectory,
+    plannerPlansDirectory,
+    plannerBriefsDirectory,
+    routerPlansDirectory,
+    routerApprovalsDirectory,
+    orchestratorPlansDirectory,
+    orchestratorDispatchPlansDirectory,
+    evalSuitesDirectory,
+    evalRunsDirectory,
+    evalReportsDirectory,
+    releaseGatesDirectory,
+    feedbackLedgersDirectory,
+  } = deps;
+
+  return [
+    ['scheduler_plans', schedulerPlansDirectory, '.scheduler-plan.json', 'Scheduler plan'],
+    ['scheduler_hook_plans', schedulerHookPlansDirectory, '.scheduler-hook-plan.json', 'Scheduler hook plan'],
+    ['scheduler_runs', schedulerRunsDirectory, '.scheduler-run.json', 'Scheduler run'],
+    ['recovery_classifications', recoveryClassificationsDirectory, '.recovery-classification.json', 'Recovery classification'],
+    ['recovery_runs', recoveryRunsDirectory, '.recovery-run.json', 'Recovery run'],
+    ['retry_packages', retryPackagesDirectory, '.retry-package.json', 'Retry package'],
+    ['retry_runs', retryRunsDirectory, '.retry-run.json', 'Retry run'],
+    ['daemon_loops', daemonLoopsDirectory, '.daemon-loop.json', 'Daemon loop'],
+    ['daemon_heartbeats', daemonHeartbeatsDirectory, '.heartbeat.json', 'Daemon heartbeat'],
+    ['reply_drafts', replyDraftsDirectory, '.reply-draft.json', 'Reply draft'],
+    ['reply_reviews', replyReviewsDirectory, '.reply-review.json', 'Reply review'],
+    ['reply_approvals', replyApprovalsDirectory, '.reply-approval.json', 'Reply approval'],
+    ['reply_outbox', replyOutboxDirectory, '.reply-outbox.json', 'Reply outbox'],
+    ['reply_send_runs', replySendRunsDirectory, '.reply-send-run.json', 'Reply send run'],
+    ['observability', observabilityDirectory, '.observability.json', 'Observability'],
+    ['methodology_gates', methodologyGatesDirectory, '.methodology-gate.json', 'Methodology gate'],
+    ['hook_intents', hookIntentsDirectory, '.hook-intent.json', 'Hook intent'],
+    ['hook_runs', hookRunsDirectory, '.hook-run.json', 'Hook run'],
+    ['hook_heartbeats', hookHeartbeatsDirectory, '.hook-heartbeat.json', 'Hook heartbeat'],
+    ['subagent_dispatches', subagentDispatchesDirectory, '.subagent-dispatch.json', 'Subagent dispatch'],
+    ['subagent_run_results', subagentRunResultsDirectory, '.subagent-run-result.json', 'Subagent run result'],
+    ['subagent_results', subagentResultsDirectory, '.subagent-result.json', 'Subagent ingested result'],
+    ['subagent_reviews', subagentReviewsDirectory, '.subagent-review.json', 'Subagent review'],
+    ['platform_capabilities', platformCapabilitiesDirectory, '.platform-capability.json', 'Platform capability'],
+    ['platform_session_approvals', platformSessionApprovalsDirectory, '.platform-session-approval.json', 'Platform session approval'],
+    ['platform_sessions', platformSessionsDirectory, '.platform-session.json', 'Platform session'],
+    ['platform_session_leases', platformSessionLeasesDirectory, '.platform-session-lease.json', 'Platform session lease'],
+    ['platform_session_results', platformSessionResultsDirectory, '.platform-session-result.json', 'Platform session result'],
+    ['platform_session_cancellations', platformSessionCancellationsDirectory, '.platform-session-cancel.json', 'Platform session cancellation'],
+    ['platform_session_intake', platformSessionIntakeDirectory, '.platform-session-intake.json', 'Platform session intake'],
+    ['platform_session_reviews', platformSessionReviewsDirectory, '.platform-session-review.json', 'Platform session review'],
+    ['source_change_candidates', sourceChangeCandidatesDirectory, '.source-change-candidate.json', 'Source change candidate'],
+    ['source_sandbox_runs', sourceSandboxRunsDirectory, '.source-sandbox-run.json', 'Source sandbox run'],
+    ['source_verifications', sourceVerificationsDirectory, '.source-verification.json', 'Source verification'],
+    ['merge_readiness', mergeReadinessDirectory, '.merge-readiness.json', 'Merge readiness'],
+    ['merge_approvals', mergeApprovalsDirectory, '.merge-approval.json', 'Merge approval'],
+    ['merge_applies', mergeAppliesDirectory, '.merge-apply.json', 'Merge apply'],
+    ['planner_routes', plannerRoutesDirectory, '.planner-route.json', 'Planner route'],
+    ['planner_plans', plannerPlansDirectory, '.planner-plan.json', 'Planner plan'],
+    ['planner_briefs', plannerBriefsDirectory, '.planner-briefs.json', 'Planner briefs'],
+    ['router_plans', routerPlansDirectory, '.router-plan.json', 'Router plan'],
+    ['router_approvals', routerApprovalsDirectory, '.router-approval.json', 'Router approval'],
+    ['orchestrator_plans', orchestratorPlansDirectory, '.orchestrator-plan.json', 'Orchestrator plan'],
+    ['orchestrator_dispatch_plans', orchestratorDispatchPlansDirectory, '.orchestrator-dispatch-plan.json', 'Orchestrator dispatch plan'],
+    ['eval_suites', evalSuitesDirectory, '.eval-suite.json', 'Eval suite'],
+    ['eval_runs', evalRunsDirectory, '.eval-run.json', 'Eval run'],
+    ['eval_reports', evalReportsDirectory, '.eval-report.json', 'Eval report'],
+    ['release_gates', releaseGatesDirectory, '.release-gate.json', 'Release gate'],
+    ['feedback_ledgers', feedbackLedgersDirectory, '.feedback-ledger.json', 'Feedback ledger'],
+  ];
+}
+
+export function runtimeTraceGroup(deps, type) {
+  return runtimeTraceGroups(deps).find(([groupType]) => groupType === type) || null;
+}
+
+export function runtimeTraceSafety({ writes = false } = {}) {
+  return {
+    stage: 'Stage 29',
+    writes: Boolean(writes),
+    trace_artifact: Boolean(writes),
+    runtime_action: false,
+    auto_execution: false,
+    platform_api: false,
+    skill_execution: false,
+    business_source_write: false,
+    source_mutation: false,
+    external_delivery: false,
+    model_invocation: false,
+    subagent: false,
+    mcp: false,
+    daemon: false,
+    git: false,
+    worktree: false,
+    dispatch_event_modified: false,
+    claim_modified: false,
+  };
+}

package/tools/vibe-runtime/runtime-verification-gate-chain-model.mjs

@@ -0,0 +1,131 @@
+import crypto from 'node:crypto';
+
+export const verificationGateChainKind = 'superpowers-parity-verification-gate-chain';
+
+export function verificationGateFromTddTrace(tddTrace = {}) {
+  const strategy = tddTraceStrategy(tddTrace);
+  const evidence = [
+    evidenceItem('tdd-trace-source', tddTrace.source_trace?.file, tddTrace.source_trace?.digest, Boolean(tddTrace.source_trace?.digest)),
+    evidenceItem('red-phase', tddTrace.red_verified?.command, tddTrace.red_verified?.key_output, tddTrace.red_verified?.verified === true),
+    evidenceItem('green-phase', tddTrace.green_verified?.command, tddTrace.green_verified?.key_output, tddTrace.green_verified?.verified === true),
+    evidenceItem('refactor-phase', tddTrace.refactor_verified?.command, tddTrace.refactor_verified?.key_output, tddTrace.refactor_verified?.verified === true),
+    evidenceItem('covered-action-items', 'covered_action_items', String((tddTrace.covered_action_items || []).length), (tddTrace.covered_action_items || []).length > 0),
+  ];
+  return buildGate({
+    stage: tddTrace.stage || 'Stage 113',
+    source_kind: tddTrace.trace_kind || 'tdd-trace-contract',
+    risk_level: 'implementation',
+    strategy,
+    evidence,
+    explicit_risk_note: '',
+    inherited_blockers: [...(tddTrace.blocked_reasons || []), ...(tddTrace.tdd_trace_invariants?.findings || [])],
+  });
+}
+
+export function verificationGateFromCompletionBundle(bundle = {}) {
+  const strategy = completionStrategy(bundle);
+  const taskSummary = bundle.task_completion_summary || {};
+  const evidence = [
+    evidenceItem('implementation-plan', bundle.implementation_chain?.plan?.file, bundle.implementation_chain?.plan?.digest, bundle.implementation_chain?.plan_bound === true),
+    evidenceItem('test-evidence', bundle.implementation_chain?.test_evidence?.file, bundle.implementation_chain?.test_evidence?.digest, bundle.implementation_chain?.test_evidence_bound === true && bundle.implementation_chain?.test_evidence_gate?.ok === true),
+    evidenceItem('diff-coverage', bundle.implementation_chain?.diff_coverage?.file, bundle.implementation_chain?.diff_coverage?.digest, bundle.implementation_chain?.diff_coverage_bound === true && bundle.implementation_chain?.diff_coverage_gate?.ok === true),
+    evidenceItem('implementation-alignment', 'implementation_alignment_gate', String(bundle.implementation_chain?.implementation_alignment_gate?.ok === true), bundle.implementation_chain?.implementation_alignment_gate?.ok === true),
+    evidenceItem('commit-boundary', 'commit_readiness_gate', String(bundle.release_readiness_chain?.commit_readiness_gate?.ok === true), bundle.release_readiness_chain?.commit_execution_authorized === false),
+  ];
+  return buildGate({
+    stage: bundle.stage || 'Stage 152',
+    source_kind: bundle.bundle_kind || 'product-completion-evidence-bundle',
+    risk_level: bundle.expanded_delivery_chain ? 'runtime-workflow' : 'docs-config',
+    strategy,
+    evidence,
+    explicit_risk_note: taskSummary.manual_next_action || '',
+    inherited_blockers: [...(bundle.blocked_reasons || []), ...(bundle.invariants?.findings || [])],
+  });
+}
+
+function buildGate({ stage, source_kind, risk_level, strategy, evidence, explicit_risk_note, inherited_blockers }) {
+  const missing = evidence.filter((item) => item.bound !== true).map((item) => item.id);
+  const blockers = unique([...missing.map((item) => `missing verification evidence: ${item}`), ...inherited_blockers]);
+  const riskAccepted = Boolean(explicit_risk_note && blockers.length > 0);
+  const ready = blockers.length === 0;
+  const gate = {
+    version: 1,
+    stage,
+    gate_chain_kind: verificationGateChainKind,
+    source_kind,
+    risk_level,
+    strategy,
+    evidence,
+    ready_for_closeout: ready,
+    can_claim_verified: ready,
+    explicit_risk_note: riskAccepted ? explicit_risk_note : '',
+    blocked_reasons: blockers,
+    allowed_followup: ready ? ['manual closeout with cited evidence'] : ['add evidence or report explicit risk before closeout'],
+    forbidden_actions: ['run tests', 'run checks', 'git write', 'commit', 'push', 'PR or merge', 'platform API call', 'model invocation', 'runtime subagent invocation', 'business source write'],
+    boundary_assertions: boundaryAssertions(),
+    writes: false,
+    local_only: true,
+    deterministic: true,
+  };
+  return { ...gate, verification_gate_digest: digest(gate) };
+}
+
+function tddTraceStrategy(tddTrace) {
+  return {
+    required_before_implementation: ['RED expected failure', 'GREEN pass evidence', 'REFACTOR pass or explicit skip', 'covered action items'],
+    required_before_closeout: ['trace digest', 'cycle order', 'phase outputs', 'coverage binding'],
+    has_strategy: tddTrace.tdd_trace_contract?.cycle_order_valid === true,
+  };
+}
+
+function completionStrategy(bundle) {
+  return {
+    required_before_implementation: ['implementation plan', 'test evidence strategy', 'diff coverage expectation'],
+    required_before_closeout: ['test evidence', 'diff coverage', 'implementation alignment', 'commit boundary'],
+    has_strategy: bundle.implementation_chain?.implementation_plan_gate?.gate_ok === true || bundle.implementation_chain?.plan_bound === true,
+  };
+}
+
+function evidenceItem(id, file, digestValue, bound) {
+  return {
+    id,
+    file: file || '',
+    digest: digestValue || '',
+    bound: Boolean(bound),
+  };
+}
+
+function boundaryAssertions() {
+  return {
+    command_execution: false,
+    check_execution: false,
+    test_execution: false,
+    git_write: false,
+    commit: false,
+    push: false,
+    pr: false,
+    merge: false,
+    worktree: false,
+    source_write: false,
+    business_source_write: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    subagent: false,
+    mcp: false,
+  };
+}
+
+function unique(values) {
+  return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}
+
+function digest(value) {
+  return crypto.createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  return JSON.stringify(value);
+}