@neuraloom/contracts 0.0.0-stage → 0.1.22

package/dist/workflow/step-id-canonical.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Canonical workflow step ID + route path normalization (#1252).
+ * Single mapper — do not duplicate alias tables elsewhere.
+ *
+ * Dual-spine contract (software_app, WF-01):
+ * - Operator nav: ~18 WORKFLOW_STEPS in `SOFTWARE_OPERATOR_NAV_STEP_IDS` (sidebar / progress).
+ * - Quality channel: 12 WORKFLOW_CHANNEL_REGISTRY steps (orchestration / Doctor artifacts).
+ * - Nav aliases below map operator keys → registry stepIds; do not collapse nav to channel count.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_STEP_ID_ALIAS_PAIRS = exports.WORKFLOW_STEP_ROUTE_PATH_ALIASES = exports.REGISTRY_WORKFLOW_STEP_ID_BY_NAV_KEY = void 0;
+exports.resolveRegistryWorkflowStepId = resolveRegistryWorkflowStepId;
+exports.resolveCanonicalWorkflowStepId = resolveCanonicalWorkflowStepId;
+exports.resolveWorkflowStepRoutePath = resolveWorkflowStepRoutePath;
+exports.normalizeWorkflowStepStatsStepId = normalizeWorkflowStepStatsStepId;
+/** Nav / URL keys → registry `ChannelStepDefinition.stepId`. */
+exports.REGISTRY_WORKFLOW_STEP_ID_BY_NAV_KEY = {
+    deployments: 'deploy',
+    knowledge: 'knowledge-graph',
+};
+/** Operator route paths that alias the same step page. */
+exports.WORKFLOW_STEP_ROUTE_PATH_ALIASES = {
+    '/workflow/review': '/review',
+};
+/** Map UI / nav step keys to registry `stepId` when they differ. */
+function resolveRegistryWorkflowStepId(navStepKey) {
+    return exports.REGISTRY_WORKFLOW_STEP_ID_BY_NAV_KEY[navStepKey] ?? navStepKey;
+}
+/** Normalize any workflow step key (nav, stats query, registry) to registry stepId. */
+function resolveCanonicalWorkflowStepId(input) {
+    return resolveRegistryWorkflowStepId(input);
+}
+/** Normalize operator page routes (e.g. /workflow/review → /review). */
+function resolveWorkflowStepRoutePath(routePath) {
+    return exports.WORKFLOW_STEP_ROUTE_PATH_ALIASES[routePath] ?? routePath;
+}
+/**
+ * Normalize step-stats query param to a supported stats id.
+ * Maps nav aliases (deployments, knowledge-graph) to schema enum values.
+ */
+function normalizeWorkflowStepStatsStepId(raw) {
+    if (raw === 'knowledge-graph') {
+        return 'knowledge';
+    }
+    if (raw === 'deploy') {
+        return 'deployments';
+    }
+    return raw;
+}
+/** All known step-id aliases (input → canonical registry stepId). */
+exports.WORKFLOW_STEP_ID_ALIAS_PAIRS = [
+    ['deployments', 'deploy'],
+    ['deploy', 'deploy'],
+    ['knowledge', 'knowledge-graph'],
+    ['knowledge-graph', 'knowledge-graph'],
+    ['review', 'review'],
+];

package/dist/workflow/test-obligation-policy.d.ts

@@ -0,0 +1,12 @@
+import type { TestSurfaceKind } from "../schemas/workflow/test-obligation-manifest.schema";
+/**
+ * Default required test harness kinds per workflow surface (`requiredTestType` stays a free-form string elsewhere).
+ */
+export type TestObligationPolicyEntry = Readonly<{
+    defaultRequiredTestTypes: readonly string[];
+    p0Blocking: boolean;
+}>;
+/** Per-surface obligations for TaskCapsules / manifests (tiering is separate). */
+export declare const TEST_OBLIGATION_POLICY: Readonly<Record<TestSurfaceKind, TestObligationPolicyEntry>>;
+export declare function getRequiredTestTypesForSurface(kind: TestSurfaceKind): readonly string[];
+export declare function isP0BlockingSurface(kind: TestSurfaceKind): boolean;

package/dist/workflow/test-obligation-policy.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_OBLIGATION_POLICY = void 0;
+exports.getRequiredTestTypesForSurface = getRequiredTestTypesForSurface;
+exports.isP0BlockingSurface = isP0BlockingSurface;
+/** Per-surface obligations for TaskCapsules / manifests (tiering is separate). */
+exports.TEST_OBLIGATION_POLICY = {
+    "api-route": {
+        defaultRequiredTestTypes: ["contract", "integration"],
+        p0Blocking: true,
+    },
+    "workflow-step": {
+        defaultRequiredTestTypes: ["unit", "integration"],
+        p0Blocking: true,
+    },
+    "registry-dispatch": {
+        defaultRequiredTestTypes: ["policy"],
+        p0Blocking: false,
+    },
+    "db-migration": {
+        defaultRequiredTestTypes: ["policy"],
+        p0Blocking: true,
+    },
+    "provider-integration": {
+        defaultRequiredTestTypes: ["integration"],
+        p0Blocking: true,
+    },
+    "auth-flow": {
+        defaultRequiredTestTypes: ["e2e", "integration"],
+        p0Blocking: false,
+    },
+    "publication-readiness": {
+        defaultRequiredTestTypes: ["smoke", "e2e"],
+        p0Blocking: false,
+    },
+    "generated-artifact": {
+        defaultRequiredTestTypes: ["integration"],
+        p0Blocking: false,
+    },
+    page: {
+        defaultRequiredTestTypes: ["component", "e2e"],
+        p0Blocking: false,
+    },
+    "ui-component": {
+        defaultRequiredTestTypes: ["component"],
+        p0Blocking: false,
+    },
+    "feature-panel": {
+        defaultRequiredTestTypes: ["component"],
+        p0Blocking: false,
+    },
+    "data-display": {
+        defaultRequiredTestTypes: ["component"],
+        p0Blocking: false,
+    },
+    "form-flow": {
+        defaultRequiredTestTypes: ["component", "e2e"],
+        p0Blocking: false,
+    },
+    "client-method": {
+        defaultRequiredTestTypes: ["contract"],
+        p0Blocking: true,
+    },
+    "presentational-component": {
+        defaultRequiredTestTypes: ["component"],
+        p0Blocking: false,
+    },
+    "static-asset": {
+        defaultRequiredTestTypes: ["visual", "smoke"],
+        p0Blocking: false,
+    },
+    "layout-wrapper": {
+        defaultRequiredTestTypes: ["component", "a11y"],
+        p0Blocking: false,
+    },
+};
+function getRequiredTestTypesForSurface(kind) {
+    return exports.TEST_OBLIGATION_POLICY[kind].defaultRequiredTestTypes;
+}
+function isP0BlockingSurface(kind) {
+    return exports.TEST_OBLIGATION_POLICY[kind].p0Blocking;
+}

package/dist/workflow/test-policy-registry.d.ts

@@ -0,0 +1,45 @@
+/**
+ * TestPolicyRegistry — canonical definition of required test types per surface category.
+ *
+ * This is the SSOT for which surfaces require which types of tests, and at which risk tier.
+ * Used by:
+ *   - TaskCapsule generation (embed obligations per surface)
+ *   - PatchReview (verify changed files have matching obligations)
+ *   - Guardian (block missing critical obligations)
+ *   - architecture-test.mjs (detect surfaces without obligations)
+ *
+ * Risk tiers:
+ *   critical  — hard required; blocks completion without explicit waiver + approver
+ *   important — required unless waived with reason
+ *   low-risk  — smoke/story/coverage acceptable; waiver allowed without approver
+ */
+import type { TestObligationTier, TestSurfaceKind } from '../schemas/workflow/test-obligation-manifest.schema';
+export type TestPolicyRule = {
+    surfaceKind: TestSurfaceKind;
+    tier: TestObligationTier;
+    /** Required test types for this surface (e.g. 'contract', 'unit', 'smoke'). */
+    requiredTestTypes: string[];
+    /** Human-readable description of what must be tested. */
+    description: string;
+    /** Path patterns that identify this surface kind (glob-style hints for detection). */
+    pathPatterns: string[];
+};
+/**
+ * Canonical test policy rules ordered by tier (critical first).
+ * These rules are evaluated against changed file paths to generate TestObligationManifest entries.
+ */
+export declare const TEST_POLICY_RULES: TestPolicyRule[];
+/**
+ * Returns the policy rule matching a surface kind.
+ * Returns undefined if the surface kind has no registered policy.
+ */
+export declare function getTestPolicyRule(surfaceKind: TestSurfaceKind): TestPolicyRule | undefined;
+/**
+ * Returns all critical policy rules (used for Guardian hard-blocker checks).
+ */
+export declare function getCriticalPolicyRules(): TestPolicyRule[];
+/**
+ * Detects the most specific surface kind for a changed file path.
+ * Returns undefined if no rule matches.
+ */
+export declare function detectSurfaceKindForPath(filePath: string): TestSurfaceKind | undefined;

package/dist/workflow/test-policy-registry.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * TestPolicyRegistry — canonical definition of required test types per surface category.
+ *
+ * This is the SSOT for which surfaces require which types of tests, and at which risk tier.
+ * Used by:
+ *   - TaskCapsule generation (embed obligations per surface)
+ *   - PatchReview (verify changed files have matching obligations)
+ *   - Guardian (block missing critical obligations)
+ *   - architecture-test.mjs (detect surfaces without obligations)
+ *
+ * Risk tiers:
+ *   critical  — hard required; blocks completion without explicit waiver + approver
+ *   important — required unless waived with reason
+ *   low-risk  — smoke/story/coverage acceptable; waiver allowed without approver
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_POLICY_RULES = void 0;
+exports.getTestPolicyRule = getTestPolicyRule;
+exports.getCriticalPolicyRules = getCriticalPolicyRules;
+exports.detectSurfaceKindForPath = detectSurfaceKindForPath;
+/**
+ * Canonical test policy rules ordered by tier (critical first).
+ * These rules are evaluated against changed file paths to generate TestObligationManifest entries.
+ */
+exports.TEST_POLICY_RULES = [
+    // ── Critical surfaces ─────────────────────────────────────────────────────
+    {
+        surfaceKind: 'api-route',
+        tier: 'critical',
+        requiredTestTypes: ['contract', 'route-dispatch'],
+        description: 'API routes must have route dispatch and contract tests.',
+        pathPatterns: ['**/app/api/**/*.ts', '**/app/api/**/*.tsx'],
+    },
+    {
+        surfaceKind: 'workflow-step',
+        tier: 'critical',
+        requiredTestTypes: ['registry-completeness', 'step-completion'],
+        description: 'New workflow steps must pass registry and completion tests.',
+        pathPatterns: ['**/workflow/channel-registry.ts', '**/workflow/*-pipeline/orchestrate.ts', '**/workflow/*-pipeline/run.ts'],
+    },
+    {
+        surfaceKind: 'registry-dispatch',
+        tier: 'critical',
+        requiredTestTypes: ['registry-dispatch', 'registry-integrity'],
+        description: 'Registry entries (orchestrator, component) must have dispatch tests.',
+        pathPatterns: ['**/workflow/orchestrator-registry.ts', '**/workflow/component-registry.ts'],
+    },
+    {
+        surfaceKind: 'db-migration',
+        tier: 'critical',
+        requiredTestTypes: ['migration-drift', 'rls-ownership', 'type-generation'],
+        description: 'DB migrations must pass supabase db diff, RLS check, and type generation.',
+        pathPatterns: ['supabase/migrations/**/*.sql'],
+    },
+    {
+        surfaceKind: 'provider-integration',
+        tier: 'critical',
+        requiredTestTypes: ['missing-config', 'failure-path'],
+        description: 'Provider integrations must handle missing config and failure paths.',
+        pathPatterns: ['**/lib/ai/**/*.ts', '**/lib/providers/**/*.ts', '**/lib/github/**/*.ts'],
+    },
+    {
+        surfaceKind: 'auth-flow',
+        tier: 'critical',
+        requiredTestTypes: ['auth-callback', 'session-expiry'],
+        description: 'Auth flows must have callback and session-expiry tests.',
+        pathPatterns: ['**/auth/**/*.ts', '**/supabase/**/*.ts'],
+    },
+    {
+        surfaceKind: 'publication-readiness',
+        tier: 'critical',
+        requiredTestTypes: ['publication-gate', 'artifact-parity'],
+        description: 'Publication/deployment readiness checks must be tested.',
+        pathPatterns: ['**/publication/**/*.ts', '**/deploy*/**/*.ts'],
+    },
+    {
+        surfaceKind: 'generated-artifact',
+        tier: 'critical',
+        requiredTestTypes: ['payload-schema', 'guardian-rubric'],
+        description: 'Generated artifacts used downstream must have payload schema and rubric tests.',
+        pathPatterns: ['**/schemas/ai/workflow-artifacts.schema.ts', '**/schemas/workflow/**/*.schema.ts'],
+    },
+    // ── Important surfaces ────────────────────────────────────────────────────
+    {
+        surfaceKind: 'page',
+        tier: 'important',
+        requiredTestTypes: ['route-load', 'empty-state', 'error-state'],
+        description: 'Page routes must handle load, empty state, and error state.',
+        pathPatterns: ['**/app/**/page.tsx', '**/app/**/page.ts'],
+    },
+    {
+        surfaceKind: 'ui-component',
+        tier: 'important',
+        requiredTestTypes: ['render', 'state'],
+        description: 'Major UI components must have render and state tests.',
+        pathPatterns: ['**/components/**/*.tsx', '**/features/**/*.tsx'],
+    },
+    {
+        surfaceKind: 'feature-panel',
+        tier: 'important',
+        requiredTestTypes: ['render', 'interaction'],
+        description: 'Feature panels must have render and interaction tests.',
+        pathPatterns: ['**/features/**/Panel*.tsx', '**/features/**/*Display*.tsx'],
+    },
+    {
+        surfaceKind: 'data-display',
+        tier: 'important',
+        requiredTestTypes: ['render', 'empty-state'],
+        description: 'Data display components must handle render and empty states.',
+        pathPatterns: ['**/features/**/*Display*.tsx', '**/features/**/*View*.tsx'],
+    },
+    {
+        surfaceKind: 'form-flow',
+        tier: 'important',
+        requiredTestTypes: ['submit', 'validation'],
+        description: 'Form flows must have submit and validation tests.',
+        pathPatterns: ['**/features/**/*Form*.tsx', '**/components/**/*Form*.tsx'],
+    },
+    {
+        surfaceKind: 'client-method',
+        tier: 'important',
+        requiredTestTypes: ['unit', 'error-handling'],
+        description: 'API client methods must have unit and error-handling tests.',
+        pathPatterns: ['**/lib/client/**/*.ts'],
+    },
+    // ── Low-risk surfaces ────────────────────────────────────────────────────
+    {
+        surfaceKind: 'presentational-component',
+        tier: 'low-risk',
+        requiredTestTypes: ['smoke'],
+        description: 'Presentational components: smoke or story coverage is acceptable.',
+        pathPatterns: ['**/components/ui/**/*.tsx'],
+    },
+    {
+        surfaceKind: 'static-asset',
+        tier: 'low-risk',
+        requiredTestTypes: ['smoke'],
+        description: 'Static icons and assets: waiver allowed without approver.',
+        pathPatterns: ['**/public/**/*', '**/assets/**/*', '**/icons/**/*.tsx'],
+    },
+    {
+        surfaceKind: 'layout-wrapper',
+        tier: 'low-risk',
+        requiredTestTypes: ['smoke'],
+        description: 'Layout wrappers and non-logic typography components.',
+        pathPatterns: ['**/app/**/layout.tsx', '**/components/layout/**/*.tsx'],
+    },
+];
+/**
+ * Returns the policy rule matching a surface kind.
+ * Returns undefined if the surface kind has no registered policy.
+ */
+function getTestPolicyRule(surfaceKind) {
+    return exports.TEST_POLICY_RULES.find(r => r.surfaceKind === surfaceKind);
+}
+/**
+ * Returns all critical policy rules (used for Guardian hard-blocker checks).
+ */
+function getCriticalPolicyRules() {
+    return exports.TEST_POLICY_RULES.filter(r => r.tier === 'critical');
+}
+/**
+ * Detects the most specific surface kind for a changed file path.
+ * Returns undefined if no rule matches.
+ */
+function detectSurfaceKindForPath(filePath) {
+    for (const rule of exports.TEST_POLICY_RULES) {
+        for (const pattern of rule.pathPatterns) {
+            if (matchesGlobPattern(filePath, pattern)) {
+                return rule.surfaceKind;
+            }
+        }
+    }
+    return undefined;
+}
+function matchesGlobPattern(filePath, pattern) {
+    // Normalize separators
+    const fp = filePath.replace(/\\/g, '/');
+    // Convert glob to regex: ** matches any path segment(s), * matches within a segment
+    const escaped = pattern
+        .replace(/\./g, '\\.')
+        .replace(/\[/g, '\\[')
+        .replace(/\]/g, '\\]')
+        .replace(/\*\*\//g, '(?:.+/)?')
+        .replace(/\*\*/g, '.+')
+        .replace(/\*/g, '[^/]+');
+    const regex = new RegExp(`(^|/)${escaped}$`);
+    return regex.test(fp);
+}

package/dist/workflow/workflow-assurance-completion-probe-gates.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Workflow Assurance Harness — completion-probe → gate-function traceability.
+ *
+ * Tracker #1361 ("Workflow Assurance Harness") PR3 asked for "gate adapters"
+ * named `ingest_gate` / `cicd_ready` / `film_domain` / `workflow_artifacts`,
+ * with acceptance "gate evaluators match existing gate functions". Those four
+ * strings are the values of `WorkflowAssuranceCompletionProbe`
+ * (buildWorkflowAssuranceManifest() tags every step with one, describing HOW
+ * the harness is meant to prove that step completed) — not separate adapter
+ * modules. No file under `tools/assurance/gates/` is literally named after
+ * them, and — the real gap a prior audit missed — nothing there was ever
+ * checked against the actual production gate functions the app already runs
+ * for ingest and film-domain completion (`evaluateIngestGate`,
+ * `runFilmGates`). Both are async and Supabase-backed, so the browser
+ * harness's synchronous, DB-free gate evaluators
+ * (`tools/assurance/gates/*.ts`) cannot call them directly without pulling
+ * live Supabase access into `tools/assurance/` — scope PR3 did not ask for
+ * and the harness deliberately avoids (see PR4's provider test-mode kit).
+ *
+ * This registry is the single, tested place recording which production
+ * symbol (if any) backs each completion probe today, and whether the browser
+ * harness can invoke it directly, so the correspondence is machine-checkable
+ * instead of assumed. `cicd_ready` is now implemented by `evaluateCicdReadyGate`
+ * (`packages/frontend/src/lib/workflow/gates/cicd-ready-gate.ts`) — it evaluates
+ * real GitHub canonical PR/check-run state through the repo's single GitHub App
+ * client (`@/lib/github/client`), never a second client, and never converts
+ * failed, stale, or unknown GitHub state into green (IC-1, see
+ * `constitution-implement-cicd-truth.md`). No runtime behavior change to any
+ * existing caller: this is metadata plus a new, additive gate function.
+ */
+import type { WorkflowAssuranceCompletionProbe } from './workflow-assurance-manifest';
+export type WorkflowAssuranceCompletionProbeGateReference = {
+    /** Where the referenced symbol is defined, as a repo-relative path (empty when none). */
+    module: string;
+    /** Exported symbol implementing the real completion check, or null when none exists yet. */
+    symbol: string | null;
+    /** True when the browser harness can invoke this today from a synchronous, DB-free gate evaluator. */
+    browserHarnessInvocable: boolean;
+    note: string;
+};
+export declare const WORKFLOW_ASSURANCE_COMPLETION_PROBE_GATE_REFERENCES: Readonly<Record<WorkflowAssuranceCompletionProbe, WorkflowAssuranceCompletionProbeGateReference>>;
+/** Probes with no canonical production gate function implemented yet — a real coverage gap, not a naming one. */
+export declare function listUnimplementedAssuranceCompletionProbes(): WorkflowAssuranceCompletionProbe[];

package/dist/workflow/workflow-assurance-completion-probe-gates.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Workflow Assurance Harness — completion-probe → gate-function traceability.
+ *
+ * Tracker #1361 ("Workflow Assurance Harness") PR3 asked for "gate adapters"
+ * named `ingest_gate` / `cicd_ready` / `film_domain` / `workflow_artifacts`,
+ * with acceptance "gate evaluators match existing gate functions". Those four
+ * strings are the values of `WorkflowAssuranceCompletionProbe`
+ * (buildWorkflowAssuranceManifest() tags every step with one, describing HOW
+ * the harness is meant to prove that step completed) — not separate adapter
+ * modules. No file under `tools/assurance/gates/` is literally named after
+ * them, and — the real gap a prior audit missed — nothing there was ever
+ * checked against the actual production gate functions the app already runs
+ * for ingest and film-domain completion (`evaluateIngestGate`,
+ * `runFilmGates`). Both are async and Supabase-backed, so the browser
+ * harness's synchronous, DB-free gate evaluators
+ * (`tools/assurance/gates/*.ts`) cannot call them directly without pulling
+ * live Supabase access into `tools/assurance/` — scope PR3 did not ask for
+ * and the harness deliberately avoids (see PR4's provider test-mode kit).
+ *
+ * This registry is the single, tested place recording which production
+ * symbol (if any) backs each completion probe today, and whether the browser
+ * harness can invoke it directly, so the correspondence is machine-checkable
+ * instead of assumed. `cicd_ready` is now implemented by `evaluateCicdReadyGate`
+ * (`packages/frontend/src/lib/workflow/gates/cicd-ready-gate.ts`) — it evaluates
+ * real GitHub canonical PR/check-run state through the repo's single GitHub App
+ * client (`@/lib/github/client`), never a second client, and never converts
+ * failed, stale, or unknown GitHub state into green (IC-1, see
+ * `constitution-implement-cicd-truth.md`). No runtime behavior change to any
+ * existing caller: this is metadata plus a new, additive gate function.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKFLOW_ASSURANCE_COMPLETION_PROBE_GATE_REFERENCES = void 0;
+exports.listUnimplementedAssuranceCompletionProbes = listUnimplementedAssuranceCompletionProbes;
+exports.WORKFLOW_ASSURANCE_COMPLETION_PROBE_GATE_REFERENCES = {
+    workflow_artifacts: {
+        module: 'tools/assurance/gates/assert-artifacts-generated.ts',
+        symbol: 'assertArtifactsGenerated',
+        browserHarnessInvocable: true,
+        note: 'Verifies expected artifact stage IDs are present in captured step results — ' +
+            'a generic, DB-free browser-evidence check, already wired into the harness.',
+    },
+    ingest_gate: {
+        module: 'packages/contracts/src/workflow/evaluate-ingest-gate.ts',
+        symbol: 'evaluateIngestGate',
+        browserHarnessInvocable: false,
+        note: 'Canonical repo-ingest readiness gate the app enforces before Specify/Plan. ' +
+            'Async + Supabase-backed, so the browser harness proves the same outcome ' +
+            'indirectly (assertDatabaseChecks / assertWorkflowState against API responses) ' +
+            'rather than calling this function directly.',
+    },
+    cicd_ready: {
+        module: 'packages/frontend/src/lib/workflow/gates/cicd-ready-gate.ts',
+        symbol: 'evaluateCicdReadyGate',
+        browserHarnessInvocable: false,
+        note: 'Evaluates real GitHub canonical PR + check-run state (IC-1…IC-4) through the ' +
+            'repo\'s single GitHub App client (createInstallationClientForRepo in ' +
+            '@/lib/github/client) — never a second client. Async + live-GitHub-backed (not ' +
+            'DB-mirror-only), so the browser harness proves the same outcome indirectly ' +
+            '(assertWorkflowState / assertNoNetworkFailures against API responses) rather ' +
+            'than calling this function directly. Classifies evidence as green / red / stale ' +
+            '/ unknown and only ever reports ready=true for green — failed, stale (a trusted ' +
+            'head SHA or check-run head_sha that no longer matches GitHub\'s current head), ' +
+            'and unknown (no check runs, in-flight checks, fetch failures, closed-not-merged) ' +
+            'all resolve to ready=false.',
+    },
+    film_domain: {
+        module: 'packages/frontend/src/lib/workflow/gates/film-gates.ts',
+        symbol: 'runFilmGates',
+        browserHarnessInvocable: false,
+        note: 'Canonical film-production gate suite (visual continuity, keyframe approval, ' +
+            'retake budget, etc). Async + Supabase-backed, so the browser harness proves ' +
+            'the same outcome indirectly (assertArtifactsGenerated / assertWorkflowState ' +
+            'against API responses) rather than calling this function directly.',
+    },
+    none: {
+        module: '',
+        symbol: null,
+        browserHarnessInvocable: true,
+        note: 'Config-only steps with no completion evidence to gate.',
+    },
+};
+/** Probes with no canonical production gate function implemented yet — a real coverage gap, not a naming one. */
+function listUnimplementedAssuranceCompletionProbes() {
+    return Object.entries(exports.WORKFLOW_ASSURANCE_COMPLETION_PROBE_GATE_REFERENCES)
+        .filter(([probe, ref]) => probe !== 'none' && ref.symbol === null)
+        .map(([probe]) => probe);
+}

package/dist/workflow/workflow-assurance-manifest.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Workflow Assurance Manifest — registry-derived SSOT for browser harness selectors.
+ *
+ * Pure derivation from channel registry, WORKFLOW_STEPS (software foundation),
+ * step-id-canonical, film nav aliases, and wiring-tier overrides.
+ * No runtime workflow behavior changes.
+ */
+import { type WorkflowVariant } from './channel-registry';
+import { type WorkflowAssuranceWiringTier } from './workflow-assurance-wiring-tiers';
+export declare const WORKFLOW_ASSURANCE_MANIFEST_VERSION = "1.0.0";
+/** Routes the harness must never treat as canonical operator paths. */
+export declare const WORKFLOW_ASSURANCE_LEGACY_ROUTE_PATTERNS: readonly string[];
+export type WorkflowAssuranceCompletionMode = 'final_artifact' | 'all_required_stages' | 'any_of_stages' | 'custom' | 'external_gate';
+export type WorkflowAssuranceCompletionProbe = 'workflow_artifacts' | 'ingest_gate' | 'cicd_ready' | 'film_domain' | 'none';
+export type WorkflowAssuranceStepStatus = 'active' | 'experimental' | 'deprecated' | 'planned';
+/**
+ * Coverage tier for a step or variant.
+ *
+ * active       — step is active and has at least one GP scenario covering it
+ * planned      — step exists in app but no GP scenario yet (canonical_planned wiring)
+ * experimental — step/variant is flagged experimental in the channel registry
+ * blocked      — step is deprecated, page is missing, or variant has no runnable steps
+ */
+export type WorkflowAssuranceCoverageTier = 'active' | 'planned' | 'experimental' | 'blocked';
+export type WorkflowAssuranceCompletion = {
+    mode: WorkflowAssuranceCompletionMode;
+    requiredStageIds: string[];
+    finalStageId?: string;
+    probe: WorkflowAssuranceCompletionProbe;
+};
+export type WorkflowAssuranceStep = {
+    variant: WorkflowVariant;
+    stepId: string;
+    navAliases: string[];
+    route: string;
+    pageExists: boolean;
+    orchestratorKey: string;
+    displayComponentKey: string;
+    apiRouteKey?: string;
+    completion: WorkflowAssuranceCompletion;
+    gates: string[];
+    status: WorkflowAssuranceStepStatus;
+    producesArtifacts: boolean;
+    legacyRoutes?: string[];
+    /** Canonical wiring tier — determines hard-fail vs. warn in the browser harness. */
+    wiringTier: WorkflowAssuranceWiringTier;
+    /** data-action values the harness must trigger to drive this step. */
+    requiredActions: string[];
+    /** Artifact stage IDs (finalStageId + requiredStageIds) this step must produce. */
+    requiredArtifacts: string[];
+    /** AI/media provider kinds required to generate artifacts for this step. */
+    requiredProviderKinds: string[];
+    /** UI component keys the harness must find rendered for this step. */
+    requiredComponents: string[];
+    /** True when the browser harness can fully drive and assert this step. */
+    isBrowserAssurable: boolean;
+    /** Reasons this step cannot be browser-assured yet. Empty when isBrowserAssurable is true. */
+    assuranceBlockers: string[];
+    /** Tier that determines how this step contributes to variant coverage. */
+    coverageTier: WorkflowAssuranceCoverageTier;
+};
+/** Per-variant rollup for management coverage dashboards. */
+export type WorkflowAssuranceVariantSummary = {
+    variant: WorkflowVariant;
+    isBrowserAssurable: boolean;
+    coverageTier: WorkflowAssuranceCoverageTier;
+    assuranceBlockers: string[];
+    activeStepCount: number;
+    browserAssurableStepCount: number;
+};
+export type WorkflowAssuranceManifest = {
+    version: string;
+    legacyRoutePatterns: readonly string[];
+    variants: Record<WorkflowVariant, WorkflowAssuranceStep[]>;
+    summaries: Record<WorkflowVariant, WorkflowAssuranceVariantSummary>;
+};
+/** Build the full assurance manifest from registry SSOT (pure, deterministic). */
+export declare function buildWorkflowAssuranceManifest(): WorkflowAssuranceManifest;
+/** Pre-built manifest singleton for importers that need a stable reference. */
+export declare const WORKFLOW_ASSURANCE_MANIFEST: WorkflowAssuranceManifest;
+/** Active channel variants that must appear in the manifest with at least one step. */
+export declare function getAssuranceActiveVariants(): WorkflowVariant[];
+/** Variant-level coverage summaries — ready for management dashboards and CI reports. */
+export declare function getAssuranceVariantSummaries(): WorkflowAssuranceVariantSummary[];