@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-control-plane-readonly-deps.mjs

@@ -0,0 +1,146 @@
+export function runtimeControlPlaneReadOnlyCommand(deps) {
+  const {
+    createRuntimeControlPlaneReadOnlyCommands,
+    fs,
+    ensureRoot,
+    writeJsonEnvelope,
+    writeStateArtifact,
+    printList,
+    localTextEvidenceDescriptor,
+    planActionManifestEnvelope,
+    runtimeAutomationReadinessEnvelope,
+    runtimeCapabilityRegistry,
+    stateDirectory,
+    workflowPath,
+    runtimeReviewIntakeEnvelope,
+    runtimeReviewIntakeDigestPayload,
+    runtimeReviewResolutionEnvelope,
+    runtimeReviewResolutionDigestPayload,
+    digestReviewEnvelope,
+    runReleaseCommand,
+    digestObject,
+    releaseGateAuditEnvelope,
+    releaseNotesAuditEnvelope,
+    releaseNotesEnvelope,
+    writeReleaseNotesArtifact,
+    buildReleaseGateEnvelope,
+    writeReleaseGateArtifact,
+    stagedCommitReadinessEnvelope,
+    commitReadinessEnvelope,
+    diffCoverageEnvelope,
+    gitDiffReadEnvelope,
+    collectGitDiffReadResults,
+    commitGuardEnvelope,
+    commitGuardBoundaryAssertions,
+    printRelease,
+    printStagedCommitReadiness,
+    printCommitReadiness,
+    printDiffCoverage,
+    printGitDiffRead,
+    printCommitGuard,
+    runtimePolicyCatalogDigest,
+    validateRuntimePolicyCatalogDigest,
+    stateDirectoryName,
+    feedbackLedgersDirectoryName,
+    feedbackLedgerSnapshotPath,
+    feedbackLedgerFilePath,
+    readJsonArtifact,
+    fileDigest,
+    artifactPayloadDigest,
+    plannerRouteFilePath,
+    plannerPlanFilePath,
+    plannerBriefsFilePath,
+    validatePlannerArtifact,
+    routerPlanFilePath,
+    routerApprovalFilePath,
+    validateRouterArtifact,
+    orchestratorPlanFilePath,
+    orchestratorDispatchPlanFilePath,
+    validateOrchestratorArtifact,
+    evalReportFilePath,
+    validateEvalArtifact,
+    releaseGateFilePath,
+    validateReleaseGateArtifact,
+    feedbackSafety,
+    validateStage53Safety,
+    jsonSchemaVersion,
+  } = deps;
+    return createRuntimeControlPlaneReadOnlyCommands({
+      ensureRoot,
+      emitReviewJsonEnvelope: (envelope) => writeJsonEnvelope('review', envelope),
+      emitFeedbackJsonEnvelope: (envelope) => writeJsonEnvelope('feedback', envelope),
+      printList,
+      localTextEvidenceDescriptor,
+      planActionManifestEnvelope,
+      runtimeAutomationReadinessEnvelope,
+      runtimeCapabilityRegistry,
+      runtimeStatePresent: (root) => fs.existsSync(stateDirectory(root)),
+      workflowStatePresent: (root) => fs.existsSync(workflowPath(root)),
+      runtimeReviewIntakeEnvelope,
+      runtimeReviewIntakeDigestPayload,
+      runtimeReviewResolutionEnvelope,
+      runtimeReviewResolutionDigestPayload,
+      digestReviewEnvelope,
+      runReleaseCommand,
+      releaseDeps: () => ({
+        ensureRoot,
+        stateDirectory,
+        writeJsonEnvelope,
+        writeStateArtifact,
+        digestObject,
+        releaseGateAuditEnvelope,
+        releaseNotesAuditEnvelope,
+        releaseNotesEnvelope,
+        writeReleaseNotesArtifact,
+        buildReleaseGateEnvelope,
+        writeReleaseGateArtifact,
+        stagedCommitReadinessEnvelope,
+        commitReadinessEnvelope,
+        diffCoverageEnvelope,
+        gitDiffReadEnvelope,
+        collectGitDiffReadResults,
+        commitGuardEnvelope,
+        commitGuardBoundaryAssertions,
+        printRelease,
+        printStagedCommitReadiness,
+        printCommitReadiness,
+        printDiffCoverage,
+        printGitDiffRead,
+        printCommitGuard,
+      }),
+      digestObject,
+      runtimePolicyCatalogDigest,
+      validateRuntimePolicyCatalogDigest,
+      stateDirectoryName,
+      feedbackLedgersDirectoryName,
+      feedbackLedgerSnapshotPath,
+      feedbackLedgerFilePath,
+      readJsonArtifact,
+      fileDigest,
+      artifactPayloadDigest,
+      plannerRouteFilePath,
+      plannerPlanFilePath,
+      plannerBriefsFilePath,
+      validatePlannerArtifact,
+      routerPlanFilePath,
+      routerApprovalFilePath,
+      validateRouterArtifact,
+      orchestratorPlanFilePath,
+      orchestratorDispatchPlanFilePath,
+      validateOrchestratorArtifact,
+      evalReportFilePath,
+      validateEvalArtifact,
+      releaseGateFilePath,
+      validateReleaseGateArtifact,
+      feedbackSafety,
+      validateStage53Safety,
+      feedbackPreviewAction: 'feedback ledger was previewed read-only from control-plane artifacts. No files were written and no runtime action occurred.',
+      feedbackPersistAction: 'feedback ledger artifact was written locally from verified control-plane artifacts. No git, PR, push, merge, platform API, model invocation, or business source write occurred.',
+      feedbackAuditAction: 'read-only feedback ledger audit inspected one local feedback ledger artifact. No git, PR, push, merge, platform API, model invocation, or business source write occurred.',
+      persistFeedbackLedgerPayload: (directory, file, payload) => writeStateArtifact(directory, file, payload),
+      jsonSchemaVersion,
+      reviewBoundaryLine: 'Boundary: writes=false; review_intake_artifact=false; review_resolution_artifact=false; command_execution=false; repair_execution=false; reviewer_invocation=false; git=false; git_write=false; commit=false; pr=false; push=false; merge=false; platform_api=false; external_network=false; model_invocation=false; subagent=false; mcp=false; business_source_write=false',
+      reviewIntakeAction: 'review intake envelope was computed read-only from one local review JSON file and optional Stage 105 plan manifest. Stage 112 did not invoke a reviewer, call a platform API, create a subagent, run checks, repair code, write review artifacts, create sidecars, call git, commit, push, PR, merge, call external network, model, MCP, daemon, scheduler, retry, or mutate business source.',
+      reviewResolutionAction: 'review resolution envelope was computed read-only from one local review intake JSON file and one local repair evidence JSON file. Stage 112 did not invoke reviewers, repair code, run checks, write evidence artifacts, create sidecars, call git, commit, push, PR, merge, call platform API, external network, model, subagent, MCP, daemon, scheduler, retry, or mutate business source.',
+    });
+}

package/tools/vibe-runtime/runtime-control-plane-release-evidence.mjs

@@ -0,0 +1,525 @@
+export function createRuntimeControlPlaneReleaseEvidence(deps) {
+  const {
+    fs,
+    path,
+    process,
+    jsonSchemaVersion,
+    stateDirectoryName,
+    releaseNotesDirectoryName,
+    ensureRoot,
+    stateDirectory,
+    releaseNotesSnapshotPath,
+    releaseNotesFilePath,
+    readJsonArtifact,
+    writeStateArtifact,
+    fileDigest,
+    digestObject,
+    printList,
+    localTextEvidenceDescriptor,
+    planActionManifestEnvelope,
+    runtimeCapabilityRegistry,
+    runtimeDiffCoverageEnvelope,
+    runtimeDiffCoverageDigestPayload,
+    digestDiffCoverage,
+    runtimeGitDiffReadEnvelope,
+    validateCommonArtifactSafety,
+  } = deps;
+function releaseNotesBoundaryAssertions() {
+  return {
+    git_write: false,
+    history_rewrite: false,
+    tag: false,
+    pr: false,
+    push: false,
+    merge: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    runtime_action: false,
+    business_source_write: false,
+    source_merge: false,
+    worktree_write: false,
+    command_execution: false,
+    release_gate_required: false,
+  };
+}
+
+function releaseNotesEvidencePath(root, evidenceFile) {
+  const raw = String(evidenceFile || '').trim();
+  if (!raw) throw new Error('release notes evidence file is required');
+  if (!path.isAbsolute(raw) && raw.includes('\\')) throw new Error(`release notes evidence file must use forward slashes: ${raw}`);
+  if (!path.isAbsolute(raw) && raw.split('/').some((part) => part === '' || part === '.' || part === '..')) throw new Error(`release notes evidence file must not include traversal: ${raw}`);
+  const absolute = path.isAbsolute(raw) ? path.resolve(raw) : path.join(root, ...raw.split('/'));
+  const relative = path.relative(root, absolute).replace(/\\/g, '/');
+  if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error(`release notes evidence file escapes root: ${raw}`);
+  if (relative.split('/').some((part) => part === '' || part === '.' || part === '..')) throw new Error(`release notes evidence file must not include traversal: ${relative}`);
+  if (!fs.existsSync(absolute)) throw new Error(`release notes evidence file not found: ${relative}`);
+  if (!fs.statSync(absolute).isFile()) throw new Error(`release notes evidence path is not a file: ${relative}`);
+  return { file: absolute, relative };
+}
+
+function commitGuardBoundaryAssertions() {
+  return {
+    writes: false,
+    state_directory_created: false,
+    commit_guard_artifact: false,
+    sidecar_write: false,
+    git: false,
+    git_write: false,
+    history_rewrite: false,
+    tag: false,
+    pr: false,
+    push: false,
+    merge: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    runtime_action: false,
+    command_execution: false,
+    auto_execution: false,
+    business_source_write: false,
+    source_merge: false,
+    worktree_write: false,
+    release_gate_required: false,
+  };
+}
+
+function commitGuardEvidencePath(root, evidenceFile) {
+  const raw = String(evidenceFile || '').trim();
+  if (!raw) throw new Error('commit guard evidence file is required');
+  if (!path.isAbsolute(raw) && raw.includes('\\')) throw new Error(`commit guard evidence file must use forward slashes: ${raw}`);
+  if (!path.isAbsolute(raw) && raw.split('/').some((part) => part === '' || part === '.' || part === '..')) throw new Error(`commit guard evidence file must not include traversal: ${raw}`);
+  const absolute = path.isAbsolute(raw) ? path.resolve(raw) : path.join(root, ...raw.split('/'));
+  const relative = path.relative(root, absolute).replace(/\\/g, '/');
+  if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error(`commit guard evidence file escapes root: ${raw}`);
+  if (relative.split('/').some((part) => part === '' || part === '.' || part === '..')) throw new Error(`commit guard evidence file must not include traversal: ${relative}`);
+  if (!fs.existsSync(absolute)) throw new Error(`commit guard evidence file not found: ${relative}`);
+  if (!fs.statSync(absolute).isFile()) throw new Error(`commit guard evidence path is not a file: ${relative}`);
+  return { file: absolute, relative };
+}
+
+function commitGuardFinding(findingType, severity, lineNumber, subject, commit = '') {
+  return { finding_type: findingType, severity, line_number: lineNumber, commit, subject };
+}
+
+function analyzeCommitGuardSubject(subject, lineNumber, commit = '', prefixFindings = []) {
+  const normalizedSubject = String(subject || '').trim();
+  const findings = [...prefixFindings];
+  if (!normalizedSubject) findings.push(commitGuardFinding('empty-subject', 'error', lineNumber, normalizedSubject, commit));
+  if (/^`{3,}/.test(normalizedSubject)) findings.push(commitGuardFinding('leading-markdown-fence', 'error', lineNumber, normalizedSubject, commit));
+  else if (/^`+/.test(normalizedSubject)) findings.push(commitGuardFinding('leading-backtick-token', 'error', lineNumber, normalizedSubject, commit));
+  if (normalizedSubject.includes('```')) findings.push(commitGuardFinding('markdown-fence-token', 'error', lineNumber, normalizedSubject, commit));
+  if (normalizedSubject.length > 120) findings.push(commitGuardFinding('subject-too-long', 'warning', lineNumber, normalizedSubject, commit));
+  if (normalizedSubject && !/^(feat|fix|docs|chore|refactor|test|build|ci|perf|style|revert|release|runtime)(\([^)]+\))?:\s+/.test(normalizedSubject)) {
+    findings.push(commitGuardFinding('non-conventional-subject', 'warning', lineNumber, normalizedSubject, commit));
+  }
+  return { line_number: lineNumber, commit, subject: normalizedSubject, findings };
+}
+
+function parseCommitGuardText(text) {
+  const normalizedText = String(text || '').replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  const lines = normalizedText.split('\n').map((line) => line.trimEnd()).filter((line) => line.trim());
+  const commitLinePattern = /^(`{3,})?\s*([0-9a-f]{7,40})\s+(.+?)\s*$/i;
+  const subjects = lines.map((line, index) => {
+    const match = commitLinePattern.exec(line);
+    if (!match) return analyzeCommitGuardSubject(line, index + 1);
+    const fencePrefix = match[1] || '';
+    const commit = match[2].toLowerCase();
+    const prefixFindings = fencePrefix ? [commitGuardFinding('markdown-fence-prefix', 'error', index + 1, match[3].trim(), commit)] : [];
+    return analyzeCommitGuardSubject(match[3], index + 1, commit, prefixFindings);
+  });
+  const findings = subjects.flatMap((item) => item.findings);
+  return { subjects, findings };
+}
+
+function commitGuardEnvelope(root, { subject = '', evidenceFile = '' } = {}) {
+  if (subject && evidenceFile) throw new Error('release --commit-guard accepts either --subject or --from-file, not both');
+  if (!subject && !evidenceFile) throw new Error('release --commit-guard requires --subject <commit-subject> or --from-file <local-evidence-file>');
+  const inputKind = subject ? 'subject' : 'local-evidence-file';
+  const source = evidenceFile ? commitGuardEvidencePath(root, evidenceFile) : { file: '', relative: '' };
+  const rawText = evidenceFile ? fs.readFileSync(source.file, 'utf8') : String(subject || '');
+  const parsed = parseCommitGuardText(rawText);
+  const blockedFindings = parsed.findings.filter((finding) => finding.severity === 'error');
+  const payload = {
+    version: 1,
+    stage: 'Stage 98',
+    artifact_kind: 'commit-title-guard',
+    guard_kind: 'deterministic-commit-title-guard',
+    input_kind: inputKind,
+    source_file: source.relative,
+    source_digest: source.file ? fileDigest(source.file) : '',
+    subject_count: parsed.subjects.length,
+    normalized_subjects: parsed.subjects.map((item) => ({
+      line_number: item.line_number,
+      commit: item.commit,
+      subject: item.subject,
+      finding_types: item.findings.map((finding) => finding.finding_type),
+    })),
+    findings: parsed.findings,
+    guard_pass: blockedFindings.length === 0,
+    blocked_reasons: blockedFindings.map((finding) => `${finding.finding_type}: line ${finding.line_number}`),
+    recommended_manual_action: blockedFindings.length === 0 ? 'Commit subject is safe to use manually.' : 'Rewrite the commit subject manually before committing; do not amend or rewrite history unless explicitly requested.',
+    deterministic: true,
+    pure_function: true,
+    local_only: true,
+    boundary_assertions: commitGuardBoundaryAssertions(),
+    allowed_followup: ['manual_commit_subject_rewrite', 'manual_commit_review'],
+  };
+  return { ...payload, commit_guard_digest: digestObject(payload) };
+}
+
+function printCommitGuard(envelope) {
+  console.log('Vibecoding Runtime Commit Guard');
+  console.log('Mode: commit-title-guard');
+  console.log(`Status: ${envelope.commit_guard.guard_pass ? 'passed' : 'blocked'}`);
+  console.log(`Subjects: ${envelope.commit_guard.subject_count}`);
+  console.log(`Findings: ${envelope.commit_guard.findings.length}`);
+  if (envelope.commit_guard.findings.length > 0) printList('Findings', envelope.commit_guard.findings.map((item) => `${item.severity}:${item.finding_type}: line ${item.line_number}`));
+  console.log(`Manual action: ${envelope.commit_guard.recommended_manual_action}`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function expandStageCoverage(text) {
+  const stages = new Set();
+  const stagePattern = /Stage\s+(\d+)(?:\s*-\s*(\d+))?/gi;
+  let match = stagePattern.exec(text);
+  while (match) {
+    const start = Number.parseInt(match[1], 10);
+    const end = match[2] ? Number.parseInt(match[2], 10) : start;
+    if (Number.isFinite(start) && Number.isFinite(end)) {
+      const low = Math.min(start, end);
+      const high = Math.max(start, end);
+      if (high - low <= 100) for (let stage = low; stage <= high; stage += 1) stages.add(`Stage ${stage}`);
+    }
+    match = stagePattern.exec(text);
+  }
+  return [...stages].sort((left, right) => Number(left.replace(/\D+/g, '')) - Number(right.replace(/\D+/g, '')));
+}
+
+function parseReleaseNotesEvidence(text) {
+  const normalizedText = String(text || '').replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+  const lines = normalizedText.split('\n');
+  const rangeHint = normalizedText.match(/[0-9a-f]{6,40}\.\.(?:HEAD|[0-9A-Za-z_./-]+)/i)?.[0] || '';
+  const stageCoverage = expandStageCoverage(normalizedText);
+  const commitLinePattern = /^(`{3,})?\s*([0-9a-f]{7,40})\s+(.+?)\s*$/i;
+  const normalizedNotes = [];
+  const commitHygieneFindings = [];
+  lines.forEach((line, index) => {
+    const match = commitLinePattern.exec(line.trimEnd());
+    if (!match) return;
+    const fencePrefix = match[1] || '';
+    const commit = match[2].toLowerCase();
+    const subject = match[3].trim();
+    const inferredStages = expandStageCoverage(subject);
+    const hygiene = [];
+    if (fencePrefix) hygiene.push('markdown-fence-prefix');
+    if (subject.includes('```')) hygiene.push('markdown-fence-token');
+    if (subject.length > 120) hygiene.push('subject-too-long');
+    if (!/^(feat|fix|docs|chore|refactor|test|build|ci|perf|style|revert|release|runtime)(\([^)]+\))?:\s+/.test(subject)) hygiene.push('non-conventional-subject');
+    normalizedNotes.push({ commit, subject, inferred_stages: inferredStages, hygiene });
+    for (const findingType of hygiene) {
+      commitHygieneFindings.push({ finding_type: findingType, severity: 'info', commit, line_number: index + 1, subject });
+    }
+  });
+  return {
+    range_hint: rangeHint,
+    commit_count: normalizedNotes.length,
+    stage_coverage: stageCoverage,
+    normalized_notes: normalizedNotes,
+    commit_hygiene_findings: commitHygieneFindings,
+  };
+}
+
+function releaseNotesPayload(root, { evidenceFile, createdAt = new Date().toISOString() } = {}) {
+  const source = releaseNotesEvidencePath(root, evidenceFile);
+  const rawText = fs.readFileSync(source.file, 'utf8');
+  const parsed = parseReleaseNotesEvidence(rawText);
+  const payload = {
+    version: 1,
+    stage: 'Stage 68',
+    artifact_kind: 'release-notes',
+    optional: true,
+    sidecar_only: true,
+    default_enabled: false,
+    release_chain_required: false,
+    created_at: createdAt,
+    source_file: source.relative,
+    source_digest: fileDigest(source.file),
+    source_bytes: Buffer.byteLength(rawText, 'utf8'),
+    source_lines: rawText.length === 0 ? 0 : rawText.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n').length,
+    range_hint: parsed.range_hint,
+    commit_count: parsed.commit_count,
+    stage_coverage: parsed.stage_coverage,
+    normalized_notes: parsed.normalized_notes,
+    commit_hygiene_findings: parsed.commit_hygiene_findings,
+    deterministic: true,
+    pure_function: true,
+    local_only: true,
+    boundary_assertions: releaseNotesBoundaryAssertions(),
+    allowed_followup: ['manual_release_notes_review', 'manual_commit_hygiene_review'],
+    planned_writes: [path.join(stateDirectoryName, releaseNotesDirectoryName, '<timestamp>.release-notes.json').replace(/\\/g, '/')],
+  };
+  return { ...payload, release_notes_digest: digestObject(payload) };
+}
+
+function releaseNotesEnvelope(root, { evidenceFile, persist = false } = {}) {
+  const notes = releaseNotesPayload(root, { evidenceFile });
+  return {
+    mode: 'release-notes',
+    ok: true,
+    state_present: fs.existsSync(stateDirectory(root)),
+    release_notes: { ...notes, writes: Boolean(persist) },
+    safety: {
+      stage: 'Stage 68',
+      writes: Boolean(persist),
+      release_notes_artifact: Boolean(persist),
+      optional: true,
+      sidecar_only: true,
+      default_enabled: false,
+      release_chain_required: false,
+      ...releaseNotesBoundaryAssertions(),
+    },
+    quality: notes.commit_hygiene_findings,
+    action: persist
+      ? 'release notes sidecar was written from one local evidence file. No git write, history rewrite, tag, PR, push, merge, platform API, external network, model invocation, runtime action, release gate requirement, or business source write occurred.'
+      : 'release notes were previewed read-only from one local evidence file. No state directory, git write, history rewrite, tag, PR, push, merge, platform API, external network, model invocation, runtime action, release gate requirement, or business source write occurred.',
+  };
+}
+
+function validateReleaseNotesArtifact(root, artifact) {
+  const failures = [];
+  if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+  if (artifact.command !== 'release') failures.push('command must be release');
+  if (artifact.mode !== 'release-notes') failures.push('mode must be release-notes');
+  const notes = artifact.release_notes || {};
+  if (notes.version !== 1) failures.push('release_notes.version must be 1');
+  if (notes.stage !== 'Stage 68') failures.push('release_notes.stage must be Stage 68');
+  if (notes.artifact_kind !== 'release-notes') failures.push('release_notes.artifact_kind must be release-notes');
+  if (notes.optional !== true) failures.push('release_notes.optional must be true');
+  if (notes.sidecar_only !== true) failures.push('release_notes.sidecar_only must be true');
+  if (notes.default_enabled !== false) failures.push('release_notes.default_enabled must be false');
+  if (notes.release_chain_required !== false) failures.push('release_notes.release_chain_required must be false');
+  if (notes.deterministic !== true) failures.push('release_notes.deterministic must be true');
+  if (notes.pure_function !== true) failures.push('release_notes.pure_function must be true');
+  if (notes.local_only !== true) failures.push('release_notes.local_only must be true');
+  if (artifact.safety?.release_notes_artifact !== true) failures.push('safety.release_notes_artifact must be true');
+  if (artifact.safety?.writes !== true) failures.push('safety.writes must be true');
+  for (const [key, expected] of Object.entries(releaseNotesBoundaryAssertions())) {
+    if (notes.boundary_assertions?.[key] !== expected) failures.push(`release_notes.boundary_assertions.${key} must be false`);
+    if (artifact.safety?.[key] !== expected) failures.push(`safety.${key} must be false`);
+  }
+  if (!Array.isArray(notes.planned_writes)) failures.push('release_notes.planned_writes must be an array');
+  else if (digestObject(notes.planned_writes) !== digestObject([path.join(stateDirectoryName, releaseNotesDirectoryName, '<timestamp>.release-notes.json').replace(/\\/g, '/')])) failures.push('release_notes.planned_writes must only contain release notes artifact');
+  try {
+    const expected = releaseNotesPayload(root, { evidenceFile: notes.source_file, createdAt: notes.created_at });
+    for (const key of ['source_file', 'source_digest', 'source_bytes', 'source_lines', 'range_hint', 'commit_count', 'release_notes_digest']) {
+      if (notes[key] !== expected[key]) failures.push(`release_notes.${key} drift`);
+    }
+    if (digestObject(notes.stage_coverage || []) !== digestObject(expected.stage_coverage)) failures.push('release_notes.stage_coverage drift');
+    if (digestObject(notes.normalized_notes || []) !== digestObject(expected.normalized_notes)) failures.push('release_notes.normalized_notes drift');
+    if (digestObject(notes.commit_hygiene_findings || []) !== digestObject(expected.commit_hygiene_findings)) failures.push('release_notes.commit_hygiene_findings drift');
+    if (digestObject(notes.allowed_followup || []) !== digestObject(expected.allowed_followup)) failures.push('release_notes.allowed_followup drift');
+  } catch (error) {
+    failures.push(error.message);
+  }
+  const digestPayload = { ...notes };
+  delete digestPayload.writes;
+  delete digestPayload.release_notes_digest;
+  if (notes.release_notes_digest !== digestObject(digestPayload)) failures.push('release notes digest mismatch');
+  return { ok: failures.length === 0, failures };
+}
+
+function writeReleaseNotesArtifact(root, envelope) {
+  const file = releaseNotesSnapshotPath(root);
+  const payload = { schema_version: jsonSchemaVersion, command: 'release', ...envelope, safety: { ...envelope.safety, release_notes_artifact: true } };
+  const verification = validateReleaseNotesArtifact(root, payload);
+  if (!verification.ok) throw new Error(`release notes verification failed: ${verification.failures.join('; ')}`);
+  return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+}
+
+function releaseNotesAuditEnvelope(root, notesFile) {
+  const file = releaseNotesFilePath(root, notesFile);
+  const artifact = readJsonArtifact(file, 'Release notes');
+  const verification = validateReleaseNotesArtifact(root, artifact);
+  if (!verification.ok) throw new Error(`release notes verification failed: ${verification.failures.join('; ')}`);
+  return {
+    mode: 'release-notes-verify',
+    ok: verification.ok,
+    summary: { file: path.basename(file), commit_count: artifact.release_notes?.commit_count || 0, finding_count: artifact.release_notes?.commit_hygiene_findings?.length || 0 },
+    verification,
+    release_notes: artifact.release_notes,
+    artifact,
+    quality: verification.failures,
+    action: 'read-only release notes audit inspected one local release notes artifact. No git write, history rewrite, tag, PR, push, merge, platform API, external network, model invocation, runtime action, release gate requirement, or business source write occurred.',
+  };
+}
+
+function printRelease(envelope, file = '') {
+  console.log('Vibecoding Runtime Release');
+  console.log(`Mode: ${envelope.mode}`);
+  if (envelope.release_gate) {
+    console.log(`Status: ${envelope.release_gate.gate_status}`);
+    console.log(`Sources: ${envelope.release_gate.sources?.length || 0}`);
+  }
+  if (envelope.release_notes) {
+    console.log(`Commits: ${envelope.release_notes.commit_count || 0}`);
+    console.log(`Stages: ${envelope.release_notes.stage_coverage?.length || 0}`);
+    console.log(`Hygiene findings: ${envelope.release_notes.commit_hygiene_findings?.length || 0}`);
+  }
+  if (envelope.summary) {
+    console.log(`File: ${envelope.summary.file}`);
+    if (envelope.summary.gate_status) console.log(`Status: ${envelope.summary.gate_status}`);
+    if (typeof envelope.summary.commit_count === 'number') console.log(`Commits: ${envelope.summary.commit_count}`);
+    if (typeof envelope.summary.finding_count === 'number') console.log(`Hygiene findings: ${envelope.summary.finding_count}`);
+  }
+  if (file) console.log(`Artifact: ${path.relative(process.cwd(), file)}`);
+  if (envelope.quality?.length > 0) printList('Findings', envelope.quality.map((item) => typeof item === 'string' ? item : `${item.finding_type}: ${item.commit || 'n/a'}`));
+  console.log(`Action: ${envelope.action}`);
+}
+
+function diffCoverageEnvelope(root, diffFile, { planFile } = {}) {
+  ensureRoot(root);
+  const source = localTextEvidenceDescriptor(root, diffFile, 'release --diff-coverage source');
+  if (!planFile) throw new Error('release --diff-coverage requires --from-plan <local-plan-file>');
+  const planEnvelope = planActionManifestEnvelope(root, planFile, { intent: 'implementation' });
+  const planActionManifest = planEnvelope.plan_action_manifest;
+  const registry = runtimeCapabilityRegistry();
+  const coverage = runtimeDiffCoverageEnvelope({
+    diffText: source.text,
+    diffSource: source,
+    planActionManifest,
+    registry,
+    registryDigest: planActionManifest.source_bindings.registry_digest,
+  });
+  const diffCoverage = {
+    ...coverage,
+    diff_coverage_digest: digestDiffCoverage(runtimeDiffCoverageDigestPayload(coverage)),
+  };
+  return {
+    mode: 'diff-coverage-envelope',
+    ok: diffCoverage.diff_coverage_invariants.pass,
+    state_present: fs.existsSync(stateDirectory(root)),
+    diff_coverage: diffCoverage,
+    safety: { stage: 'Stage 111', ...diffCoverage.boundary_assertions },
+    quality: diffCoverage.diff_coverage_invariants.findings,
+    action: 'diff-coverage envelope was computed read-only from one local diff file and one local plan file. Stage 111 did not call git, generate a diff, run checks, repair, format, generate code, write diff artifacts, create sidecars, commit, push, PR, merge, call platform API, external network, model, subagent, MCP, daemon, scheduler, retry, or mutate business source.',
+  };
+}
+
+function gitDiffReadEnvelope(root, commandResults, { planFile } = {}) {
+  ensureRoot(root);
+  if (!planFile) throw new Error('release --diff-read requires --from-plan <local-plan-file>');
+  const planEnvelope = planActionManifestEnvelope(root, planFile, { intent: 'implementation' });
+  const planActionManifest = planEnvelope.plan_action_manifest;
+  const registry = runtimeCapabilityRegistry();
+  const diffRead = runtimeGitDiffReadEnvelope({
+    commandResults,
+    planActionManifest,
+    registry,
+    registryDigest: planActionManifest.source_bindings.registry_digest,
+  });
+  return {
+    mode: 'git-diff-read-evidence',
+    ok: diffRead.git_diff_read_invariants.pass,
+    state_present: fs.existsSync(stateDirectory(root)),
+    ...diffRead.diff_coverage_evidence,
+    git_diff_read: diffRead,
+    safety: { stage: 'P3', ...diffRead.boundary_assertions },
+    quality: diffRead.git_diff_read_invariants.findings,
+    action: 'git diff read evidence was computed from fixed read-only git diff commands and one local plan file. It did not run tests, repair, format, generate code, write diff artifacts, create sidecars, add, commit, checkout, reset, push, PR, merge, call platform API, external network, model, MCP, background worker, delegated agent, or mutate business source.',
+  };
+}
+
+function printDiffCoverage(envelope) {
+  const coverage = envelope.diff_coverage;
+  console.log('Vibecoding Runtime Diff Coverage Envelope');
+  console.log(`Stage: ${coverage.stage}; Kind: ${coverage.coverage_kind}; pass=${coverage.diff_coverage_invariants.pass}`);
+  console.log(`Diff: changed=${coverage.diff_coverage.changed_file_count}; expected=${coverage.diff_coverage.expected_file_count}; covered=${coverage.diff_coverage.covered_expected_file_count}; missing=${coverage.diff_coverage.missing_expected_file_count}; unexpected=${coverage.diff_coverage.unexpected_file_count}; git_executed_by_stage_111=false; diff_generated_by_stage_111=false`);
+  console.log(`Docs coverage: expected=${coverage.docs_coverage.expected_files.length}; covered=${coverage.docs_coverage.covered_files.length}; missing=${coverage.docs_coverage.missing_files.length}`);
+  console.log(`Code coverage: expected=${coverage.code_coverage.expected_files.length}; covered=${coverage.code_coverage.covered_files.length}; missing=${coverage.code_coverage.missing_files.length}`);
+  for (const file of coverage.changed_files) console.log(`- changed: ${file}`);
+  console.log(`Source bindings: diff=${coverage.source_diff.digest}; plan_action_manifest=${coverage.source_bindings.plan_action_manifest_digest}; registry=${coverage.source_bindings.registry_digest}`);
+  printList('Forbidden actions', coverage.forbidden_actions);
+  console.log('Boundary: writes=false; diff_coverage_artifact=false; diff_artifact_write=false; command_execution=false; git=false; git_write=false; commit=false; pr=false; push=false; merge=false; platform_api=false; external_network=false; model_invocation=false; subagent=false; mcp=false; business_source_write=false');
+  console.log(`Diff coverage digest: ${coverage.diff_coverage_digest}`);
+  if (coverage.safety_findings.length > 0) printList('Safety findings', coverage.safety_findings.map((item) => `${item.id}: ${item.reason}`));
+  if (coverage.blocked_reasons.length > 0) printList('Blocked reasons', coverage.blocked_reasons);
+  console.log(`Manual action: ${coverage.manual_action}`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printGitDiffRead(envelope) {
+  const read = envelope.git_diff_read;
+  const summary = read.git_diff_read;
+  console.log('Vibecoding Runtime Git Diff Read Evidence');
+  console.log(`Stage: ${read.stage}; Kind: ${read.read_kind}; pass=${read.git_diff_read_invariants.pass}`);
+  console.log(`Commands: total=${summary.command_count}; allowed=${summary.allowed_command_count}; failed=${summary.failed_command_count}`);
+  console.log(`Diff: changed=${summary.changed_file_count}; planned=${summary.planned_file_count}; missing=${summary.missing_file_count}; unexpected=${summary.unexpected_file_count}; git_read=true; git_write=false; worktree_write=false`);
+  for (const file of envelope.changed_files) console.log(`- changed: ${file}`);
+  console.log(`Source bindings: plan_action_manifest=${read.source_bindings.plan_action_manifest_digest}; registry=${read.source_bindings.registry_digest}`);
+  printList('Forbidden actions', read.forbidden_actions);
+  console.log('Boundary: writes=false; diff_coverage_artifact=false; sidecar_write=false; runtime_read_git_diff=true; git_read=true; git_write=false; worktree_write=false; commit=false; pr=false; push=false; merge=false; platform_api=false; external_network=false; model_invocation=false; mcp=false; business_source_write=false');
+  console.log(`Git diff read digest: ${read.diff_read_digest}`);
+  if (read.safety_findings.length > 0) printList('Safety findings', read.safety_findings.map((item) => `${item.id}: ${item.reason}`));
+  if (read.blocked_reasons.length > 0) printList('Blocked reasons', read.blocked_reasons);
+  console.log(`Manual action: ${read.manual_action}`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function feedbackSafety({ writes = false, artifact = false } = {}) {
+  return {
+    stage: 'Stage 53',
+    writes: Boolean(writes),
+    feedback_ledger_artifact: Boolean(artifact),
+    dispatch: false,
+    session_create: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    runtime_action: false,
+    auto_execution: false,
+    controlled_auto_execution: false,
+    skill_execution: false,
+    business_source_write: false,
+    source_merge: false,
+    pr: false,
+    push: false,
+    merge: false,
+    subagent_dispatch: false,
+    subagent: false,
+    mcp: false,
+    daemon: false,
+    git: false,
+    worktree: false,
+    dispatch_event_modified: false,
+    claim_modified: false,
+  };
+}
+
+function validateStage53Safety(safety, artifactKey) {
+  const failures = validateCommonArtifactSafety(safety, 'Stage 53');
+  if (safety?.[artifactKey] !== true) failures.push(`safety.${artifactKey} must be true`);
+  for (const key of ['dispatch', 'session_create', 'platform_api', 'external_network', 'model_invocation', 'runtime_action', 'source_merge', 'pr', 'push', 'merge', 'subagent_dispatch']) {
+    if (safety?.[key] !== false) failures.push(`safety.${key} must be false`);
+  }
+  return failures;
+}
+
+  return {
+    releaseNotesBoundaryAssertions,
+    releaseNotesEnvelope,
+    validateReleaseNotesArtifact,
+    writeReleaseNotesArtifact,
+    releaseNotesAuditEnvelope,
+    commitGuardBoundaryAssertions,
+    commitGuardEnvelope,
+    printCommitGuard,
+    printRelease,
+    diffCoverageEnvelope,
+    gitDiffReadEnvelope,
+    printDiffCoverage,
+    printGitDiffRead,
+    feedbackSafety,
+    validateStage53Safety,
+  };
+}