@pixel-point/toolcraft 0.0.15 → 0.0.16

package/templates/starter/scripts/toolcraft-receipt-boundary.test.mjs

@@ -0,0 +1,285 @@
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  getToolcraftDeliveryReceiptShapeError,
+  validateToolcraftDeliveryReceipt,
+} from "./toolcraft-delivery-receipt.mjs";
+import * as deliveryAnchor from "./toolcraft-delivery-anchor.mjs";
+import {
+  createToolcraftLocalDependencyGraph,
+  getToolcraftProductionCycleViolations,
+} from "./toolcraft-local-dependency-graph.mjs";
+import { getToolcraftPerformanceReceiptShapeError } from "./toolcraft-performance-receipt-policy.mjs";
+import * as performanceReceiptPolicy from "./toolcraft-performance-receipt-policy.mjs";
+import {
+  validateToolcraftPerformanceReceipt,
+  validateToolcraftVerificationReceipt,
+} from "./toolcraft-verification-receipt.mjs";
+import * as verificationReceiptFacade from "./toolcraft-verification-receipt.mjs";
+import * as receiptFileIo from "./toolcraft-receipt-file-io.mjs";
+import * as deliveryEvidence from "./toolcraft-delivery-evidence.mjs";
+import * as deliveryExecutor from "./toolcraft-delivery-executor.mjs";
+import * as planExecutionAuthority from "./toolcraft-plan-execution-authority.mjs";
+import * as targetedPerformanceExecution from "./toolcraft-targeted-performance-execution.mjs";
+import * as proofProcess from "./toolcraft-proof-process.mjs";
+import { collectToolcraftSourceInventory } from "./toolcraft-source-inventory.mjs";
+import { isToolcraftPackageRootOrSubpath } from "./toolcraft-typescript-source-evidence.mjs";
+import { createReceiptFixture } from "./toolcraft-verification-receipt-test-helpers.mjs";
+
+const expectedVerificationReceiptExports = [
+  "TOOLCRAFT_PERFORMANCE_RECEIPT_VERSION",
+  "assertToolcraftVerificationInputsUnchanged",
+  "collectToolcraftVerificationInputs",
+  "readToolcraftDurablePerformanceBaseline",
+  "validateToolcraftCurrentPerformanceImpactInventory",
+  "validateToolcraftPerformanceReceipt",
+  "validateToolcraftVerificationReceipt",
+];
+
+const expectedDeliveryExecutorExports = [
+  "executeToolcraftDeliveryPlan",
+  "executeToolcraftDeliveryPlanCore",
+  "finalizeToolcraftPlanExecutionAuthority",
+  "releaseToolcraftPlanExecutionAuthority",
+  "reserveToolcraftPlanExecutionAuthority",
+];
+
+const expectedPerformanceReceiptPolicyExports = [
+  "TOOLCRAFT_PERFORMANCE_RECEIPT_VERSION",
+  "createToolcraftPerformanceCheckpointReceipt",
+  "getToolcraftPerformanceReceiptShapeError",
+];
+
+async function collectCrossSpawnImportFacts(rootDir) {
+  const inventory = await collectToolcraftSourceInventory({
+    rootDir,
+    sourceRoots: ["scripts"],
+    testSupportPatterns: [
+      /(?:^|\/)[^/]+-fixture\.[cm]?js$/u,
+      /(?:^|\/)[^/]+-test-(?:helpers|fixtures)\.[cm]?js$/u,
+    ],
+  });
+  assert.deepEqual(inventory.filesystemViolations, []);
+  const graph = await createToolcraftLocalDependencyGraph({
+    entries: inventory.entries.filter(({ role }) => role === "production"),
+    rootDir,
+  });
+  return graph.moduleImports.filter(({ specifier }) =>
+    isToolcraftPackageRootOrSubpath(specifier, "cross-spawn")
+  );
+}
+
+test("receipt production dependency graph is acyclic", async () => {
+  const rootDir = path.resolve(import.meta.dirname, "../..");
+  const scriptNames = await fs.readdir(import.meta.dirname);
+  const entries = scriptNames
+    .filter(
+      (name) =>
+        name.endsWith(".mjs") &&
+        !name.endsWith(".test.mjs") &&
+        !name.endsWith("-test-helpers.mjs"),
+    )
+    .map((name) => ({
+      absolutePath: path.join(import.meta.dirname, name),
+      owner: "product",
+      repoPath: `starter/scripts/${name}`,
+      role: "production",
+    }));
+  const graph = await createToolcraftLocalDependencyGraph({
+    entries,
+    rootDir,
+  });
+  const violations = getToolcraftProductionCycleViolations(graph).filter(({ cycle }) =>
+    cycle.some((repoPath) => /toolcraft-(?:delivery|verification)-receipt/iu.test(repoPath)),
+  );
+
+  assert.deepEqual(violations, []);
+});
+
+test("verification receipt facade preserves its public API", () => {
+  assert.deepEqual(
+    Object.keys(verificationReceiptFacade).sort(),
+    expectedVerificationReceiptExports,
+  );
+  assert.equal(
+    "writeToolcraftPerformanceIteration" in verificationReceiptFacade,
+    false,
+  );
+});
+
+test("delivery anchor exposes only the current receipt boundary", async () => {
+  assert.deepEqual(Object.keys(deliveryAnchor).sort(), [
+    "getToolcraftDeliveryAnchorShapeError",
+    "normalizeToolcraftDeliveryAnchor",
+    "readToolcraftDeliveryAnchor",
+    "validateToolcraftDeliveryAnchor",
+  ]);
+  for (const obsolete of [
+    "toolcraft-delivery-baseline-policy.mjs",
+    "toolcraft-delivery-anchor-utils.mjs",
+    "toolcraft-delivery-anchor-verification.mjs",
+    "toolcraft-delivery-receipt-builder.mjs",
+    "toolcraft-linked-performance-authority.mjs",
+    "toolcraft-legacy-targeted-evidence.mjs",
+    "toolcraft-verification-receipt-core.mjs",
+  ]) {
+    await assert.rejects(
+      fs.access(path.join(import.meta.dirname, obsolete)),
+      /ENOENT/iu,
+    );
+  }
+});
+
+test("receipt file I/O exposes no generic protected receipt writer", () => {
+  assert.deepEqual(Object.keys(receiptFileIo), ["readToolcraftReceiptFile"]);
+});
+
+test("plan execution owns one exact evidence and authority boundary", async () => {
+  assert.deepEqual(
+    Object.keys(deliveryExecutor).sort(),
+    expectedDeliveryExecutorExports,
+  );
+  assert.deepEqual(
+    Object.keys(deliveryEvidence).sort(),
+    [
+      "getToolcraftExecutionEvidenceError",
+      "getToolcraftProofStepEvidenceError",
+    ],
+  );
+  assert.deepEqual(Object.keys(planExecutionAuthority), [
+    "createToolcraftPlanExecutionAuthorityRegistry",
+  ]);
+  assert.deepEqual(Object.keys(targetedPerformanceExecution).sort(), [
+    "executeToolcraftTargetedPerformanceVerification",
+    "executeToolcraftTargetedPerformanceVerificationCore",
+  ]);
+  assert.deepEqual(Object.keys(proofProcess).sort(), [
+    "captureToolcraftProofProcess",
+    "detectToolcraftPackageManager",
+    "ensureToolcraftChromium",
+    "getToolcraftBinaryPath",
+    "getToolcraftFrozenInstallCommand",
+    "runToolcraftProofPackageScript",
+    "runToolcraftProofProcess",
+  ]);
+  for (const obsolete of [
+    "toolcraft-targeted-evidence-policy.mjs",
+    "toolcraft-targeted-execution-authority.mjs",
+    "toolcraft-targeted-verification-execution.mjs",
+    "toolcraft-targeted-verification-runner.mjs",
+    "toolcraft-targeted-verification-selection.mjs",
+  ]) {
+    await assert.rejects(
+      fs.access(path.join(import.meta.dirname, obsolete)),
+      /ENOENT/iu,
+    );
+  }
+});
+
+test("short-lived proof execution imports cross-spawn only through the canonical adapter", async () => {
+  const rootDir = path.resolve(import.meta.dirname, "..");
+  const crossSpawnImporters = [
+    ...new Set(
+      (await collectCrossSpawnImportFacts(rootDir)).map(
+        ({ importerRepoPath }) => importerRepoPath,
+      ),
+    ),
+  ].sort();
+  assert.deepEqual(crossSpawnImporters, [
+    "scripts/run-kernel-benchmarks.mjs",
+    "scripts/run-vite-on-free-port.mjs",
+    "scripts/toolcraft-proof-process.mjs",
+  ]);
+  for (const obsolete of [
+    "toolcraft-delivery-command-runner.mjs",
+    "toolcraft-targeted-process-adapter.mjs",
+  ]) {
+    await assert.rejects(
+      fs.access(path.join(import.meta.dirname, obsolete)),
+      /ENOENT/iu,
+    );
+  }
+});
+
+test("cross-spawn import guard catches recursive structural bypass variants", async (t) => {
+  const rootDir = await fs.mkdtemp(
+    path.join(tmpdir(), "cross-spawn-import-fixture-"),
+  );
+  t.after(() => fs.rm(rootDir, { force: true, recursive: true }));
+  const sources = {
+    "scripts/nested/dynamic.mjs": "await import('cross-spawn');\n",
+    "scripts/nested/export.mjs":
+      'export { default } from "cross-spawn/lib/parse.js";\n',
+    "scripts/nested/require.cjs":
+      'require("cross-spawn/lib/util/escape.js");\n',
+    "scripts/nested/static.mjs": "import spawn from 'cross-spawn';\n",
+  };
+  for (const [repoPath, source] of Object.entries(sources)) {
+    const absolutePath = path.join(rootDir, repoPath);
+    await fs.mkdir(path.dirname(absolutePath), { recursive: true });
+    await fs.writeFile(absolutePath, source);
+  }
+
+  assert.deepEqual(
+    (await collectCrossSpawnImportFacts(rootDir)).map(
+      ({ category, importerRepoPath, specifier }) => ({
+        category,
+        importerRepoPath,
+        specifier,
+      }),
+    ),
+    [
+      {
+        category: "dynamic-import",
+        importerRepoPath: "scripts/nested/dynamic.mjs",
+        specifier: "cross-spawn",
+      },
+      {
+        category: "static-export",
+        importerRepoPath: "scripts/nested/export.mjs",
+        specifier: "cross-spawn/lib/parse.js",
+      },
+      {
+        category: "require",
+        importerRepoPath: "scripts/nested/require.cjs",
+        specifier: "cross-spawn/lib/util/escape.js",
+      },
+      {
+        category: "static-import",
+        importerRepoPath: "scripts/nested/static.mjs",
+        specifier: "cross-spawn",
+      },
+    ],
+  );
+});
+
+test("current performance evidence remains a dedicated receipt boundary", () => {
+  assert.deepEqual(
+    Object.keys(performanceReceiptPolicy).sort(),
+    expectedPerformanceReceiptPolicyExports,
+  );
+});
+
+test("receipt validators remain fail-closed without protected authority", async (t) => {
+  assert.match(getToolcraftDeliveryReceiptShapeError({}), /malformed/iu);
+  assert.match(getToolcraftPerformanceReceiptShapeError({}), /malformed/iu);
+
+  const rootDir = await createReceiptFixture();
+  t.after(() => fs.rm(rootDir, { force: true, recursive: true }));
+  assert.match(
+    (await validateToolcraftDeliveryReceipt({ rootDir }))[0],
+    /delivery receipt is missing/iu,
+  );
+  assert.match(
+    (await validateToolcraftPerformanceReceipt({ rootDir }))[0],
+    /performance receipt is missing/iu,
+  );
+  assert.match(
+    (await validateToolcraftVerificationReceipt({ rootDir }))[0],
+    /delivery receipt is missing/iu,
+  );
+});

package/templates/starter/scripts/toolcraft-receipt-file-io.mjs

@@ -0,0 +1,16 @@
+import fs from "node:fs/promises";
+
+export async function readToolcraftReceiptFile(receiptPath) {
+  let source;
+  try {
+    source = await fs.readFile(receiptPath, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return { missing: true };
+    throw error;
+  }
+  try {
+    return { receipt: JSON.parse(source) };
+  } catch {
+    return { malformed: true };
+  }
+}

package/templates/starter/scripts/toolcraft-source-inventory.mjs

@@ -83,6 +83,7 @@ export function collectToolcraftSourceInventorySync({
   frameworkPathPrefixes = ["src/toolcraft/"],
   generatedFilePatterns = defaultGeneratedFilePatterns,
   ignoredFilePatterns = [],
+  includeResourceFiles = false,
   protectedFilePaths = [],
   rootDir,
   sourceExtensions = toolcraftSourceExtensions,
@@ -131,7 +132,11 @@ export function collectToolcraftSourceInventorySync({
         continue;
       }
 
-      if (!entry.isFile() || !sourceExtensions.has(path.extname(entry.name))) {
+      if (
+        !entry.isFile() ||
+        (!includeResourceFiles &&
+          !sourceExtensions.has(path.extname(entry.name)))
+      ) {
         continue;
       }
 
@@ -185,3 +190,97 @@ export function collectToolcraftSourceInventorySync({
 export async function collectToolcraftSourceInventory(options) {
   return collectToolcraftSourceInventorySync(options);
 }
+
+function createResourceRootEscapeError(resourcePath, rootDir, reason) {
+  const error = new Error(
+    `Explicit resource path "${resourcePath}" ${reason} "${rootDir}".`,
+  );
+  error.code = "TOOLCRAFT_RESOURCE_ROOT_ESCAPE";
+  return error;
+}
+
+function pathEscapesRoot(rootPath, targetPath) {
+  const relativePath = path.relative(rootPath, targetPath);
+  return (
+    relativePath === ".." ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  );
+}
+
+function resolveExplicitResourcePath(resourcePath, rootDir) {
+  if (
+    typeof resourcePath !== "string" ||
+    path.isAbsolute(resourcePath) ||
+    path.posix.isAbsolute(resourcePath) ||
+    path.win32.isAbsolute(resourcePath)
+  ) {
+    throw createResourceRootEscapeError(
+      resourcePath,
+      rootDir,
+      "must be root-relative and stay within the configured root boundary",
+    );
+  }
+  const normalizedPath = path.posix.normalize(resourcePath.replaceAll("\\", "/"));
+  const absolutePath = path.resolve(rootDir, ...normalizedPath.split("/"));
+  if (
+    normalizedPath === ".." ||
+    normalizedPath.startsWith("../") ||
+    pathEscapesRoot(path.resolve(rootDir), absolutePath)
+  ) {
+    throw createResourceRootEscapeError(
+      resourcePath,
+      rootDir,
+      "is outside the configured root boundary",
+    );
+  }
+  return absolutePath;
+}
+
+export function createCanonicalGraphEntries({
+  entries,
+  explicitResourcePaths = [],
+  rootDir,
+}) {
+  const entriesByRepoPath = new Map(
+    entries.map((entry) => [
+      toPosixPath(entry.repoPath).replace(/^\.\//u, ""),
+      entry,
+    ]),
+  );
+  const rootRealPath =
+    explicitResourcePaths.length > 0 ? fs.realpathSync(rootDir) : undefined;
+
+  for (const resourcePath of explicitResourcePaths) {
+    const absolutePath = resolveExplicitResourcePath(resourcePath, rootDir);
+    const repoPath = toPosixPath(path.relative(rootDir, absolutePath));
+    if (entriesByRepoPath.has(repoPath)) continue;
+
+    let resourceStat;
+    try {
+      resourceStat = fs.lstatSync(absolutePath);
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw error;
+    }
+    if (!resourceStat.isFile() || resourceStat.isSymbolicLink()) continue;
+    const resourceRealPath = fs.realpathSync(absolutePath);
+    if (pathEscapesRoot(rootRealPath, resourceRealPath)) {
+      throw createResourceRootEscapeError(
+        resourcePath,
+        rootDir,
+        "resolves outside the root boundary for configured root",
+      );
+    }
+
+    entriesByRepoPath.set(repoPath, {
+      absolutePath,
+      repoPath,
+      ...classifyToolcraftSourcePath(repoPath),
+    });
+  }
+
+  return [...entriesByRepoPath.values()].sort((left, right) =>
+    compareCodeUnits(left.repoPath, right.repoPath),
+  );
+}

package/templates/starter/scripts/toolcraft-source-inventory.test.mjs

@@ -8,6 +8,7 @@ import {
   classifyToolcraftSourcePath,
   collectToolcraftSourceInventory,
   collectToolcraftSourceInventorySync,
+  createCanonicalGraphEntries,
 } from "./toolcraft-source-inventory.mjs";
 
 test("classifies platform, framework, product, test, and generated source", () => {
@@ -130,3 +131,108 @@ test("rejects a symbolic link used as a configured source root", async (context)
     },
   ]);
 });
+
+test("rejects a parent-relative explicit resource outside the root", async (context) => {
+  const fixtureDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "toolcraft-explicit-resource-relative-"),
+  );
+  context.after(() => fs.rm(fixtureDir, { force: true, recursive: true }));
+  const rootDir = path.join(fixtureDir, "app");
+  await fs.mkdir(rootDir);
+  await fs.writeFile(path.join(fixtureDir, "outside.ts"), "outside\n");
+
+  assert.throws(
+    () =>
+      createCanonicalGraphEntries({
+        entries: [],
+        explicitResourcePaths: ["../outside.ts"],
+        rootDir,
+      }),
+    (error) => {
+      assert.equal(error.code, "TOOLCRAFT_RESOURCE_ROOT_ESCAPE");
+      assert.match(error.message, /\.\.\/outside\.ts/u);
+      assert.match(error.message, /outside the configured root boundary/u);
+      return true;
+    },
+  );
+});
+
+test("rejects an absolute explicit resource path", async (context) => {
+  const fixtureDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "toolcraft-explicit-resource-absolute-"),
+  );
+  context.after(() => fs.rm(fixtureDir, { force: true, recursive: true }));
+  const rootDir = path.join(fixtureDir, "app");
+  const resourcePath = path.join(fixtureDir, "outside.ts");
+  await fs.mkdir(rootDir);
+  await fs.writeFile(resourcePath, "outside\n");
+
+  assert.throws(
+    () =>
+      createCanonicalGraphEntries({
+        entries: [],
+        explicitResourcePaths: [resourcePath],
+        rootDir,
+      }),
+    (error) => {
+      assert.equal(error.code, "TOOLCRAFT_RESOURCE_ROOT_ESCAPE");
+      assert.equal(error.message.includes(resourcePath), true);
+      assert.match(error.message, /must be root-relative/u);
+      return true;
+    },
+  );
+});
+
+test("rejects an explicit resource through a symlinked parent", async (context) => {
+  const fixtureDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "toolcraft-explicit-resource-symlink-"),
+  );
+  context.after(() => fs.rm(fixtureDir, { force: true, recursive: true }));
+  const rootDir = path.join(fixtureDir, "app");
+  const outsideDir = path.join(fixtureDir, "outside");
+  await fs.mkdir(rootDir);
+  await fs.mkdir(outsideDir);
+  await fs.writeFile(path.join(outsideDir, "resource.ts"), "outside\n");
+  try {
+    await fs.symlink(outsideDir, path.join(rootDir, "linked-parent"));
+  } catch (error) {
+    if (["EACCES", "ENOSYS", "EPERM"].includes(error?.code)) {
+      context.skip(`symbolic links are unavailable: ${error.code}`);
+      return;
+    }
+    throw error;
+  }
+
+  assert.throws(
+    () =>
+      createCanonicalGraphEntries({
+        entries: [],
+        explicitResourcePaths: ["linked-parent/resource.ts"],
+        rootDir,
+      }),
+    (error) => {
+      assert.equal(error.code, "TOOLCRAFT_RESOURCE_ROOT_ESCAPE");
+      assert.match(error.message, /linked-parent\/resource\.ts/u);
+      assert.match(error.message, /resolves outside the root boundary/u);
+      return true;
+    },
+  );
+});
+
+test("accepts an in-root explicit public resource", async (context) => {
+  const rootDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), "toolcraft-explicit-resource-valid-"),
+  );
+  context.after(() => fs.rm(rootDir, { force: true, recursive: true }));
+  await fs.mkdir(path.join(rootDir, "public"));
+  await fs.writeFile(path.join(rootDir, "public/preset.bin"), "preset\n");
+
+  assert.deepEqual(
+    createCanonicalGraphEntries({
+      entries: [],
+      explicitResourcePaths: ["public/preset.bin"],
+      rootDir,
+    }).map(({ repoPath }) => repoPath),
+    ["public/preset.bin"],
+  );
+});

package/templates/starter/scripts/toolcraft-source-ownership.mjs

@@ -2,6 +2,10 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import {
+  hasValidToolcraftIntegrityManifestSignature,
+} from "./toolcraft-integrity-manifest.mjs";
+
 export const toolcraftFrameworkOwnedSourceRoots = Object.freeze([
   "docs/toolcraft",
   "scripts",
@@ -26,10 +30,14 @@ export const toolcraftFrameworkOwnedRootFiles = Object.freeze([
 
 export const toolcraftProductOwnedGeneratedPaths = Object.freeze([
   "docs/toolcraft/agent-worklog.md",
+  "docs/toolcraft/workflow-observation.md",
+  "e2e/app-kernel-benchmarks.ts",
   "e2e/app-controls.spec.ts",
+  "e2e/app-performance-path-adapters.ts",
   "src/app/app-acceptance-data.ts",
   "src/app/app-composition.tsx",
   "src/app/app-performance.ts",
+  "src/app/app-verification-impact.json",
   "src/app/app-schema.test.ts",
   "src/app/app-schema.ts",
 ]);
@@ -130,8 +138,15 @@ export async function collectToolcraftFrameworkOwnedLocalPaths(rootDir) {
 
   try {
     const manifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+    if (
+      manifest.version !== 3 ||
+      !hasValidToolcraftIntegrityManifestSignature(manifest)
+    ) {
+      return [];
+    }
     return Object.keys(manifest.protectedFiles ?? {}).sort(compareCodeUnits);
   } catch (error) {
+    if (error instanceof SyntaxError) return [];
     if (error?.code !== "ENOENT") throw error;
   }
 

package/templates/starter/scripts/toolcraft-source-ownership.test.mjs

@@ -80,7 +80,7 @@ test("keeps the signed-manifest trust root small and inside canonical ownership"
 
   assert.ok(requiredProtectedTrustRootFilePaths.length > 0);
   assert.ok(
-    requiredProtectedTrustRootFilePaths.length <= 24,
+    requiredProtectedTrustRootFilePaths.length <= 28,
     `The trust root must stay small; received ${requiredProtectedTrustRootFilePaths.length} paths.`,
   );
   assert.equal(
@@ -96,8 +96,13 @@ test("keeps the signed-manifest trust root small and inside canonical ownership"
 
   const subsystemSentinels = [
     "AGENTS.md",
+    "e2e/app-performance.spec.ts",
+    "e2e/browser-performance-report.ts",
     "e2e/browser-runtime-evidence-reporter.ts",
+    "e2e/performance-pipeline-evidence.ts",
+    "e2e/toolcraft-product-test.ts",
     "scripts/check-toolcraft-integrity.mjs",
+    "scripts/run-delivery-verification.mjs",
     "scripts/toolcraft-integrity-policy.mjs",
     "scripts/toolcraft-source-ownership.mjs",
     "scripts/toolcraft-vitest-runtime-evidence-reporter.mjs",
@@ -110,4 +115,29 @@ test("keeps the signed-manifest trust root small and inside canonical ownership"
       `Trust root must retain the ${relativePath} sentinel.`,
     );
   }
+
+  // The required root names subsystem authorities. Their transitive modules stay
+  // protected by the complete signed framework inventory without becoming sentinels.
+  for (const relativePath of [
+    "e2e/browser-performance-evidence.ts",
+    "e2e/browser-model-import-evidence-helpers.ts",
+    "e2e/browser-orientation-gizmo-evidence-helpers.ts",
+    "e2e/browser-performance-measurement-evidence.ts",
+    "e2e/browser-performance-measurement-report.ts",
+    "e2e/performance-checkpoint-report.ts",
+    "e2e/performance-environment-evidence.ts",
+    "e2e/performance-helpers.ts",
+    "e2e/performance-measurement-evidence.ts",
+    "e2e/performance-path-adapter-contract.ts",
+    "e2e/performance-path-helpers.ts",
+    "e2e/performance-pipeline-invariants.ts",
+    "src/app/test-evidence/browser-performance-contract.ts",
+    "src/app/test-evidence/browser-performance-measurement-contract.ts",
+    "scripts/toolcraft-performance-report.mjs",
+  ]) {
+    assert.ok(
+      generatedPathSet.has(relativePath),
+      `Rich performance dependency must remain in the signed inventory: ${relativePath}`,
+    );
+  }
 });