@mrciphersmith/keryx 0.2.32 → 0.2.33

package/dist/cli.js

@@ -35991,6 +35991,165 @@ async function resolvePolicySelectionSafely(workspaceRoot, canonicalFallback) {
     return canonicalFallback;
   }
 }
+async function diagnosePolicyReadiness(workspaceRoot) {
+  const steps = [];
+  const msg = (error2) => error2 instanceof Error ? error2.message : String(error2);
+  const pass = (step, detail) => {
+    steps.push(detail === undefined ? { step, status: "pass" } : { step, status: "pass", detail });
+  };
+  const fail = (step, detail) => {
+    steps.push({ step, status: "fail", detail });
+  };
+  const finalize = (configPresent, enabled2, killSwitch2) => {
+    const integrityReady = steps.every((entry) => entry.step === "activation-flags" || entry.status === "pass");
+    return Object.freeze({ configPresent, enabled: enabled2, killSwitch: killSwitch2, integrityReady, candidateWouldActivate: integrityReady && enabled2 && !killSwitch2, steps: Object.freeze([...steps]) });
+  };
+  const configPath3 = path118.join(workspaceRoot, ...policyExperimentConfigPath);
+  let configJson;
+  try {
+    const raw = await readFile64(configPath3, "utf8").catch((error2) => {
+      if (isMissing(error2))
+        return;
+      throw error2;
+    });
+    if (raw === undefined) {
+      fail("config", "no policy-experiment config at .metaproject/context-operations/policy-experiment/config.json");
+      return finalize(false, false, true);
+    }
+    const parsed = JSON.parse(raw);
+    if (!isRecord3(parsed) || !isConfigRecord(parsed)) {
+      fail("config", "config is not a valid policy-experiment record (needs boolean enabled + killSwitch)");
+      return finalize(true, false, true);
+    }
+    configJson = parsed;
+  } catch (error2) {
+    fail("config", `config could not be read or parsed: ${msg(error2)}`);
+    return finalize(true, false, true);
+  }
+  pass("config");
+  const enabled = configJson.enabled === true;
+  const killSwitch = configJson.killSwitch !== false;
+  if (enabled && !killSwitch)
+    pass("activation-flags", "enabled and kill-switch released");
+  else
+    fail("activation-flags", `candidate stays off by config: enabled=${String(configJson.enabled)}, killSwitch=${String(configJson.killSwitch)}`);
+  const requiredPins = ["candidateArtifactRef", "candidateArtifactDigest", "candidateVersion", "baselineArtifactRef", "baselineArtifactDigest", "baselineVersion", "corpusRef", "corpusDigest", "corpusVersion", "evaluationReportRef", "evaluationDigest"];
+  const missing = requiredPins.filter((name) => typeof configJson[name] !== "string");
+  if (missing.length > 0) {
+    fail("config-pins", `missing or non-string pins: ${missing.join(", ")}`);
+    return finalize(true, enabled, killSwitch);
+  }
+  const candidateRef = configJson.candidateArtifactRef;
+  const candidateDigest = configJson.candidateArtifactDigest;
+  const baselineRef = configJson.baselineArtifactRef;
+  const baselineDigest = configJson.baselineArtifactDigest;
+  const corpusRef = configJson.corpusRef;
+  const corpusDigest = configJson.corpusDigest;
+  const evaluationRef = configJson.evaluationReportRef;
+  const evaluationDigest = configJson.evaluationDigest;
+  if (!asString4(candidateRef) || !asString4(candidateDigest) || !asString4(baselineRef) || !asString4(baselineDigest) || !asString4(corpusRef) || !asString4(corpusDigest) || !asString4(evaluationRef) || !asString4(evaluationDigest)) {
+    fail("config-pins", "pins are present but not non-empty strings");
+    return finalize(true, enabled, killSwitch);
+  }
+  pass("config-pins");
+  const refsOk = workspacePathPattern3.test(candidateRef) && workspacePathPattern3.test(baselineRef) && workspacePathPattern3.test(corpusRef) && workspacePathPattern3.test(evaluationRef);
+  if (refsOk)
+    pass("reference-paths");
+  else
+    fail("reference-paths", "one or more artifact refs are not contained workspace-relative './\u2026' paths");
+  const hashesOk = validHash(candidateDigest) && validHash(baselineDigest) && validHash(corpusDigest) && validHash(evaluationDigest);
+  if (hashesOk)
+    pass("digest-format");
+  else
+    fail("digest-format", "one or more pinned digests are not sha256 hex");
+  const versionsOk = isImmutableVersion2(configJson.candidateVersion) && isImmutableVersion2(configJson.baselineVersion) && isImmutableVersion2(configJson.corpusVersion);
+  if (versionsOk)
+    pass("immutable-versions");
+  else
+    fail("immutable-versions", "candidate/baseline/corpus versions must be immutable (no latest/main/head/\u2026)");
+  const policyRefsOk = policyRefPattern.test(candidateRef) && policyRefPattern.test(baselineRef);
+  if (policyRefsOk)
+    pass("policy-refs");
+  else
+    fail("policy-refs", "candidate/baseline refs must be './\u2026' policy references");
+  if (!(refsOk && hashesOk && versionsOk && policyRefsOk))
+    return finalize(true, enabled, killSwitch);
+  let baselineArtifact;
+  let candidateArtifact;
+  let corpusPayload;
+  let evaluationPayload;
+  try {
+    baselineArtifact = await readPinnedJson({ workspaceRoot, uri: baselineRef, digest: baselineDigest });
+    if (isBaselineArtifact(baselineArtifact.artifact))
+      pass("baseline-artifact");
+    else
+      fail("baseline-artifact", "not a valid deterministic-baseline artifact");
+  } catch (error2) {
+    fail("baseline-artifact", `unreadable or digest mismatch: ${msg(error2)}`);
+  }
+  try {
+    candidateArtifact = await readPinnedJson({ workspaceRoot, uri: candidateRef, digest: candidateDigest });
+    if (isCandidateArtifact(candidateArtifact.artifact))
+      pass("candidate-artifact");
+    else
+      fail("candidate-artifact", "not a valid offline-selection-advisor artifact");
+  } catch (error2) {
+    fail("candidate-artifact", `unreadable or digest mismatch: ${msg(error2)}`);
+  }
+  try {
+    corpusPayload = await readWorkspaceJson({ workspaceRoot, uri: corpusRef });
+    if (!isCompleteCorpus(corpusPayload.artifact))
+      fail("corpus", "corpus failed structural / manifest verification");
+    else if (corpusPayload.artifact.manifest.corpusVersion !== configJson.corpusVersion || corpusPayload.artifact.manifest.corpusDigest !== corpusDigest)
+      fail("corpus", "corpus manifest version/digest does not match pins");
+    else
+      pass("corpus");
+  } catch (error2) {
+    fail("corpus", `unreadable: ${msg(error2)}`);
+  }
+  try {
+    evaluationPayload = await readWorkspaceJson({ workspaceRoot, uri: evaluationRef });
+    if (!isEvaluationReport(evaluationPayload.artifact) || !hasReportIntegrity(evaluationPayload.artifact))
+      fail("evaluation-report", "report is malformed or its recomputed digest does not match");
+    else if (evaluationPayload.artifact.reportDigest !== evaluationDigest)
+      fail("evaluation-report", "report digest does not match pin");
+    else
+      pass("evaluation-report");
+  } catch (error2) {
+    fail("evaluation-report", `unreadable: ${msg(error2)}`);
+  }
+  if (baselineArtifact && candidateArtifact && corpusPayload && evaluationPayload && isBaselineArtifact(baselineArtifact.artifact) && isCandidateArtifact(candidateArtifact.artifact) && isCompleteCorpus(corpusPayload.artifact) && isEvaluationReport(evaluationPayload.artifact) && hasReportIntegrity(evaluationPayload.artifact) && corpusPayload.artifact.manifest.corpusVersion === configJson.corpusVersion && corpusPayload.artifact.manifest.corpusDigest === corpusDigest && evaluationPayload.artifact.reportDigest === evaluationDigest) {
+    try {
+      const config = {
+        ...configJson,
+        enabled: true,
+        killSwitch: false,
+        candidateArtifactDigest: candidateArtifact.digest,
+        candidateDigest: candidateArtifact.digest,
+        baselineArtifactDigest: baselineArtifact.digest,
+        baselineDigest: baselineArtifact.digest,
+        corpusDigest,
+        evaluationDigest,
+        candidateVersion: configJson.candidateVersion,
+        baselineVersion: configJson.baselineVersion,
+        corpusVersion: configJson.corpusVersion,
+        rollbackBaselineVersion: configJson.rollbackBaselineVersion ?? configJson.baselineVersion
+      };
+      const baseline = { selectedIds: evaluationPayload.artifact.candidateSelectedIds, source: "deterministic-baseline", version: baselineArtifact.artifact.version, artifactDigest: baselineArtifact.digest };
+      const candidate = { version: candidateArtifact.artifact.version, artifactDigest: candidateArtifact.digest };
+      const outcome = resolvePolicyExperiment({ config, evaluation: evaluationPayload.artifact, candidate, corpus: corpusPayload.artifact, baseline });
+      if (outcome.source === "candidate")
+        pass("activation-gate", "evidence gates pass: security non-regression, holdout, adversarial, pins and candidate subset");
+      else
+        fail("activation-gate", `evidence gates reject candidate; report reasons: ${evaluationPayload.artifact.reasons.join(", ") || "none"}`);
+    } catch (error2) {
+      fail("activation-gate", `activation check errored: ${msg(error2)}`);
+    }
+  } else {
+    fail("activation-gate", "skipped: one or more prerequisite artifact checks did not pass");
+  }
+  return finalize(true, enabled, killSwitch);
+}
 function isCompleteCorpus(value) {
   return isRecord3(value) && isRecord3(value.manifest) && Array.isArray(value.rows) && Array.isArray(value.quarantine) && verifyPolicyCorpus(value);
 }
@@ -48466,7 +48625,7 @@ init_shell_config();
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.32",
+  version: "0.2.33",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -54294,6 +54453,14 @@ async function workspaceCommand(args2) {
       console.log(JSON.stringify(await createLocalCollaborationService(process.cwd()).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID20() }), null, 2));
       return;
     }
+    if (subcommand === "policy-readiness") {
+      rejectUnknownOptions(args2.slice(1), new Set);
+      const report = await diagnosePolicyReadiness(process.cwd());
+      console.log(JSON.stringify(report, null, 2));
+      if (!report.integrityReady)
+        process.exitCode = 1;
+      return;
+    }
     throw new Error(`Unknown workspace command: ${subcommand}`);
   } catch (error2) {
     console.error(error2 instanceof Error ? error2.message : String(error2));
@@ -54318,7 +54485,8 @@ keryx workspace overview <workspace-id> [--max-items N] [--max-tokens N]
 keryx workspace read <workspace-id> <item-id> [--max-items N] [--max-tokens N]
 keryx workspace propose <workspace-id> --kind <kind> --summary <explicit-summary> --evidence <workspace-relative-ref> [--revision <revision>]
 keryx workspace review <workspace-id> <proposal-id> --decision <accepted|rejected|dismissed> [--reason <reason>] [--idempotency-key <key>]
-keryx workspace collaboration <workspace-id>`);
+keryx workspace collaboration <workspace-id>
+keryx workspace policy-readiness`);
 }
 
 // src/cli.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {