@ran-sh/dsh-crew 1.9.0 → 1.10.0

package/src/client/surface-detection.mjs

@@ -1,43 +1,43 @@
-export const CREW_UI_SURFACES = Object.freeze({
-  OFFICIAL: 'official-bridge',
-  NATIVE: 'native-crew-harness',
-  UNKNOWN: 'unknown',
-});
-
-/**
- * Classify the current same-origin UI from explicit backend contracts. The
- * official bridge signal wins because its proxied runtime response correctly
- * describes the 3210 backend, not the browser-facing 3080 surface.
- */
-export function classifyCrewSurface({ bridgeStatus, runtime } = {}) {
-  if (bridgeStatus?.ok === true
-    && (bridgeStatus.surface === CREW_UI_SURFACES.OFFICIAL
-      || bridgeStatus.mode === 'official-3080-isolated-3210')) {
-    return CREW_UI_SURFACES.OFFICIAL;
-  }
-  if (runtime?.ok === true
-    && runtime.service === 'dsh-crew-hub'
-    && (runtime.surface === CREW_UI_SURFACES.NATIVE || runtime.surface === undefined)) {
-    return CREW_UI_SURFACES.NATIVE;
-  }
-  return CREW_UI_SURFACES.UNKNOWN;
-}
-
-/**
- * Surface capability model. The NATIVE 3210 Crew harness is the single full
- * control plane; the OFFICIAL 3080 surface is a narrow quick-controls panel
- * (total switch and the flash/pro model priority lists) plus a
- * deep link back to 3210. Unknown surfaces get diagnostics only — never write
- * authority. This replaces the old binary full-vs-minimal assumption.
- */
-export function surfaceResponsibilities(surface) {
-  switch (surface) {
-    case CREW_UI_SURFACES.NATIVE:
-      return { fullControlPlane: true, quickControlPlane: true, diagnostics: true };
-    case CREW_UI_SURFACES.OFFICIAL:
-      return { fullControlPlane: false, quickControlPlane: true, diagnostics: true };
-    default:
-      return { fullControlPlane: false, quickControlPlane: false, diagnostics: true };
-  }
-}
-
+export const CREW_UI_SURFACES = Object.freeze({
+  OFFICIAL: 'official-bridge',
+  NATIVE: 'native-crew-harness',
+  UNKNOWN: 'unknown',
+});
+
+/**
+ * Classify the current same-origin UI from explicit backend contracts. The
+ * official bridge signal wins because its proxied runtime response correctly
+ * describes the 3210 backend, not the browser-facing 3080 surface.
+ */
+export function classifyCrewSurface({ bridgeStatus, runtime } = {}) {
+  if (bridgeStatus?.ok === true
+    && (bridgeStatus.surface === CREW_UI_SURFACES.OFFICIAL
+      || bridgeStatus.mode === 'official-3080-isolated-3210')) {
+    return CREW_UI_SURFACES.OFFICIAL;
+  }
+  if (runtime?.ok === true
+    && runtime.service === 'dsh-crew-hub'
+    && (runtime.surface === CREW_UI_SURFACES.NATIVE || runtime.surface === undefined)) {
+    return CREW_UI_SURFACES.NATIVE;
+  }
+  return CREW_UI_SURFACES.UNKNOWN;
+}
+
+/**
+ * Surface capability model. The NATIVE 3210 Crew harness is the single full
+ * control plane; the OFFICIAL 3080 surface is a narrow quick-controls panel
+ * (total switch and the flash/pro model priority lists) plus a
+ * deep link back to 3210. Unknown surfaces get diagnostics only — never write
+ * authority. This replaces the old binary full-vs-minimal assumption.
+ */
+export function surfaceResponsibilities(surface) {
+  switch (surface) {
+    case CREW_UI_SURFACES.NATIVE:
+      return { fullControlPlane: true, quickControlPlane: true, diagnostics: true };
+    case CREW_UI_SURFACES.OFFICIAL:
+      return { fullControlPlane: false, quickControlPlane: true, diagnostics: true };
+    default:
+      return { fullControlPlane: false, quickControlPlane: false, diagnostics: true };
+  }
+}
+

package/src/config-readiness.mjs

@@ -1,226 +1,226 @@
-import { buildReadinessMatrix, READINESS_REASON_CODES } from './readiness-matrix.mjs';
-import { PRODUCTION_EXECUTION_PLANE, PRODUCTION_PROFILE, PRODUCTION_LISTEN_PORT } from './runtime-identity.mjs';
-
-function warningCodes(catalogBody) {
-  const hints = Array.isArray(catalogBody?.health?.hints) ? catalogBody.health.hints : [];
-  return [...new Set(hints
-    .filter((hint) => hint?.level === 'warning' && typeof hint?.code === 'string' && hint.code.trim())
-    .map((hint) => hint.code.trim()))];
-}
-
-function verifiedHubJob(job) {
-  const context = job?.execution_context;
-  return job?.status === 'done'
-    && job?.task_status === 'success'
-    && job?.delivery_complete === true
-    && job?.workspace_evidence_ok === true
-    && context?.execution_plane === PRODUCTION_EXECUTION_PLANE
-    && context?.profile === PRODUCTION_PROFILE
-    && Number(context?.listen_port) === PRODUCTION_LISTEN_PORT
-    && typeof context?.runtime_id === 'string'
-    && context.runtime_id.trim().length > 0;
-}
-
-function hasBlockingProviderRecovery(body, currentSelections) {
-  if (!Object.hasOwn(body, 'recovery_transactions')) return false;
-  if (!Array.isArray(body.recovery_transactions)) return true;
-  const selectedProviders = new Set(Object.values(currentSelections ?? {})
-    .filter((selection) => selection?.ok === true && typeof selection.provider === 'string')
-    .map((selection) => selection.provider));
-  return body.recovery_transactions.some((transaction) => transaction?.unresolved === true
-    || typeof transaction?.provider_id !== 'string'
-    || selectedProviders.has(transaction.provider_id));
-}
-
-function structurallyConsistentProviderInventory(body, currentSelections) {
-  if (!body || typeof body !== 'object' || body.ok === false || !Array.isArray(body.records)) return false;
-  if ('lifecycle_evidence' in body && body.lifecycle_evidence?.ok !== true) return false;
-  if ('declaration_evidence' in body && body.declaration_evidence?.ok !== true) return false;
-  if ('default_evidence' in body && body.default_evidence?.ok !== true) return false;
-  if (hasBlockingProviderRecovery(body, currentSelections)) return false;
-  return body.records.every((record) => {
-    if (!record || typeof record.id !== 'string' || record.id.trim() === '') return false;
-    if (!['present', 'absent'].includes(record.desired_state)) return false;
-    if (!record.lifecycle || typeof record.lifecycle !== 'object' || Array.isArray(record.lifecycle)) return false;
-    for (const field of ['installed', 'configured', 'enabled', 'catalogued']) {
-      if (typeof record.lifecycle[field] !== 'boolean') return false;
-    }
-    if (record.desired_state === 'absent' && record.lifecycle.enabled === true) return false;
-    return true;
-  });
-}
-
-function matchesCurrentRoute(job, currentSelections, role) {
-  if (!currentSelections) return true;
-  const selectionKey = role === 'worker'
-    && Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) > 0
-    && Object.hasOwn(currentSelections, 'worker_escalation')
-    ? 'worker_escalation'
-    : role;
-  if (!Object.hasOwn(currentSelections, selectionKey)) return true;
-  const selected = currentSelections[selectionKey];
-  return selected?.ok === true
-    && job?.provider === selected.provider
-    && job?.model === selected.model;
-}
-
-function safeDetailCode(value, fallback) {
-  return typeof value === 'string' && /^[A-Z][A-Z0-9_]{0,127}$/u.test(value) ? value : fallback;
-}
-
-function currentRouteHealthEvidence({ role, currentSelections, providerHealthChecked, providerHealthBody } = {}) {
-  if (!currentSelections || !Object.hasOwn(currentSelections, role)) return null;
-  const selected = currentSelections[role];
-  if (selected?.ok === false) {
-    return {
-      status: 'FAIL',
-      reason_code: 'PROVIDER_ROUTE_UNCALLABLE',
-      evidence_source: 'model-routing',
-      detail_code: safeDetailCode(selected.code, 'MODEL_ROUTE_UNAVAILABLE'),
-    };
-  }
-  if (!selected?.provider || !selected?.model || providerHealthChecked !== true) return null;
-  if (providerHealthBody?.ok === false) {
-    return { status: 'FAIL', reason_code: 'PROVIDER_HEALTH_UNAVAILABLE', evidence_source: 'provider-health' };
-  }
-  const health = Array.isArray(providerHealthBody?.health) ? providerHealthBody.health : [];
-  const observation = health.find((entry) => entry?.provider === selected.provider
-    && entry?.model === selected.model
-    && entry?.fresh === true);
-  if (!observation || observation.state === 'unprobed') return null;
-  if (observation.state === 'callable') {
-    return { status: 'PASS', reason_code: 'PROVIDER_ROUTE_CALLABLE', evidence_source: 'provider-health' };
-  }
-  const stateCode = String(observation.state ?? '').toUpperCase().replaceAll('-', '_');
-  return {
-    status: 'FAIL',
-    reason_code: 'PROVIDER_ROUTE_UNCALLABLE',
-    evidence_source: 'provider-health',
-    detail_code: safeDetailCode(observation.reason_code, safeDetailCode(stateCode, 'PROVIDER_UNCALLABLE')),
-  };
-}
-
-export function buildHubExecutionRows(hubJobs = [], { currentSelections = null } = {}) {
-  const jobs = Array.isArray(hubJobs) ? hubJobs : [];
-  const workerPassed = jobs.some((job) => job?.role === 'worker' && matchesCurrentRoute(job, currentSelections, 'worker') && verifiedHubJob(job));
-  const workerPrimaryPassed = jobs.some((job) => job?.role === 'worker'
-    && matchesCurrentRoute(job, currentSelections, 'worker')
-    && verifiedHubJob(job)
-    && Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) === 0);
-  const workerEscalationPassed = jobs.some((job) => job?.role === 'worker'
-    && matchesCurrentRoute(job, currentSelections, 'worker')
-    && verifiedHubJob(job)
-    && (Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) > 0));
-  const reviewerPassed = jobs.some((job) => job?.role === 'reviewer'
-    && matchesCurrentRoute(job, currentSelections, 'reviewer')
-    && verifiedHubJob(job)
-    && job?.review_verdict === 'approve');
-  return [
-    workerPassed
-      ? { id: 'model_execution', status: 'PASS', reason_code: 'REAL_EXECUTION_PASSED', evidence_source: 'hub-jobs' }
-      : { id: 'model_execution', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-    workerPrimaryPassed
-      ? { id: 'worker_primary_callable', status: 'PASS', reason_code: 'WORKER_PRIMARY_CALLABLE', evidence_source: 'hub-jobs' }
-      : { id: 'worker_primary_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-    workerEscalationPassed
-      ? { id: 'worker_escalation_callable', status: 'PASS', reason_code: 'WORKER_ESCALATION_CALLABLE', evidence_source: 'hub-jobs' }
-      : { id: 'worker_escalation_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-    reviewerPassed
-      ? { id: 'reviewer_primary_callable', status: 'PASS', reason_code: 'REVIEWER_PRIMARY_CALLABLE', evidence_source: 'hub-jobs' }
-      : { id: 'reviewer_primary_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-    { id: 'provider_lifecycle_consistent', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-    reviewerPassed
-      ? { id: 'reviewer_pipeline', status: 'PASS', reason_code: 'REAL_REVIEW_PASSED', evidence_source: 'hub-jobs' }
-      : { id: 'reviewer_pipeline', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
-  ];
-}
-
-/**
- * Enrich the conservative runtime matrix with evidence the config report has
- * already collected. This function performs no I/O and never reads provider
- * configuration, credentials, quotas, pricing, or hidden catalog expectations.
- */
-export function buildConfigReadinessMatrix({
-  platform = process.platform,
-  hubCompatibility = null,
-  workerProviderMode = null,
-  providerCatalogChecked = false,
-  providerCatalogBody = null,
-  providerInventoryChecked = false,
-  providerInventoryBody = null,
-  providerHealthChecked = false,
-  providerHealthBody = null,
-  hubJobsChecked = false,
-  hubJobsBody = null,
-  currentSelections = null,
-} = {}) {
-  const warnings = warningCodes(providerCatalogBody);
-  const catalogResponseOk = !!providerCatalogBody
-    && typeof providerCatalogBody === 'object'
-    && providerCatalogBody.ok !== false;
-  const catalogOk = providerCatalogChecked && catalogResponseOk && warnings.length === 0;
-
-  const evidence = {};
-  const hubJobs = hubCompatibility?.compatible === true
-    && hubJobsChecked
-    && hubJobsBody?.ok !== false
-    && Array.isArray(hubJobsBody?.jobs)
-    ? hubJobsBody.jobs
-    : [];
-  for (const row of buildHubExecutionRows(hubJobs, { currentSelections })) {
-    if (row.status === 'PASS') {
-      evidence[row.id] = {
-        status: row.status,
-        reason_code: row.reason_code,
-        evidence_source: row.evidence_source,
-      };
-    }
-  }
-  if (
-    workerProviderMode !== 'deepseek-official'
-    && hubCompatibility?.compatible === true
-    && providerCatalogChecked
-    && catalogResponseOk
-    && warnings.length > 0
-  ) {
-    evidence.provider_catalog = {
-      status: 'FAIL',
-      reason_code: READINESS_REASON_CODES.PROVIDER_CATALOG_HEALTH_WARNING,
-      evidence_source: 'harness-catalog',
-    };
-  }
-
-  if (providerInventoryChecked) {
-    evidence.provider_lifecycle_consistent = structurallyConsistentProviderInventory(providerInventoryBody, currentSelections)
-      ? { status: 'PASS', reason_code: READINESS_REASON_CODES.PROVIDER_LIFECYCLE_CONSISTENT, evidence_source: 'provider-inventory' }
-      : {
-          status: 'FAIL',
-          reason_code: providerInventoryBody?.ok === false
-            ? READINESS_REASON_CODES.PROVIDER_INVENTORY_UNAVAILABLE
-            : READINESS_REASON_CODES.PROVIDER_LIFECYCLE_INCONSISTENT,
-          evidence_source: 'provider-inventory',
-        };
-  }
-
-  for (const [role, rowId] of [['worker', 'provider_health'], ['reviewer', 'reviewer_health']]) {
-    const healthEvidence = currentRouteHealthEvidence({ role, currentSelections, providerHealthChecked, providerHealthBody });
-    if (healthEvidence) evidence[rowId] = healthEvidence;
-  }
-
-  const matrix = buildReadinessMatrix({
-    platform,
-    hubCompatibility,
-    workerProviderMode,
-    providerCatalogChecked,
-    providerCatalogOk: catalogOk,
-    evidence,
-  });
-
-  if (warnings.length === 0) return matrix;
-  return {
-    ...matrix,
-    rows: matrix.rows.map((row) => row.id === 'provider_catalog'
-      ? { ...row, detail_codes: warnings }
-      : row),
-  };
-}
+import { buildReadinessMatrix, READINESS_REASON_CODES } from './readiness-matrix.mjs';
+import { PRODUCTION_EXECUTION_PLANE, PRODUCTION_PROFILE, PRODUCTION_LISTEN_PORT } from './runtime-identity.mjs';
+
+function warningCodes(catalogBody) {
+  const hints = Array.isArray(catalogBody?.health?.hints) ? catalogBody.health.hints : [];
+  return [...new Set(hints
+    .filter((hint) => hint?.level === 'warning' && typeof hint?.code === 'string' && hint.code.trim())
+    .map((hint) => hint.code.trim()))];
+}
+
+function verifiedHubJob(job) {
+  const context = job?.execution_context;
+  return job?.status === 'done'
+    && job?.task_status === 'success'
+    && job?.delivery_complete === true
+    && job?.workspace_evidence_ok === true
+    && context?.execution_plane === PRODUCTION_EXECUTION_PLANE
+    && context?.profile === PRODUCTION_PROFILE
+    && Number(context?.listen_port) === PRODUCTION_LISTEN_PORT
+    && typeof context?.runtime_id === 'string'
+    && context.runtime_id.trim().length > 0;
+}
+
+function hasBlockingProviderRecovery(body, currentSelections) {
+  if (!Object.hasOwn(body, 'recovery_transactions')) return false;
+  if (!Array.isArray(body.recovery_transactions)) return true;
+  const selectedProviders = new Set(Object.values(currentSelections ?? {})
+    .filter((selection) => selection?.ok === true && typeof selection.provider === 'string')
+    .map((selection) => selection.provider));
+  return body.recovery_transactions.some((transaction) => transaction?.unresolved === true
+    || typeof transaction?.provider_id !== 'string'
+    || selectedProviders.has(transaction.provider_id));
+}
+
+function structurallyConsistentProviderInventory(body, currentSelections) {
+  if (!body || typeof body !== 'object' || body.ok === false || !Array.isArray(body.records)) return false;
+  if ('lifecycle_evidence' in body && body.lifecycle_evidence?.ok !== true) return false;
+  if ('declaration_evidence' in body && body.declaration_evidence?.ok !== true) return false;
+  if ('default_evidence' in body && body.default_evidence?.ok !== true) return false;
+  if (hasBlockingProviderRecovery(body, currentSelections)) return false;
+  return body.records.every((record) => {
+    if (!record || typeof record.id !== 'string' || record.id.trim() === '') return false;
+    if (!['present', 'absent'].includes(record.desired_state)) return false;
+    if (!record.lifecycle || typeof record.lifecycle !== 'object' || Array.isArray(record.lifecycle)) return false;
+    for (const field of ['installed', 'configured', 'enabled', 'catalogued']) {
+      if (typeof record.lifecycle[field] !== 'boolean') return false;
+    }
+    if (record.desired_state === 'absent' && record.lifecycle.enabled === true) return false;
+    return true;
+  });
+}
+
+function matchesCurrentRoute(job, currentSelections, role) {
+  if (!currentSelections) return true;
+  const selectionKey = role === 'worker'
+    && Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) > 0
+    && Object.hasOwn(currentSelections, 'worker_escalation')
+    ? 'worker_escalation'
+    : role;
+  if (!Object.hasOwn(currentSelections, selectionKey)) return true;
+  const selected = currentSelections[selectionKey];
+  return selected?.ok === true
+    && job?.provider === selected.provider
+    && job?.model === selected.model;
+}
+
+function safeDetailCode(value, fallback) {
+  return typeof value === 'string' && /^[A-Z][A-Z0-9_]{0,127}$/u.test(value) ? value : fallback;
+}
+
+function currentRouteHealthEvidence({ role, currentSelections, providerHealthChecked, providerHealthBody } = {}) {
+  if (!currentSelections || !Object.hasOwn(currentSelections, role)) return null;
+  const selected = currentSelections[role];
+  if (selected?.ok === false) {
+    return {
+      status: 'FAIL',
+      reason_code: 'PROVIDER_ROUTE_UNCALLABLE',
+      evidence_source: 'model-routing',
+      detail_code: safeDetailCode(selected.code, 'MODEL_ROUTE_UNAVAILABLE'),
+    };
+  }
+  if (!selected?.provider || !selected?.model || providerHealthChecked !== true) return null;
+  if (providerHealthBody?.ok === false) {
+    return { status: 'FAIL', reason_code: 'PROVIDER_HEALTH_UNAVAILABLE', evidence_source: 'provider-health' };
+  }
+  const health = Array.isArray(providerHealthBody?.health) ? providerHealthBody.health : [];
+  const observation = health.find((entry) => entry?.provider === selected.provider
+    && entry?.model === selected.model
+    && entry?.fresh === true);
+  if (!observation || observation.state === 'unprobed') return null;
+  if (observation.state === 'callable') {
+    return { status: 'PASS', reason_code: 'PROVIDER_ROUTE_CALLABLE', evidence_source: 'provider-health' };
+  }
+  const stateCode = String(observation.state ?? '').toUpperCase().replaceAll('-', '_');
+  return {
+    status: 'FAIL',
+    reason_code: 'PROVIDER_ROUTE_UNCALLABLE',
+    evidence_source: 'provider-health',
+    detail_code: safeDetailCode(observation.reason_code, safeDetailCode(stateCode, 'PROVIDER_UNCALLABLE')),
+  };
+}
+
+export function buildHubExecutionRows(hubJobs = [], { currentSelections = null } = {}) {
+  const jobs = Array.isArray(hubJobs) ? hubJobs : [];
+  const workerPassed = jobs.some((job) => job?.role === 'worker' && matchesCurrentRoute(job, currentSelections, 'worker') && verifiedHubJob(job));
+  const workerPrimaryPassed = jobs.some((job) => job?.role === 'worker'
+    && matchesCurrentRoute(job, currentSelections, 'worker')
+    && verifiedHubJob(job)
+    && Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) === 0);
+  const workerEscalationPassed = jobs.some((job) => job?.role === 'worker'
+    && matchesCurrentRoute(job, currentSelections, 'worker')
+    && verifiedHubJob(job)
+    && (Number(job?.attempt ?? job?.selection_trace?.logical_attempt ?? 0) > 0));
+  const reviewerPassed = jobs.some((job) => job?.role === 'reviewer'
+    && matchesCurrentRoute(job, currentSelections, 'reviewer')
+    && verifiedHubJob(job)
+    && job?.review_verdict === 'approve');
+  return [
+    workerPassed
+      ? { id: 'model_execution', status: 'PASS', reason_code: 'REAL_EXECUTION_PASSED', evidence_source: 'hub-jobs' }
+      : { id: 'model_execution', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+    workerPrimaryPassed
+      ? { id: 'worker_primary_callable', status: 'PASS', reason_code: 'WORKER_PRIMARY_CALLABLE', evidence_source: 'hub-jobs' }
+      : { id: 'worker_primary_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+    workerEscalationPassed
+      ? { id: 'worker_escalation_callable', status: 'PASS', reason_code: 'WORKER_ESCALATION_CALLABLE', evidence_source: 'hub-jobs' }
+      : { id: 'worker_escalation_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+    reviewerPassed
+      ? { id: 'reviewer_primary_callable', status: 'PASS', reason_code: 'REVIEWER_PRIMARY_CALLABLE', evidence_source: 'hub-jobs' }
+      : { id: 'reviewer_primary_callable', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+    { id: 'provider_lifecycle_consistent', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+    reviewerPassed
+      ? { id: 'reviewer_pipeline', status: 'PASS', reason_code: 'REAL_REVIEW_PASSED', evidence_source: 'hub-jobs' }
+      : { id: 'reviewer_pipeline', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE', evidence_source: 'none' },
+  ];
+}
+
+/**
+ * Enrich the conservative runtime matrix with evidence the config report has
+ * already collected. This function performs no I/O and never reads provider
+ * configuration, credentials, quotas, pricing, or hidden catalog expectations.
+ */
+export function buildConfigReadinessMatrix({
+  platform = process.platform,
+  hubCompatibility = null,
+  workerProviderMode = null,
+  providerCatalogChecked = false,
+  providerCatalogBody = null,
+  providerInventoryChecked = false,
+  providerInventoryBody = null,
+  providerHealthChecked = false,
+  providerHealthBody = null,
+  hubJobsChecked = false,
+  hubJobsBody = null,
+  currentSelections = null,
+} = {}) {
+  const warnings = warningCodes(providerCatalogBody);
+  const catalogResponseOk = !!providerCatalogBody
+    && typeof providerCatalogBody === 'object'
+    && providerCatalogBody.ok !== false;
+  const catalogOk = providerCatalogChecked && catalogResponseOk && warnings.length === 0;
+
+  const evidence = {};
+  const hubJobs = hubCompatibility?.compatible === true
+    && hubJobsChecked
+    && hubJobsBody?.ok !== false
+    && Array.isArray(hubJobsBody?.jobs)
+    ? hubJobsBody.jobs
+    : [];
+  for (const row of buildHubExecutionRows(hubJobs, { currentSelections })) {
+    if (row.status === 'PASS') {
+      evidence[row.id] = {
+        status: row.status,
+        reason_code: row.reason_code,
+        evidence_source: row.evidence_source,
+      };
+    }
+  }
+  if (
+    workerProviderMode !== 'deepseek-official'
+    && hubCompatibility?.compatible === true
+    && providerCatalogChecked
+    && catalogResponseOk
+    && warnings.length > 0
+  ) {
+    evidence.provider_catalog = {
+      status: 'FAIL',
+      reason_code: READINESS_REASON_CODES.PROVIDER_CATALOG_HEALTH_WARNING,
+      evidence_source: 'harness-catalog',
+    };
+  }
+
+  if (providerInventoryChecked) {
+    evidence.provider_lifecycle_consistent = structurallyConsistentProviderInventory(providerInventoryBody, currentSelections)
+      ? { status: 'PASS', reason_code: READINESS_REASON_CODES.PROVIDER_LIFECYCLE_CONSISTENT, evidence_source: 'provider-inventory' }
+      : {
+          status: 'FAIL',
+          reason_code: providerInventoryBody?.ok === false
+            ? READINESS_REASON_CODES.PROVIDER_INVENTORY_UNAVAILABLE
+            : READINESS_REASON_CODES.PROVIDER_LIFECYCLE_INCONSISTENT,
+          evidence_source: 'provider-inventory',
+        };
+  }
+
+  for (const [role, rowId] of [['worker', 'provider_health'], ['reviewer', 'reviewer_health']]) {
+    const healthEvidence = currentRouteHealthEvidence({ role, currentSelections, providerHealthChecked, providerHealthBody });
+    if (healthEvidence) evidence[rowId] = healthEvidence;
+  }
+
+  const matrix = buildReadinessMatrix({
+    platform,
+    hubCompatibility,
+    workerProviderMode,
+    providerCatalogChecked,
+    providerCatalogOk: catalogOk,
+    evidence,
+  });
+
+  if (warnings.length === 0) return matrix;
+  return {
+    ...matrix,
+    rows: matrix.rows.map((row) => row.id === 'provider_catalog'
+      ? { ...row, detail_codes: warnings }
+      : row),
+  };
+}

package/src/credential-reference.mjs

@@ -1,38 +1,38 @@
-// Credential references are identifiers, never credential values. Keep this
-// boundary strict because provider metadata is returned to the browser/UI.
-
-const ENV_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
-const HANDLE_REFERENCE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
-const SECRET_LIKE = /^(?:sk|pk|rk|sess|tok|token|key|secret)[_-]/iu;
-const EMBEDDED_SECRET = /(?:^|\s)(?:bearer|basic)\s+|(?:https?|data):|=/iu;
-
-function rawText(value) {
-  if (typeof value === 'string') return value.trim() || null;
-  if (value && typeof value === 'object') {
-    const candidate = value.name_or_handle ?? value.name ?? value.reference;
-    return typeof candidate === 'string' ? candidate.trim() || null : null;
-  }
-  return null;
-}
-
-/**
- * Classify a reference without returning an unsafe value. `kind: env` is the
- * common apiKeyEnv form; non-env stores may use a bounded opaque handle.
- */
-export function classifyCredentialReference(value, { kind = 'env' } = {}) {
-  const raw = rawText(value);
-  if (!raw) return { present: false, value: null, redacted: false };
-  const normalizedKind = typeof kind === 'string' ? kind.trim().toLowerCase() : 'env';
-  const valid = normalizedKind === 'env'
-    ? ENV_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw)
-    : HANDLE_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw);
-  return { present: true, value: valid ? raw : null, redacted: !valid };
-}
-
-export function sanitizeCredentialReference(value, options = {}) {
-  return classifyCredentialReference(value, options).value;
-}
-
-export function hasCredentialReference(value, options = {}) {
-  return classifyCredentialReference(value, options).present;
-}
+// Credential references are identifiers, never credential values. Keep this
+// boundary strict because provider metadata is returned to the browser/UI.
+
+const ENV_REFERENCE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+const HANDLE_REFERENCE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const SECRET_LIKE = /^(?:sk|pk|rk|sess|tok|token|key|secret)[_-]/iu;
+const EMBEDDED_SECRET = /(?:^|\s)(?:bearer|basic)\s+|(?:https?|data):|=/iu;
+
+function rawText(value) {
+  if (typeof value === 'string') return value.trim() || null;
+  if (value && typeof value === 'object') {
+    const candidate = value.name_or_handle ?? value.name ?? value.reference;
+    return typeof candidate === 'string' ? candidate.trim() || null : null;
+  }
+  return null;
+}
+
+/**
+ * Classify a reference without returning an unsafe value. `kind: env` is the
+ * common apiKeyEnv form; non-env stores may use a bounded opaque handle.
+ */
+export function classifyCredentialReference(value, { kind = 'env' } = {}) {
+  const raw = rawText(value);
+  if (!raw) return { present: false, value: null, redacted: false };
+  const normalizedKind = typeof kind === 'string' ? kind.trim().toLowerCase() : 'env';
+  const valid = normalizedKind === 'env'
+    ? ENV_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw)
+    : HANDLE_REFERENCE.test(raw) && !SECRET_LIKE.test(raw) && !EMBEDDED_SECRET.test(raw);
+  return { present: true, value: valid ? raw : null, redacted: !valid };
+}
+
+export function sanitizeCredentialReference(value, options = {}) {
+  return classifyCredentialReference(value, options).value;
+}
+
+export function hasCredentialReference(value, options = {}) {
+  return classifyCredentialReference(value, options).present;
+}