@pellux/goodvibes-tui 1.25.0 → 1.27.0

package/src/verification/verification-ledger.ts

@@ -70,12 +70,20 @@ const SETTINGS_BEHAVIOR_BASELINE = 184;
  * overlaps neither other counted set, so nothing is double-counted and nothing
  * drifts in uncounted.
  *
- * PER-KEY EVIDENCE. All 25 are read by a LIVE consumer, which is why they were
+ * PER-KEY EVIDENCE. All 42 are read by a LIVE consumer, which is why they were
  * declared at all: the SDK's mail and calendar gateway compositions
  * (platform/email/surface-config.ts and platform/calendar/caldav-gateway-config.ts)
- * resolve every one of them when the daemon serves `email.*` and `calendar.*`.
- * The three password keys additionally resolve through the daemon secret tier
- * rather than from config, and carry no secret value in config themselves.
+ * resolve every one of them when the daemon serves `email.*` and `calendar.*`,
+ * and the `surfaces.email.inbound.*` block is read by the daemon's inbound mail
+ * reader — the poller/IDLE path that makes incoming mail visible at all.
+ * The five password keys (email.password, email.imapPassword,
+ * email.imap.password, email.smtp.password, calendar.caldavPassword)
+ * additionally resolve through the daemon secret tier rather than from config,
+ * and carry no secret value in config themselves. That is now enforced on the
+ * write side too: all five are in `config/secret-config.ts`'s
+ * SECRET_CONFIG_KEYS, so the settings modal and `/config set` route an entered
+ * value into the secret store and leave only a `goodvibes://` reference in
+ * config, rather than writing the password itself into a settings file.
  */
 export const DAEMON_MAILBOX_LOCAL_SETTINGS = [
   'surfaces.email.host',
@@ -98,6 +106,31 @@ export const DAEMON_MAILBOX_LOCAL_SETTINGS = [
   'surfaces.email.smtp.port',
   'surfaces.email.smtp.password',
   'surfaces.email.smtp.secure',
+  // Inbound mail — the poller/IDLE reader the daemon runs to actually READ mail,
+  // which arrived with the platform runtime. These are counted for exactly the
+  // reason the keys above are: the same four-part persistence contract runs over
+  // every one of them in
+  // src/test/verification/daemon-mailbox-settings-persistence.test.ts, and the
+  // list is asserted there to be the complete surfaces.email.*/surfaces.calendar.*
+  // schema set. Arriving uncounted is what dropped localBehaviorPercent through
+  // its floor when the schema grew.
+  'surfaces.email.inbound.enabled',
+  'surfaces.email.inbound.accounts',
+  'surfaces.email.inbound.source',
+  'surfaces.email.inbound.gmailPollSecondsExpecting',
+  'surfaces.email.inbound.gmailPollSecondsIdle',
+  'surfaces.email.inbound.mode',
+  'surfaces.email.inbound.pollIntervalSeconds',
+  'surfaces.email.inbound.idleReissueMinutes',
+  'surfaces.email.inbound.reconnect.maxBackoffSeconds',
+  'surfaces.email.inbound.notice.route',
+  'surfaces.email.inbound.notice.mode',
+  'surfaces.email.inbound.expectationWindowMinutes',
+  'surfaces.email.inbound.dedupTtlMinutes',
+  'surfaces.email.inbound.retentionDays',
+  'surfaces.email.inbound.maxRecords',
+  'surfaces.email.inbound.capabilityRecheckMinutes',
+  'surfaces.email.inbound.onInsufficientCapability',
   'surfaces.calendar.caldavUrl',
   'surfaces.calendar.caldavUser',
   'surfaces.calendar.caldavPassword',
@@ -176,16 +209,16 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  *   watchers.triggers.onExitMaxDurationMs    persistence · live (on-exit trigger duration cap)
  *   watchers.triggers.onExitStdin            persistence · live (on-exit stdin posture)
  *   watchers.triggers.outputTailBytes        persistence · live (captured output tail)
- *   device.capabilities.allowAlwaysOffer     persistence · settings surface only in this build
- *   device.capabilities.requestTimeoutSeconds persistence · settings surface only in this build
- *   device.location.precision                persistence · settings surface only in this build
- *   device.clipboard.readMode                persistence · settings surface only in this build
- *   device.capture.retentionHours            persistence · settings surface only in this build
- *   device.capture.maxArtifacts              persistence · settings surface only in this build
- *   device.capture.sweepIntervalMinutes      persistence · settings surface only in this build
- *   device.grants.expiryDays                 persistence · settings surface only in this build
- *   device.grants.maxPerNode                 persistence · settings surface only in this build
- *   device.grants.auditRetentionDays         persistence · settings surface only in this build
+ *   device.capabilities.allowAlwaysOffer     persistence · behavior (durable-grant offer by sensitivity)
+ *   device.capabilities.requestTimeoutSeconds persistence · behavior (dispatch, wire payload and prompt deadline)
+ *   device.location.precision                persistence · behavior (precise fix refused / never granted)
+ *   device.clipboard.readMode                persistence · behavior (clipboard read refused / never granted)
+ *   device.capture.retentionHours            persistence · behavior (capture TTL, swept off disk at expiry)
+ *   device.capture.maxArtifacts              persistence · behavior (capture count cap at the sweep)
+ *   device.capture.sweepIntervalMinutes      persistence · behavior (period of the sweep that reaps)
+ *   device.grants.expiryDays                 persistence · behavior (grant TTL, then asks again)
+ *   device.grants.maxPerNode                 persistence · behavior (per-node grant cap at the sweep)
+ *   device.grants.auditRetentionDays         persistence · behavior (grant ledger retention)
  *   device.nodes.maxPaired                   persistence · live (enforced at the pairing path)
  *
  * On `device.nodes.maxPaired`: the SDK enforces it where a device pairs —
@@ -202,17 +235,56 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  * in this column so the "how live is it" audit stays accurate, not to claim
  * coverage this repo did not write.
  *
- * On the other ten `device.*` rows: DeviceCapabilityService carries its own
- * policy struct whose defaults match those keys one for one, and names them in
- * its field comments and refusal messages, but no code path in either tree maps
- * configuration into that struct. Persistence is therefore the whole of what is
- * verified for them, and the settings-workspace description for the `device`
- * category says exactly that to the user rather than implying live knobs.
+ * On the other ten `device.*` rows: they are live now. This app composes the
+ * platform's device posture runtime (src/runtime/device-posture-composition.ts)
+ * on the same distributed runtime phones pair onto and the same approval broker
+ * every other confirmation rides, registers the `phone` tool on it, and binds the
+ * devices.* verbs to it — so each of these keys is read, per request and per
+ * sweep, by the DeviceCapabilityService / DeviceGrantStore /
+ * DeviceCaptureArtifactStore / DeviceHousekeeper that serve them. They were dark
+ * before that: the policy struct carried matching defaults and named the keys in
+ * its refusal messages, but nothing mapped configuration into it in either tree.
+ * The mapping now lives in the SDK, so every daemon host honours it rather than
+ * only whichever consumer had written its own.
  *
- * DELIBERATELY NOT COUNTED: the 24 non-enablement `voice.wake.*` keys from the
- * same release. `wake-word-detection` is declared `notOperable` — no surface
- * captures audio — so its rows stay in `total` and out of the numerator. That is
- * the honest reading, and it is why this list raises coverage by 29 and not 53.
+ * The second column above is upgraded to "behavior" on the strength of
+ * `src/test/verification/device-posture-behavior.test.ts`, which drives THIS
+ * app's composition with a real ConfigManager over a temp home and the platform's
+ * real stores, stubs only the peer transport and the approval bridge, and asserts
+ * per key at two values that the observable outcome differs — refusal code, how
+ * authority was established, what reached the transport, what the prompt was
+ * given, and what survives on disk after a sweep. It also invokes the `phone`
+ * tool and the devices.* verbs off the composed runtime graph, because a mapping
+ * nothing composes is the same defect in a different place.
+ *
+ * STILL NOT COUNTED, FOR A DIFFERENT REASON NOW: the 24 non-enablement
+ * `voice.wake.*` keys from the same release. When this list was written they were
+ * excluded because nothing captured audio at all. That is no longer true — this
+ * terminal opens a recorder subprocess (src/audio/capture.ts), runs the SDK
+ * detector over it through onnxruntime-web (src/audio/wake-inference.ts), and
+ * hands both a confirmed wake's utterance and a push-to-talk recording to the
+ * daemon's `voice.stt` verb. Every one of those rows is read by
+ * resolveWakeRuntimeSettings and reaches this surface's runtime.
+ *
+ * They stay out of the NUMERATOR here because this constant counts exactly one
+ * thing — keys whose four-part PERSISTENCE contract is exercised by
+ * device-and-trigger-settings-persistence.test.ts — and that test does not cover
+ * them. The behaviour they now drive is covered instead by the capture and wake
+ * tests under src/test/audio/, which assert the frame path, the detection
+ * chain, the disabled-means-no-capture rule, the supervisor's restart and latch,
+ * and the recorder argv. Counting them in both places would double-count; adding
+ * them here without writing their persistence round-trip would overclaim. So the
+ * number this list raises coverage by is unchanged, and the reason it excludes
+ * them is recorded above rather than left reading as "the feature does nothing".
+ *
+ * Every wake row is now in force on this surface, with one condition stated at
+ * every surfacing: `voice.wake.vadThreshold` above 0 needs the speech gate's own
+ * pinned artifact provisioned (`/voice wake setup` fetches it with the models),
+ * and until it is, startup BLOCKS with that reason rather than scoring frames
+ * ungated behind a row that says they are screened. `voice.wake.noiseSuppression:
+ * speex` runs here: the filter is a WebAssembly module the SDK carries, applied
+ * by the wrapper the listener and the push-to-talk session put around this
+ * surface's capture opener.
  */
 export const DEVICE_AND_TRIGGER_LOCAL_SETTINGS = [
   'watchers.triggers.backoffLadderMs',
@@ -300,11 +372,78 @@ export const CLUSTER_GROUP_LOCAL_SETTINGS = [
   'cluster.rosterGossipSeconds',
 ] as const;
 
+/**
+ * Config keys for the daemon's payment capability: the master switch, which
+ * card to use by default, the settlement currency, CVV handling, the six
+ * budget knobs, the shipping-tier preference, the fourteen billing/shipping
+ * address sub-fields, the two approval/veto windows, and the notify-channel
+ * list. Card MATERIAL (number, expiry, CVV, cardholder name) is intentionally
+ * NOT here — see the SDK's schema-domain-payments.ts header and this repo's
+ * own input/payments-config.ts: that material lives write-only in the daemon
+ * secret store, never in CONFIG_SCHEMA, so there is nothing for a persistence
+ * contract to count.
+ *
+ * THIS CONSTANT IS NOT A DIAL, for the same reason as the sets above. Every
+ * key below is counted because
+ * `src/test/verification/payments-settings-persistence.test.ts` runs the same
+ * four-part persistence contract the other counted sets are counted for:
+ * schema default exposure, `set()` through the key's own validator to disk,
+ * reload into a fresh ConfigManager with read-back equality, and
+ * reset-to-default that also survives reload. That test also asserts this
+ * list is exactly the CONFIG_SCHEMA's `payments.*` key set, so a future SDK
+ * addition under this domain is caught (fails the inventory-integrity test)
+ * rather than silently uncounted.
+ *
+ * PER-KEY EVIDENCE. All 28 are read by the daemon's own payment capability
+ * (platform/payments, platform/control-plane/routes/payments.ts): the budget
+ * keys size the daily/overage/tolerance pools, the window keys size the
+ * veto/approval timers, cvvHandling and shipping.preferredTier select the
+ * enum behaviors `platform/payments` documents, and the address sub-fields
+ * are read directly by the daemon's shipping-address-required refusal and the
+ * card-issuer address-verification path. `enabled` and `defaultCardId` gate
+ * and select, respectively, whether/which card a purchase uses.
+ */
+export const PAYMENTS_LOCAL_SETTINGS = [
+  'payments.enabled',
+  'payments.defaultCardId',
+  'payments.currency',
+  'payments.cvvHandling',
+  'payments.budget.dailyItemCents',
+  'payments.budget.dailyOverageCents',
+  'payments.budget.perPurchaseCeilingEnabled',
+  'payments.budget.perPurchaseCeilingCents',
+  'payments.budget.overageToleranceEnabled',
+  'payments.budget.overageToleranceDailyAllowanceCents',
+  'payments.shipping.preferredTier',
+  'payments.billingAddress.name',
+  'payments.billingAddress.line1',
+  'payments.billingAddress.line2',
+  'payments.billingAddress.city',
+  'payments.billingAddress.region',
+  'payments.billingAddress.postalCode',
+  'payments.billingAddress.country',
+  'payments.shippingAddress.name',
+  'payments.shippingAddress.line1',
+  'payments.shippingAddress.line2',
+  'payments.shippingAddress.city',
+  'payments.shippingAddress.region',
+  'payments.shippingAddress.postalCode',
+  'payments.shippingAddress.country',
+  'payments.windows.vetoMinutes',
+  'payments.windows.approvalMinutes',
+  'payments.majorRetailersAdditional',
+  'payments.majorRetailersExcluded',
+  'payments.ebayMinSellerFeedbackCount',
+  'payments.ebayMinSellerPositivePercent',
+  'payments.notifyChannels',
+] as const;
+
 const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
   + FEATURE_KNOB_LOCAL_SETTINGS.length
   + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
   + CLUSTER_GROUP_LOCAL_SETTINGS.length
   + DAEMON_MAILBOX_LOCAL_SETTINGS.length
+  + PAYMENTS_LOCAL_SETTINGS.length
   + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.25.0';
+let _version = '1.27.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file