@lqc123qwe/car-runtime 1.0.0-rc.1

package/src/security/secrets.ts

@@ -0,0 +1,111 @@
+/**
+ * F12 · secrets 检测（完整版，M2-S7 实装加载期；运行期输出期挂点预留）
+ *
+ * 口径（M2 安全设计增补 T-6 + D-3 裁决）：
+ *  - 模式库 6 类（api-key 前缀族 / 私钥块 / 连接串 / 云凭据 / token-Bearer / 自定义正则）；
+ *  - 三层检测降误报：L1 精确前缀（Aho-Corasick 等价的朴素扫描，规模小不构成瓶颈）
+ *    → L2 Shannon 熵（≥3.5 才升级候选，排除 'aaaa' 类低熵误报）
+ *    → L3 上下文打分（键名共现 +1、代码引号内 +0、注释 -1；总分 ≥2 判命中）；
+ *  - 可验证交付（D-3）：漏报率 <1.5%、FPR ≤5%、precision ≥80%——基准集 1:9 正负比、CI 标定；
+ *  - 检测不可静默关闭：disable 仅允许显式配置且留痕（本层不提供总开关，红线 §6.3）。
+ */
+
+export type SecretCategory = 'api-key' | 'private-key' | 'connection-string' | 'cloud-credential' | 'bearer-token' | 'custom'
+
+export interface SecretPattern { category: SecretCategory; name: string; re: RegExp; /** 键名共现提示 */ keyHints?: string[] }
+
+/** 6 类模式库（v1：30 条精选；自定义正则经 manifest 注入需过安全评审，M3） */
+export const PATTERN_LIBRARY: SecretPattern[] = [
+  // ── api-key 前缀族 ──
+  { category: 'api-key', name: 'OpenAI', re: /sk-[A-Za-z0-9_-]{20,}/g, keyHints: ['openai', 'OPENAI_API_KEY'] },
+  { category: 'api-key', name: 'Anthropic', re: /sk-ant-[A-Za-z0-9_-]{20,}/g, keyHints: ['anthropic'] },
+  { category: 'api-key', name: 'GitHub PAT', re: /gh[pousr]_[A-Za-z0-9]{30,}/g, keyHints: ['github', 'GITHUB_TOKEN'] },
+  { category: 'api-key', name: 'Slack', re: /xox[baprs]-[A-Za-z0-9-]{10,}/g, keyHints: ['slack'] },
+  { category: 'api-key', name: 'AWS Access Key', re: /AKIA[0-9A-Z]{16}/g, keyHints: ['aws'] },
+  { category: 'api-key', name: 'Stripe', re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g, keyHints: ['stripe'] },
+  { category: 'api-key', name: 'npm', re: /npm_[A-Za-z0-9]{30,}/g, keyHints: ['npm_token'] },
+  // ── 私钥块 ──
+  { category: 'private-key', name: 'PEM RSA/EC', re: /-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g },
+  { category: 'private-key', name: 'PKCS8', re: /-----BEGIN PRIVATE KEY-----/g },
+  { category: 'private-key', name: 'PuTTY PPK', re: /PuTTY-User-Key-File-2:/g },
+  // ── 连接串 ──
+  { category: 'connection-string', name: 'postgres', re: /postgres(ql)?:\/\/[^:\s"']+:[^@\s"']+@[^\s"']+/g, keyHints: ['database_url'] },
+  { category: 'connection-string', name: 'mysql', re: /mysql:\/\/[^:\s"']+:[^@\s"']+@[^\s"']+/g },
+  { category: 'connection-string', name: 'mongodb', re: /mongodb(\+srv)?:\/\/[^:\s"']+:[^@\s"']+@[^\s"']+/g, keyHints: ['mongo'] },
+  { category: 'connection-string', name: 'redis', re: /redis:\/\/:[^@\s"']+@[^\s"']+/g },
+  { category: 'connection-string', name: 'jdbc', re: /jdbc:[a-z0-9]+:\/\/[^:\s"']+:[^@\s"']+@/g },
+  // ── 云凭据 ──
+  { category: 'cloud-credential', name: 'AWS Secret', re: /aws(.{0,20})?(secret|secretaccesskey)(.{0,10})?[':= ]+[A-Za-z0-9/+=]{40}/gi },
+  { category: 'cloud-credential', name: 'GCP service account', re: /"type":\s*"service_account"/g },
+  { category: 'cloud-credential', name: 'Azure conn', re: /AccountKey=[A-Za-z0-9+/=]{60,}/g },
+  { category: 'cloud-credential', name: 'JWT', re: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, keyHints: ['token', 'jwt'] },
+  // ── token-Bearer ──
+  { category: 'bearer-token', name: 'Authorization header', re: /Authorization['":= ]+Bearer\s+[A-Za-z0-9._-]{15,}/gi, keyHints: ['authorization'] },
+  { category: 'bearer-token', name: 'api_key kv', re: /['"]?api[_-]?key['"]?\s*[:=]\s*['"][A-Za-z0-9._-]{16,}['"]/gi, keyHints: ['api_key'] },
+  { category: 'bearer-token', name: 'secret kv', re: /['"]?(client[_-]?secret|access[_-]?token)['"]?\s*[:=]\s*['"][A-Za-z0-9._-]{12,}['"]/gi },
+  { category: 'bearer-token', name: 'password kv', re: /['"]?password['"]?\s*[:=]\s*['"][^\s'"]{8,}['"]/gi },
+]
+
+/** Shannon 熵（bit/char） */
+export function shannonEntropy(s: string): number {
+  if (!s.length) return 0
+  const freq = new Map<string, number>()
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1)
+  let h = 0
+  for (const n of freq.values()) { const p = n / s.length; h -= p * Math.log2(p) }
+  return h
+}
+
+export interface ScanHit { category: SecretCategory; name: string; start: number; end: number; /** 命中摘要（全遮蔽，保留首尾 ≤4） */ masked: string; score: number }
+
+const ENTROPY_FLOOR = 3.5
+
+function maskToken(t: string): string {
+  if (t.length <= 8) return '*'.repeat(t.length)
+  return t.slice(0, 4) + '****' + t.slice(-4)
+}
+
+/**
+ * 三层检测：前缀命中 → 熵过滤 → 上下文打分。
+ * 返回确认命中（score ≥2）；低分候选不返回但可通过 returnCandidates 观察（标定用）。
+ */
+export function scanSecrets(text: string, opts: { returnCandidates?: boolean } = {}): { hits: ScanHit[]; candidates: ScanHit[] } {
+  const hits: ScanHit[] = []
+  const candidates: ScanHit[] = []
+  for (const p of PATTERN_LIBRARY) {
+    p.re.lastIndex = 0
+    let m: RegExpExecArray | null
+    while ((m = p.re.exec(text)) !== null) {
+      const token = m[0]
+      // L2 熵过滤：私钥块/连接串结构化模式豁免熵检查；其余需 ≥3.5
+      const structured = p.category === 'private-key' || p.category === 'connection-string' || (p.category === 'cloud-credential' && p.name === 'GCP service account')
+      const ent = shannonEntropy(token)
+      if (!structured && ent < ENTROPY_FLOOR) continue
+      // L3 上下文打分：L1 前缀 + L2 熵双过 = 高精度（基础 2）；上下文仅加成/降级
+      let score = 2
+      const before = text.slice(Math.max(0, m.index - 40), m.index).toLowerCase()
+      if (p.keyHints?.some(h => before.includes(h.toLowerCase()))) score += 1
+      if (/\b(const|let|var|return|echo|export)\b/.test(before)) score += 1 // 赋值/输出语境
+      if (/^\s*(\/\/|#|\*)/.test(text.slice(0, m.index).split('\n').pop() ?? '')) score -= 1 // 注释行降级
+      const hit: ScanHit = { category: p.category, name: p.name, start: m.index, end: m.index + token.length, masked: maskToken(token), score }
+      if (score >= 2) hits.push(hit)
+      else if (opts.returnCandidates) candidates.push(hit)
+      if (m.index === p.re.lastIndex) p.re.lastIndex++ // 防零宽死循环
+    }
+  }
+  hits.sort((a, b) => a.start - b.start)
+  return { hits, candidates }
+}
+
+/** 脱敏钩子：确认命中全遮蔽后返回新文本（M8 redact 的 F12 升级实现） */
+export function redactSecrets(text: string): { text: string; redacted: number } {
+  const { hits } = scanSecrets(text)
+  let out = ''
+  let cursor = 0
+  for (const h of hits) {
+    out += text.slice(cursor, h.start) + h.masked
+    cursor = h.end
+  }
+  out += text.slice(cursor)
+  return { text: out, redacted: hits.length }
+}

package/src/session/export.ts

@@ -0,0 +1,110 @@
+/**
+ * F15 基础增强 · 合规导出（M2-S9）：取证包完整性清单 + 三标分层声明
+ *
+ * 口径（安全设计 §7.2.4 Q-09 定稿 + 决议⑧三标并集）：
+ *  - 导出包 = 事件 JSONL + manifest 清单（逐文件 SHA-256 + 链头尾锚点 + 审计元数据）；
+ *    导出前强制 verifyHashChain（断链中止，SQ-06）；运行时无上传功能（端点归用户）；
+ *  - 三标分层声明（T-7 程序化版本）：13 项审计字段对 SOC 2 CC7.2 / GDPR Art.30 / 等保 2.0
+ *    三级的逐字段映射；对外按行业分层声明（合规问卷答复骨架）；9 核心字段不可裁剪。
+ */
+import { createHash } from 'node:crypto'
+import type { SessionLog, SessionEvent } from './log.ts'
+
+export interface ExportMeta {
+  sessionId: string
+  exportedBy: string          // OS 用户（谁导出）
+  exportedAt: string          // ISO-8601 UTC
+  runtimeVersion: string
+  agentPreset?: string
+  sessionRange: { fromSeq: number; toSeq: number }
+}
+
+export interface ForensicsBundle {
+  files: { name: string; content: string; sha256: string }[]
+  manifest: {
+    format: 'car-forensics/1'
+    chainHead: string | null
+    chainTail: string | null
+    eventCount: number
+    verifyChainAtExport: 'PASS'
+    meta: ExportMeta
+    files: { name: string; sha256: string }[]
+  }
+}
+
+function sha256(s: string): string { return createHash('sha256').update(s).digest('hex') }
+
+/** 取证包导出：断链即中止（不产出"带病审计包"） */
+export function exportForensicsBundle(log: SessionLog, meta: ExportMeta): ForensicsBundle {
+  const broken = log.verifyChain()
+  if (broken !== null) throw new Error(`CAR-E-EXPORT: hash chain broken at seq=${broken}——断链中止导出（禁止带病审计包外流）`)
+  const jsonl = log.exportJSONL()
+  const files = [{ name: `sessions/{sessionId}/events.jsonl`.replace('{sessionId}', meta.sessionId), content: jsonl, sha256: sha256(jsonl) }]
+  const events = log.events as SessionEvent[]
+  const manifest: ForensicsBundle['manifest'] = {
+    format: 'car-forensics/1',
+    chainHead: log.stats().tailHash ? (events[0]?.hash ?? null) : null,
+    chainTail: log.stats().tailHash,
+    eventCount: events.length,
+    verifyChainAtExport: 'PASS',
+    meta,
+    files: files.map(f => ({ name: f.name, sha256: f.sha256 })),
+  }
+  const manifestJson = JSON.stringify(manifest, null, 2)
+  files.push({ name: 'manifest.json', content: manifestJson, sha256: sha256(manifestJson) })
+  return { files, manifest }
+}
+
+/** 包完整性校验：逐文件 SHA-256 重算 + 链锚点一致 */
+export function verifyBundle(bundle: ForensicsBundle): { ok: boolean; brokenFile: string | null } {
+  for (const f of bundle.files) {
+    if (sha256(f.content) !== f.sha256) return { ok: false, brokenFile: f.name }
+  }
+  for (const fm of bundle.manifest.files) {
+    const actual = bundle.files.find(f => f.name === fm.name)
+    if (!actual || actual.sha256 !== fm.sha256) return { ok: false, brokenFile: fm.name }
+  }
+  return { ok: true, brokenFile: null }
+}
+
+// ── 三标分层声明（T-7）──────────────────────────────────────────────
+
+/** 13 项审计字段（安全设计 §7.2.2）；core9 = 不可裁剪核心字段 */
+export const AUDIT_FIELDS = [
+  'seq+sessionId', 'ts', 'actor', 'actorDetail', 'eventType', 'resource', 'payload(redacted)',
+  'result/status', 'authorizationId+decidedBy+reason', 'traceId', 'tenantId', 'hash+prevHash', 'runtimeVersion+agentPreset',
+] as const
+const CORE9 = new Set(['seq+sessionId', 'ts', 'actor', 'eventType', 'result/status', 'authorizationId+decidedBy+reason', 'hash+prevHash', 'tenantId', 'payload(redacted)'])
+
+export type StandardId = 'soc2' | 'gdpr' | 'mlps'
+
+/** 字段 → 标准条款映射（T-7 矩阵的程序化数据源；导出时按 standard 裁剪字段集） */
+// 9 核心字段三标全覆盖（核心公共底座，不可裁剪）；非核心为标准特有扩展（分层声明语义）
+const ALL: StandardId[] = ['soc2', 'gdpr', 'mlps']
+export const FIELD_STANDARD_MAP: Record<string, StandardId[]> = {
+  'seq+sessionId': ALL,                           // 个体事件级（SOC2 CC7.2）
+  'ts': ALL,                                      // 日期和时间（等保 8.1.4.3 b）
+  'actor': ALL,                                   // 用户（GDPR Art.30 归因）
+  'actorDetail': ['gdpr'],                        // 处理活动主体细化（扩展）
+  'eventType': ALL,                               // 事件类型
+  'resource': ['soc2', 'mlps'],                   // 操作对象（扩展）
+  'payload(redacted)': ALL,                       // 完整参数与结果（脱敏后）
+  'result/status': ALL,                           // 事件是否成功
+  'authorizationId+decidedBy+reason': ALL,        // 授权凭据链（US6 凭什么）
+  'traceId': ['mlps'],                            // 关联排查（扩展）
+  'tenantId': ALL,                                // 归属边界
+  'hash+prevHash': ALL,                           // 不可变自证
+  'runtimeVersion+agentPreset': ['gdpr'],         // 处理环境快照（扩展）
+}
+
+/** 分层声明：按标准输出字段集 + 合规声明骨架（合规问卷答复用） */
+export function complianceStatement(std: StandardId): { standard: StandardId; fields: string[]; coreMissing: string[]; statement: string } {
+  const fields = AUDIT_FIELDS.filter(f => FIELD_STANDARD_MAP[f]?.includes(std))
+  const coreMissing = [...CORE9].filter(f => !fields.includes(f))
+  const lines: Record<StandardId, string> = {
+    soc2: 'CAR 会话日志逐事件记录（actor/时间戳/工具名/脱敏后参数与结果/授权凭据），SHA-256 哈希链不可变；保留期默认永久（用户自管），建议 ≥1 年（CC7.2）。',
+    gdpr: '事件含 actor/actorDetail/eventType/runtimeVersion（GDPR 第 30 条处理活动可归因）；数据主体权利由部署方在自有环境行使；遥测默认关、零内容字段。',
+    mlps: '对应 GB/T 22239-2019 三级 8.1.4.3 安全审计 a)–d)——审计覆盖四类 actor 全量事件、记录含日期时间/用户/事件类型/是否成功、哈希链防未预期篡改、审计接口零写入；日志留存 ≥6 个月由用户环境承诺（运行时不自动清理）。',
+  }
+  return { standard: std, fields, coreMissing, statement: lines[std] }
+}

package/src/session/log.ts

@@ -0,0 +1,120 @@
+/**
+ * append-only 会话日志层（F2 / N1 —— POC-3 断言框架的产品化）
+ *
+ * 设计口径：
+ *  - 哈希链（SHA-256）为 CAR 自研增强（dsh 无此物，源码级核实）——合规卖点落地
+ *  - 「Model-visible means logged」：断言口径 = 请求时快照 === 日志前缀 [0, atSeq) 投影
+ *  - append-only：本层仅暴露 append/verifyChain/deriveMessages/assertModelVisibleLogged
+ */
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+
+export type EventKind = 'user' | 'assistant' | 'toolCall' | 'toolResult' | 'turnEnd' | 'goalUpdate' | 'hostRaw' // M3-S11 加法扩展：多宿主归一化降级通道（pattern 未命中留痕，零静默）；六值 TurnEndReason 不变
+export type Actor = 'user' | 'model' | 'plugin' | 'runtime'
+export interface SessionEvent {
+  seq: number
+  ts: number
+  actor: Actor
+  kind: EventKind
+  turnId: string
+  payload: unknown
+  meta?: Record<string, unknown>
+  prevHash: string
+  hash: string
+}
+
+const sha = (s: string) => createHash('sha256').update(s).digest('hex')
+const canonical = (e: Omit<SessionEvent, 'hash'>) =>
+  sha(JSON.stringify({ seq: e.seq, ts: e.ts, actor: e.actor, kind: e.kind, turnId: e.turnId, payload: e.payload, meta: e.meta ?? null, prevHash: e.prevHash }))
+
+export interface ModelSnapshot {
+  /** 快照对应日志前缀边界（事件数），断言时逐字节比对前缀投影 */
+  atSeq: number
+  request: unknown[]
+}
+
+export class SessionLog {
+  readonly sessionId: string
+  events: readonly SessionEvent[] = []
+  #tail = 'GENESIS'
+  #snapshots: ModelSnapshot[] = []
+
+  constructor(sessionId = 'S-' + Date.now().toString(36)) {
+    this.sessionId = sessionId
+  }
+
+  /** 唯一写入路径（append-only；无 update/delete API） */
+  append(actor: Actor, kind: EventKind, turnId: string, payload: unknown, meta?: Record<string, unknown>): SessionEvent {
+    const e: Omit<SessionEvent, 'hash'> = {
+      seq: this.events.length, ts: Date.now(), actor, kind, turnId, payload, meta, prevHash: this.#tail,
+    }
+    const full: SessionEvent = { ...e, hash: canonical(e) }
+    this.events = [...this.events, full]
+    this.#tail = full.hash
+    return full
+  }
+
+  /** 模型请求发起时调用（agent-loop 集成点）：登记「请求时快照」 */
+  snapshotModelRequest(): ModelSnapshot {
+    const snap: ModelSnapshot = { atSeq: this.events.length, request: structuredClone(this.deriveMessages(this.events.length)) }
+    this.#snapshots.push(snap)
+    return snap
+  }
+
+  /** 逐链校验；返回 null=完整，否则断链事件序号（审计导出前置，断链即中止） */
+  verifyChain(): number | null {
+    let prev = 'GENESIS'
+    for (const e of this.events) {
+      if (e.prevHash !== prev || e.hash !== canonical(e)) return e.seq
+      prev = e.hash
+    }
+    return null
+  }
+
+  /** 投影：从日志前缀重建模型可见消息流（不依赖模型运行时状态） */
+  deriveMessages(upTo?: number): Array<{ role: string; [k: string]: unknown }> {
+    const out: Array<{ role: string; [k: string]: unknown }> = []
+    for (const e of this.events) {
+      if (upTo !== undefined && e.seq >= upTo) break
+      if (e.kind === 'user') out.push({ role: 'user', content: e.payload })
+      else if (e.kind === 'assistant') out.push({ role: 'assistant', content: e.payload })
+      else if (e.kind === 'toolCall') out.push({ role: 'assistant', toolCall: e.payload })
+      else if (e.kind === 'toolResult') out.push({ role: 'toolResult', content: e.payload })
+    }
+    return out
+  }
+
+  /** N1 不变量断言（CI 门禁雏形）：全部快照必须与当前日志前缀投影逐字节一致 */
+  assertModelVisibleLogged(): { ok: boolean; failedAt?: number } {
+    for (const s of this.#snapshots) {
+      if (JSON.stringify(s.request) !== JSON.stringify(this.deriveMessages(s.atSeq))) {
+        return { ok: false, failedAt: s.atSeq }
+      }
+    }
+    return { ok: true }
+  }
+
+  /** 只读统计（供监控/测试） */
+  stats() {
+    return { events: this.events.length, snapshots: this.#snapshots.length, tailHash: this.#tail }
+  }
+
+  /** 导出取证数据（MVP 基础导出：JSONL 全量 + 审计元数据；F15 完整包为 M2） */
+  exportJSONL(): string {
+    return this.events.map(e => JSON.stringify(e)).join('\n') + '\n'
+  }
+}
+
+/** 从 JSONL 文件加载并校验哈希链（审计回放/跨机迁移入口；断链即拒绝装载） */
+export function loadSessionLog(file: string): { log: SessionLog; brokenAt: number | null } {
+  const log = new SessionLog(file)
+  const lines = readFileSync(file, 'utf-8').split('\n').filter(l => l.trim())
+  for (const line of lines) {
+    const e = JSON.parse(line) as SessionEvent
+    // 直接重建（绕过 append 的哈希计算），随后用 verifyChain 校验完整性
+    ;(log.events as SessionEvent[]).push(e)
+  }
+  return { log, brokenAt: log.verifyChain() }
+}
+
+export { sha as sha256Hex }

package/src/telemetry/metrics.ts

@@ -0,0 +1,38 @@
+/**
+ * S17 · 采集面（D-2 enforce 数据窗口 S18–S20 前置）：零内容计数器
+ *
+ * 口径（M4系统设计增补 S17 采集面 / Q-08 遥测三原则 / D-3）：
+ *  - 3 个 Counter：car_load_total{result} / car_unsigned_confirmed{confirmed} / car_registry_decision{source}；
+ *    labels 仅枚举值（来源/结果/模式）——**零内容字段**（无代码/提示词/路径/会话 id 明文），Q-08 兼容可机器断言；
+ *  - 双通道：遥测显式开（OTel 端点归用户）+ 登记表人工填报兜底（snapshot() 导出计数快照）；
+ *    未开启遥测时仅进程内累计，不落地不缓存出站（BD-05 语义）；
+ *  - 本层是可插拔计数钩子（onCount 注入面），非完整 OTel Metrics——完整面显式排除在 S17 外。
+ */
+
+export type CounterName = 'car_load_total' | 'car_unsigned_confirmed' | 'car_registry_decision'
+/** labels 仅枚举值——零内容红线由 AllowedLabels 类型约束 */
+export type AllowedLabels = { result?: 'ok' | 'failed'; confirmed?: 'yes' | 'no'; source?: 'registry' | 'npm-fallback' | 'rejected' | 'git' | 'path' }
+
+export interface Counters {
+  onCount(name: CounterName, labels?: AllowedLabels): void
+  /** 计数快照（登记表人工填报兜底通道的数据源；不含任何内容字段） */
+  snapshot(): Record<string, number>
+}
+
+export function createCounters(): Counters {
+  const store = new Map<string, number>()
+  return {
+    onCount(name, labels = {}) {
+      const key = name + Object.entries(labels).sort().map(([k, v]) => `|${k}=${v}`).join('')
+      store.set(key, (store.get(key) ?? 0) + 1)
+    },
+    snapshot() {
+      return Object.fromEntries([...store.entries()].sort())
+    },
+  }
+}
+
+/** 零内容红线自检：snapshot 键不得包含内容型模式（sk-/路径分隔/空格长串） */
+export function assertZeroContent(snapshot: Record<string, number>): boolean {
+  return Object.keys(snapshot).every(k => !/sk-|ghp_|\/|\\|.{60,}/.test(k))
+}

package/test/kernel.spec.ts

@@ -0,0 +1,136 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { Context } from '../src/kernel/context.ts'
+import { SessionLog } from '../src/session/log.ts'
+
+// ==================== 内核 F1/F9 + ADR-002 ====================
+
+test('F1: inject 依赖推导——provider 未就绪时 PENDING，就绪后自动挂载', () => {
+  const ctx = new Context()
+  const order: string[] = []
+  ctx.plugin({ name: 'consumer', inject: ['svc'], apply: (c) => { c.get('svc'); order.push('consumer') } })
+  ctx.plugin({ name: 'provider', apply: (c) => { order.push('provider'); c.provide('svc', { v: 1 }) } })
+  assert.deepEqual(order, ['provider', 'consumer']) // provider 先挂载；provide 同步解锁 consumer
+})
+
+test('F1: 缺依赖服务时 get 显式报错（禁静默）', () => {
+  const ctx = new Context()
+  // apply 同步异常在加载期（plugin() 调用点）显式抛出，调用方直接感知
+  assert.throws(() => ctx.plugin({ name: 'bad', apply: (c) => c.get('nope') }), /not provided/)
+  assert.throws(() => ctx.get('nope'), /not provided/)
+})
+
+test('F1: 重复 provide 同名服务 = 加载期硬报错 + 冲突链', () => {
+  const ctx = new Context()
+  ctx.provide('dup', 1, 'p1')
+  assert.throws(() => ctx.provide('dup', 2, 'p2'), /already provided by "p1".*p2/)
+})
+
+test('F1: 重复注册同名插件 = 显式报错', () => {
+  const ctx = new Context()
+  ctx.plugin({ name: 'x', apply: () => {} })
+  assert.throws(() => ctx.plugin({ name: 'x', apply: () => {} }), /already registered/)
+})
+
+test('F1: fiber 内 effect 注册逆序回卷（确定性）', async () => {
+  const ctx = new Context()
+  const marks: string[] = []
+  ctx.plugin({
+    name: 'p', apply: (c) => {
+      for (const l of ['e1', 'e2', 'e3']) c.effect(() => async () => { marks.push(l + ':end') }, l)
+    },
+  })
+  await ctx.disposeRuntime()
+  assert.deepEqual(marks, ['e3:end', 'e2:end', 'e1:end'])
+})
+
+test('ADR-002 strict-topo：consumer 先于 provider 卸载（逐层排空）', async () => {
+  const ctx = new Context()
+  const events: string[] = []
+  const sleep = (ms: number) => new Promise<void>(r => setTimeout(r, ms))
+  ctx.plugin({ name: 'db', apply: (c) => c.effect(() => async () => { await sleep(30); events.push('db:end') }, 'db-teardown') })
+  ctx.plugin({ name: 'cache', inject: ['dbConn'], apply: (c) => c.effect(() => async () => { await sleep(20); events.push('cache:end') }, 'cache-teardown') })
+  ctx.plugin({ name: 'api', inject: ['dbConn', 'cacheConn'], apply: (c) => c.effect(() => async () => { events.push('api:end') }, 'api-teardown') })
+  ctx.provide('dbConn', {}, 'db')
+  ctx.provide('cacheConn', {}, 'cache')
+  const report = await ctx.disposeRuntime({ order: 'strict-topo' })
+  assert.deepEqual(events, ['api:end', 'cache:end', 'db:end']) // 消费者层先排空
+  assert.deepEqual(report.order, ['api', 'cache', 'db'])
+})
+
+test('ADR-002 concurrent 模式：跨 fiber 并发（对照/降级模式可用）', async () => {
+  const ctx = new Context()
+  ctx.plugin({ name: 'a', apply: (c) => c.effect(() => async () => {}, 'a') })
+  ctx.plugin({ name: 'b', apply: (c) => c.effect(() => async () => {}, 'b') })
+  const report = await ctx.disposeRuntime({ order: 'concurrent' })
+  assert.equal(report.unloaded.length, 2)
+})
+
+test('ADR-002: strict-topo 模式下 disposer 抛错被捕获进 DisposeReport（屏障不悬挂）', async () => {
+  const ctx = new Context()
+  ctx.plugin({ name: 'boom', apply: (c) => c.effect(() => () => { throw new Error('boom') }, 'boom') })
+  ctx.plugin({ name: 'ok', apply: (c) => c.effect(() => () => {}, 'ok') })
+  const report = await ctx.disposeRuntime()
+  assert.equal(report.errors.length, 1)
+  assert.equal(report.errors[0].plugin, 'boom')
+  assert.equal(report.unloaded.length, 2)
+})
+
+test('F9: 依赖环 = 拓扑分层显式报错（加载期失败，不进入运行）', async () => {
+  const ctx = new Context()
+  // 通过互 inject 构造环（S1 骨架：环在 disposeRuntime 拓扑分层时暴露）
+  ctx.plugin({ name: 'a', inject: ['bSvc'], apply: (c) => {} })
+  ctx.plugin({ name: 'b', inject: ['aSvc'], apply: (c) => {} })
+  ctx.provide('bSvc', 1, 'b')
+  ctx.provide('aSvc', 1, 'a')
+  await assert.rejects(() => ctx.disposeRuntime(), /dependency cycle/)
+})
+
+test('POC-2 约束：effect 绑定插件 fiber 作用域（不串到根）', async () => {
+  const ctx = new Context()
+  let disposed = 0
+  ctx.plugin({ name: 'scoped', apply: (c) => c.effect(() => () => { disposed++ }, 't') })
+  await ctx.disposeRuntime()
+  assert.equal(disposed, 1)
+})
+
+// ==================== 会话日志 F2 / N1 ====================
+
+test('F2: 哈希链篡改检出并定位序号', () => {
+  const log = new SessionLog()
+  log.append('user', 'user', 'T0', 'hi')
+  log.append('model', 'assistant', 'T0', 'hello')
+  log.append('runtime', 'turnEnd', 'T0', null, { reason: 'completed' })
+  assert.equal(log.verifyChain(), null)
+  ;(log.events as any)[1] = { ...(log.events as any)[1], payload: 'tampered' }
+  assert.equal(log.verifyChain(), 1)
+})
+
+test('F2: deriveMessages 前缀投影（upTo 语义）', () => {
+  const log = new SessionLog()
+  log.append('user', 'user', 'T0', 'q1')
+  const snapAt1 = log.deriveMessages(1)
+  log.append('model', 'assistant', 'T0', 'a1')
+  assert.deepEqual(log.deriveMessages(1), snapAt1)
+  assert.equal(log.deriveMessages().length, 2)
+})
+
+test('N1: Model-visible means logged 断言（快照=前缀投影）', () => {
+  const log = new SessionLog()
+  log.append('user', 'user', 'T0', 'q')
+  log.snapshotModelRequest()
+  log.append('model', 'assistant', 'T0', 'a')
+  log.append('plugin', 'toolResult', 'T0', 'r')
+  const r = log.assertModelVisibleLogged()
+  assert.equal(r.ok, true)
+})
+
+test('N1: 断言失败可检出（模拟日志被篡改后投影漂移）', () => {
+  const log = new SessionLog()
+  log.append('user', 'user', 'T0', 'q')
+  log.snapshotModelRequest()
+  // 模拟「模型看到了日志外的东西」：快照后直接改历史（绕过 append API 的场景以校验断言灵敏度）
+  ;(log.events as any)[0] = { ...(log.events as any)[0], payload: 'mutated' }
+  const r = log.assertModelVisibleLogged()
+  assert.equal(r.ok, false)
+})

package/test/s11.spec.ts

@@ -0,0 +1,129 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { deriveSessionId, normalizeHostEvent, HOST_MAPPINGS } from '../src/host/mappings.ts'
+import { HostGateway, HOST_TOOLS, ingestHostEvent, type RuntimeFacade } from '../src/host/hostGateway.ts'
+import { readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+// ==================== session id 归一化 ====================
+
+test('T-1: deriveSessionId 确定性 + 跨宿主隔离 + 无语义解析', () => {
+  const a1 = deriveSessionId('claude-code', 'sess-42')
+  const a2 = deriveSessionId('claude-code', 'sess-42')
+  assert.equal(a1, a2, '幂等')
+  assert.match(a1, /^SH-[0-9a-f]{24}$/)
+  assert.notEqual(deriveSessionId('codex', 'sess-42'), a1, '不同宿主同 id → 不同 CAR 会话（跨宿主隔离）')
+  assert.notEqual(deriveSessionId('claude-code', 'sess-43'), a1)
+})
+
+// ==================== 归一化 schema（host-mappings-v1） ====================
+
+test('T-1: 命中映射——两宿主同语义事件归一化结果等价', () => {
+  const cc = normalizeHostEvent(HOST_MAPPINGS[0], 'user_message', { content: 'hello' })
+  const cx = normalizeHostEvent(HOST_MAPPINGS[1], 'input_item', { text: 'hello' })
+  assert.equal(cc.kind, 'user')
+  assert.equal(cx.kind, 'user')
+  assert.deepEqual(cc.payload, cx.payload) // { text: 'hello' }——等价性核心断言
+  assert.equal(cc.degraded, false)
+  assert.equal(cx.degraded, false)
+})
+
+test('T-1: 未命中 → hostRaw 降级留痕（零静默）', () => {
+  const r = normalizeHostEvent(HOST_MAPPINGS[0], 'unknown_future_event', { foo: 1 })
+  assert.equal(r.kind, 'hostRaw')
+  assert.equal(r.degraded, true)
+  assert.equal(r.payload.hostEvent, 'unknown_future_event')
+  assert.deepEqual(r.payload.raw, { foo: 1 }, '原样保留可回溯')
+})
+
+test('T-1: toolCall 归一化——字段重命名（tool_name→tool / name→tool）', () => {
+  const cc = normalizeHostEvent(HOST_MAPPINGS[0], 'tool_use', { tool_name: 'fs', tool_call_id: 'c1' })
+  const cx = normalizeHostEvent(HOST_MAPPINGS[1], 'function_call', { name: 'fs', call_id: 'c1' })
+  assert.deepEqual(cc.payload, cx.payload) // { tool: 'fs', id: 'c1' }
+})
+
+// ==================== HostGateway（9 tool 面 + 登记制） ====================
+
+function mockFacade(): RuntimeFacade {
+  return {
+    sessionStart: async ({ hostSessionId }) => ({ sessionId: deriveSessionId('claude-code', hostSessionId) }),
+    sessionTurn: async () => ({ reason: 'completed', steps: 1 }),
+    sessionStop: async () => ({ reason: 'aborted' }),
+    sessionStatus: async () => ({ state: 'idle' }),
+    sessionReplay: async () => ({ messages: [] }),
+    sessionVerify: async () => ({ ok: true, brokenAt: null }),
+    sessionExport: async () => ({ bundle: {} }),
+    toolList: async () => ({ tools: ['t1'] }),
+    toolCall: async () => ({ ok: true, result: 'x' }),
+  }
+}
+
+test('T-1: 登记制——未登记 host 拒绝（A050001）+ 重复登记报错', async () => {
+  const audits: string[] = []
+  const gw = new HostGateway({ facade: mockFacade(), audit: e => audits.push(e.kind) })
+  const r = await gw.handle('ghost', 'session_status', {})
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /A050001/)
+  assert.ok(audits.includes('host-rejected'), '拒绝也留痕')
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0], transport: { onRequest: async () => ({ jsonrpc: '2.0', id: 1 }), alive: () => true, close: () => {} } })
+  assert.throws(() => gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0], transport: {} as never }), /already registered/)
+})
+
+test('T-1: 9 tool 面固定 + 未知 tool 拒绝（step 循环不暴露）', async () => {
+  const gw = new HostGateway({ facade: mockFacade(), audit: () => {} })
+  assert.deepEqual(gw.listTools().sort(), [...HOST_TOOLS].sort())
+  assert.equal(HOST_TOOLS.length, 9)
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0], transport: {} as never })
+  const r = await gw.handle('claude-code', 'run_step', {})
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /step 循环不暴露/)
+})
+
+test('T-1: 端到端分发——facade 调用 + 审计留痕', async () => {
+  const audits: string[] = []
+  const gw = new HostGateway({ facade: mockFacade(), audit: e => audits.push(e.kind) })
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0], transport: {} as never })
+  const r = await gw.handle('claude-code', 'session_start', { hostSessionId: 'sess-42' })
+  assert.equal(r.ok, true)
+  assert.match((r.result as { sessionId: string }).sessionId, /^SH-/)
+  assert.ok(audits.includes('host-call'))
+})
+
+// ==================== 双宿主等价：契约测试框架（S13 扩全五类） ====================
+
+test('契约测试 v0: 同一 fixture 序列在两宿主 profile 下归一化等价', () => {
+  const fixtures: Array<{ semantic: string; cc: [string, Record<string, unknown>]; cx: [string, Record<string, unknown>] }>[] = [
+    [{
+      semantic: 'user-input',
+      cc: ['user_message', { content: 'hi' }],
+      cx: ['input_item', { text: 'hi' }],
+    }],
+    [{
+      semantic: 'tool-call',
+      cc: ['tool_use', { tool_name: 'fs', tool_call_id: 'c1' }],
+      cx: ['function_call', { name: 'fs', call_id: 'c1' }],
+    }],
+  ]
+  const flat = fixtures.flat()
+  for (const f of flat) {
+    const a = normalizeHostEvent(HOST_MAPPINGS[0], f.cc[0], f.cc[1])
+    const b = normalizeHostEvent(HOST_MAPPINGS[1], f.cx[0], f.cx[1])
+    assert.equal(a.kind, b.kind, `${f.semantic}: kind 等价`)
+    assert.deepEqual(a.payload, b.payload, `${f.semantic}: payload 等价`)
+    assert.equal(a.degraded, b.degraded)
+  }
+})
+
+test('静态架构断言: 宿主标识字符串只允许出现在 mappings 数据文件', () => {
+  const scan = (dir: string): string[] => readdirSync(dir, { recursive: true } as never)
+    .filter(f => String(f).endsWith('.ts'))
+    .map(f => join(dir, String(f)))
+  // 只扫生产代码（src/）——测试 fixture 自身含宿主标识属预期；mappings.ts 为唯一数据白名单
+  const files = scan('src').filter(f => !f.replaceAll('\\', '/').endsWith('src/host/mappings.ts'))
+  const offenders = files.filter(f => /claude-code|codex/.test(readFileSync(f, 'utf-8')))
+  assert.deepEqual(offenders, [], `宿主标识泄漏到非数据文件: ${offenders.join(', ')}`)
+})
+
+test('ingestHostEvent: 未登记宿主归一化拒绝（登记制在归一化之前）', () => {
+  assert.throws(() => ingestHostEvent('unregistered', 'user_message', {}), /A050001/)
+})