@openprose/reactor-cradle 0.1.0-rc.1

package/dist/release-candidate/index.js

@@ -0,0 +1,553 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderReleaseCandidateEvidenceBundleMarkdownV0 = exports.createR7ReleaseCandidateEvidenceBundleV0 = exports.R7_REQUIRED_DEFERRED_ROW_IDS_V0 = exports.R7_REQUIRED_COMMAND_IDS_V0 = exports.R7_CRADLE_PUBLIC_IMPORT_SPECIFIERS_V0 = exports.R7_REACTOR_PUBLIC_IMPORT_SPECIFIERS_V0 = exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_VERSION_V0 = exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_SCHEMA_V0 = void 0;
+exports.buildR7ReleaseCandidateEvidenceBundleV0 = buildR7ReleaseCandidateEvidenceBundleV0;
+exports.assertR7ReleaseCandidateEvidenceBundleV0 = assertR7ReleaseCandidateEvidenceBundleV0;
+exports.renderR7ReleaseCandidateEvidenceBundleMarkdownV0 = renderR7ReleaseCandidateEvidenceBundleMarkdownV0;
+const node_crypto_1 = require("node:crypto");
+const eval_1 = require("../eval");
+const release_parity_1 = require("../release-parity");
+exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_SCHEMA_V0 = "openprose.reactor-cradle.release-candidate-evidence-bundle";
+exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_VERSION_V0 = 0;
+exports.R7_REACTOR_PUBLIC_IMPORT_SPECIFIERS_V0 = [
+    "@openprose/reactor",
+    "@openprose/reactor/receipt",
+    "@openprose/reactor/cost",
+    "@openprose/reactor/kernel",
+    "@openprose/reactor/evidence-plan",
+    "@openprose/reactor/memo",
+    "@openprose/reactor/forecast",
+    "@openprose/reactor/sdk",
+    "@openprose/reactor/policy",
+    "@openprose/reactor/composition",
+    "@openprose/reactor/projection",
+];
+exports.R7_CRADLE_PUBLIC_IMPORT_SPECIFIERS_V0 = [
+    "@openprose/reactor-cradle",
+    "@openprose/reactor-cradle/assert",
+    "@openprose/reactor-cradle/eval",
+    "@openprose/reactor-cradle/spikes",
+    "@openprose/reactor-cradle/spikes/live-refresh",
+    "@openprose/reactor-cradle/spikes/k1-ensemble-spread",
+    "@openprose/reactor-cradle/spikes/k2-policy-author",
+    "@openprose/reactor-cradle/doubles/clock",
+    "@openprose/reactor-cradle/doubles/storage",
+    "@openprose/reactor-cradle/policy-author",
+    "@openprose/reactor-cradle/policy-drift",
+    "@openprose/reactor-cradle/policy-replay",
+    "@openprose/reactor-cradle/recompile",
+    "@openprose/reactor-cradle/release-parity",
+    "@openprose/reactor-cradle/release-candidate",
+    "@openprose/reactor-cradle/rollback",
+    "@openprose/reactor-cradle/replay/model-gateway",
+    "@openprose/reactor-cradle/replay/parity",
+    "@openprose/reactor-cradle/scenario/parser",
+    "@openprose/reactor-cradle/scenario/runner",
+    "@openprose/reactor-cradle/scenario/time",
+    "@openprose/reactor-cradle/scenario/types",
+    "@openprose/reactor-cradle/world",
+];
+exports.R7_REQUIRED_COMMAND_IDS_V0 = [
+    "verifier-smoke-tests",
+    "reactor-tests",
+    "cradle-tests",
+    "local-pack",
+    "pin-verify",
+    "tarball-import-smoke",
+    "release-readiness-example-smoke",
+    "diff-check",
+    "dependency-scan",
+    "secret-scan",
+];
+exports.R7_REQUIRED_DEFERRED_ROW_IDS_V0 = [
+    "down-after-budget-exhaustion",
+    "postgres-parity",
+    "live-provider-model-matrix",
+];
+const CONTENT_HASH_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const HEX_SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const GIT_COMMIT_PATTERN = /^[a-f0-9]{40}$/;
+const ISO_INSTANT_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+const SECRET_SHAPED_PATTERNS = [
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,
+    /\bBearer\s+[A-Za-z0-9._-]{8,}\b/i,
+    new RegExp(`\\b${["sk", "or"].join("-")}-[A-Za-z0-9._-]{8,}\\b`),
+    /\bapi[_-]?key[_:/= -]+[A-Za-z0-9._-]{8,}\b/i,
+    /\b(?:secret|token|password|credential|authorization)[_:/= -]+[A-Za-z0-9._-]{8,}\b/i,
+];
+const PATH_SHAPED_PATTERN = new RegExp(String.raw `(?:^|\s)(?:\/[^\s]+|[A-Za-z]:\\[^\s]+|\.{1,2}\/[^\s]+)|\.${[
+    "tg",
+    "z",
+].join("")}\b|${["tarball", "Path"].join("")}`, "i");
+const FORBIDDEN_RUNTIME_TEXT_PATTERN = /\b(?:stdout|stderr|raw replay bytes|expected_bytes|actual_bytes|memo_key|run_id|provider_norm)\b/i;
+function buildR7ReleaseCandidateEvidenceBundleV0(input) {
+    const payload = {
+        schema: exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_SCHEMA_V0,
+        v: exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_VERSION_V0,
+        release_candidate_id: cleanText(input.release_candidate_id, "release_candidate_id"),
+        generated_at: assertIsoInstant(input.generated_at, "generated_at"),
+        as_of: assertIsoInstant(input.as_of, "as_of"),
+        build: normalizeBuild(input.build),
+        package_pin: normalizePackagePin(input.package_pin),
+        tarball_smoke: normalizeTarballSmoke(input.tarball_smoke),
+        cradle_tarball_smoke: normalizeCradleTarballSmoke(input.cradle_tarball_smoke),
+        commands: normalizeCommands(input.commands),
+        release_parity: normalizeReleaseParity(input.release_parity),
+        deferred_rows: normalizeDeferredRows(input.deferred_rows),
+    };
+    const bundle = Object.freeze({
+        ...payload,
+        content_hash: hashCanonicalValue(payload),
+    });
+    assertR7ReleaseCandidateEvidenceBundleV0(bundle);
+    return bundle;
+}
+exports.createR7ReleaseCandidateEvidenceBundleV0 = buildR7ReleaseCandidateEvidenceBundleV0;
+function assertR7ReleaseCandidateEvidenceBundleV0(bundle) {
+    if (!isRecord(bundle)) {
+        throw new Error("release candidate evidence bundle must be an object");
+    }
+    if (bundle.schema !== exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_SCHEMA_V0) {
+        throw new Error("release candidate evidence bundle schema is malformed");
+    }
+    if (bundle.v !== exports.R7_RELEASE_CANDIDATE_EVIDENCE_BUNDLE_VERSION_V0) {
+        throw new Error("release candidate evidence bundle version must be 0");
+    }
+    assertContentHash(bundle.content_hash, "content_hash");
+    const { content_hash: _contentHash, ...payload } = bundle;
+    const actualHash = hashCanonicalValue(payload);
+    if (actualHash !== bundle.content_hash) {
+        throw new Error("release candidate evidence bundle content_hash is stale");
+    }
+    normalizeBuild(bundle.build);
+    normalizePackagePin({
+        ...bundle.package_pin,
+        checked_files: ["checked-files-hash-only"],
+    });
+    normalizeTarballSmoke({
+        package_name: bundle.tarball_smoke.package_name,
+        version: bundle.tarball_smoke.version,
+        imported_entrypoints: bundle.tarball_smoke.imported_entrypoints,
+    });
+    normalizeCradleTarballSmoke({
+        package_name: bundle.cradle_tarball_smoke.package_name,
+        version: bundle.cradle_tarball_smoke.version,
+        imported_entrypoints: bundle.cradle_tarball_smoke.imported_entrypoints,
+    });
+    normalizeCommands(bundle.commands);
+    normalizeDeferredRows(bundle.deferred_rows);
+    if (bundle.package_pin.checked_file_count <= 0) {
+        throw new Error("package_pin.checked_file_count must be positive");
+    }
+    assertContentHash(bundle.package_pin.checked_files_hash, "checked_files_hash");
+    assertContentHash(bundle.release_parity.proof_hash, "release_parity.proof_hash");
+    assertContentHash(bundle.release_parity.replay_snapshot_hash, "release_parity.replay_snapshot_hash");
+    assertContentHash(bundle.release_parity.eval_result_hash, "release_parity.eval_result_hash");
+    assertContentHash(bundle.release_parity.public_projection_hash, "release_parity.public_projection_hash");
+    assertContentHash(bundle.release_parity.eval_report_hash, "release_parity.eval_report_hash");
+    assertContentHash(bundle.release_parity.public_projection_report_hash, "release_parity.public_projection_report_hash");
+    if (bundle.release_parity.model_matrix_status !== "not-run") {
+        throw new Error("release parity model matrix must stay not-run");
+    }
+}
+function renderR7ReleaseCandidateEvidenceBundleMarkdownV0(bundle) {
+    assertR7ReleaseCandidateEvidenceBundleV0(bundle);
+    const commandRows = bundle.commands.map((item) => [
+        markdownTableCell(item.command_id),
+        item.status,
+        markdownTableCell(item.summary),
+        item.tests_passed === undefined || item.tests_total === undefined
+            ? "n/a"
+            : `${item.tests_passed}/${item.tests_total}`,
+    ].join(" | "));
+    const deferredRows = bundle.deferred_rows.map((item) => [
+        markdownTableCell(item.row_id),
+        item.status,
+        item.represented ? "true" : "false",
+        markdownTableCell(item.reason),
+    ].join(" | "));
+    return [
+        "# Reactor Release Candidate Evidence Bundle",
+        "",
+        `Bundle hash: \`${bundle.content_hash}\``,
+        `Release candidate: \`${markdownInline(bundle.release_candidate_id)}\``,
+        `Generated at: \`${bundle.generated_at}\``,
+        `As of: \`${bundle.as_of}\``,
+        `Build: \`${markdownInline(bundle.build.branch)}@${bundle.build.commit}\``,
+        "",
+        "## Package Evidence",
+        `- Reactor package: ${bundle.package_pin.package_name}@${bundle.package_pin.version}`,
+        `- Reactor tree hash: \`${bundle.package_pin.package_tree_sha256}\``,
+        `- Reactor checked files: ${bundle.package_pin.checked_file_count}`,
+        `- Reactor imported entrypoints: ${bundle.tarball_smoke.imported_entrypoint_count}`,
+        `- Cradle package: ${bundle.cradle_tarball_smoke.package_name}@${bundle.cradle_tarball_smoke.version}`,
+        `- Cradle imported entrypoints: ${bundle.cradle_tarball_smoke.imported_entrypoint_count}`,
+        "",
+        "## Release Parity",
+        `- Eval result hash: \`${bundle.release_parity.eval_result_hash}\``,
+        `- Public projection hash: \`${bundle.release_parity.public_projection_hash}\``,
+        `- Represented cases: ${bundle.release_parity.represented_case_count}`,
+        `- Parity rows: ${bundle.release_parity.parity_ready_rows_run} ready, ${bundle.release_parity.parity_future_rows} future`,
+        `- Live model matrix: ${bundle.release_parity.model_matrix_status}`,
+        "",
+        "## Commands",
+        "| Command | Status | Summary | Tests |",
+        "| --- | --- | --- | --- |",
+        ...commandRows.map((row) => `| ${row} |`),
+        "",
+        "## Deferred Rows",
+        "| Row | Status | Represented | Reason |",
+        "| --- | --- | --- | --- |",
+        ...deferredRows.map((row) => `| ${row} |`),
+        "",
+    ].join("\n");
+}
+exports.renderReleaseCandidateEvidenceBundleMarkdownV0 = renderR7ReleaseCandidateEvidenceBundleMarkdownV0;
+function normalizeBuild(input) {
+    return Object.freeze({
+        branch: cleanText(input.branch, "build.branch"),
+        commit: assertGitCommit(input.commit, "build.commit"),
+        worktree_status: assertLiteral(input.worktree_status, "clean", "build.worktree_status"),
+    });
+}
+function normalizePackagePin(input) {
+    if (input.package_name !== "@openprose/reactor") {
+        throw new Error("package_pin.package_name must be @openprose/reactor");
+    }
+    if (input.version !== "0.1.0-rc.1") {
+        throw new Error("package_pin.version must be 0.1.0-rc.1");
+    }
+    if (input.consumer_name !== "@openprose/reactor-cradle") {
+        throw new Error("package_pin.consumer_name must be @openprose/reactor-cradle");
+    }
+    if (input.consumer_dependency !== "workspace:0.1.0-rc.1") {
+        throw new Error("package_pin.consumer_dependency must be workspace:0.1.0-rc.1");
+    }
+    const checkedFiles = normalizeCheckedFiles(input.checked_files);
+    return Object.freeze({
+        package_name: "@openprose/reactor",
+        version: "0.1.0-rc.1",
+        consumer_name: "@openprose/reactor-cradle",
+        consumer_dependency: "workspace:0.1.0-rc.1",
+        package_tree_sha256: assertHexSha256(input.package_tree_sha256, "package_pin.package_tree_sha256"),
+        checked_file_count: checkedFiles.length,
+        checked_files_hash: hashCanonicalValue(checkedFiles),
+    });
+}
+function normalizeTarballSmoke(input) {
+    if (input.package_name !== "@openprose/reactor") {
+        throw new Error("tarball_smoke.package_name must be @openprose/reactor");
+    }
+    if (input.version !== "0.1.0-rc.1") {
+        throw new Error("tarball_smoke.version must be 0.1.0-rc.1");
+    }
+    const imports = [...input.imported_entrypoints].sort((left, right) => left.localeCompare(right));
+    const expected = [...exports.R7_REACTOR_PUBLIC_IMPORT_SPECIFIERS_V0].sort((left, right) => left.localeCompare(right));
+    if (imports.length !== expected.length) {
+        throw new Error("tarball_smoke.imported_entrypoints must cover every public Reactor entrypoint");
+    }
+    for (let index = 0; index < expected.length; index += 1) {
+        if (imports[index] !== expected[index]) {
+            throw new Error(`tarball_smoke.imported_entrypoints mismatch at ${index}: expected ${expected[index]}, received ${imports[index] ?? "missing"}`);
+        }
+    }
+    return Object.freeze({
+        package_name: "@openprose/reactor",
+        version: "0.1.0-rc.1",
+        imported_entrypoint_count: imports.length,
+        imported_entrypoints: Object.freeze(imports),
+    });
+}
+function normalizeCradleTarballSmoke(input) {
+    if (input.package_name !== "@openprose/reactor-cradle") {
+        throw new Error("cradle_tarball_smoke.package_name must be @openprose/reactor-cradle");
+    }
+    if (input.version !== "0.1.0-rc.1") {
+        throw new Error("cradle_tarball_smoke.version must be 0.1.0-rc.1");
+    }
+    const imports = [...input.imported_entrypoints].sort((left, right) => left.localeCompare(right));
+    const expected = [...exports.R7_CRADLE_PUBLIC_IMPORT_SPECIFIERS_V0].sort((left, right) => left.localeCompare(right));
+    if (imports.length !== expected.length) {
+        throw new Error("cradle_tarball_smoke.imported_entrypoints must cover every public Cradle entrypoint");
+    }
+    for (let index = 0; index < expected.length; index += 1) {
+        if (imports[index] !== expected[index]) {
+            throw new Error(`cradle_tarball_smoke.imported_entrypoints mismatch at ${index}: expected ${expected[index]}, received ${imports[index] ?? "missing"}`);
+        }
+    }
+    return Object.freeze({
+        package_name: "@openprose/reactor-cradle",
+        version: "0.1.0-rc.1",
+        imported_entrypoint_count: imports.length,
+        imported_entrypoints: Object.freeze(imports),
+    });
+}
+function normalizeCommands(input) {
+    if (input.length === 0) {
+        throw new Error("commands must include release candidate evidence");
+    }
+    const byId = new Map();
+    for (const command of input) {
+        if (!exports.R7_REQUIRED_COMMAND_IDS_V0.includes(command.command_id)) {
+            throw new Error(`unknown release candidate command ${command.command_id}`);
+        }
+        if (byId.has(command.command_id)) {
+            throw new Error(`duplicate release candidate command ${command.command_id}`);
+        }
+        if (command.status !== "pass") {
+            throw new Error(`release candidate command ${command.command_id} must pass`);
+        }
+        const summary = cleanEvidenceText(command.summary, `commands.${command.command_id}.summary`);
+        const tests = command.tests_passed === undefined && command.tests_total === undefined
+            ? {}
+            : normalizeTestCounts(command);
+        byId.set(command.command_id, Object.freeze({
+            command_id: command.command_id,
+            status: "pass",
+            summary,
+            ...tests,
+        }));
+    }
+    const missing = exports.R7_REQUIRED_COMMAND_IDS_V0.filter((commandId) => !byId.has(commandId));
+    if (missing.length > 0) {
+        throw new Error(`commands missing required evidence: ${missing.join(", ")}`);
+    }
+    return Object.freeze(exports.R7_REQUIRED_COMMAND_IDS_V0.map((commandId) => {
+        const item = byId.get(commandId);
+        if (item === undefined) {
+            throw new Error(`commands missing required evidence: ${commandId}`);
+        }
+        return item;
+    }));
+}
+function normalizeReleaseParity(input) {
+    const expectedProof = (0, release_parity_1.runRecordedR6ReleaseParityProofV0)();
+    assertCanonicalEqual(input.proof, expectedProof, "release_parity.proof must match the deterministic R6 proof");
+    const expectedEval = (0, release_parity_1.buildR6ReleaseParityEvalResultV0)(expectedProof);
+    assertCanonicalEqual(input.eval_result, expectedEval, "release_parity.eval_result must match the deterministic R6 eval result");
+    const expectedProjection = (0, eval_1.projectCradleEvalResultV0)(expectedEval, "public");
+    if (input.public_projection.source_content_hash !== input.eval_result.content_hash) {
+        throw new Error("release_parity.public_projection.source_content_hash must match eval_result.content_hash");
+    }
+    assertCanonicalEqual(input.public_projection, expectedProjection, "release_parity.public_projection must match the deterministic public projection");
+    const expectedEvalReport = (0, eval_1.renderCradleEvalReportMarkdownV0)(expectedEval);
+    const expectedProjectionReport = (0, eval_1.renderCradleEvalProjectionReportMarkdownV0)(expectedProjection);
+    if (input.eval_report_markdown !== expectedEvalReport) {
+        throw new Error("release_parity.eval_report_markdown does not match the eval renderer output");
+    }
+    if (input.public_projection_report_markdown !== expectedProjectionReport) {
+        throw new Error("release_parity.public_projection_report_markdown does not match the projection renderer output");
+    }
+    if (input.eval_result.model_matrix.status !== "not-run") {
+        throw new Error("release parity eval model matrix must be not-run");
+    }
+    if (!input.proof.suite.deferred_cases.some((item) => item.case_id === "down-after-budget-exhaustion")) {
+        throw new Error("release parity proof must defer down-after-budget-exhaustion");
+    }
+    return Object.freeze({
+        proof_hash: hashCanonicalValue(input.proof),
+        replay_snapshot_hash: input.proof.replay_snapshot.content_hash,
+        eval_result_hash: input.eval_result.content_hash,
+        public_projection_hash: input.public_projection.content_hash,
+        eval_report_hash: hashText(input.eval_report_markdown),
+        public_projection_report_hash: hashText(input.public_projection_report_markdown),
+        represented_case_count: input.proof.suite.cases.length,
+        deferred_case_ids: Object.freeze(input.proof.suite.deferred_cases
+            .map((item) => item.case_id)
+            .sort((left, right) => left.localeCompare(right))),
+        model_matrix_status: "not-run",
+        parity_ready_rows_run: input.proof.parity.ready_rows_run,
+        parity_future_rows: input.proof.parity.future_rows,
+    });
+}
+function normalizeDeferredRows(input) {
+    if (input.length === 0) {
+        throw new Error("deferred_rows must include explicit release candidate gaps");
+    }
+    const byId = new Map();
+    for (const row of input) {
+        if (!exports.R7_REQUIRED_DEFERRED_ROW_IDS_V0.includes(row.row_id)) {
+            throw new Error(`unknown release candidate deferred row ${row.row_id}`);
+        }
+        if (byId.has(row.row_id)) {
+            throw new Error(`duplicate release candidate deferred row ${row.row_id}`);
+        }
+        if (row.represented !== false) {
+            throw new Error(`deferred row ${row.row_id} must not be marked represented`);
+        }
+        assertExpectedDeferredStatus(row);
+        byId.set(row.row_id, Object.freeze({
+            row_id: row.row_id,
+            status: row.status,
+            represented: false,
+            reason: cleanEvidenceText(row.reason, `deferred_rows.${row.row_id}.reason`),
+        }));
+    }
+    const missing = exports.R7_REQUIRED_DEFERRED_ROW_IDS_V0.filter((rowId) => !byId.has(rowId));
+    if (missing.length > 0) {
+        throw new Error(`deferred_rows missing required row(s): ${missing.join(", ")}`);
+    }
+    return Object.freeze(exports.R7_REQUIRED_DEFERRED_ROW_IDS_V0.map((rowId) => {
+        const item = byId.get(rowId);
+        if (item === undefined) {
+            throw new Error(`deferred_rows missing required row: ${rowId}`);
+        }
+        return item;
+    }));
+}
+function assertExpectedDeferredStatus(row) {
+    const expected = row.row_id === "postgres-parity"
+        ? "future"
+        : row.row_id === "live-provider-model-matrix"
+            ? "not-run"
+            : "deferred";
+    if (row.status !== expected) {
+        throw new Error(`deferred row ${row.row_id} must have status ${expected}`);
+    }
+}
+function normalizeCheckedFiles(files) {
+    if (files.length === 0) {
+        throw new Error("package_pin.checked_files must not be empty");
+    }
+    const seen = new Set();
+    const normalized = files.map((file, index) => {
+        const value = cleanText(file, `package_pin.checked_files[${index}]`);
+        if (value.startsWith("/") || value.startsWith("../") || value.includes("/../")) {
+            throw new Error(`package_pin.checked_files[${index}] must be package-relative`);
+        }
+        if (seen.has(value)) {
+            throw new Error(`package_pin.checked_files contains duplicate file ${value}`);
+        }
+        seen.add(value);
+        return value;
+    });
+    return Object.freeze(normalized.sort((left, right) => left.localeCompare(right)));
+}
+function normalizeTestCounts(command) {
+    if (command.tests_passed === undefined || command.tests_total === undefined) {
+        throw new Error(`command ${command.command_id} test counts require both passed and total`);
+    }
+    if (!Number.isSafeInteger(command.tests_passed) ||
+        !Number.isSafeInteger(command.tests_total) ||
+        command.tests_passed < 0 ||
+        command.tests_total <= 0 ||
+        command.tests_passed !== command.tests_total) {
+        throw new Error(`command ${command.command_id} test counts must be equal passing safe integers`);
+    }
+    return {
+        tests_passed: command.tests_passed,
+        tests_total: command.tests_total,
+    };
+}
+function assertCanonicalEqual(left, right, message) {
+    if (renderCanonical(left) !== renderCanonical(right)) {
+        throw new Error(message);
+    }
+}
+function cleanText(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${label} must be a non-empty string`);
+    }
+    if (SECRET_SHAPED_PATTERNS.some((pattern) => pattern.test(value))) {
+        throw new Error(`${label} must not contain secret-shaped text`);
+    }
+    return value;
+}
+function cleanEvidenceText(value, label) {
+    const text = cleanText(value, label);
+    if (text.includes("\n") || text.includes("\r")) {
+        throw new Error(`${label} must be a summary, not raw command output`);
+    }
+    if (PATH_SHAPED_PATTERN.test(text)) {
+        throw new Error(`${label} must not include local paths or tarball paths`);
+    }
+    if (FORBIDDEN_RUNTIME_TEXT_PATTERN.test(text)) {
+        throw new Error(`${label} must not include raw runtime/private evidence`);
+    }
+    return text;
+}
+function assertLiteral(value, expected, label) {
+    if (value !== expected) {
+        throw new Error(`${label} must be ${expected}`);
+    }
+    return expected;
+}
+function assertIsoInstant(value, label) {
+    if (!ISO_INSTANT_PATTERN.test(value)) {
+        throw new Error(`${label} must be an ISO instant string`);
+    }
+    return value;
+}
+function assertGitCommit(value, label) {
+    if (!GIT_COMMIT_PATTERN.test(value)) {
+        throw new Error(`${label} must be a 40-character lowercase git commit SHA`);
+    }
+    return value;
+}
+function assertHexSha256(value, label) {
+    if (!HEX_SHA256_PATTERN.test(value)) {
+        throw new Error(`${label} must be a lowercase 64-character SHA-256 hex string`);
+    }
+    return value;
+}
+function assertContentHash(value, label) {
+    if (!CONTENT_HASH_PATTERN.test(value)) {
+        throw new Error(`${label} must be a sha256 content hash`);
+    }
+}
+function hashText(value) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(value).digest("hex")}`;
+}
+function hashCanonicalValue(value) {
+    return hashText(renderCanonical(value));
+}
+function markdownTableCell(value) {
+    return markdownInline(value).replace(/\|/g, "\\|").replace(/\n/g, "<br>");
+}
+function markdownInline(value) {
+    return value.replace(/`/g, "\\`");
+}
+function renderCanonical(value) {
+    if (value === null) {
+        return "null";
+    }
+    switch (typeof value) {
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            if (!Number.isFinite(value)) {
+                throw new TypeError("Cannot canonicalize non-finite numbers");
+            }
+            return JSON.stringify(value);
+        case "string":
+            return JSON.stringify(value);
+        case "object":
+            if (Array.isArray(value)) {
+                return `[${value.map((item) => renderCanonical(item)).join(",")}]`;
+            }
+            if (!isRecord(value)) {
+                throw new TypeError("Cannot canonicalize non-plain objects");
+            }
+            return renderCanonicalObject(value);
+        case "undefined":
+        case "bigint":
+        case "function":
+        case "symbol":
+            throw new TypeError(`Cannot canonicalize ${typeof value}`);
+    }
+    throw new TypeError("Cannot canonicalize unknown value");
+}
+function renderCanonicalObject(value) {
+    const fields = [];
+    for (const key of Object.keys(value).sort()) {
+        const item = value[key];
+        if (item === undefined) {
+            throw new TypeError(`Cannot canonicalize undefined field ${key}`);
+        }
+        fields.push(`${JSON.stringify(key)}:${renderCanonical(item)}`);
+    }
+    return `{${fields.join(",")}}`;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/release-parity/index.d.ts

@@ -0,0 +1,80 @@
+import type { ContentHashV0, ReceiptV0 } from "@openprose/reactor/receipt";
+import type { ReactorRegistrySnapshotV0 } from "@openprose/reactor/sdk";
+import type { CradleAssertionResultV0 } from "../assert";
+import { type CradleEvalResultV0 } from "../eval";
+import { type ReplayComparableScenarioOutputInputV0, type ReplayComparableSnapshotV0, type ReplayParityMatrixResultV0 } from "../replay/parity";
+export declare const R6_RELEASE_PARITY_SUITE_SCHEMA_V0: "openprose.reactor-cradle.r6-release-parity-suite";
+export declare const R6_RELEASE_PARITY_SUITE_VERSION_V0: 0;
+export declare const R6_RELEASE_PARITY_PROOF_SCHEMA_V0: "openprose.reactor-cradle.r6-release-parity-proof";
+export declare const R6_RELEASE_PARITY_PROOF_VERSION_V0: 0;
+export declare const R6_RELEASE_PARITY_CASE_IDS_V0: readonly ["healthy-quiet", "drifting-schedules-fulfillment", "blocked-human-review", "forecast-pulls-judge-earlier", "hysteresis-prevents-flip-flop", "duplicate-event-idempotency", "stale-status-fencing", "contract-revision-fencing", "policy-recompile-byte-identical-registry", "memoized-verdict-zero-fresh-tokens"];
+export declare const R6_RELEASE_PARITY_DEFERRED_CASE_IDS_V0: readonly ["down-after-budget-exhaustion"];
+export type R6ReleaseParityCaseIdV0 = (typeof R6_RELEASE_PARITY_CASE_IDS_V0)[number];
+export type R6ReleaseParityDeferredCaseIdV0 = (typeof R6_RELEASE_PARITY_DEFERRED_CASE_IDS_V0)[number];
+export interface RecordedR6ReleaseParitySuiteV0 {
+    readonly schema: typeof R6_RELEASE_PARITY_SUITE_SCHEMA_V0;
+    readonly v: typeof R6_RELEASE_PARITY_SUITE_VERSION_V0;
+    readonly suite_id: string;
+    readonly generated_at: string;
+    readonly as_of: string;
+    readonly initial_instant: string;
+    readonly final_instant: string;
+    readonly world_profile: "recorded-release-parity";
+    readonly cassette_path: "recorded://openprose/reactor-cradle/r6-release-parity-v0";
+    readonly registry: ReactorRegistrySnapshotV0;
+    readonly registry_content_hash: ContentHashV0;
+    readonly cases: readonly RecordedR6ReleaseParityCaseV0[];
+    readonly deferred_cases: readonly DeferredR6ReleaseParityCaseV0[];
+}
+export interface RecordedR6ReleaseParityCaseV0 {
+    readonly case_id: R6ReleaseParityCaseIdV0;
+    readonly title: string;
+    readonly represented_by: string;
+    readonly receipts: readonly ReceiptV0[];
+    readonly decisions: readonly RecordedR6ReleaseParityDecisionV0[];
+    readonly trace: readonly RecordedR6ReleaseParityTraceEntryV0[];
+    readonly expected_relationships: readonly string[];
+    readonly evidence_hashes: readonly ContentHashV0[];
+    readonly notes: readonly string[];
+}
+export interface RecordedR6ReleaseParityDecisionV0 {
+    readonly decision_id: string;
+    readonly case_id: R6ReleaseParityCaseIdV0;
+    readonly as_of: string;
+    readonly outcome: string;
+    readonly reason: string;
+    readonly receipt_hashes: readonly ContentHashV0[];
+    readonly evidence_hashes: readonly ContentHashV0[];
+    readonly token_summary: {
+        readonly fresh: number;
+        readonly reused: number;
+    };
+    readonly guardrails: readonly string[];
+}
+export interface RecordedR6ReleaseParityTraceEntryV0 {
+    readonly as_of: string;
+    readonly event: string;
+    readonly observed: Readonly<Record<string, unknown>>;
+}
+export interface DeferredR6ReleaseParityCaseV0 {
+    readonly case_id: R6ReleaseParityDeferredCaseIdV0;
+    readonly reason: string;
+    readonly missing_primitives: readonly string[];
+    readonly boundary: "not-represented-in-r6";
+}
+export interface RecordedR6ReleaseParityProofV0 {
+    readonly schema: typeof R6_RELEASE_PARITY_PROOF_SCHEMA_V0;
+    readonly v: typeof R6_RELEASE_PARITY_PROOF_VERSION_V0;
+    readonly suite: RecordedR6ReleaseParitySuiteV0;
+    readonly replay_snapshot: ReplayComparableSnapshotV0;
+    readonly parity: ReplayParityMatrixResultV0;
+    readonly assertions: readonly CradleAssertionResultV0[];
+}
+export declare function makeRecordedR6ReleaseParitySuiteV0(): RecordedR6ReleaseParitySuiteV0;
+export declare function makeR6ReleaseParityReplayInputV0(suite?: RecordedR6ReleaseParitySuiteV0): ReplayComparableScenarioOutputInputV0;
+export declare function runRecordedR6ReleaseParityProofV0(suite?: RecordedR6ReleaseParitySuiteV0): RecordedR6ReleaseParityProofV0;
+export declare function buildR6ReleaseParityEvalResultV0(proof?: RecordedR6ReleaseParityProofV0): CradleEvalResultV0;
+export declare const buildRecordedR6ReleaseParityEvalResultV0: typeof buildR6ReleaseParityEvalResultV0;
+export declare function assertRecordedR6ReleaseParitySuiteV0(suite: RecordedR6ReleaseParitySuiteV0): void;
+export declare function assertR6ReleaseParityCaseV0(item: RecordedR6ReleaseParityCaseV0): CradleAssertionResultV0;
+//# sourceMappingURL=index.d.ts.map

package/dist/release-parity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release-parity/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAEV,aAAa,EAMb,SAAS,EAEV,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAExE,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAGL,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,kBAAkB,CAAC;AAqB1B,eAAO,MAAM,iCAAiC,EAC5C,kDAA2D,CAAC;AAC9D,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAC7D,eAAO,MAAM,iCAAiC,EAC5C,kDAA2D,CAAC;AAC9D,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAE7D,eAAO,MAAM,6BAA6B,6TAWhC,CAAC;AAEX,eAAO,MAAM,sCAAsC,2CAEzC,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACjD,MAAM,MAAM,+BAA+B,GACzC,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,iCAAiC,CAAC;IAC1D,QAAQ,CAAC,CAAC,EAAE,OAAO,kCAAkC,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,0DAA0D,CAAC;IACnF,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,EAAE,aAAa,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACnE;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,iCAAiC,EAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAC/D,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,EAAE,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,EAAE,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,iCAAiC,CAAC;IAC1D,QAAQ,CAAC,CAAC,EAAE,OAAO,kCAAkC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,0BAA0B,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACzD;AA8CD,wBAAgB,kCAAkC,IAAI,8BAA8B,CAyCnF;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,GAAE,8BAAqE,GAC3E,qCAAqC,CA0BvC;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,GAAE,8BAAqE,GAC3E,8BAA8B,CA2BhC;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,GAAE,8BAAoE,GAC1E,kBAAkB,CA0BpB;AAED,eAAO,MAAM,wCAAwC,yCACnB,CAAC;AAEnC,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAkBN;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,6BAA6B,GAClC,uBAAuB,CA8FzB"}