@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/commands/qa-synthetic-backend-capture.js

@@ -1 +1,266 @@
-import{createHash as re,randomUUID as ce}from"node:crypto";import{closeSync as N,constants as c,fsyncSync as B,openSync as D,writeFileSync as ne}from"node:fs";import{join as oe}from"node:path";import le from"axe-core";import{launchSyntheticBackendBrowser as de}from"./qa-synthetic-browser.js";import{scenarioRequirementDigest as V,validateRootQaScanScenario as he}from"./qa-scan-capture.js";import{planRootQaScan as U,rootQaScanEvidenceDirectory as fe}from"./qa-scan-review.js";import{openSyntheticBackendSession as we}from"./qa-synthetic-backend.js";const F=a=>re("sha256").update(a).digest("hex");async function Se(a,w,i){const d=he(a.scenario),g=F(JSON.stringify(d)),y=U(a.projectRoot,a.surface,a.targetUrl),q=V(a.projectRoot,d);if(w&&(Object.keys(w).sort().join(",")!=="contractSha256,observations,request,scopeSha256,verify"||!["observations","request","verify"].every(n=>typeof w[n]=="function")||!/^[a-f0-9]{64}$/.test(w.contractSha256)||w.scopeSha256!==F(JSON.stringify([y.sourceHead,a.surface,a.targetUrl,a.generation,g,a.grantId]))))throw new Error("qa-synthetic-backend-broker-port-unverified");const u=w??await we({...a,scenarioSha256:g});if(i&&(!w||Object.keys(i).sort().join(",")!=="containerId,imageId,jobBindingSha256,kind,launch"||i.kind!=="operator-docker-job"||!/^sha256:[a-f0-9]{64}$/.test(i.imageId)||!/^[a-f0-9]{64}$/.test(i.containerId)||!/^[a-f0-9]{64}$/.test(i.jobBindingSha256)||typeof i.launch!="function"))throw new Error("qa-synthetic-backend-docker-context-invalid");const E=i?await i.launch():await de();let O,W=!1,b="context",R="";try{const n=await E.newContext({serviceWorkers:"block",acceptDownloads:!1,permissions:[],ignoreHTTPSErrors:!1,viewport:{width:1280,height:900}});let l=0,h=0,j=!1,k=0,x=0,H=0,J=0,I=0,M=0;const p=new Set,$=new URL(a.targetUrl);await n.route("**/*",async e=>{try{const t=e.request();j?k++:x++;const s=u.request(t.url(),t.method(),t.postData(),await t.allHeaders());p.add(s);let o;try{o=await s}finally{p.delete(s)}await e.fulfill({status:o.status,body:o.body,headers:{"content-type":o.contentType,"cache-control":"no-store"}})}catch(t){t instanceof Error&&/^qa-[a-z-]+$/.test(t.message)&&(R=t.message),l++,await e.abort("blockedbyclient").catch(()=>{})}}),await n.routeWebSocket(/.*/,async e=>{l++,await e.close({code:1008,reason:"blocked"})});const r=await n.newPage();n.on("page",e=>{e!==r&&(h++,e.close())}),r.on("framenavigated",()=>{j&&h++}),r.on("download",()=>{h++}),r.on("pageerror",()=>{h++,J++}),r.on("console",e=>{e.type()==="error"&&(h++,H++)}),r.on("request",()=>{M++}),r.on("requestfailed",()=>{I++}),r.on("response",e=>{e.status()>=400&&(I++,h++)}),O=setTimeout(()=>{W=!0,n.close().catch(()=>{})},15e3),b="navigation";const z=await r.goto($.href,{waitUntil:"load",timeout:5e3});if(!z||z.status()>=400||r.url()!==$.href||l||h)throw new Error("qa-synthetic-backend-target-unavailable");j=!0;const f=()=>{if(l)throw new Error("qa-synthetic-backend-effects-denied-network");if(h)throw new Error("qa-synthetic-backend-effects-denied-page");if(W)throw new Error("qa-synthetic-backend-effects-denied-budget");if(r.url()!==$.href)throw new Error("qa-synthetic-backend-effects-denied-navigation")},C=async e=>{const t=r.locator(e);if(await t.count()!==1)throw new Error("qa-synthetic-backend-target-ambiguous");return t};b="scenario";for(const e of d.actions){const t=await C(e.selector);if(!await t.isVisible()||!await t.isEnabled())throw new Error("qa-synthetic-backend-action-unavailable");e.kind==="click"?await t.click({timeout:2e3}):e.kind==="fill"?await t.fill(e.value,{timeout:2e3}):e.kind==="select"?await t.selectOption(e.value,{timeout:2e3}):e.kind==="press"&&await t.press(e.key,{timeout:2e3}),f()}const A=[];for(const e of d.checks){const t=await C(e.selector),s=Date.now()+2e3;for(;f(),(e.kind==="text"?(await t.textContent({timeout:1e3}))?.trim():e.kind==="value"?await t.inputValue({timeout:1e3}):e.kind==="visible"?await t.isVisible():e.kind==="enabled"?await t.isEnabled():await t.isChecked({timeout:1e3}))!==e.expected;){if(Date.now()>=s)throw new Error("qa-synthetic-backend-check-failed");await r.waitForTimeout(25)}A.push({id:`functional-${e.id}`,passed:!0})}if(await r.waitForTimeout(250),f(),await Promise.allSettled([...p]),f(),await u.verify(),!k||!u.observations().length)throw new Error("qa-synthetic-backend-no-backend-observation");if(U(a.projectRoot,a.surface,a.targetUrl).planSha256!==y.planSha256)throw new Error("qa-synthetic-backend-source-drift");if(V(a.projectRoot,d)!==q)throw new Error("qa-synthetic-backend-source-drift");b="artifacts";const T=fe(a.projectRoot),Y=[],Q=new Date().toISOString(),m=(e,t,s,o,ie)=>{if(s.length<8||s.length>8*1024*1024)throw new Error("qa-synthetic-backend-artifact-limit");const se=re("sha256").update(s).digest("hex"),ae=`backend-${e}-${ce().replaceAll("-","").slice(0,20)}.${o}`,L=D(oe(T,ae),c.O_WRONLY|c.O_CREAT|c.O_EXCL|c.O_NOFOLLOW,384);try{ne(L,s),B(L)}finally{N(L)}Y.push({kind:e,artifactId:ae,sha256:se,captureMethod:t,capturedAt:Q,rationale:ie})},v=e=>Buffer.from(JSON.stringify(e));await r.addScriptTag({content:le.source});let X=0,Z=0,G=0;for(const[e,t,s]of[["visual",1440,900],["responsive",375,812],["responsive-tablet",768,1024],["responsive-desktop",1024,768]]){await r.setViewportSize({width:t,height:s}),f(),m(e,"browser-screenshot",await r.screenshot({type:"png",animations:"disabled",timeout:2e3}),"png",`Isolated network-namespace browser screenshot at ${t}x${s} after the source-bound synthetic scenario.`);const o=await r.evaluate("window.axe.run(document)");if(!o||!Array.isArray(o.violations)||!Array.isArray(o.incomplete)||!Array.isArray(o.passes))throw new Error("qa-synthetic-backend-accessibility-unavailable");X+=o.violations.length,Z+=o.incomplete.length,G+=o.passes.length,f()}m("accessibility","axe-scan",v({schemaVersion:1,engine:"axe-core",violationCount:X,incompleteCount:Z,passCount:G}),"json","Independent-review input: axe observations across all four declared viewport widths after the synthetic scenario.");const S=await r.evaluate("performance.getEntriesByType('navigation')[0]?.duration");if(typeof S!="number"||!Number.isFinite(S)||S<0)throw new Error("qa-synthetic-backend-performance-unavailable");if(m("performance","performance-trace",v({schemaVersion:1,metric:"load",observedMs:Math.ceil(S),budgetMs:1e4}),"json","Physical navigation load observation in the isolated browser with a predeclared ten-second load budget."),await Promise.allSettled([...p]),f(),await n.close(),await Promise.allSettled([...p]),f(),await u.verify(),m("interaction","browser-interaction",v({schemaVersion:3,syntheticTarget:!0,allowedActionRequests:k,deniedRequests:l,generation:a.generation,scenarioSha256:g,checks:A,backend:u.observations()}),"json","Source-bound synthetic backend interaction with exact declared transport and physical browser/backend observations."),m("console-network","console-capture",v({schemaVersion:1,initialCapture:!0,consoleErrors:H,pageErrors:J,failedRequests:I,requestsObserved:M}),"json","Console and request listeners were installed before navigation in a fresh network-isolated browser context."),U(a.projectRoot,a.surface,a.targetUrl).planSha256!==y.planSha256||V(a.projectRoot,d)!==q)throw new Error("qa-synthetic-backend-source-drift");const K={schemaVersion:3,kind:"root-qa-synthetic-backend-observation",sourceHead:y.sourceHead,planSha256:y.planSha256,surface:a.surface,targetSha256:y.targetSha256,generation:a.generation,scenarioSha256:g,backendContractSha256:u.contractSha256,requirementSourceSha256:q,requirementIds:d.requirementIds,capturedAt:Q,checks:A,scenario:d,grantId:a.grantId,evidenceCount:8,observations:Y,initialRequests:x,allowedActionRequests:k,deniedRequests:l,backend:u.observations(),sandboxNetwork:"none",browserNetwork:i?"docker-none":"unshared",browserHostWorkspaceMounted:!1,browserVersion:E.version(),...i?{producerJob:{imageId:i.imageId,containerId:i.containerId,jobBindingSha256:i.jobBindingSha256}}:{},qaAccepted:!1,checkpointAccepted:!1,workflowContinuationAuthorized:!1},P=JSON.stringify(K),ee=F(P),_=D(oe(T,`synthetic-backend-${ee}.json`),c.O_WRONLY|c.O_CREAT|c.O_EXCL|c.O_NOFOLLOW,384);try{ne(_,P),B(_)}finally{N(_)}const te=D(T,c.O_RDONLY|c.O_DIRECTORY|c.O_NOFOLLOW);try{B(te)}finally{N(te)}return{...K,observationSha256:ee}}catch(n){if(R)throw new Error(R);if(n instanceof Error&&/^qa-(synthetic-backend|scan-review)-[a-z-]+$/.test(n.message))throw n;if(n instanceof Error){const l=n.message.match(/net::(ERR_[A-Z_]+)/)?.[1];if(l)throw new Error(`qa-synthetic-backend-${b}-${l.toLowerCase().replaceAll("_","-")}`);if(/Target.*closed|browser has been closed/i.test(n.message))throw new Error(`qa-synthetic-backend-${b}-browser-closed`);if(/Timeout/i.test(n.message))throw new Error(`qa-synthetic-backend-${b}-timeout`)}throw new Error(`qa-synthetic-backend-${b}-unavailable`)}finally{O&&clearTimeout(O),await E.close().catch(()=>{})}}export{Se as captureSyntheticBackendScenario};
+/** Browser/backend observations for the separately granted synthetic path.
+ * Schema 3 deliberately cannot masquerade as the DOM-only schema 2 evidence. */
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, constants, fsyncSync, openSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import axe from 'axe-core';
+import { launchSyntheticBackendBrowser } from './qa-synthetic-browser.js';
+import { scenarioRequirementDigest, validateRootQaScanScenario } from './qa-scan-capture.js';
+import { planRootQaScan, rootQaScanEvidenceDirectory } from './qa-scan-review.js';
+import { openSyntheticBackendSession } from './qa-synthetic-backend.js';
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+export async function captureSyntheticBackendScenario(options, trustedPort, dockerContext) {
+    const scenario = validateRootQaScanScenario(options.scenario);
+    const scenarioSha256 = sha(JSON.stringify(scenario));
+    const plan = planRootQaScan(options.projectRoot, options.surface, options.targetUrl);
+    const requirementSourceSha256 = scenarioRequirementDigest(options.projectRoot, scenario);
+    if (trustedPort && (Object.keys(trustedPort).sort().join(',') !== 'contractSha256,observations,request,scopeSha256,verify'
+        || !['observations', 'request', 'verify'].every(key => typeof trustedPort[key] === 'function')
+        || !/^[a-f0-9]{64}$/.test(trustedPort.contractSha256)
+        || trustedPort.scopeSha256 !== sha(JSON.stringify([plan.sourceHead, options.surface, options.targetUrl,
+            options.generation, scenarioSha256, options.grantId]))))
+        throw new Error('qa-synthetic-backend-broker-port-unverified');
+    const backend = trustedPort ?? await openSyntheticBackendSession({ ...options, scenarioSha256 });
+    if (dockerContext && (!trustedPort || Object.keys(dockerContext).sort().join(',') !== 'containerId,imageId,jobBindingSha256,kind,launch'
+        || dockerContext.kind !== 'operator-docker-job' || !/^sha256:[a-f0-9]{64}$/.test(dockerContext.imageId)
+        || !/^[a-f0-9]{64}$/.test(dockerContext.containerId) || !/^[a-f0-9]{64}$/.test(dockerContext.jobBindingSha256)
+        || typeof dockerContext.launch !== 'function'))
+        throw new Error('qa-synthetic-backend-docker-context-invalid');
+    const browser = dockerContext ? await dockerContext.launch() : await launchSyntheticBackendBrowser();
+    let timer;
+    let expired = false;
+    let phase = 'context';
+    let routeFailure = '';
+    try {
+        const context = await browser.newContext({ serviceWorkers: 'block', acceptDownloads: false,
+            permissions: [], ignoreHTTPSErrors: false, viewport: { width: 1280, height: 900 } });
+        let denied = 0;
+        let disruptions = 0;
+        let started = false;
+        let actionRequests = 0;
+        let initialRequests = 0;
+        let consoleErrors = 0;
+        let pageErrors = 0;
+        let failedRequests = 0;
+        let requestsObserved = 0;
+        const pending = new Set();
+        const target = new URL(options.targetUrl);
+        await context.route('**/*', async (route) => {
+            try {
+                const request = route.request();
+                // Request cookies/auth are refused; headers are never forwarded.
+                if (started)
+                    actionRequests++;
+                else
+                    initialRequests++;
+                const transfer = backend.request(request.url(), request.method(), request.postData(), await request.allHeaders());
+                pending.add(transfer);
+                let response;
+                try {
+                    response = await transfer;
+                }
+                finally {
+                    pending.delete(transfer);
+                }
+                await route.fulfill({ status: response.status, body: response.body,
+                    headers: { 'content-type': response.contentType, 'cache-control': 'no-store' } });
+            }
+            catch (error) {
+                if (error instanceof Error && /^qa-[a-z-]+$/.test(error.message))
+                    routeFailure = error.message;
+                denied++;
+                await route.abort('blockedbyclient').catch(() => undefined);
+            }
+        });
+        await context.routeWebSocket(/.*/, async (socket) => { denied++; await socket.close({ code: 1008, reason: 'blocked' }); });
+        const page = await context.newPage();
+        context.on('page', opened => { if (opened !== page) {
+            disruptions++;
+            void opened.close();
+        } });
+        page.on('framenavigated', () => { if (started)
+            disruptions++; });
+        page.on('download', () => { disruptions++; });
+        page.on('pageerror', () => { disruptions++; pageErrors++; });
+        page.on('console', message => { if (message.type() === 'error') {
+            disruptions++;
+            consoleErrors++;
+        } });
+        page.on('request', () => { requestsObserved++; });
+        page.on('requestfailed', () => { failedRequests++; });
+        page.on('response', r => { if (r.status() >= 400) {
+            failedRequests++;
+            disruptions++;
+        } });
+        timer = setTimeout(() => { expired = true; void context.close().catch(() => undefined); }, 15000);
+        phase = 'navigation';
+        const response = await page.goto(target.href, { waitUntil: 'load', timeout: 5000 });
+        if (!response || response.status() >= 400 || page.url() !== target.href || denied || disruptions) {
+            throw new Error('qa-synthetic-backend-target-unavailable');
+        }
+        started = true;
+        const safe = () => {
+            if (denied)
+                throw new Error('qa-synthetic-backend-effects-denied-network');
+            if (disruptions)
+                throw new Error('qa-synthetic-backend-effects-denied-page');
+            if (expired)
+                throw new Error('qa-synthetic-backend-effects-denied-budget');
+            if (page.url() !== target.href)
+                throw new Error('qa-synthetic-backend-effects-denied-navigation');
+        };
+        const unique = async (selector) => {
+            const locator = page.locator(selector);
+            if (await locator.count() !== 1)
+                throw new Error('qa-synthetic-backend-target-ambiguous');
+            return locator;
+        };
+        phase = 'scenario';
+        for (const action of scenario.actions) {
+            const locator = await unique(action.selector);
+            if (!await locator.isVisible() || !await locator.isEnabled())
+                throw new Error('qa-synthetic-backend-action-unavailable');
+            if (action.kind === 'click')
+                await locator.click({ timeout: 2000 });
+            else if (action.kind === 'fill')
+                await locator.fill(action.value, { timeout: 2000 });
+            else if (action.kind === 'select')
+                await locator.selectOption(action.value, { timeout: 2000 });
+            else if (action.kind === 'press')
+                await locator.press(action.key, { timeout: 2000 });
+            safe();
+        }
+        const checks = [];
+        for (const check of scenario.checks) {
+            const locator = await unique(check.selector);
+            const deadline = Date.now() + 2000;
+            for (;;) {
+                safe();
+                const value = check.kind === 'text' ? (await locator.textContent({ timeout: 1000 }))?.trim()
+                    : check.kind === 'value' ? await locator.inputValue({ timeout: 1000 })
+                        : check.kind === 'visible' ? await locator.isVisible()
+                            : check.kind === 'enabled' ? await locator.isEnabled() : await locator.isChecked({ timeout: 1000 });
+                if (value === check.expected)
+                    break;
+                if (Date.now() >= deadline)
+                    throw new Error('qa-synthetic-backend-check-failed');
+                await page.waitForTimeout(25);
+            }
+            checks.push({ id: `functional-${check.id}`, passed: true });
+        }
+        await page.waitForTimeout(250);
+        safe();
+        await Promise.allSettled([...pending]);
+        safe();
+        await backend.verify();
+        if (!actionRequests || !backend.observations().length)
+            throw new Error('qa-synthetic-backend-no-backend-observation');
+        if (planRootQaScan(options.projectRoot, options.surface, options.targetUrl).planSha256 !== plan.planSha256) {
+            throw new Error('qa-synthetic-backend-source-drift');
+        }
+        if (scenarioRequirementDigest(options.projectRoot, scenario) !== requirementSourceSha256)
+            throw new Error('qa-synthetic-backend-source-drift');
+        phase = 'artifacts';
+        const dir = rootQaScanEvidenceDirectory(options.projectRoot);
+        const observations = [];
+        const capturedAt = new Date().toISOString();
+        const save = (kind, method, bytes, suffix, rationale) => {
+            if (bytes.length < 8 || bytes.length > 8 * 1024 * 1024)
+                throw new Error('qa-synthetic-backend-artifact-limit');
+            const digest = createHash('sha256').update(bytes).digest('hex');
+            const artifactId = `backend-${kind}-${randomUUID().replaceAll('-', '').slice(0, 20)}.${suffix}`;
+            const fd = openSync(join(dir, artifactId), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                writeFileSync(fd, bytes);
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            observations.push({ kind, artifactId, sha256: digest, captureMethod: method, capturedAt, rationale });
+        };
+        const json = (v) => Buffer.from(JSON.stringify(v));
+        await page.addScriptTag({ content: axe.source });
+        let violations = 0;
+        let incomplete = 0;
+        let passes = 0;
+        for (const [kind, width, height] of [['visual', 1440, 900], ['responsive', 375, 812],
+            ['responsive-tablet', 768, 1024], ['responsive-desktop', 1024, 768]]) {
+            await page.setViewportSize({ width, height });
+            safe();
+            save(kind, 'browser-screenshot', await page.screenshot({ type: 'png', animations: 'disabled', timeout: 2000 }), 'png', `Isolated network-namespace browser screenshot at ${width}x${height} after the source-bound synthetic scenario.`);
+            const result = await page.evaluate('window.axe.run(document)');
+            if (!result || !Array.isArray(result.violations) || !Array.isArray(result.incomplete) || !Array.isArray(result.passes))
+                throw new Error('qa-synthetic-backend-accessibility-unavailable');
+            violations += result.violations.length;
+            incomplete += result.incomplete.length;
+            passes += result.passes.length;
+            safe();
+        }
+        save('accessibility', 'axe-scan', json({ schemaVersion: 1, engine: 'axe-core', violationCount: violations, incompleteCount: incomplete, passCount: passes }), 'json', 'Independent-review input: axe observations across all four declared viewport widths after the synthetic scenario.');
+        const duration = await page.evaluate(`performance.getEntriesByType('navigation')[0]?.duration`);
+        if (typeof duration !== 'number' || !Number.isFinite(duration) || duration < 0)
+            throw new Error('qa-synthetic-backend-performance-unavailable');
+        save('performance', 'performance-trace', json({ schemaVersion: 1, metric: 'load', observedMs: Math.ceil(duration), budgetMs: 10000 }), 'json', 'Physical navigation load observation in the isolated browser with a predeclared ten-second load budget.');
+        await Promise.allSettled([...pending]);
+        safe();
+        await context.close();
+        await Promise.allSettled([...pending]);
+        safe();
+        await backend.verify();
+        save('interaction', 'browser-interaction', json({ schemaVersion: 3, syntheticTarget: true, allowedActionRequests: actionRequests,
+            deniedRequests: denied, generation: options.generation, scenarioSha256, checks, backend: backend.observations() }), 'json', 'Source-bound synthetic backend interaction with exact declared transport and physical browser/backend observations.');
+        save('console-network', 'console-capture', json({ schemaVersion: 1, initialCapture: true, consoleErrors, pageErrors, failedRequests, requestsObserved }), 'json', 'Console and request listeners were installed before navigation in a fresh network-isolated browser context.');
+        if (planRootQaScan(options.projectRoot, options.surface, options.targetUrl).planSha256 !== plan.planSha256
+            || scenarioRequirementDigest(options.projectRoot, scenario) !== requirementSourceSha256)
+            throw new Error('qa-synthetic-backend-source-drift');
+        const receipt = { schemaVersion: 3, kind: 'root-qa-synthetic-backend-observation', sourceHead: plan.sourceHead,
+            planSha256: plan.planSha256, surface: options.surface, targetSha256: plan.targetSha256,
+            generation: options.generation, scenarioSha256, backendContractSha256: backend.contractSha256,
+            requirementSourceSha256, requirementIds: scenario.requirementIds,
+            capturedAt, checks, scenario, grantId: options.grantId, evidenceCount: 8, observations,
+            initialRequests, allowedActionRequests: actionRequests, deniedRequests: denied, backend: backend.observations(),
+            sandboxNetwork: 'none', browserNetwork: dockerContext ? 'docker-none' : 'unshared', browserHostWorkspaceMounted: false, browserVersion: browser.version(),
+            ...(dockerContext ? { producerJob: { imageId: dockerContext.imageId, containerId: dockerContext.containerId, jobBindingSha256: dockerContext.jobBindingSha256 } } : {}),
+            qaAccepted: false, checkpointAccepted: false, workflowContinuationAuthorized: false };
+        const bytes = JSON.stringify(receipt);
+        const digest = sha(bytes);
+        const fd = openSync(join(dir, `synthetic-backend-${digest}.json`), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, bytes);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        const parent = openSync(dir, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            fsyncSync(parent);
+        }
+        finally {
+            closeSync(parent);
+        }
+        return { ...receipt, observationSha256: digest };
+    }
+    catch (error) {
+        if (routeFailure)
+            throw new Error(routeFailure);
+        if (error instanceof Error && /^qa-(synthetic-backend|scan-review)-[a-z-]+$/.test(error.message))
+            throw error;
+        if (error instanceof Error) {
+            const network = error.message.match(/net::(ERR_[A-Z_]+)/)?.[1];
+            if (network)
+                throw new Error(`qa-synthetic-backend-${phase}-${network.toLowerCase().replaceAll('_', '-')}`);
+            if (/Target.*closed|browser has been closed/i.test(error.message))
+                throw new Error(`qa-synthetic-backend-${phase}-browser-closed`);
+            if (/Timeout/i.test(error.message))
+                throw new Error(`qa-synthetic-backend-${phase}-timeout`);
+        }
+        throw new Error(`qa-synthetic-backend-${phase}-unavailable`);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        await browser.close().catch(() => undefined);
+    }
+}

package/packages/client/dist/commands/qa-synthetic-backend-review.js

@@ -1 +1,297 @@
-import{createHash as B}from"node:crypto";import{closeSync as v,constants as l,fstatSync as R,fsyncSync as I,openSync as w,readFileSync as C,writeFileSync as $}from"node:fs";import{join as q}from"node:path";import{planRootQaScan as j,rootQaScanEvidenceDirectory as J,validateRootQaScanArtifact as M}from"./qa-scan-review.js";import{validateRootQaScanScenario as z,scenarioRequirementDigest as L}from"./qa-scan-capture.js";import{validateSyntheticBackendContract as _}from"./qa-synthetic-backend.js";import{readRootQaScanDiscovery as E,readRootQaScanDiscoveryTargets as F}from"./qa-scan-discovery.js";const p=/^[a-f0-9]{64}$/,x=["visual","responsive","responsive-tablet","responsive-desktop","accessibility","interaction","console-network","performance"],T={visual:"browser-screenshot",responsive:"browser-screenshot","responsive-tablet":"browser-screenshot","responsive-desktop":"browser-screenshot",accessibility:"axe-scan",interaction:"browser-interaction","console-network":"console-capture",performance:"performance-trace"},m=t=>B("sha256").update(t).digest("hex");function s(){throw new Error("qa-synthetic-backend-review-unverified")}function h(t,i){return!!t&&typeof t=="object"&&!Array.isArray(t)&&Object.keys(t).sort().join(",")===[...i].sort().join(",")}function g(t,i,o){const n=w(q(J(t),i),l.O_RDONLY|l.O_NOFOLLOW);try{const a=R(n);(!a.isFile()||a.nlink!==1||a.uid!==process.getuid?.()||a.mode&63||a.size<1||a.size>o)&&s();const d=C(n),e=R(n);return(d.length!==a.size||e.size!==a.size||e.mtimeMs!==a.mtimeMs||e.ctimeMs!==a.ctimeMs)&&s(),d}finally{v(n)}}function y(t){const i=new TextDecoder("utf-8",{fatal:!0}).decode(t),o=JSON.parse(i);return(!o||typeof o!="object"||Array.isArray(o)||JSON.stringify(o)!==i)&&s(),o}function A(t,i,o){const n=J(t);let a;try{a=w(q(n,i),l.O_WRONLY|l.O_CREAT|l.O_EXCL|l.O_NOFOLLOW,384)}catch(e){(e.code!=="EEXIST"||g(t,i,131072).toString("utf8")!==o)&&s();return}try{$(a,o),I(a)}finally{v(a)}const d=w(n,l.O_RDONLY|l.O_DIRECTORY|l.O_NOFOLLOW);try{I(d)}finally{v(d)}}function W(t,i,o,n){try{p.test(n)||s();const a=j(t,i,o),d=g(t,`synthetic-backend-${n}.json`,131072);m(d)!==n&&s();const e=y(d);if((!h(e,["schemaVersion","kind","sourceHead","planSha256","surface","targetSha256","generation","scenarioSha256","backendContractSha256","requirementSourceSha256","requirementIds","capturedAt","checks","scenario","grantId","evidenceCount","observations","initialRequests","allowedActionRequests","deniedRequests","backend","sandboxNetwork","browserNetwork","browserHostWorkspaceMounted","browserVersion","qaAccepted","checkpointAccepted","workflowContinuationAuthorized",..."producerJob"in e?["producerJob"]:[]])||e.schemaVersion!==3||e.kind!=="root-qa-synthetic-backend-observation"||e.sourceHead!==a.sourceHead||e.planSha256!==a.planSha256||e.surface!==i||e.targetSha256!==a.targetSha256||typeof e.generation!="string"||!p.test(e.generation)||typeof e.scenarioSha256!="string"||!p.test(e.scenarioSha256)||typeof e.grantId!="string"||!/^[a-f0-9]{8}-[a-f0-9-]{27}$/.test(e.grantId)||typeof e.capturedAt!="string"||!Number.isFinite(Date.parse(e.capturedAt))||new Date(e.capturedAt).toISOString()!==e.capturedAt||Date.parse(e.capturedAt)>Date.now()||Date.now()-Date.parse(e.capturedAt)>36e5||e.evidenceCount!==8||!Array.isArray(e.observations)||e.observations.length!==8||e.sandboxNetwork!=="none"||!["unshared","docker-none"].includes(String(e.browserNetwork))||e.browserHostWorkspaceMounted!==!1||typeof e.browserVersion!="string"||!/^[0-9]+(?:\.[0-9]+){2,3}$/.test(e.browserVersion)||!Number.isSafeInteger(e.allowedActionRequests)||Number(e.allowedActionRequests)<1||Number(e.allowedActionRequests)>64||!Number.isSafeInteger(e.initialRequests)||Number(e.initialRequests)<1||Number(e.initialRequests)>64||e.deniedRequests!==0||e.qaAccepted!==!1||e.checkpointAccepted!==!1||e.workflowContinuationAuthorized!==!1)&&s(),e.browserNetwork==="docker-none"){const r=e.producerJob;(!h(r,["imageId","containerId","jobBindingSha256"])||typeof r.imageId!="string"||!/^sha256:[a-f0-9]{64}$/.test(r.imageId)||typeof r.containerId!="string"||!p.test(r.containerId)||typeof r.jobBindingSha256!="string"||!p.test(r.jobBindingSha256))&&s();const f=y(g(t,`producer-job-${r.jobBindingSha256}-${r.containerId}.json`,4096));(!h(f,["schemaVersion","kind","containerId","imageId","jobBindingSha256","sourceHead","requestSha256","phase","bindingSha256","network","producerDockerSocketMounted","createdVerified","completedVerified"])||f.schemaVersion!==1||f.kind!=="root-synthetic-producer-job-attestation"||f.containerId!==r.containerId||f.imageId!==r.imageId||f.jobBindingSha256!==r.jobBindingSha256||f.sourceHead!==a.sourceHead||typeof f.requestSha256!="string"||!p.test(f.requestSha256)||typeof f.bindingSha256!="string"||!p.test(f.bindingSha256)||f.phase!=="completed"||f.network!=="none"||f.producerDockerSocketMounted!==!1||f.createdVerified!==!0||f.completedVerified!==!0)&&s()}else"producerJob"in e&&s();const c=z(e.scenario);(m(JSON.stringify(c))!==e.scenarioSha256||L(t,c)!==e.requirementSourceSha256||JSON.stringify(c.requirementIds)!==JSON.stringify(e.requirementIds)||JSON.stringify(e.checks)!==JSON.stringify(c.checks.map(r=>({id:`functional-${r.id}`,passed:!0}))))&&s();const u=y(g(t,`backend-grant-${e.grantId}.json`,32768));(!h(u,["schemaVersion","contract","planSha256","sourceHead","surface","targetUrl","expiresAt"])||u.schemaVersion!==1||u.planSha256!==a.planSha256||u.sourceHead!==a.sourceHead||u.surface!==i||u.targetUrl!==o||typeof u.expiresAt!="string"||!Number.isFinite(Date.parse(u.expiresAt)))&&s();const b=_(u.contract);(b.generation!==e.generation||b.scenarioSha256!==e.scenarioSha256||m(JSON.stringify(b))!==e.backendContractSha256||Date.parse(e.capturedAt)>Date.parse(u.expiresAt)||Date.parse(e.capturedAt)<Date.parse(u.expiresAt)-b.durationMs||g(t,`backend-consumed-${e.grantId}`,16).toString("utf8")!=="consumed")&&s(),(!Array.isArray(e.backend)||e.backend.length<2||e.backend.length>b.maxRequests)&&s();for(const r of e.backend)(!h(r,["path","method","status","responseSha256"])||!b.routes.some(f=>f.path===r.path&&f.method===r.method)||!Number.isSafeInteger(r.status)||Number(r.status)<200||Number(r.status)>599||Number(r.status)>=300&&Number(r.status)<400||typeof r.responseSha256!="string"||!p.test(r.responseSha256))&&s();Number(e.allowedActionRequests)+Number(e.initialRequests)!==e.backend.length&&s();const k=new Map,O=new Set;for(const r of e.observations){(!h(r,["kind","artifactId","sha256","captureMethod","capturedAt","rationale"])||!x.includes(r.kind)||k.has(r.kind)||typeof r.artifactId!="string"||!/^[a-z][a-z0-9-]{0,63}\.(?:png|json)$/.test(r.artifactId)||O.has(r.artifactId)||r.captureMethod!==T[r.kind]||typeof r.sha256!="string"||!p.test(r.sha256)||r.capturedAt!==e.capturedAt||typeof r.rationale!="string"||r.rationale.length<30||r.rationale.length>500||/[\x00-\x1f\x7f]/.test(r.rationale))&&s();const f=g(t,r.artifactId,8*1024*1024);(m(f)!==r.sha256||r.captureMethod==="browser-screenshot"!==r.artifactId.endsWith(".png"))&&s(),O.add(r.artifactId),k.set(r.kind,f)}const S=y(k.get("interaction"));(!h(S,["schemaVersion","syntheticTarget","allowedActionRequests","deniedRequests","generation","scenarioSha256","checks","backend"])||S.schemaVersion!==3||S.syntheticTarget!==!0||S.allowedActionRequests!==e.allowedActionRequests||S.deniedRequests!==0||S.generation!==e.generation||S.scenarioSha256!==e.scenarioSha256||JSON.stringify(S.checks)!==JSON.stringify(e.checks)||JSON.stringify(S.backend)!==JSON.stringify(e.backend))&&s(),j(t,i,o).planSha256!==a.planSha256&&s();const V=x.filter(r=>r!=="interaction"&&!M(r,k.get(r)));return{receipt:e,observationSha256:n,rejectedKinds:V}}catch{return s()}}function N(t,i,o,n){(!h(n,["schemaVersion","kind","observationSha256","verdict","issues"])||n.schemaVersion!==3||n.kind!=="root-qa-synthetic-backend-report"||typeof n.observationSha256!="string"||!["approved","issues-found"].includes(String(n.verdict))||!Array.isArray(n.issues)||n.issues.length>128)&&s();const a=W(t,i,o,n.observationSha256);(n.verdict==="approved"&&(n.issues.length||a.rejectedKinds.length)||n.verdict==="issues-found"&&!n.issues.length)&&s();const d=new Set(a.receipt.observations.map(c=>c.artifactId));for(const c of n.issues)(!h(c,["severity","evidenceArtifactId","summary"])||!["critical","high","medium","low"].includes(String(c.severity))||!d.has(String(c.evidenceArtifactId))||typeof c.summary!="string"||c.summary.length<20||c.summary.length>500||/[\x00-\x1f\x7f]/.test(c.summary))&&s();const e=n;return{report:e,receipt:{schemaVersion:3,kind:"root-qa-synthetic-backend-review",sourceHead:a.receipt.sourceHead,planSha256:a.receipt.planSha256,observationSha256:a.observationSha256,reviewSha256:m(JSON.stringify(e)),verdict:e.verdict,evidenceCount:8,issueCount:e.issues.length,qaAccepted:e.verdict==="approved",checkpointAccepted:!1,workflowContinuationAuthorized:!1}}}function ee(t){try{t.authorizeRootReview!==!0&&s();const i=N(t.projectRoot,t.surface,t.targetUrl,t.report),o=JSON.stringify(i);A(t.projectRoot,`backend-review-${i.receipt.reviewSha256}.json`,o),JSON.stringify(N(t.projectRoot,t.surface,t.targetUrl,i.report))!==o&&s();const n=JSON.stringify({observationSha256:i.receipt.observationSha256,reviewSha256:i.receipt.reviewSha256});return A(t.projectRoot,`backend-reviewed-${i.receipt.observationSha256}.json`,n),i.receipt}catch{return s()}}function te(t,i,o,n){try{p.test(n)||s();const a=y(g(t,`backend-reviewed-${n}.json`,4096));(!h(a,["observationSha256","reviewSha256"])||a.observationSha256!==n||typeof a.reviewSha256!="string")&&s();const d=D(t,i,o,a.reviewSha256);return d.receipt.observationSha256!==n&&s(),d}catch{return s()}}function D(t,i,o,n){try{p.test(n)||s();const a=y(g(t,`backend-review-${n}.json`,131072));h(a,["report","receipt"])||s();const d=N(t,i,o,a.report);return(d.receipt.reviewSha256!==n||JSON.stringify(d.receipt)!==JSON.stringify(a.receipt))&&s(),d}catch{return s()}}function H(t,i,o){(!Array.isArray(o)||!o.length||o.length>32)&&s();const n=E(t,i),a=F(t,i),d=new Set,e=o.map(c=>{(!h(c,["surface","targetUrl","observationSha256","reviewSha256"])||typeof c.surface!="string"||d.has(c.surface)||typeof c.targetUrl!="string"||typeof c.observationSha256!="string"||typeof c.reviewSha256!="string")&&s(),d.add(c.surface);const u=D(t,c.surface,c.targetUrl,c.reviewSha256);return(u.receipt.sourceHead!==n.sourceHead||u.receipt.observationSha256!==c.observationSha256)&&s(),u.receipt});return JSON.stringify(o.map(c=>c.targetUrl).sort((c,u)=>Buffer.from(c).compare(Buffer.from(u))))!==JSON.stringify(a)&&s(),{schemaVersion:3,kind:"root-qa-synthetic-backend-discovered-phase",sourceHead:n.sourceHead,discoverySha256:i,aggregateSha256:m(JSON.stringify({discoverySha256:i,targets:o,receipts:e})),surfaceCount:o.length,qaAccepted:e.every(c=>c.qaAccepted),issueCount:e.reduce((c,u)=>c+u.issueCount,0),workflowContinuationAuthorized:!1,checkpointAccepted:!1}}function re(t,i,o){try{const n=H(t,i,o),a=JSON.stringify(n),d=`backend-phase-${n.aggregateSha256}.json`;return A(t,d,a),Q(t,i,o)}catch{return s()}}function Q(t,i,o){try{const n=H(t,i,o),a=y(g(t,`backend-phase-${n.aggregateSha256}.json`,4096));return JSON.stringify(a)!==JSON.stringify(n)&&s(),n}catch{return s()}}export{re as acceptSyntheticBackendDiscoveredPhase,ee as acceptSyntheticBackendRootReview,Q as readSyntheticBackendDiscoveredPhase,W as readSyntheticBackendObservation,te as readSyntheticBackendReviewedObservation,D as readSyntheticBackendRootReview};
+/** Separate root review of confined backend evidence. No legacy schema coercion,
+ * workflow checkpoint, caller artifact path or sandbox effect is accepted here. */
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, fsyncSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { planRootQaScan, rootQaScanEvidenceDirectory, validateRootQaScanArtifact } from './qa-scan-review.js';
+import { validateRootQaScanScenario, scenarioRequirementDigest } from './qa-scan-capture.js';
+import { validateSyntheticBackendContract } from './qa-synthetic-backend.js';
+import { readRootQaScanDiscovery, readRootQaScanDiscoveryTargets } from './qa-scan-discovery.js';
+const HASH = /^[a-f0-9]{64}$/;
+const KINDS = ['visual', 'responsive', 'responsive-tablet', 'responsive-desktop', 'accessibility', 'interaction', 'console-network', 'performance'];
+const METHODS = { visual: 'browser-screenshot', responsive: 'browser-screenshot', 'responsive-tablet': 'browser-screenshot',
+    'responsive-desktop': 'browser-screenshot', accessibility: 'axe-scan', interaction: 'browser-interaction',
+    'console-network': 'console-capture', performance: 'performance-trace' };
+const sha = (v) => createHash('sha256').update(v).digest('hex');
+function fail() { throw new Error('qa-synthetic-backend-review-unverified'); }
+function exact(v, keys) {
+    return !!v && typeof v === 'object' && !Array.isArray(v) && Object.keys(v).sort().join(',') === [...keys].sort().join(',');
+}
+function read(root, name, limit) {
+    const fd = openSync(join(rootQaScanEvidenceDirectory(root), name), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = fstatSync(fd);
+        if (!before.isFile() || before.nlink !== 1 || before.uid !== process.getuid?.() || before.mode & 0o077
+            || before.size < 1 || before.size > limit)
+            fail();
+        const bytes = readFileSync(fd);
+        const after = fstatSync(fd);
+        if (bytes.length !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+            fail();
+        return bytes;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function parse(bytes) {
+    const raw = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== 'object' || Array.isArray(value) || JSON.stringify(value) !== raw)
+        fail();
+    return value;
+}
+function save(root, name, bytes) {
+    const dir = rootQaScanEvidenceDirectory(root);
+    let fd;
+    try {
+        fd = openSync(join(dir, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST' || read(root, name, 131072).toString('utf8') !== bytes)
+            fail();
+        return;
+    }
+    try {
+        writeFileSync(fd, bytes);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    const parent = openSync(dir, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        fsyncSync(parent);
+    }
+    finally {
+        closeSync(parent);
+    }
+}
+/** Source and all artifacts are recomputed; an arbitrary JSON/200 response is no proof. */
+export function readSyntheticBackendObservation(root, surface, targetUrl, digest) {
+    try {
+        if (!HASH.test(digest))
+            fail();
+        const plan = planRootQaScan(root, surface, targetUrl);
+        const bytes = read(root, `synthetic-backend-${digest}.json`, 131072);
+        if (sha(bytes) !== digest)
+            fail();
+        const v = parse(bytes);
+        if (!exact(v, ['schemaVersion', 'kind', 'sourceHead', 'planSha256', 'surface', 'targetSha256', 'generation',
+            'scenarioSha256', 'backendContractSha256', 'requirementSourceSha256', 'requirementIds', 'capturedAt', 'checks', 'scenario',
+            'grantId', 'evidenceCount', 'observations', 'initialRequests', 'allowedActionRequests', 'deniedRequests', 'backend', 'sandboxNetwork',
+            'browserNetwork', 'browserHostWorkspaceMounted', 'browserVersion', 'qaAccepted', 'checkpointAccepted', 'workflowContinuationAuthorized',
+            ...('producerJob' in v ? ['producerJob'] : [])])
+            || v.schemaVersion !== 3 || v.kind !== 'root-qa-synthetic-backend-observation'
+            || v.sourceHead !== plan.sourceHead || v.planSha256 !== plan.planSha256 || v.surface !== surface || v.targetSha256 !== plan.targetSha256
+            || typeof v.generation !== 'string' || !HASH.test(v.generation) || typeof v.scenarioSha256 !== 'string' || !HASH.test(v.scenarioSha256)
+            || typeof v.grantId !== 'string' || !/^[a-f0-9]{8}-[a-f0-9-]{27}$/.test(v.grantId)
+            || typeof v.capturedAt !== 'string' || !Number.isFinite(Date.parse(v.capturedAt))
+            || new Date(v.capturedAt).toISOString() !== v.capturedAt || Date.parse(v.capturedAt) > Date.now()
+            || Date.now() - Date.parse(v.capturedAt) > 3600000 || v.evidenceCount !== 8
+            || !Array.isArray(v.observations) || v.observations.length !== 8 || v.sandboxNetwork !== 'none'
+            || !['unshared', 'docker-none'].includes(String(v.browserNetwork)) || v.browserHostWorkspaceMounted !== false
+            || typeof v.browserVersion !== 'string' || !/^[0-9]+(?:\.[0-9]+){2,3}$/.test(v.browserVersion)
+            || !Number.isSafeInteger(v.allowedActionRequests) || Number(v.allowedActionRequests) < 1 || Number(v.allowedActionRequests) > 64
+            || !Number.isSafeInteger(v.initialRequests) || Number(v.initialRequests) < 1 || Number(v.initialRequests) > 64
+            || v.deniedRequests !== 0 || v.qaAccepted !== false || v.checkpointAccepted !== false || v.workflowContinuationAuthorized !== false)
+            fail();
+        if (v.browserNetwork === 'docker-none') {
+            const job = v.producerJob;
+            if (!exact(job, ['imageId', 'containerId', 'jobBindingSha256']) || typeof job.imageId !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(job.imageId)
+                || typeof job.containerId !== 'string' || !HASH.test(job.containerId) || typeof job.jobBindingSha256 !== 'string' || !HASH.test(job.jobBindingSha256))
+                fail();
+            const attestation = parse(read(root, `producer-job-${job.jobBindingSha256}-${job.containerId}.json`, 4096));
+            if (!exact(attestation, ['schemaVersion', 'kind', 'containerId', 'imageId', 'jobBindingSha256', 'sourceHead', 'requestSha256',
+                'phase', 'bindingSha256', 'network', 'producerDockerSocketMounted', 'createdVerified', 'completedVerified'])
+                || attestation.schemaVersion !== 1 || attestation.kind !== 'root-synthetic-producer-job-attestation'
+                || attestation.containerId !== job.containerId || attestation.imageId !== job.imageId || attestation.jobBindingSha256 !== job.jobBindingSha256
+                || attestation.sourceHead !== plan.sourceHead || typeof attestation.requestSha256 !== 'string' || !HASH.test(attestation.requestSha256)
+                || typeof attestation.bindingSha256 !== 'string' || !HASH.test(attestation.bindingSha256) || attestation.phase !== 'completed'
+                || attestation.network !== 'none' || attestation.producerDockerSocketMounted !== false
+                || attestation.createdVerified !== true || attestation.completedVerified !== true)
+                fail();
+        }
+        else if ('producerJob' in v)
+            fail();
+        const scenario = validateRootQaScanScenario(v.scenario);
+        if (sha(JSON.stringify(scenario)) !== v.scenarioSha256
+            || scenarioRequirementDigest(root, scenario) !== v.requirementSourceSha256
+            || JSON.stringify(scenario.requirementIds) !== JSON.stringify(v.requirementIds)
+            || JSON.stringify(v.checks) !== JSON.stringify(scenario.checks.map(c => ({ id: `functional-${c.id}`, passed: true }))))
+            fail();
+        const grant = parse(read(root, `backend-grant-${v.grantId}.json`, 32768));
+        if (!exact(grant, ['schemaVersion', 'contract', 'planSha256', 'sourceHead', 'surface', 'targetUrl', 'expiresAt'])
+            || grant.schemaVersion !== 1 || grant.planSha256 !== plan.planSha256 || grant.sourceHead !== plan.sourceHead
+            || grant.surface !== surface || grant.targetUrl !== targetUrl || typeof grant.expiresAt !== 'string'
+            || !Number.isFinite(Date.parse(grant.expiresAt)))
+            fail();
+        const contract = validateSyntheticBackendContract(grant.contract);
+        if (contract.generation !== v.generation || contract.scenarioSha256 !== v.scenarioSha256
+            || sha(JSON.stringify(contract)) !== v.backendContractSha256 || Date.parse(v.capturedAt) > Date.parse(grant.expiresAt)
+            || Date.parse(v.capturedAt) < Date.parse(grant.expiresAt) - contract.durationMs
+            || read(root, `backend-consumed-${v.grantId}`, 16).toString('utf8') !== 'consumed')
+            fail();
+        if (!Array.isArray(v.backend) || v.backend.length < 2 || v.backend.length > contract.maxRequests)
+            fail();
+        for (const row of v.backend) {
+            if (!exact(row, ['path', 'method', 'status', 'responseSha256']) || !contract.routes.some(r => r.path === row.path && r.method === row.method)
+                || !Number.isSafeInteger(row.status) || Number(row.status) < 200 || Number(row.status) > 599
+                || Number(row.status) >= 300 && Number(row.status) < 400 || typeof row.responseSha256 !== 'string' || !HASH.test(row.responseSha256))
+                fail();
+        }
+        if (Number(v.allowedActionRequests) + Number(v.initialRequests) !== v.backend.length)
+            fail();
+        const artifacts = new Map();
+        const artifactIds = new Set();
+        for (const row of v.observations) {
+            if (!exact(row, ['kind', 'artifactId', 'sha256', 'captureMethod', 'capturedAt', 'rationale'])
+                || !KINDS.includes(row.kind) || artifacts.has(row.kind)
+                || typeof row.artifactId !== 'string' || !/^[a-z][a-z0-9-]{0,63}\.(?:png|json)$/.test(row.artifactId)
+                || artifactIds.has(row.artifactId) || row.captureMethod !== METHODS[row.kind]
+                || typeof row.sha256 !== 'string' || !HASH.test(row.sha256) || row.capturedAt !== v.capturedAt
+                || typeof row.rationale !== 'string' || row.rationale.length < 30 || row.rationale.length > 500
+                || /[\x00-\x1f\x7f]/.test(row.rationale))
+                fail();
+            const data = read(root, row.artifactId, 8 * 1024 * 1024);
+            if (sha(data) !== row.sha256 || (row.captureMethod === 'browser-screenshot') !== row.artifactId.endsWith('.png'))
+                fail();
+            artifactIds.add(row.artifactId);
+            artifacts.set(row.kind, data);
+        }
+        const interaction = parse(artifacts.get('interaction'));
+        if (!exact(interaction, ['schemaVersion', 'syntheticTarget', 'allowedActionRequests', 'deniedRequests', 'generation', 'scenarioSha256', 'checks', 'backend'])
+            || interaction.schemaVersion !== 3 || interaction.syntheticTarget !== true
+            || interaction.allowedActionRequests !== v.allowedActionRequests || interaction.deniedRequests !== 0
+            || interaction.generation !== v.generation || interaction.scenarioSha256 !== v.scenarioSha256
+            || JSON.stringify(interaction.checks) !== JSON.stringify(v.checks) || JSON.stringify(interaction.backend) !== JSON.stringify(v.backend))
+            fail();
+        if (planRootQaScan(root, surface, targetUrl).planSha256 !== plan.planSha256)
+            fail();
+        const rejectedKinds = KINDS.filter(kind => kind !== 'interaction' && !validateRootQaScanArtifact(kind, artifacts.get(kind)));
+        return { receipt: v, observationSha256: digest, rejectedKinds };
+    }
+    catch {
+        return fail();
+    }
+}
+function validateReport(root, surface, targetUrl, input) {
+    if (!exact(input, ['schemaVersion', 'kind', 'observationSha256', 'verdict', 'issues']) || input.schemaVersion !== 3
+        || input.kind !== 'root-qa-synthetic-backend-report' || typeof input.observationSha256 !== 'string'
+        || !['approved', 'issues-found'].includes(String(input.verdict)) || !Array.isArray(input.issues) || input.issues.length > 128)
+        fail();
+    const checked = readSyntheticBackendObservation(root, surface, targetUrl, input.observationSha256);
+    if (input.verdict === 'approved' && (input.issues.length || checked.rejectedKinds.length)
+        || input.verdict === 'issues-found' && !input.issues.length)
+        fail();
+    const ids = new Set(checked.receipt.observations.map(row => row.artifactId));
+    for (const issue of input.issues)
+        if (!exact(issue, ['severity', 'evidenceArtifactId', 'summary'])
+            || !['critical', 'high', 'medium', 'low'].includes(String(issue.severity)) || !ids.has(String(issue.evidenceArtifactId))
+            || typeof issue.summary !== 'string' || issue.summary.length < 20 || issue.summary.length > 500 || /[\x00-\x1f\x7f]/.test(issue.summary))
+            fail();
+    const report = input;
+    return { report, receipt: { schemaVersion: 3, kind: 'root-qa-synthetic-backend-review',
+            sourceHead: checked.receipt.sourceHead, planSha256: checked.receipt.planSha256,
+            observationSha256: checked.observationSha256, reviewSha256: sha(JSON.stringify(report)), verdict: report.verdict,
+            evidenceCount: 8, issueCount: report.issues.length, qaAccepted: report.verdict === 'approved',
+            checkpointAccepted: false, workflowContinuationAuthorized: false } };
+}
+export function acceptSyntheticBackendRootReview(options) {
+    try {
+        if (options.authorizeRootReview !== true)
+            fail();
+        const checked = validateReport(options.projectRoot, options.surface, options.targetUrl, options.report);
+        const bytes = JSON.stringify(checked);
+        save(options.projectRoot, `backend-review-${checked.receipt.reviewSha256}.json`, bytes);
+        // Recompute after persistence; a raced source or artifact grants no accepted result.
+        if (JSON.stringify(validateReport(options.projectRoot, options.surface, options.targetUrl, checked.report)) !== bytes)
+            fail();
+        const pointerBytes = JSON.stringify({ observationSha256: checked.receipt.observationSha256, reviewSha256: checked.receipt.reviewSha256 });
+        save(options.projectRoot, `backend-reviewed-${checked.receipt.observationSha256}.json`, pointerBytes);
+        return checked.receipt;
+    }
+    catch {
+        return fail();
+    }
+}
+export function readSyntheticBackendReviewedObservation(root, surface, targetUrl, observationSha256) {
+    try {
+        if (!HASH.test(observationSha256))
+            fail();
+        const pointer = parse(read(root, `backend-reviewed-${observationSha256}.json`, 4096));
+        if (!exact(pointer, ['observationSha256', 'reviewSha256']) || pointer.observationSha256 !== observationSha256 || typeof pointer.reviewSha256 !== 'string')
+            fail();
+        const checked = readSyntheticBackendRootReview(root, surface, targetUrl, pointer.reviewSha256);
+        if (checked.receipt.observationSha256 !== observationSha256)
+            fail();
+        return checked;
+    }
+    catch {
+        return fail();
+    }
+}
+export function readSyntheticBackendRootReview(root, surface, targetUrl, digest) {
+    try {
+        if (!HASH.test(digest))
+            fail();
+        const stored = parse(read(root, `backend-review-${digest}.json`, 131072));
+        if (!exact(stored, ['report', 'receipt']))
+            fail();
+        const checked = validateReport(root, surface, targetUrl, stored.report);
+        if (checked.receipt.reviewSha256 !== digest || JSON.stringify(checked.receipt) !== JSON.stringify(stored.receipt))
+            fail();
+        return checked;
+    }
+    catch {
+        return fail();
+    }
+}
+function checkedPhase(root, discoverySha256, targets) {
+    if (!Array.isArray(targets) || !targets.length || targets.length > 32)
+        fail();
+    const discovery = readRootQaScanDiscovery(root, discoverySha256);
+    const urls = readRootQaScanDiscoveryTargets(root, discoverySha256);
+    const surfaces = new Set();
+    const receipts = targets.map(target => {
+        if (!exact(target, ['surface', 'targetUrl', 'observationSha256', 'reviewSha256'])
+            || typeof target.surface !== 'string' || surfaces.has(target.surface) || typeof target.targetUrl !== 'string'
+            || typeof target.observationSha256 !== 'string' || typeof target.reviewSha256 !== 'string')
+            fail();
+        surfaces.add(target.surface);
+        const checked = readSyntheticBackendRootReview(root, target.surface, target.targetUrl, target.reviewSha256);
+        if (checked.receipt.sourceHead !== discovery.sourceHead || checked.receipt.observationSha256 !== target.observationSha256)
+            fail();
+        return checked.receipt;
+    });
+    if (JSON.stringify(targets.map(t => t.targetUrl).sort((a, b) => Buffer.from(a).compare(Buffer.from(b)))) !== JSON.stringify(urls))
+        fail();
+    return { schemaVersion: 3, kind: 'root-qa-synthetic-backend-discovered-phase', sourceHead: discovery.sourceHead,
+        discoverySha256, aggregateSha256: sha(JSON.stringify({ discoverySha256, targets, receipts })), surfaceCount: targets.length,
+        qaAccepted: receipts.every(r => r.qaAccepted), issueCount: receipts.reduce((sum, r) => sum + r.issueCount, 0),
+        workflowContinuationAuthorized: false, checkpointAccepted: false };
+}
+export function acceptSyntheticBackendDiscoveredPhase(root, discoverySha256, targets) {
+    try {
+        const receipt = checkedPhase(root, discoverySha256, targets);
+        const bytes = JSON.stringify(receipt);
+        const name = `backend-phase-${receipt.aggregateSha256}.json`;
+        save(root, name, bytes);
+        return readSyntheticBackendDiscoveredPhase(root, discoverySha256, targets);
+    }
+    catch {
+        return fail();
+    }
+}
+export function readSyntheticBackendDiscoveredPhase(root, discoverySha256, targets) {
+    try {
+        const expected = checkedPhase(root, discoverySha256, targets);
+        const stored = parse(read(root, `backend-phase-${expected.aggregateSha256}.json`, 4096));
+        if (JSON.stringify(stored) !== JSON.stringify(expected))
+            fail();
+        return expected;
+    }
+    catch {
+        return fail();
+    }
+}