@mytegroupinc/myte-core 0.0.53 → 0.0.55

package/scripts/project-assistant-read-certification.js

@@ -1,470 +1,470 @@
-#!/usr/bin/env node
-"use strict";
-
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-const { randomUUID } = require("node:crypto");
-
-const CLI_PATH = path.resolve(__dirname, "..", "cli.js");
-
-const ROUTE_MATRIX = [
-  { id: "doctor", kind: "transport", mutation: "none" },
-  { id: "config", kind: "read", mutation: "none" },
-  { id: "bootstrap", kind: "read/local-sync", mutation: "local_temp_only" },
-  { id: "feedback-sync", kind: "read/local-sync", mutation: "local_temp_only" },
-  { id: "sync-qaqc", kind: "read/local-sync", mutation: "local_temp_only" },
-  { id: "suggestions-sync", kind: "read/local-sync", mutation: "local_temp_only" },
-  { id: "feedback-get", kind: "read", mutation: "none", conditional: "feedback_id" },
-  { id: "feedback-history", kind: "read", mutation: "none", conditional: "feedback_id" },
-  { id: "feedback-prd-versions", kind: "read", mutation: "none", conditional: "feedback_id" },
-  { id: "feedback-prd-diff", kind: "read", mutation: "none", conditional: "version_id" },
-  { id: "query", kind: "inference-job", mutation: "ephemeral_job", conditional: "--include-query" },
-  {
-    id: "query-with-diff",
-    kind: "inference-job",
-    mutation: "temporary_tracked_fixture_and_ephemeral_job",
-    conditional: "--include-diff-query",
-  },
-];
-
-function parseArgs(argv) {
-  const args = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--")) continue;
-    const key = token.slice(2);
-    const next = argv[index + 1];
-    if (!next || next.startsWith("--")) {
-      args[key] = true;
-    } else {
-      args[key] = next;
-      index += 1;
-    }
-  }
-  return args;
-}
-
-function parseJsonOutput(result, command) {
-  const text = String(result.stdout || "").trim();
-  if (!text) return null;
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`${command} did not return JSON.`);
-  }
-}
-
-function safeCommandLabel(args) {
-  if (args[0] === "feedback") {
-    return `myte feedback ${String(args[1] || "").trim() || "<subcommand>"}`;
-  }
-  if (args[0] === "suggestions") {
-    return `myte suggestions ${String(args[1] || "").trim() || "<subcommand>"}`;
-  }
-  if (args[0] === "query") {
-    return "myte query <redacted>";
-  }
-  return `myte ${String(args[0] || "").trim() || "<command>"}`;
-}
-
-function runCli(args, { cwd, timeoutMs = 360000 } = {}) {
-  const started = Date.now();
-  const result = spawnSync(process.execPath, [CLI_PATH, ...args], {
-    cwd,
-    env: process.env,
-    encoding: "utf8",
-    timeout: timeoutMs,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  const command = safeCommandLabel(args);
-  const parsed = parseJsonOutput(result, command);
-  return {
-    id: command.replace(/^myte\s+/, "").replace(/\s+/g, "-"),
-    command,
-    ok: result.status === 0,
-    exit_code: result.status,
-    duration_ms: Date.now() - started,
-    data: parsed,
-    error: result.status === 0
-      ? null
-      : String(result.stderr || parsed?.message || "Command failed.").trim().slice(0, 2000),
-  };
-}
-
-function runGit(args, cwd) {
-  const result = spawnSync("git", args, {
-    cwd,
-    env: process.env,
-    encoding: "utf8",
-    timeout: 60000,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  return {
-    ok: result.status === 0,
-    exit_code: result.status,
-    stdout: String(result.stdout || ""),
-    stderr: String(result.stderr || "").trim(),
-  };
-}
-
-function resolveDiffFixture(configData) {
-  const local = configData?.local && typeof configData.local === "object"
-    ? configData.local
-    : {};
-  const root = String(local.root || "").trim();
-  const found = Array.isArray(local.found) ? local.found.map(String) : [];
-  if (!root || !found.length) {
-    throw new Error("Diff certification requires at least one resolved configured repository.");
-  }
-
-  for (const repoName of found) {
-    const repoPath = path.resolve(root, repoName);
-    const status = runGit(["status", "--porcelain"], repoPath);
-    if (!status.ok || status.stdout.trim()) continue;
-
-    const tracked = runGit(["ls-files"], repoPath);
-    if (!tracked.ok) continue;
-    const candidates = tracked.stdout
-      .split(/\r?\n/)
-      .map((item) => item.trim())
-      .filter(Boolean)
-      .filter((item) => /(^|\/)readme(?:\.[a-z0-9]+)?$/i.test(item));
-    for (const relativePath of candidates) {
-      const filePath = path.resolve(repoPath, relativePath);
-      if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
-        return {
-          repoName,
-          repoPath,
-          relativePath,
-          filePath,
-        };
-      }
-    }
-  }
-  throw new Error(
-    "Diff certification requires a clean configured repository with a tracked README file.",
-  );
-}
-
-function runDiffCertification({
-  args,
-  configData,
-  runId,
-  workspace,
-  shared,
-}) {
-  const fixture = resolveDiffFixture(configData);
-  const marker = `MYTE_CERT_DIFF_${runId.replace(/[^A-Za-z0-9_]/g, "_")}`;
-  const original = fs.readFileSync(fixture.filePath);
-  const originalStatus = runGit(["status", "--porcelain"], fixture.repoPath);
-  let contextCheck = null;
-  let queryCheck = null;
-  let restoreError = null;
-
-  try {
-    const separator = original.length && !original.toString("utf8").endsWith("\n")
-      ? "\n"
-      : "";
-    fs.appendFileSync(
-      fixture.filePath,
-      `${separator}\n<!-- ${marker} -->\n`,
-      "utf8",
-    );
-    const diffLimit = String(args["diff-limit"] || 500000);
-    const prompt = [
-      "Goal: certify project-scoped diff ingestion.",
-      `Evidence marker: ${marker}.`,
-      `Ask: return the exact marker and name ${fixture.repoName}/${fixture.relativePath}.`,
-    ].join(" ");
-    const commonDiffArgs = [
-      "query",
-      prompt,
-      "--with-diff",
-      "--no-fetch",
-      "--diff-limit",
-      diffLimit,
-      ...shared,
-    ];
-    const rawContextCheck = runCli(
-      [...commonDiffArgs, "--print-context"],
-      { cwd: workspace },
-    );
-    const contextText = Array.isArray(rawContextCheck.data?.additional_context)
-      ? rawContextCheck.data.additional_context.join("\n")
-      : "";
-    const markerPresent = contextText.includes(marker);
-    const fetchDisabled =
-      rawContextCheck.data?.diff_diagnostics?.fetch_remote === false;
-    contextCheck = {
-      ...rawContextCheck,
-      id: "query-with-diff-context",
-      command: "myte query <redacted> --with-diff --print-context",
-      ok: rawContextCheck.ok && markerPresent && fetchDisabled,
-      error: rawContextCheck.ok && markerPresent && fetchDisabled
-        ? null
-        : rawContextCheck.error
-          || "Diff context did not contain the marker or --no-fetch was not honored.",
-      data: {
-        marker_present: markerPresent,
-        fetch_remote: rawContextCheck.data?.diff_diagnostics?.fetch_remote,
-        truncated: rawContextCheck.data?.diff_diagnostics?.truncated,
-        fixture_repo: fixture.repoName,
-        fixture_file: fixture.relativePath,
-      },
-    };
-
-    if (contextCheck.ok) {
-      const rawQueryCheck = runCli(
-        [
-          ...commonDiffArgs,
-          "--request-id",
-          `cert-diff-${runId}`.slice(0, 128),
-          "--json",
-        ],
-        { cwd: workspace },
-      );
-      const answer = String(rawQueryCheck.data?.answer || "");
-      const answerContainsMarker = answer.includes(marker);
-      queryCheck = {
-        ...rawQueryCheck,
-        id: "query-with-diff",
-        command: "myte query <redacted> --with-diff",
-        ok: rawQueryCheck.ok && answerContainsMarker,
-        error: rawQueryCheck.ok && answerContainsMarker
-          ? null
-          : rawQueryCheck.error
-            || "Live diff-query answer did not contain the exact fixture marker.",
-        data: {
-          marker_present_in_answer: answerContainsMarker,
-          job_id: rawQueryCheck.data?.job_id || null,
-          request_id: rawQueryCheck.data?.request_id || null,
-        },
-      };
-    }
-  } finally {
-    try {
-      fs.writeFileSync(fixture.filePath, original);
-      const restoredStatus = runGit(["status", "--porcelain"], fixture.repoPath);
-      if (
-        !restoredStatus.ok
-        || restoredStatus.stdout !== originalStatus.stdout
-      ) {
-        restoreError = "Diff fixture repository did not return to its original clean status.";
-      }
-    } catch (error) {
-      restoreError = error?.message || String(error);
-    }
-  }
-
-  const checks = [];
-  if (contextCheck) checks.push(contextCheck);
-  if (queryCheck) checks.push(queryCheck);
-  checks.push({
-    id: "query-with-diff-fixture-restore",
-    command: "restore temporary tracked diff fixture",
-    ok: !restoreError,
-    exit_code: restoreError ? 1 : 0,
-    duration_ms: 0,
-    data: {
-      fixture_repo: fixture.repoName,
-      fixture_file: fixture.relativePath,
-    },
-    error: restoreError,
-  });
-  return checks;
-}
-
-function firstFeedbackId(feedbackPath) {
-  if (!fs.existsSync(feedbackPath)) return null;
-  const text = fs.readFileSync(feedbackPath, "utf8");
-  const match = text.match(/^\s*(?:-\s+)?feedback_id:\s*["']?([^"'\s]+)["']?\s*$/m);
-  return match ? match[1] : null;
-}
-
-function versionIdentifier(version) {
-  return String(version?.version_id || version?._id || "").trim() || null;
-}
-
-function versionDocumentIdentifier(version) {
-  const documentSet =
-    version?.prd_document_set && typeof version.prd_document_set === "object"
-      ? version.prd_document_set
-      : null;
-  const documents = Array.isArray(version?.prd_documents)
-    ? version.prd_documents
-    : Array.isArray(documentSet?.documents)
-      ? documentSet.documents
-      : [];
-  return String(
-    version?.primary_document_id
-      || documentSet?.primary_document_id
-      || documents[0]?.document_id
-      || "",
-  ).trim() || null;
-}
-
-function baseArgs(args) {
-  const result = [];
-  if (args["base-url"]) result.push("--base-url", String(args["base-url"]));
-  result.push("--timeout-ms", String(args["timeout-ms"] || 300000));
-  return result;
-}
-
-function main() {
-  const args = parseArgs(process.argv.slice(2));
-  if (!args["confirm-read"]) {
-    console.log(JSON.stringify({
-      ok: true,
-      dry_run: true,
-      message: "No network or project mutation was performed.",
-      route_matrix: ROUTE_MATRIX,
-      mutation_harnesses: [
-        "feedback-live-full-harness.js",
-        "mission-live-full-harness.js",
-        "mission-live-disposable-harness.js",
-      ],
-    }, null, 2));
-    return;
-  }
-  if (!process.env.MYTE_API_KEY && !process.env.MYTE_PROJECT_API_KEY) {
-    throw new Error("Missing MYTE_API_KEY or MYTE_PROJECT_API_KEY.");
-  }
-
-  const runId = String(args["run-id"] || randomUUID());
-  const workspace = path.resolve(
-    args.workspace || fs.mkdtempSync(path.join(os.tmpdir(), `myte-read-cert-${runId}-`)),
-  );
-  const outputDir = path.join(workspace, "MyteCommandCenter");
-  fs.mkdirSync(workspace, { recursive: true });
-  const shared = baseArgs(args);
-  const checks = [];
-
-  const doctor = runCli(["doctor", "--json", ...shared], { cwd: workspace, timeoutMs: 60000 });
-  checks.push({ ...doctor, data: doctor.data ? {
-    ok: doctor.data.ok,
-    failure_layer: doctor.data.failure_layer,
-    runtime: doctor.data.runtime,
-    api: doctor.data.api,
-    project_key: doctor.data.project_key,
-    proxy: doctor.data.proxy,
-    dns: doctor.data.dns,
-    direct_transport: doctor.data.direct_transport,
-    config_probe: doctor.data.config_probe,
-  } : null });
-  if (!doctor.ok) {
-    console.log(JSON.stringify({
-      ok: false,
-      run_id: runId,
-      workspace,
-      stopped_at: "doctor",
-      failure_layer: doctor.data?.failure_layer || "unknown",
-      checks,
-    }, null, 2));
-    process.exit(1);
-  }
-
-  const config = runCli(["config", "--json", ...shared], { cwd: workspace });
-  checks.push(config);
-  checks.push(runCli(["bootstrap", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
-  checks.push(runCli(["feedback-sync", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
-  checks.push(runCli(["sync-qaqc", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
-  checks.push(runCli(["suggestions", "sync", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
-
-  const feedbackId = firstFeedbackId(path.join(outputDir, "data", "feedback.yml"));
-  if (feedbackId) {
-    checks.push(runCli(["feedback", "get", "--feedback-id", feedbackId, "--json", ...shared], { cwd: workspace }));
-    checks.push(runCli(["feedback", "history", "--feedback-id", feedbackId, "--json", ...shared], { cwd: workspace }));
-    const versionsCheck = runCli(
-      ["feedback", "prd-versions", "--feedback-id", feedbackId, "--json", ...shared],
-      { cwd: workspace },
-    );
-    checks.push(versionsCheck);
-    if (versionsCheck.ok) {
-      const versions = Array.isArray(versionsCheck.data?.versions)
-        ? versionsCheck.data.versions
-        : [];
-      const activeVersionId = String(
-        versionsCheck.data?.active_prd_version_id || "",
-      ).trim();
-      const targetVersion =
-        versions.find((version) => versionIdentifier(version) !== activeVersionId)
-        || versions[0];
-      const targetVersionId = versionIdentifier(targetVersion);
-      if (targetVersionId) {
-        const diffArgs = [
-          "feedback",
-          "prd-diff",
-          "--feedback-id",
-          feedbackId,
-          "--version-id",
-          targetVersionId,
-        ];
-        const documentId = versionDocumentIdentifier(targetVersion);
-        if (documentId) diffArgs.push("--document-id", documentId);
-        diffArgs.push("--json", ...shared);
-        checks.push(runCli(diffArgs, { cwd: workspace }));
-      }
-    }
-  }
-
-  if (args["include-query"]) {
-    checks.push(runCli([
-      "query",
-      "Goal: certify Project Assistant query transport. Ask: return the project title in one sentence.",
-      "--request-id",
-      `cert-read-${runId}`,
-      "--json",
-      ...shared,
-    ], { cwd: workspace }));
-  }
-
-  if (args["include-diff-query"]) {
-    if (!config.ok) {
-      checks.push({
-        id: "query-with-diff",
-        command: "myte query <redacted> --with-diff",
-        ok: false,
-        exit_code: 1,
-        duration_ms: 0,
-        data: null,
-        error: "Project config failed; diff certification could not resolve a repository.",
-      });
-    } else {
-      checks.push(...runDiffCertification({
-        args,
-        configData: config.data,
-        runId,
-        workspace,
-        shared,
-      }));
-    }
-  }
-
-  const failed = checks.filter((check) => !check.ok);
-  console.log(JSON.stringify({
-    ok: failed.length === 0,
-    run_id: runId,
-    workspace,
-    local_artifacts_only: true,
-    live_business_mutations: false,
-    checks: checks.map((check) => ({
-      id: check.id,
-      command: check.command,
-      ok: check.ok,
-      exit_code: check.exit_code,
-      duration_ms: check.duration_ms,
-      error: check.error,
-    })),
-    failed_count: failed.length,
-  }, null, 2));
-  if (failed.length) process.exit(1);
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(JSON.stringify({ ok: false, message: error?.message || String(error) }, null, 2));
-  process.exit(1);
-}
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+const { randomUUID } = require("node:crypto");
+
+const CLI_PATH = path.resolve(__dirname, "..", "cli.js");
+
+const ROUTE_MATRIX = [
+  { id: "doctor", kind: "transport", mutation: "none" },
+  { id: "config", kind: "read", mutation: "none" },
+  { id: "bootstrap", kind: "read/local-sync", mutation: "local_temp_only" },
+  { id: "feedback-sync", kind: "read/local-sync", mutation: "local_temp_only" },
+  { id: "sync-qaqc", kind: "read/local-sync", mutation: "local_temp_only" },
+  { id: "suggestions-sync", kind: "read/local-sync", mutation: "local_temp_only" },
+  { id: "feedback-get", kind: "read", mutation: "none", conditional: "feedback_id" },
+  { id: "feedback-history", kind: "read", mutation: "none", conditional: "feedback_id" },
+  { id: "feedback-prd-versions", kind: "read", mutation: "none", conditional: "feedback_id" },
+  { id: "feedback-prd-diff", kind: "read", mutation: "none", conditional: "version_id" },
+  { id: "query", kind: "inference-job", mutation: "ephemeral_job", conditional: "--include-query" },
+  {
+    id: "query-with-diff",
+    kind: "inference-job",
+    mutation: "temporary_tracked_fixture_and_ephemeral_job",
+    conditional: "--include-diff-query",
+  },
+];
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) continue;
+    const key = token.slice(2);
+    const next = argv[index + 1];
+    if (!next || next.startsWith("--")) {
+      args[key] = true;
+    } else {
+      args[key] = next;
+      index += 1;
+    }
+  }
+  return args;
+}
+
+function parseJsonOutput(result, command) {
+  const text = String(result.stdout || "").trim();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${command} did not return JSON.`);
+  }
+}
+
+function safeCommandLabel(args) {
+  if (args[0] === "feedback") {
+    return `myte feedback ${String(args[1] || "").trim() || "<subcommand>"}`;
+  }
+  if (args[0] === "suggestions") {
+    return `myte suggestions ${String(args[1] || "").trim() || "<subcommand>"}`;
+  }
+  if (args[0] === "query") {
+    return "myte query <redacted>";
+  }
+  return `myte ${String(args[0] || "").trim() || "<command>"}`;
+}
+
+function runCli(args, { cwd, timeoutMs = 360000 } = {}) {
+  const started = Date.now();
+  const result = spawnSync(process.execPath, [CLI_PATH, ...args], {
+    cwd,
+    env: process.env,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  const command = safeCommandLabel(args);
+  const parsed = parseJsonOutput(result, command);
+  return {
+    id: command.replace(/^myte\s+/, "").replace(/\s+/g, "-"),
+    command,
+    ok: result.status === 0,
+    exit_code: result.status,
+    duration_ms: Date.now() - started,
+    data: parsed,
+    error: result.status === 0
+      ? null
+      : String(result.stderr || parsed?.message || "Command failed.").trim().slice(0, 2000),
+  };
+}
+
+function runGit(args, cwd) {
+  const result = spawnSync("git", args, {
+    cwd,
+    env: process.env,
+    encoding: "utf8",
+    timeout: 60000,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return {
+    ok: result.status === 0,
+    exit_code: result.status,
+    stdout: String(result.stdout || ""),
+    stderr: String(result.stderr || "").trim(),
+  };
+}
+
+function resolveDiffFixture(configData) {
+  const local = configData?.local && typeof configData.local === "object"
+    ? configData.local
+    : {};
+  const root = String(local.root || "").trim();
+  const found = Array.isArray(local.found) ? local.found.map(String) : [];
+  if (!root || !found.length) {
+    throw new Error("Diff certification requires at least one resolved configured repository.");
+  }
+
+  for (const repoName of found) {
+    const repoPath = path.resolve(root, repoName);
+    const status = runGit(["status", "--porcelain"], repoPath);
+    if (!status.ok || status.stdout.trim()) continue;
+
+    const tracked = runGit(["ls-files"], repoPath);
+    if (!tracked.ok) continue;
+    const candidates = tracked.stdout
+      .split(/\r?\n/)
+      .map((item) => item.trim())
+      .filter(Boolean)
+      .filter((item) => /(^|\/)readme(?:\.[a-z0-9]+)?$/i.test(item));
+    for (const relativePath of candidates) {
+      const filePath = path.resolve(repoPath, relativePath);
+      if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
+        return {
+          repoName,
+          repoPath,
+          relativePath,
+          filePath,
+        };
+      }
+    }
+  }
+  throw new Error(
+    "Diff certification requires a clean configured repository with a tracked README file.",
+  );
+}
+
+function runDiffCertification({
+  args,
+  configData,
+  runId,
+  workspace,
+  shared,
+}) {
+  const fixture = resolveDiffFixture(configData);
+  const marker = `MYTE_CERT_DIFF_${runId.replace(/[^A-Za-z0-9_]/g, "_")}`;
+  const original = fs.readFileSync(fixture.filePath);
+  const originalStatus = runGit(["status", "--porcelain"], fixture.repoPath);
+  let contextCheck = null;
+  let queryCheck = null;
+  let restoreError = null;
+
+  try {
+    const separator = original.length && !original.toString("utf8").endsWith("\n")
+      ? "\n"
+      : "";
+    fs.appendFileSync(
+      fixture.filePath,
+      `${separator}\n<!-- ${marker} -->\n`,
+      "utf8",
+    );
+    const diffLimit = String(args["diff-limit"] || 500000);
+    const prompt = [
+      "Goal: certify project-scoped diff ingestion.",
+      `Evidence marker: ${marker}.`,
+      `Ask: return the exact marker and name ${fixture.repoName}/${fixture.relativePath}.`,
+    ].join(" ");
+    const commonDiffArgs = [
+      "query",
+      prompt,
+      "--with-diff",
+      "--no-fetch",
+      "--diff-limit",
+      diffLimit,
+      ...shared,
+    ];
+    const rawContextCheck = runCli(
+      [...commonDiffArgs, "--print-context"],
+      { cwd: workspace },
+    );
+    const contextText = Array.isArray(rawContextCheck.data?.additional_context)
+      ? rawContextCheck.data.additional_context.join("\n")
+      : "";
+    const markerPresent = contextText.includes(marker);
+    const fetchDisabled =
+      rawContextCheck.data?.diff_diagnostics?.fetch_remote === false;
+    contextCheck = {
+      ...rawContextCheck,
+      id: "query-with-diff-context",
+      command: "myte query <redacted> --with-diff --print-context",
+      ok: rawContextCheck.ok && markerPresent && fetchDisabled,
+      error: rawContextCheck.ok && markerPresent && fetchDisabled
+        ? null
+        : rawContextCheck.error
+          || "Diff context did not contain the marker or --no-fetch was not honored.",
+      data: {
+        marker_present: markerPresent,
+        fetch_remote: rawContextCheck.data?.diff_diagnostics?.fetch_remote,
+        truncated: rawContextCheck.data?.diff_diagnostics?.truncated,
+        fixture_repo: fixture.repoName,
+        fixture_file: fixture.relativePath,
+      },
+    };
+
+    if (contextCheck.ok) {
+      const rawQueryCheck = runCli(
+        [
+          ...commonDiffArgs,
+          "--request-id",
+          `cert-diff-${runId}`.slice(0, 128),
+          "--json",
+        ],
+        { cwd: workspace },
+      );
+      const answer = String(rawQueryCheck.data?.answer || "");
+      const answerContainsMarker = answer.includes(marker);
+      queryCheck = {
+        ...rawQueryCheck,
+        id: "query-with-diff",
+        command: "myte query <redacted> --with-diff",
+        ok: rawQueryCheck.ok && answerContainsMarker,
+        error: rawQueryCheck.ok && answerContainsMarker
+          ? null
+          : rawQueryCheck.error
+            || "Live diff-query answer did not contain the exact fixture marker.",
+        data: {
+          marker_present_in_answer: answerContainsMarker,
+          job_id: rawQueryCheck.data?.job_id || null,
+          request_id: rawQueryCheck.data?.request_id || null,
+        },
+      };
+    }
+  } finally {
+    try {
+      fs.writeFileSync(fixture.filePath, original);
+      const restoredStatus = runGit(["status", "--porcelain"], fixture.repoPath);
+      if (
+        !restoredStatus.ok
+        || restoredStatus.stdout !== originalStatus.stdout
+      ) {
+        restoreError = "Diff fixture repository did not return to its original clean status.";
+      }
+    } catch (error) {
+      restoreError = error?.message || String(error);
+    }
+  }
+
+  const checks = [];
+  if (contextCheck) checks.push(contextCheck);
+  if (queryCheck) checks.push(queryCheck);
+  checks.push({
+    id: "query-with-diff-fixture-restore",
+    command: "restore temporary tracked diff fixture",
+    ok: !restoreError,
+    exit_code: restoreError ? 1 : 0,
+    duration_ms: 0,
+    data: {
+      fixture_repo: fixture.repoName,
+      fixture_file: fixture.relativePath,
+    },
+    error: restoreError,
+  });
+  return checks;
+}
+
+function firstFeedbackId(feedbackPath) {
+  if (!fs.existsSync(feedbackPath)) return null;
+  const text = fs.readFileSync(feedbackPath, "utf8");
+  const match = text.match(/^\s*(?:-\s+)?feedback_id:\s*["']?([^"'\s]+)["']?\s*$/m);
+  return match ? match[1] : null;
+}
+
+function versionIdentifier(version) {
+  return String(version?.version_id || version?._id || "").trim() || null;
+}
+
+function versionDocumentIdentifier(version) {
+  const documentSet =
+    version?.prd_document_set && typeof version.prd_document_set === "object"
+      ? version.prd_document_set
+      : null;
+  const documents = Array.isArray(version?.prd_documents)
+    ? version.prd_documents
+    : Array.isArray(documentSet?.documents)
+      ? documentSet.documents
+      : [];
+  return String(
+    version?.primary_document_id
+      || documentSet?.primary_document_id
+      || documents[0]?.document_id
+      || "",
+  ).trim() || null;
+}
+
+function baseArgs(args) {
+  const result = [];
+  if (args["base-url"]) result.push("--base-url", String(args["base-url"]));
+  result.push("--timeout-ms", String(args["timeout-ms"] || 300000));
+  return result;
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args["confirm-read"]) {
+    console.log(JSON.stringify({
+      ok: true,
+      dry_run: true,
+      message: "No network or project mutation was performed.",
+      route_matrix: ROUTE_MATRIX,
+      mutation_harnesses: [
+        "feedback-live-full-harness.js",
+        "mission-live-full-harness.js",
+        "mission-live-disposable-harness.js",
+      ],
+    }, null, 2));
+    return;
+  }
+  if (!process.env.MYTE_API_KEY && !process.env.MYTE_PROJECT_API_KEY) {
+    throw new Error("Missing MYTE_API_KEY or MYTE_PROJECT_API_KEY.");
+  }
+
+  const runId = String(args["run-id"] || randomUUID());
+  const workspace = path.resolve(
+    args.workspace || fs.mkdtempSync(path.join(os.tmpdir(), `myte-read-cert-${runId}-`)),
+  );
+  const outputDir = path.join(workspace, "MyteCommandCenter");
+  fs.mkdirSync(workspace, { recursive: true });
+  const shared = baseArgs(args);
+  const checks = [];
+
+  const doctor = runCli(["doctor", "--json", ...shared], { cwd: workspace, timeoutMs: 60000 });
+  checks.push({ ...doctor, data: doctor.data ? {
+    ok: doctor.data.ok,
+    failure_layer: doctor.data.failure_layer,
+    runtime: doctor.data.runtime,
+    api: doctor.data.api,
+    project_key: doctor.data.project_key,
+    proxy: doctor.data.proxy,
+    dns: doctor.data.dns,
+    direct_transport: doctor.data.direct_transport,
+    config_probe: doctor.data.config_probe,
+  } : null });
+  if (!doctor.ok) {
+    console.log(JSON.stringify({
+      ok: false,
+      run_id: runId,
+      workspace,
+      stopped_at: "doctor",
+      failure_layer: doctor.data?.failure_layer || "unknown",
+      checks,
+    }, null, 2));
+    process.exit(1);
+  }
+
+  const config = runCli(["config", "--json", ...shared], { cwd: workspace });
+  checks.push(config);
+  checks.push(runCli(["bootstrap", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
+  checks.push(runCli(["feedback-sync", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
+  checks.push(runCli(["sync-qaqc", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
+  checks.push(runCli(["suggestions", "sync", "--output-dir", outputDir, "--json", ...shared], { cwd: workspace }));
+
+  const feedbackId = firstFeedbackId(path.join(outputDir, "data", "feedback.yml"));
+  if (feedbackId) {
+    checks.push(runCli(["feedback", "get", "--feedback-id", feedbackId, "--json", ...shared], { cwd: workspace }));
+    checks.push(runCli(["feedback", "history", "--feedback-id", feedbackId, "--json", ...shared], { cwd: workspace }));
+    const versionsCheck = runCli(
+      ["feedback", "prd-versions", "--feedback-id", feedbackId, "--json", ...shared],
+      { cwd: workspace },
+    );
+    checks.push(versionsCheck);
+    if (versionsCheck.ok) {
+      const versions = Array.isArray(versionsCheck.data?.versions)
+        ? versionsCheck.data.versions
+        : [];
+      const activeVersionId = String(
+        versionsCheck.data?.active_prd_version_id || "",
+      ).trim();
+      const targetVersion =
+        versions.find((version) => versionIdentifier(version) !== activeVersionId)
+        || versions[0];
+      const targetVersionId = versionIdentifier(targetVersion);
+      if (targetVersionId) {
+        const diffArgs = [
+          "feedback",
+          "prd-diff",
+          "--feedback-id",
+          feedbackId,
+          "--version-id",
+          targetVersionId,
+        ];
+        const documentId = versionDocumentIdentifier(targetVersion);
+        if (documentId) diffArgs.push("--document-id", documentId);
+        diffArgs.push("--json", ...shared);
+        checks.push(runCli(diffArgs, { cwd: workspace }));
+      }
+    }
+  }
+
+  if (args["include-query"]) {
+    checks.push(runCli([
+      "query",
+      "Goal: certify Project Assistant query transport. Ask: return the project title in one sentence.",
+      "--request-id",
+      `cert-read-${runId}`,
+      "--json",
+      ...shared,
+    ], { cwd: workspace }));
+  }
+
+  if (args["include-diff-query"]) {
+    if (!config.ok) {
+      checks.push({
+        id: "query-with-diff",
+        command: "myte query <redacted> --with-diff",
+        ok: false,
+        exit_code: 1,
+        duration_ms: 0,
+        data: null,
+        error: "Project config failed; diff certification could not resolve a repository.",
+      });
+    } else {
+      checks.push(...runDiffCertification({
+        args,
+        configData: config.data,
+        runId,
+        workspace,
+        shared,
+      }));
+    }
+  }
+
+  const failed = checks.filter((check) => !check.ok);
+  console.log(JSON.stringify({
+    ok: failed.length === 0,
+    run_id: runId,
+    workspace,
+    local_artifacts_only: true,
+    live_business_mutations: false,
+    checks: checks.map((check) => ({
+      id: check.id,
+      command: check.command,
+      ok: check.ok,
+      exit_code: check.exit_code,
+      duration_ms: check.duration_ms,
+      error: check.error,
+    })),
+    failed_count: failed.length,
+  }, null, 2));
+  if (failed.length) process.exit(1);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(JSON.stringify({ ok: false, message: error?.message || String(error) }, null, 2));
+  process.exit(1);
+}