@kylecheng3146/agent-ops 0.5.2 → 0.6.0

package/dist/runtime/src/verify/acceptance-coverage.js

@@ -0,0 +1,85 @@
+import { calculateConfigHash, canonicalJson } from "../config/hash.js";
+import { readPrivateFile } from "../security/permissions.js";
+import { join } from "node:path";
+import { sha256 } from "../fs/hash.js";
+import { criterionContractHash, taskContractHash } from "../task/contract.js";
+/** Only current, paired check evidence discharges a mechanical contract. */
+export async function acceptanceCoverage(record, config, sourceFingerprint, store) {
+    const contract = taskContractHash(record.task);
+    const configHash = calculateConfigHash(config);
+    const rows = [];
+    for (const criterion of record.task.criteria) {
+        const definition = criterion.acceptance;
+        const refs = record.evidence[criterion.id] ?? [];
+        const matching = [];
+        for (const reference of refs) {
+            if (reference.startsWith("review:"))
+                continue;
+            const evidence = await store.load(reference);
+            if (evidence?.schemaVersion === 4 && evidence.taskId === record.task.id &&
+                evidence.criterionId === criterion.id && evidence.configHash === configHash &&
+                evidence.sourceFingerprint === sourceFingerprint && evidence.taskContractHash === contract &&
+                evidence.acceptance?.criterionContractHash === criterionContractHash(criterion)) {
+                matching.push({ reference, evidence });
+            }
+        }
+        const authenticated = [];
+        for (const item of matching) {
+            const proof = item.evidence.acceptance;
+            try {
+                const source = await readPrivateFile(join(store.root, ...proof.executionArtifact.split("/")), store.root);
+                if (source === null || proof.executionArtifact !== ".agent-ops/tasks/acceptance/" + sha256(source) + ".json")
+                    continue;
+                const artifact = JSON.parse(source);
+                if (artifact.commit !== proof.commit || artifact.phase !== proof.phase || artifact.pairedCommit !== proof.pairedCommit ||
+                    artifact.materialDigest !== proof.materialDigest || artifact.executionDigest !== proof.executionDigest ||
+                    artifact.runner?.id !== item.evidence.commandId || artifact.run?.completed !== true ||
+                    artifact.aggregate?.status === "UNKNOWN" || !Array.isArray(artifact.run?.results) ||
+                    proof.checks.some(check => !artifact.run.results.some((actual) => actual.checkId === check.checkId && actual.status === check.status && actual.attempts === 1 &&
+                        (actual.failureClass === "assertion-failed" ? "assertion" : actual.failureClass) === check.failureClass)))
+                    continue;
+                authenticated.push(item);
+            }
+            catch { /* Missing, modified or malformed execution records cannot prove a contract. */ }
+        }
+        const authenticatedRefs = new Set(authenticated.map(item => item.reference));
+        for (let i = 0; i < matching.length; i++)
+            if (!authenticatedRefs.has(matching[i].reference)) {
+                const item = matching[i];
+                matching[i] = { ...item, evidence: { ...item.evidence, status: "UNKNOWN", failureClass: "execution-artifact-invalid" } };
+            }
+        const row = { criterionId: criterion.id, mode: definition?.mode ?? "legacy",
+            evidenceReferences: matching.map(item => item.reference) };
+        if (definition === undefined || definition.mode === "review-only") {
+            rows.push({ ...row, status: "undischarged", reason: definition?.mode === "review-only"
+                    ? "Review-only: " + definition.reviewOnlyReason + "; requires independent review against the original goal."
+                    : "Requires independent review against the original goal." });
+            continue;
+        }
+        let proven = true;
+        for (const binding of definition.bindings) {
+            const phase = (name) => matching.filter(({ evidence }) => evidence.commandId === binding.runnerId && evidence.acceptance?.phase === name &&
+                evidence.acceptance.bindingHash === sha256(canonicalJson({ runnerId: binding.runnerId, materials: binding.materials })))
+                .sort((a, b) => Date.parse(b.evidence.finishedAt) - Date.parse(a.evidence.finishedAt) ||
+                (a.evidence.status === "PASS" ? 1 : -1))[0]?.evidence;
+            const baseline = phase("baseline");
+            const candidate = phase("candidate");
+            const base = baseline?.acceptance;
+            const head = candidate?.acceptance;
+            if (baseline?.status !== "PASS" || candidate?.status !== "PASS" || base === undefined || head === undefined ||
+                base.commit !== definition.baselineCommit || head.pairedCommit !== definition.baselineCommit ||
+                base.pairedCommit !== head.commit || base.materialDigest !== head.materialDigest ||
+                binding.checkIds.some(id => !head.checks.some(check => check.checkId === id && check.status === "PASS")) ||
+                binding.checkIds.some(id => !base.checks.some(check => check.checkId === id)) ||
+                base.checks.some(check => check.status === "UNKNOWN") ||
+                (binding.redCheckIds ?? []).some(id => !base.checks.some(check => check.checkId === id && check.status === "FAIL" && check.failureClass === "assertion")))
+                proven = false;
+        }
+        rows.push({ ...row, status: proven ? "proven" : "undischarged",
+            reason: proven ? "Current paired check evidence satisfies the contract." : "Paired check evidence is missing, stale, unknown or non-discriminating." });
+    }
+    return rows;
+}
+export function coverageDigest(rows) {
+    return sha256(canonicalJson(rows));
+}

package/dist/runtime/src/verify/acceptance-protocol.js

@@ -0,0 +1,252 @@
+/**
+ * The small, framework-neutral result protocol used by acceptance adapters.
+ *
+ * Adapters are deliberately consumers of structured harness output. They do
+ * not infer assertion failures from arbitrary stdout, and this module keeps
+ * the final safety decision in one place.
+ */
+export const ACCEPTANCE_PROTOCOL_VERSION = 1;
+export const ACCEPTANCE_FAILURE = {
+    assertion: "assertion-failed",
+    collection: "collection-error",
+    duplicate: "duplicate-check",
+    emptyEvidence: "empty-evidence",
+    fixture: "fixture-error",
+    hook: "hook-error",
+    incomplete: "incomplete-output",
+    infrastructure: "infrastructure-error",
+    malformed: "malformed-output",
+    missing: "missing-check",
+    retry: "retry",
+    skipped: "skipped",
+    timeout: "timeout",
+    todo: "todo",
+    unexpected: "unexpected-check",
+    unsupported: "unsupported-output",
+    xfail: "xfail"
+};
+const MAX_TEXT = 4096;
+const MAX_RESULTS = 4096;
+const MAX_EVIDENCE = 32;
+function text(value, field) {
+    if (typeof value !== "string" || value.length === 0 ||
+        value.length > MAX_TEXT || value.includes("\0") ||
+        /[\r\n]/u.test(value)) {
+        throw new TypeError(`${field} must be a bounded single-line string.`);
+    }
+    return value;
+}
+function boundedEvidence(values) {
+    if (values.length === 0 || values.length > MAX_EVIDENCE ||
+        values.some((value) => {
+            try {
+                text(value, "evidence");
+                return false;
+            }
+            catch {
+                return true;
+            }
+        })) {
+        throw new TypeError("evidence must contain one to 32 bounded strings.");
+    }
+    return [...values];
+}
+function attempts(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (!Number.isSafeInteger(value) || value < 1 || value > 1000) {
+        throw new TypeError("attempts must be a positive safe integer or null.");
+    }
+    return value;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function stringValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+export function stableCheckId(parts) {
+    const normalized = parts
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    if (normalized.length === 0) {
+        throw new TypeError("A check needs a stable identity.");
+    }
+    return normalized.join("::");
+}
+export function makeAcceptanceCheck(input) {
+    const status = input.status;
+    if (status !== "PASS" && status !== "FAIL" && status !== "UNKNOWN") {
+        throw new TypeError("Invalid acceptance status.");
+    }
+    if (input.phase !== "baseline" && input.phase !== "candidate") {
+        throw new TypeError("Invalid acceptance phase.");
+    }
+    const failureClass = input.failureClass ?? (status === "PASS" ? "none" : ACCEPTANCE_FAILURE.infrastructure);
+    if (status === "PASS" && failureClass !== "none") {
+        throw new TypeError("A passing check must have failureClass none.");
+    }
+    if (status === "FAIL" && failureClass === "none") {
+        throw new TypeError("A failed check needs a failure class.");
+    }
+    return {
+        executionId: text(input.executionId, "executionId"),
+        framework: text(input.framework, "framework"),
+        frameworkVersion: text(input.frameworkVersion, "frameworkVersion"),
+        checkId: text(input.checkId, "checkId"),
+        phase: input.phase,
+        status,
+        failureClass,
+        attempts: attempts(input.attempts),
+        evidence: boundedEvidence(input.evidence)
+    };
+}
+export function makeAcceptanceRun(input) {
+    if (input.results.length > MAX_RESULTS) {
+        throw new TypeError("An acceptance run contains too many check results.");
+    }
+    if (input.phase !== "baseline" && input.phase !== "candidate") {
+        throw new TypeError("Invalid acceptance phase.");
+    }
+    const completionEvidence = input.completionEvidence ?? [];
+    if (input.completed)
+        boundedEvidence(completionEvidence);
+    const diagnostics = input.diagnostics ?? [];
+    diagnostics.forEach((value) => text(value, "diagnostic"));
+    for (const result of input.results) {
+        if (result.executionId !== input.executionId ||
+            result.framework !== input.framework ||
+            result.frameworkVersion !== input.frameworkVersion ||
+            result.phase !== input.phase) {
+            throw new TypeError("Every check result must use the run execution identity.");
+        }
+    }
+    return {
+        protocolVersion: ACCEPTANCE_PROTOCOL_VERSION,
+        executionId: text(input.executionId, "executionId"),
+        framework: text(input.framework, "framework"),
+        frameworkVersion: text(input.frameworkVersion, "frameworkVersion"),
+        phase: input.phase,
+        results: [...input.results],
+        completed: input.completed,
+        completionEvidence: [...completionEvidence],
+        diagnostics: [...diagnostics]
+    };
+}
+function sortedUnique(values) {
+    return [...new Set(values)].sort();
+}
+function unknown(run, results, failureClass, diagnostics, missingCheckIds = [], duplicateCheckIds = [], unexpectedCheckIds = []) {
+    return {
+        status: "UNKNOWN",
+        failureClass,
+        results,
+        missingCheckIds,
+        duplicateCheckIds,
+        unexpectedCheckIds,
+        diagnostics: [...run.diagnostics, ...diagnostics]
+    };
+}
+export function aggregateAcceptanceRun(run, requestedCheckIds) {
+    const requested = sortedUnique(requestedCheckIds);
+    if (requested.length !== requestedCheckIds.length || requested.length === 0) {
+        return unknown(run, run.results, ACCEPTANCE_FAILURE.malformed, [
+            "Requested check IDs must be non-empty and unique."
+        ]);
+    }
+    if (!run.completed || run.completionEvidence.length === 0) {
+        return unknown(run, run.results, ACCEPTANCE_FAILURE.incomplete, [
+            "The adapter did not emit a complete terminal marker."
+        ]);
+    }
+    const expected = new Set(requested);
+    const counts = new Map();
+    for (const result of run.results) {
+        counts.set(result.checkId, (counts.get(result.checkId) ?? 0) + 1);
+    }
+    const duplicateCheckIds = sortedUnique([...counts.entries()].filter(([, count]) => count > 1).map(([id]) => id));
+    const unexpectedCheckIds = sortedUnique(run.results.filter((result) => !expected.has(result.checkId)).map((result) => result.checkId));
+    const missingCheckIds = requested.filter((id) => !counts.has(id));
+    if (duplicateCheckIds.length > 0 || unexpectedCheckIds.length > 0 || missingCheckIds.length > 0) {
+        return unknown(run, run.results, duplicateCheckIds.length > 0 ? ACCEPTANCE_FAILURE.duplicate :
+            missingCheckIds.length > 0 ? ACCEPTANCE_FAILURE.missing : ACCEPTANCE_FAILURE.unexpected, ["The observed checks do not match the requested checks exactly."], missingCheckIds, duplicateCheckIds, unexpectedCheckIds);
+    }
+    const requestedResults = requested.map((id) => run.results.find((result) => result.checkId === id));
+    if (run.diagnostics.length > 0) {
+        return unknown(run, requestedResults, ACCEPTANCE_FAILURE.infrastructure, [
+            "The adapter reported execution diagnostics.",
+            ...run.diagnostics
+        ]);
+    }
+    for (const result of requestedResults) {
+        if (result.evidence.length === 0) {
+            return unknown(run, requestedResults, ACCEPTANCE_FAILURE.emptyEvidence, [
+                `Check ${result.checkId} has no evidence.`
+            ]);
+        }
+        if (result.attempts === null || result.attempts !== 1 || result.failureClass === ACCEPTANCE_FAILURE.retry) {
+            return unknown(run, requestedResults, ACCEPTANCE_FAILURE.retry, [
+                `Check ${result.checkId} has missing or repeated attempts.`
+            ]);
+        }
+        if (result.status === "UNKNOWN") {
+            return unknown(run, requestedResults, result.failureClass, [
+                `Check ${result.checkId} did not produce a mechanical result.`
+            ]);
+        }
+        if (result.status === "PASS" && result.failureClass !== "none") {
+            return unknown(run, requestedResults, ACCEPTANCE_FAILURE.malformed, [
+                `Check ${result.checkId} marked PASS with a failure class.`
+            ]);
+        }
+        if (result.status === "FAIL" && result.failureClass !== ACCEPTANCE_FAILURE.assertion) {
+            return unknown(run, requestedResults, result.failureClass, [
+                `Check ${result.checkId} failed outside an assertion.`
+            ]);
+        }
+    }
+    if (requestedResults.some((result) => result.status === "FAIL")) {
+        return {
+            status: "FAIL",
+            failureClass: ACCEPTANCE_FAILURE.assertion,
+            results: requestedResults,
+            missingCheckIds: [],
+            duplicateCheckIds: [],
+            unexpectedCheckIds: [],
+            diagnostics: [...run.diagnostics]
+        };
+    }
+    return {
+        status: "PASS",
+        failureClass: "none",
+        results: requestedResults,
+        missingCheckIds: [],
+        duplicateCheckIds: [],
+        unexpectedCheckIds: [],
+        diagnostics: [...run.diagnostics]
+    };
+}
+export function parseJsonLines(source) {
+    const values = [];
+    const invalidLines = [];
+    source.split(/\r?\n/u).forEach((line, index) => {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            return;
+        try {
+            values.push(JSON.parse(trimmed));
+        }
+        catch {
+            invalidLines.push(index + 1);
+        }
+    });
+    return { values, invalidLines };
+}
+export function parseJsonDocument(source) {
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/runtime/src/verify/acceptance-replay.js

@@ -0,0 +1,239 @@
+import { lstat, mkdir, mkdtemp, readFile, realpath, rm, writeFile, chmod } from "node:fs/promises";
+import { join, delimiter, isAbsolute } from "node:path";
+import { tmpdir } from "node:os";
+import { writePrivateFile } from "../security/permissions.js";
+import { redactSecrets } from "../security/redact.js";
+import { randomUUID } from "node:crypto";
+import { canonicalJson } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
+import { criterionContractHash, taskContractHash } from "../task/contract.js";
+import { aggregateAcceptanceRun, makeAcceptanceCheck, makeAcceptanceRun } from "./acceptance-protocol.js";
+import { collectNodeAcceptance, collectJestAcceptance, collectVitestAcceptance, collectPytestAcceptance, collectRustAcceptance } from "./adapters/index.js";
+import { buildVerificationEvidence } from "./evidence.js";
+import { collectChangeSurface, resolveGitCommit } from "./change-surface.js";
+import { runVerificationCommand } from "./spawn.js";
+async function executableIdentity(command, cwd, env) {
+    const paths = isAbsolute(command) ? [command] : command.includes("/") ? [join(cwd, command)] :
+        (env.PATH ?? "").split(delimiter).filter(Boolean).map(path => join(path, command));
+    for (const path of paths) {
+        try {
+            const resolved = await realpath(path);
+            const entry = await lstat(resolved);
+            if (!entry.isFile() || (process.platform !== "win32" && (entry.mode & 0o111) === 0))
+                continue;
+            return sha256(canonicalJson({ path: resolved, bytes: sha256(await readFile(resolved)) }));
+        }
+        catch { /* Try the next fixed PATH entry. */ }
+    }
+    return "unavailable";
+}
+function replayEnvironment(checkout, phase, executionId) {
+    const env = Object.fromEntries(Object.entries(process.env).filter((pair) => pair[1] !== undefined && !/^(?:NODE_OPTIONS|NODE_PATH|PYTHONPATH|PYTHONHOME|CARGO_TARGET_DIR|RUSTC_WRAPPER|RUSTC_WORKSPACE_WRAPPER|AGENT_OPS_|CLAUDE_|CODEX_)/u.test(pair[0])));
+    env.PATH = [join(checkout, "node_modules/.bin"), join(checkout, ".venv/bin"),
+        ...(process.env.PATH ?? "").split(delimiter).filter(path => !path.includes("node_modules/.bin"))].join(delimiter);
+    env.AGENT_OPS_ACCEPTANCE_PHASE = phase;
+    env.AGENT_OPS_ACCEPTANCE_EXECUTION_ID = executionId;
+    return env;
+}
+function collected(runner, output, checkout, options) {
+    if (output.timedOut || output.signal !== null || output.stdoutTruncated || output.stderrTruncated || output.status === "UNKNOWN")
+        return makeAcceptanceRun({ ...options, framework: runner.adapter, results: [], completed: false, diagnostics: [output.failureClass] });
+    // Framework file identities must be repository-relative across disposable checkouts.
+    const normalize = (value) => typeof value === "string" && value.startsWith(checkout + "/") ? value.slice(checkout.length + 1) :
+        Array.isArray(value) ? value.map(normalize) : typeof value === "object" && value !== null ?
+            Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalize(item)])) : value;
+    let structured = output.stdout;
+    try {
+        structured = JSON.stringify(normalize(JSON.parse(structured)));
+    }
+    catch {
+        structured = structured.split("\n").map(line => { try {
+            return JSON.stringify(normalize(JSON.parse(line)));
+        }
+        catch {
+            return line;
+        } }).join("\n");
+    }
+    switch (runner.adapter) {
+        case "node": return collectNodeAcceptance(structured, options);
+        case "jest": return collectJestAcceptance(structured, options);
+        case "vitest": return collectVitestAcceptance(structured, options);
+        case "pytest": return collectPytestAcceptance(structured, options);
+        case "rust": return collectRustAcceptance(structured, options);
+        case "generic": {
+            const value = JSON.parse(structured);
+            if (value.protocolVersion !== 1 || value.executionId !== options.executionId || value.phase !== options.phase)
+                throw new TypeError("Generic output does not match this execution.");
+            return makeAcceptanceRun({ ...value, results: value.results.map(makeAcceptanceCheck) });
+        }
+    }
+}
+/** Clean disposable clones are verification checkouts, never managed writer worktrees. */
+export async function replayAcceptance(options) {
+    if (!options.trusted)
+        throw new AgentOpsError("VERIFICATION_UNTRUSTED", "Acceptance runners require the repository's current trust binding.");
+    if ((await collectChangeSurface(options.gitRunner)).paths.length > 0)
+        throw new AgentOpsError("ACCEPTANCE_COMMITTED_SOURCE_REQUIRED", "Formal acceptance replay requires a clean committed candidate.");
+    const candidate = await resolveGitCommit(options.gitRunner, "HEAD");
+    const groups = new Map();
+    for (const criterion of options.task.criteria) {
+        if (criterion.acceptance === undefined || criterion.acceptance.mode === "review-only")
+            continue;
+        for (const binding of criterion.acceptance.bindings) {
+            const runner = options.config.verification.acceptanceRunners?.find(r => r.id === binding.runnerId);
+            if (runner === undefined)
+                throw new AgentOpsError("ACCEPTANCE_RUNNER_MISSING", "The acceptance runner is not configured.");
+            const key = canonicalJson({ baseline: criterion.acceptance.baselineCommit, runner, materials: binding.materials });
+            const group = groups.get(key);
+            if (group === undefined)
+                groups.set(key, { baseline: criterion.acceptance.baselineCommit, runner, binding, criteria: [criterion] });
+            else if (!group.criteria.some(c => c.id === criterion.id))
+                group.criteria.push(criterion);
+        }
+    }
+    const reports = [];
+    for (const group of groups.values()) {
+        const materials = [];
+        for (const material of group.binding.materials) {
+            const metadata = await options.gitRunner.run(["ls-tree", "-z", candidate, "--", material.path]);
+            const entry = Buffer.from(metadata.stdout).toString("utf8").match(/^(100644|100755) blob ([a-f0-9]+)\t([^\0]+)\0$/u);
+            if (metadata.exitCode !== 0 || entry === null || entry[3] !== material.path)
+                throw new AgentOpsError("ACCEPTANCE_UNSAFE_MATERIAL", "Acceptance materials must be committed regular files.");
+            const blob = await options.gitRunner.run(["cat-file", "blob", entry[2]]);
+            if (blob.exitCode !== 0 || blob.stdout.byteLength > 1024 * 1024)
+                throw new AgentOpsError("ACCEPTANCE_MATERIAL_UNAVAILABLE", "Acceptance material exceeds its bound or is unavailable.");
+            materials.push({ ...material, bytes: blob.stdout, mode: entry[1] === "100755" ? 0o755 : 0o644 });
+        }
+        const materialDigest = sha256(canonicalJson(materials.map(m => ({ path: m.path, role: m.role, mode: m.mode, hash: sha256(m.bytes) }))));
+        for (const phase of ["baseline", "candidate"]) {
+            const commit = phase === "baseline" ? group.baseline : candidate;
+            const executionId = randomUUID();
+            const startedAt = new Date().toISOString();
+            const temp = await mkdtemp(join(tmpdir(), "agent-ops-acceptance-"));
+            const checkout = join(temp, "repository");
+            const env = replayEnvironment(checkout, phase, executionId);
+            const command = async (executable, args, cwd, timeoutMs = 60_000) => await runVerificationCommand({ id: group.runner.id, command: executable, args: [...args], cwd: ".", required: true,
+                evidence: { kind: "exit-code" }, timeoutMs }, { cwd, runner: options.processRunner, env, replaceEnv: true,
+                outputLimitBytes: 1024 * 1024, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+            let aggregate;
+            let failure = "replay-unavailable";
+            let output;
+            let run;
+            const steps = [];
+            let executionDigest = sha256(executionId);
+            let argv = [];
+            const requested = [...new Set(group.criteria.flatMap(c => c.acceptance.bindings
+                    .filter(b => b.runnerId === group.runner.id && canonicalJson(b.materials) === canonicalJson(group.binding.materials)).flatMap(b => b.checkIds)))];
+            try {
+                for (const [cwd, args] of [[temp, ["clone", "--no-hardlinks", "--quiet", "--", options.root, checkout]],
+                    [checkout, ["fetch", "--quiet", "--", options.root, commit]], [checkout, ["checkout", "--detach", "--quiet", commit]]]) {
+                    const result = await command("git", args, cwd);
+                    if (result.status !== "PASS")
+                        throw new Error("checkout-unavailable");
+                }
+                const cwd = group.runner.cwd === "." ? checkout : await resolveContainedPath(checkout, group.runner.cwd);
+                for (const step of [...(group.runner.setup ?? []), ...(group.runner.build ?? [])]) {
+                    const result = await command(step.command, step.args, cwd, step.timeoutMs);
+                    steps.push({ command: step.command, args: step.args, status: result.status, failureClass: result.failureClass, stderr: result.stderr });
+                    if (result.status !== "PASS")
+                        throw new Error("setup-or-build-unavailable");
+                }
+                // Both sides receive exactly the candidate's explicit test material, after their own build.
+                for (const material of materials) {
+                    let parent = checkout;
+                    for (const segment of material.path.split("/").slice(0, -1)) {
+                        parent = join(parent, segment);
+                        try {
+                            if (!(await lstat(parent)).isDirectory())
+                                throw new Error("unsafe-material-parent");
+                        }
+                        catch (error) {
+                            if (error.code !== "ENOENT")
+                                throw error;
+                            await mkdir(parent);
+                        }
+                    }
+                    const path = join(checkout, ...material.path.split("/"));
+                    try {
+                        if (!(await lstat(path)).isFile())
+                            throw new Error("unsafe-material-target");
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT")
+                            throw error;
+                    }
+                    await writeFile(path, material.bytes);
+                    await chmod(path, material.mode);
+                }
+                for (const step of group.runner.testBuild ?? []) {
+                    const result = await command(step.command, step.args, cwd, step.timeoutMs);
+                    steps.push({ command: step.command, args: step.args, status: result.status, failureClass: result.failureClass, stderr: result.stderr });
+                    if (result.status !== "PASS")
+                        throw new Error("test-build-unavailable");
+                }
+                argv = group.runner.args.flatMap(arg => arg === "{materials}" ?
+                    materials.filter(m => m.role === "test").map(m => m.path) : [arg]);
+                const dependencies = [];
+                for (const path of ["package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "Cargo.toml", "Cargo.lock", "pyproject.toml", "requirements.txt"]) {
+                    try {
+                        dependencies.push({ path, hash: sha256(await readFile(join(checkout, path))) });
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT")
+                            throw error;
+                    }
+                }
+                const identity = await executableIdentity(group.runner.command, cwd, env);
+                if (identity === "unavailable")
+                    throw new Error("missing-executable");
+                executionDigest = sha256(canonicalJson({ commit, materialDigest, runner: group.runner, argv, dependencies,
+                    executable: identity, platform: process.platform, arch: process.arch, environment: sha256(canonicalJson(env)) }));
+                output = await command(group.runner.command, argv, cwd, group.runner.timeoutMs);
+                run = collected(group.runner, output, checkout, { executionId, phase,
+                    frameworkVersion: group.runner.adapter === "node" ? process.version : "dependency-lock:" + sha256(canonicalJson(dependencies)) });
+                aggregate = aggregateAcceptanceRun(run, requested);
+                // Process errors never become assertion red, even if stdout claims a result.
+                if (output.exitCode === null || output.status === "UNKNOWN" ||
+                    (aggregate.status === "PASS" && output.exitCode !== 0) || (aggregate.status === "FAIL" && output.exitCode === 0))
+                    aggregate = undefined;
+                failure = aggregate?.failureClass ?? output.failureClass;
+            }
+            catch (error) {
+                failure = error instanceof Error && /^[a-z-]+$/u.test(error.message) ? error.message : "replay-unavailable";
+            }
+            finally {
+                await rm(temp, { recursive: true, force: true });
+            }
+            const finishedAt = new Date().toISOString();
+            const artifactContent = redactSecrets(JSON.stringify({ schemaVersion: 1, executionId, phase, commit,
+                pairedCommit: phase === "baseline" ? candidate : group.baseline, materialDigest, executionDigest,
+                runner: group.runner, argv, run: run ?? null, aggregate: aggregate ?? null, output: output ?? null, steps, failure, startedAt, finishedAt }));
+            const executionArtifact = ".agent-ops/tasks/acceptance/" + sha256(artifactContent) + ".json";
+            await writePrivateFile(join(options.root, ...executionArtifact.split("/")), artifactContent, options.root);
+            for (const criterion of group.criteria) {
+                const bindings = criterion.acceptance.bindings.filter(b => b.runnerId === group.runner.id && canonicalJson(b.materials) === canonicalJson(group.binding.materials));
+                const binding = { checkIds: [...new Set(bindings.flatMap(b => b.checkIds))], redCheckIds: [...new Set(bindings.flatMap(b => b.redCheckIds ?? []))] };
+                const checks = binding.checkIds.map(checkId => {
+                    const check = aggregate?.results.find(result => result.checkId === checkId);
+                    return { checkId, status: check?.status ?? "UNKNOWN",
+                        failureClass: check?.failureClass === "assertion-failed" ? "assertion" : check?.failureClass ?? failure };
+                });
+                const red = binding.redCheckIds ?? [];
+                const status = aggregate === undefined || aggregate.status === "UNKNOWN" ? "UNKNOWN" :
+                    phase === "candidate" ? checks.every(c => c.status === "PASS") ? "PASS" : "FAIL" :
+                        red.every(id => checks.some(c => c.checkId === id && c.status === "FAIL" && c.failureClass === "assertion")) ? "PASS" : "FAIL";
+                const evidence = buildVerificationEvidence({ taskId: options.task.id, criterionId: criterion.id,
+                    command: { id: group.runner.id, command: group.runner.command, args: argv, cwd: group.runner.cwd, required: true, evidence: { kind: "exit-code" } },
+                    scope: options.scope, startedAt, finishedAt, exitCode: output?.exitCode ?? null, testCount: checks.length,
+                    status, failureClass: status === "PASS" ? "none" : phase === "baseline" && aggregate?.status === "PASS" ? "non-discriminating" : failure,
+                    sourceFingerprint: options.sourceFingerprint, toolVersions: { node: process.version }, config: options.config,
+                    taskContractHash: taskContractHash(options.task), acceptance: { criterionContractHash: criterionContractHash(criterion),
+                        bindingHash: sha256(canonicalJson({ runnerId: group.runner.id, materials: group.binding.materials })), phase, commit, pairedCommit: phase === "baseline" ? candidate : group.baseline, materialDigest, executionDigest, executionArtifact, checks } });
+                const reference = await options.evidenceStore.save(evidence);
+                reports.push({ criterionId: criterion.id, runnerId: group.runner.id, phase, status, failureClass: evidence.failureClass, reference });
+            }
+        }
+    }
+    return reports;
+}

package/dist/runtime/src/verify/adapters/index.js

@@ -0,0 +1,5 @@
+export { collectJestAcceptance } from "./jest.js";
+export { collectNodeAcceptance } from "./node.js";
+export { collectPytestAcceptance } from "./pytest.js";
+export { collectRustAcceptance } from "./rust.js";
+export { collectVitestAcceptance } from "./vitest.js";