@riddledc/riddle-proof 0.5.0 → 0.5.2

package/runtime/lib/author.py

@@ -0,0 +1,343 @@
+"""Author: prepare or apply the supervising agent's proof packet.
+
+This stage no longer delegates proof authoring to an embedded alternate model.
+Instead it does two things:
+- distill recon state into a structured request for the supervising agent
+- normalize and persist a supervisor-supplied proof packet for later stages
+"""
+
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from util import load_state, save_state
+
+
+RUNTIME_MODEL_HINT = (
+    os.environ.get('RIDDLE_PROOF_AUTHOR_RUNTIME_MODEL', '').strip()
+    or os.environ.get('OPENCLAW_MODEL', '').strip()
+    or os.environ.get('OPENCLAW_DEFAULT_MODEL', '').strip()
+    or os.environ.get('OPENCLAW_RUNTIME_MODEL', '').strip()
+    or os.environ.get('AGENT_MODEL', '').strip()
+    or os.environ.get('DEFAULT_MODEL', '').strip()
+    or os.environ.get('MODEL', '').strip()
+)
+
+
+def normalize_path(value):
+    path = (value or '').strip()
+    if not path:
+        return ''
+    if not path.startswith('/'):
+        path = '/' + path
+    return path
+
+
+def first_non_empty(*values):
+    for value in values:
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    return ''
+
+
+def sanitize_rationale(value):
+    if isinstance(value, str):
+        value = [value]
+    if not isinstance(value, list):
+        return []
+    out = []
+    for item in value:
+        if isinstance(item, str) and item.strip():
+            out.append(item.strip())
+    return out[:6]
+
+
+def recon_baseline_understanding(state):
+    assessment = state.get('recon_assessment') or {}
+    understanding = assessment.get('baseline_understanding') or state.get('recon_baseline_understanding') or {}
+    return understanding if isinstance(understanding, dict) else {}
+
+
+def authored_capture_script(existing_script, wait_for_selector=''):
+    script = (existing_script or '').strip()
+    if script:
+        return script
+    steps = ['await page.waitForTimeout(1500);']
+    selector = (wait_for_selector or '').strip()
+    if selector:
+        steps.append('await page.waitForSelector(' + json.dumps(selector) + ');')
+    steps.append("await saveScreenshot('after-proof');")
+    return ' '.join(steps)
+
+
+def authored_proof_plan(state, reference, target_path, baselines, wait_for_selector=''):
+    existing = (state.get('proof_plan') or '').strip()
+    if existing:
+        return existing
+
+    lines = []
+    change_request = (state.get('change_request') or '').strip()
+    success_criteria = (state.get('success_criteria') or '').strip()
+    verification_mode = (state.get('verification_mode') or 'proof').strip() or 'proof'
+
+    if change_request:
+        lines.append('Goal: ' + change_request)
+    lines.append('Verification mode: ' + verification_mode)
+    if success_criteria:
+        lines.append('Success criteria: ' + success_criteria)
+    lines.append('Target route: ' + (target_path or '/'))
+    lines.append('Reference baseline: ' + reference)
+    if baselines.get('before', {}).get('url'):
+        lines.append('Reuse recon before baseline: ' + baselines['before']['url'])
+    if baselines.get('prod', {}).get('url'):
+        lines.append('Reuse recon prod baseline: ' + baselines['prod']['url'])
+    baseline_understanding = recon_baseline_understanding(state)
+    visible_before = (baseline_understanding.get('visible_before_state') or '').strip()
+    proof_focus = (baseline_understanding.get('proof_focus') or '').strip()
+    stop_condition = (baseline_understanding.get('stop_condition') or '').strip()
+    if visible_before:
+        lines.append('Observed before state: ' + visible_before)
+    if proof_focus:
+        lines.append('Proof focus: ' + proof_focus)
+    if stop_condition:
+        lines.append('Stop condition: ' + stop_condition)
+    if wait_for_selector:
+        lines.append('Stabilize capture on selector: ' + wait_for_selector)
+    lines.append('After evidence should load the recon-confirmed route and collect the evidence type required by verification_mode without rediscovering baseline context.')
+    lines.append('For visual modes this usually means a stable screenshot; for data, audio, log, metric, or custom modes it may mean structured proofEvidence, JSON artifacts, console observations, or assertions.')
+    lines.append('Revise this draft only when the supervising agent concludes the proof needs richer interactions, better sense data, or tighter framing.')
+    return '\n'.join(lines)
+
+
+def author_request_payload(state, reference, baselines, current_plan, hypothesis, fallback_path, fallback_selector):
+    recon_results = state.get('recon_results') or {}
+    attempt_history = recon_results.get('attempt_history') or []
+    trimmed_attempts = []
+    for item in attempt_history[-3:]:
+        trimmed_attempts.append({
+            'attempt': item.get('attempt'),
+            'result': item.get('result'),
+            'plan': item.get('plan'),
+            'observations': item.get('observations'),
+        })
+
+    fallback_capture_script = authored_capture_script(state.get('capture_script'), fallback_selector)
+    fallback_proof_plan = authored_proof_plan(state, reference, fallback_path, baselines, fallback_selector)
+
+    return {
+        'status': 'needs_supervisor_judgment',
+        'goal': (state.get('change_request') or '').strip(),
+        'success_criteria': (state.get('success_criteria') or '').strip(),
+        'verification_mode': (state.get('verification_mode') or 'proof').strip() or 'proof',
+        'reference': reference,
+        'baseline_understanding': recon_baseline_understanding(state),
+        'observed_baselines': baselines,
+        'current_plan': current_plan or {},
+        'hypothesis': hypothesis or {},
+        'route_hints': (state.get('author_request') or {}).get('route_hints') or recon_results.get('route_hints') or [],
+        'keyword_hits': (state.get('author_request') or {}).get('keyword_hits') or recon_results.get('keyword_hits') or [],
+        'recon_summary': (state.get('recon_summary') or '').strip(),
+        'attempt_history_tail': trimmed_attempts,
+        'fallback_defaults': {
+            'server_path': fallback_path,
+            'wait_for_selector': fallback_selector,
+            'capture_script': fallback_capture_script,
+            'proof_plan': fallback_proof_plan,
+        },
+        'instructions': [
+            'The supervising agent owns proof authoring. Use the recon-confirmed route and baselines instead of inventing a new context.',
+            'Treat baseline_understanding as the required before-state review. The proof plan must name the observed before state, requested delta, and stop condition.',
+            'Return the authored packet via author_packet_json when possible. You may also set proof_plan, capture_script, server_path, and wait_for_selector directly.',
+            'Keep capture_script concise Playwright statements.',
+            'For visual/UI proof, include saveScreenshot(\'after-proof\') exactly once.',
+            'For data/audio/log/metric/custom proof, screenshots are optional; set window.__riddleProofEvidence inside page.evaluate to a JSON-serializable object with the measured observations the verifier should judge.',
+            'Do not assign globalThis.__riddleProofEvidence, window.__riddleProofEvidence, or self.__riddleProofEvidence outside page.evaluate; the Riddle worker context may not expose those globals safely.',
+            'Do not begin capture_script with page.goto unless an in-app navigation is genuinely required after the preview opens the target route.',
+            'Only escalate to the human after the supervising agent concludes the workflow is genuinely stuck or not converging.',
+        ],
+        'response_schema': {
+            'proof_plan': 'string',
+            'capture_script': 'string',
+            'baseline_understanding_used': {
+                'reference': 'before | prod | both | unknown',
+                'target_route': 'string',
+                'before_evidence_url': 'string',
+                'visible_before_state': 'string',
+                'relevant_elements': ['string'],
+                'requested_change': 'string',
+                'proof_focus': 'string',
+                'stop_condition': 'string',
+                'quality_risks': ['string'],
+            },
+            'refined_inputs': {
+                'server_path': 'string',
+                'wait_for_selector': 'string',
+                'reference': 'string',
+            },
+            'rationale': ['string'],
+            'confidence': 'high | medium | low',
+            'summary': 'string',
+        },
+    }
+
+
+s = load_state()
+if s.get('recon_status') not in ('ready_for_proof_plan', 'completed'):
+    raise SystemExit('Recon is not ready for proof authoring. Run recon until it produces a usable observation packet first.')
+
+recon_results = s.get('recon_results') or {}
+author_request = s.get('author_request') or s.get('proof_plan_request') or {}
+baselines = (author_request.get('observed_baselines') or recon_results.get('baselines') or {})
+current_plan = author_request.get('current_plan') or recon_results.get('current_plan') or {}
+hypothesis = author_request.get('hypothesis') or s.get('recon_hypothesis') or {}
+reference = s.get('requested_reference') or s.get('reference') or author_request.get('reference') or 'before'
+
+before_path = ((baselines.get('before') or {}).get('path') or '').strip()
+prod_path = ((baselines.get('prod') or {}).get('path') or '').strip()
+current_path = (current_plan.get('target_path') or '').strip()
+hypothesis_path = (hypothesis.get('target_path') or '').strip()
+existing_path = (s.get('server_path') or '').strip()
+default_path = normalize_path(first_non_empty(before_path, prod_path, current_path, hypothesis_path, existing_path, '/')) or '/'
+
+default_selector = first_non_empty((s.get('wait_for_selector') or '').strip(), (current_plan.get('wait_for_selector') or '').strip())
+default_proof_plan = authored_proof_plan(s, reference, default_path, baselines, default_selector)
+default_capture_script = authored_capture_script(s.get('capture_script'), default_selector)
+
+supervisor_packet = s.get('supervisor_author_packet') or {}
+if not isinstance(supervisor_packet, dict):
+    supervisor_packet = {}
+
+provided_payload = {
+    'proof_plan': first_non_empty(supervisor_packet.get('proof_plan'), s.get('proof_plan')),
+    'capture_script': first_non_empty(supervisor_packet.get('capture_script'), s.get('capture_script')),
+    'baseline_understanding_used': supervisor_packet.get('baseline_understanding_used') or recon_baseline_understanding(s),
+    'refined_inputs': supervisor_packet.get('refined_inputs') or {},
+    'rationale': supervisor_packet.get('rationale', s.get('supervisor_author_rationale', [])),
+    'confidence': first_non_empty(supervisor_packet.get('confidence'), s.get('supervisor_author_confidence'), 'medium').lower(),
+    'summary': first_non_empty(supervisor_packet.get('summary'), s.get('supervisor_author_summary')),
+}
+
+has_supervisor_packet = bool(provided_payload['proof_plan']) and bool(provided_payload['capture_script'])
+
+if not has_supervisor_packet:
+    s['stage'] = 'author'
+    s['author_status'] = 'needs_supervisor_judgment'
+    s['proof_plan_status'] = 'needs_supervisor_judgment'
+    s['author_mode'] = 'supervisor_request'
+    s['author_model'] = 'supervising-agent'
+    s['author_confidence'] = 'pending'
+    s['author_rationale'] = []
+    s['author_warnings'] = []
+    s['author_runtime_model_hint'] = RUNTIME_MODEL_HINT
+    s['author_summary'] = 'Awaiting supervising agent proof packet for recon-confirmed route ' + default_path
+    s['proof_assessment'] = s.get('proof_assessment') or {}
+    s['author_request'] = author_request_payload(s, reference, baselines, current_plan, hypothesis, default_path, default_selector)
+    s['proof_plan_request'] = s['author_request']
+    save_state(s)
+
+    print('AUTHOR')
+    print('=' * 50)
+    print('Proof plan ready: no')
+    print('Capture script ready: no')
+    print('Authoring owner: supervising agent')
+    print('Target path draft: ' + default_path)
+    print('Wait for selector draft: ' + (default_selector or '(none)'))
+    print(json.dumps({
+        'ok': True,
+        'author_status': s['author_status'],
+        'proof_plan_status': s['proof_plan_status'],
+        'author_mode': s['author_mode'],
+        'author_model': s['author_model'],
+        'server_path': default_path,
+        'wait_for_selector': default_selector,
+    }, indent=2))
+    raise SystemExit(0)
+
+refined = provided_payload['refined_inputs'] if isinstance(provided_payload['refined_inputs'], dict) else {}
+refined_path = normalize_path(first_non_empty(refined.get('server_path'), s.get('server_path'), default_path)) or '/'
+refined_selector = first_non_empty(refined.get('wait_for_selector'), s.get('wait_for_selector'), default_selector)
+refined_reference = first_non_empty(refined.get('reference'), reference) or reference
+confidence = provided_payload['confidence'] if provided_payload['confidence'] in ('high', 'medium', 'low') else 'medium'
+rationale = sanitize_rationale(provided_payload['rationale'])
+summary = provided_payload['summary'] or 'Supervising agent supplied the proof packet from recon observations.'
+
+authored_packet = {
+    'proof_plan': provided_payload['proof_plan'],
+    'capture_script': provided_payload['capture_script'],
+    'baseline_understanding_used': provided_payload['baseline_understanding_used'] if isinstance(provided_payload['baseline_understanding_used'], dict) else {},
+    'refined_inputs': {
+        'server_path': refined_path,
+        'wait_for_selector': refined_selector,
+        'reference': refined_reference,
+    },
+    'rationale': rationale,
+    'confidence': confidence,
+    'mode': 'supervising_agent',
+    'model': ('supervising-agent:' + RUNTIME_MODEL_HINT) if RUNTIME_MODEL_HINT else 'supervising-agent',
+    'summary': summary,
+}
+
+s['server_path'] = refined_path
+if refined_selector:
+    s['wait_for_selector'] = refined_selector
+elif s.get('wait_for_selector'):
+    s['wait_for_selector'] = ''
+
+s['proof_plan'] = authored_packet['proof_plan']
+s['capture_script'] = authored_packet['capture_script']
+s['author_status'] = 'ready'
+s['proof_plan_status'] = 'ready'
+s['stage'] = 'author'
+s['author_mode'] = 'supervising_agent'
+s['author_model'] = authored_packet['model']
+s['author_confidence'] = confidence
+s['author_rationale'] = rationale
+s['author_warnings'] = []
+s['author_runtime_model_hint'] = RUNTIME_MODEL_HINT
+s['author_packet'] = authored_packet
+s['author_summary'] = summary
+s['supervisor_author_packet'] = authored_packet
+s['author_baseline_understanding_used'] = authored_packet['baseline_understanding_used']
+
+authored_request = dict(author_request_payload(s, refined_reference, baselines, current_plan, hypothesis, refined_path, refined_selector))
+authored_request.update({
+    'status': 'ready',
+    'authoring_mode': 'supervising_agent',
+    'authoring_model': authored_packet['model'],
+    'confidence': confidence,
+    'rationale': rationale,
+    'warnings': [],
+    'runtime_model_hint': RUNTIME_MODEL_HINT,
+    'refined_inputs': authored_packet['refined_inputs'],
+    'authored_outputs': {
+        'proof_plan': authored_packet['proof_plan'],
+        'capture_script': authored_packet['capture_script'],
+    },
+    'summary': summary,
+})
+s['author_request'] = authored_request
+s['proof_plan_request'] = authored_request
+
+save_state(s)
+
+print('AUTHOR')
+print('=' * 50)
+print('Proof plan ready: yes')
+print('Capture script ready: yes')
+print('Authoring owner: supervising agent')
+print('Authoring model hint: ' + s['author_model'])
+print('Target path: ' + refined_path)
+print('Wait for selector: ' + (refined_selector or '(none)'))
+print('Reference: ' + str(refined_reference))
+if rationale:
+    print('Rationale: ' + rationale[0])
+print(json.dumps({
+    'ok': True,
+    'author_status': s['author_status'],
+    'proof_plan_status': s['proof_plan_status'],
+    'author_mode': s['author_mode'],
+    'author_model': s['author_model'],
+    'server_path': s.get('server_path', ''),
+    'wait_for_selector': s.get('wait_for_selector', ''),
+}, indent=2))

package/runtime/lib/implement.py

@@ -0,0 +1,63 @@
+"""Implement: confirm that code work now exists between recon and verify.
+
+This stage does not make code changes itself. It records that implementation
+has happened on the after worktree so verify does not run against an untouched
+branch.
+"""
+
+import json, os, sys
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from util import load_state, save_state, git, shell_quote
+
+s = load_state()
+after_dir = (s.get('after_worktree') or '').strip()
+if not after_dir or not os.path.exists(after_dir):
+    raise SystemExit('after_worktree not found. Run setup first.')
+
+base_branch = s.get('base_branch', 'main')
+base_ref = (s.get('before_ref') or '').strip() or ('origin/' + base_branch)
+dirty = [ln for ln in git('git status --short', after_dir).stdout.splitlines() if ln.strip()]
+
+diff_cmd = 'git diff --name-only ' + shell_quote(base_ref) + '...HEAD'
+diff_result = git(diff_cmd, after_dir)
+committed = [ln for ln in diff_result.stdout.splitlines() if ln.strip()]
+if diff_result.returncode != 0:
+    fallback_base = base_branch
+    fallback_result = git('git diff --name-only ' + shell_quote(fallback_base) + '...HEAD', after_dir)
+    committed = [ln for ln in fallback_result.stdout.splitlines() if ln.strip()]
+if diff_result.returncode != 0 and not committed:
+    fallback = git('git diff --name-only HEAD~1 HEAD', after_dir)
+    committed = [ln for ln in fallback.stdout.splitlines() if ln.strip()]
+
+changed = []
+for line in dirty + committed:
+    item = line.strip()
+    if item and item not in changed:
+        changed.append(item)
+
+if not changed:
+    raise SystemExit('No implementation detected on the after worktree. Make the code changes, then rerun riddle-proof-implement.')
+
+summary = 'Implementation detected in ' + str(len(changed)) + ' file(s): ' + ', '.join(changed[:8])
+if len(changed) > 8:
+    summary += ', ...'
+
+s['implementation_status'] = 'changes_detected'
+s['implementation_summary'] = summary
+s['changed_files'] = changed[:20]
+s['stage'] = 'implement'
+authored = bool((s.get('capture_script') or '').strip()) and bool((s.get('proof_plan') or '').strip())
+if authored:
+    s['author_status'] = 'ready'
+    s['proof_plan_status'] = 'ready'
+else:
+    s['author_status'] = s.get('author_status') or 'needs_authoring'
+    s['proof_plan_status'] = s.get('proof_plan_status') or 'needs_authoring'
+save_state(s)
+
+print('IMPLEMENT')
+print('=' * 50)
+print(summary)
+if s.get('implementation_notes'):
+    print('Implementation notes: ' + s['implementation_notes'])
+print(json.dumps({'ok': True, 'changed_files': changed[:20]}))

package/runtime/lib/preflight.py

@@ -0,0 +1,246 @@
+"""Preflight: validate args and initialize state file.
+
+Reads args from RIDDLE_PROOF_ARGS_FILE, defaulting to /tmp/riddle-proof-args.json.
+Supports both static and server modes.
+reference: 'prod', 'before', or 'both' (default: 'both')
+capture_script: optional at setup and recon; required before verify.
+"""
+
+import json, os, re, time, uuid, sys
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from util import STATE_FILE, ARGS_FILE, save_state, invoke, load_package_json
+
+def truthy(value):
+    return str(value or '').strip().lower() in ('1', 'true', 'yes', 'y', 'on')
+
+
+def parse_json_arg(key, expected, default):
+    raw = s.get(key)
+    if raw in (None, ''):
+        return default
+    if isinstance(raw, expected):
+        return raw
+    if not isinstance(raw, str):
+        raise SystemExit(key + ' must be JSON ' + '/'.join(t.__name__ for t in expected) + '.')
+    text = raw.strip()
+    if not text:
+        return default
+    try:
+        parsed = json.loads(text)
+    except Exception as e:
+        raise SystemExit(key + ' is not valid JSON: ' + str(e))
+    if not isinstance(parsed, expected):
+        raise SystemExit(key + ' must decode to ' + '/'.join(t.__name__ for t in expected) + '.')
+    return parsed
+
+args_file = ARGS_FILE
+if not os.path.exists(args_file):
+    raise SystemExit('No args file. Lobster wrapper must write ' + args_file + ' first.')
+
+with open(args_file) as f:
+    s = json.load(f)
+
+mode = (s.get('mode') or '').strip().lower()
+reference = s.get('reference', 'both')
+reference_note = ''
+verification_mode = (s.get('verification_mode') or 'proof').strip() or 'proof'
+s['verification_mode'] = verification_mode
+s['success_criteria'] = (s.get('success_criteria') or '').strip()
+raw_assertions = (s.get('assertions_json') or '').strip()
+allow_static_preview_fallback = str(s.get('allow_static_preview_fallback') or '').strip().lower() in ('1', 'true', 'yes', 'y', 'on')
+s['allow_static_preview_fallback'] = allow_static_preview_fallback
+s['leave_draft'] = truthy(s.get('leave_draft'))
+for key in ('discord_channel', 'discord_thread_id', 'discord_message_id', 'discord_source_url'):
+    s[key] = (s.get(key) or '').strip()
+
+discord_url_match = re.search(r'discord(?:app)?\.com/channels/[^/]+/([^/?#]+)/([^/?#]+)', s.get('discord_source_url') or '')
+if discord_url_match:
+    discord_container_id, discord_message_id = discord_url_match.groups()
+    if not s.get('discord_message_id'):
+        s['discord_message_id'] = discord_message_id
+    if not s.get('discord_thread_id') and (not s.get('discord_channel') or discord_container_id != s.get('discord_channel')):
+        # The URL's channel component is the exact message container. If it
+        # differs from the parent channel, it is the thread ID; if no parent is
+        # known, it still works as a POST target.
+        s['discord_thread_id'] = discord_container_id
+
+# Validate reference
+if reference not in ('prod', 'before', 'both'):
+    raise SystemExit('Invalid reference: ' + reference + '. Must be prod, before, or both.')
+s['reference'] = reference
+
+# Infer a reasonable commit title during setup instead of forcing the caller to
+# fill boilerplate that can be derived from the requested change.
+if not (s.get('commit_message') or '').strip():
+    s['commit_message'] = (s.get('change_request') or '').strip()
+
+# Setup should not block on a missing production URL. If prod comparison was
+# requested but prod_url is not known yet, continue with a before-only setup so
+# the repo homework can happen first.
+if reference in ('prod', 'both') and not (s.get('prod_url') or '').strip():
+    s['requested_reference'] = reference
+    reference = 'before'
+    s['reference'] = reference
+    reference_note = 'prod_url not provided; setup will continue with reference=before until prod is known.'
+
+# Parse optional assertions JSON
+parsed_assertions = None
+if raw_assertions:
+    try:
+        parsed_assertions = json.loads(raw_assertions)
+    except Exception as e:
+        raise SystemExit('assertions_json is not valid JSON: ' + str(e))
+s['parsed_assertions'] = parsed_assertions
+
+# Generate branch if not provided. The riddle-proof/* namespace is reserved for
+# temporary proof worktrees, so never let a user-supplied branch use it as the
+# real PR branch.
+requested_branch = (s.get('branch') or '').strip()
+if not requested_branch or requested_branch.startswith('riddle-proof/'):
+    slug = re.sub(r'[^a-z0-9]+', '-', (s.get('change_request') or 'proof-check').lower())[:34].strip('-') or 'proof-check'
+    s['branch'] = 'agent/openclaw/' + slug + '-' + uuid.uuid4().hex[:6]
+    if requested_branch:
+        s['branch_rewritten_from'] = requested_branch
+requested_target_branch = (s.get('target_branch') or '').strip()
+if requested_target_branch.startswith('riddle-proof/'):
+    s['target_branch_rewritten_from'] = requested_target_branch
+    requested_target_branch = ''
+s['target_branch'] = (requested_target_branch or s.get('branch') or '').strip()
+s['ship_target_branch'] = s['target_branch']
+if s['target_branch'].startswith('riddle-proof/'):
+    raise SystemExit('Invalid target_branch: riddle-proof/* is reserved for temporary proof worktrees.')
+
+# Validate required fields (common)
+missing = []
+for k in ('repo', 'change_request', 'commit_message'):
+    if not s.get(k):
+        missing.append(k)
+
+# prod_url required only once prod is actively part of the comparison
+if reference in ('prod', 'both') and not s.get('prod_url', '').strip():
+    missing.append('prod_url (required when reference=' + reference + ')')
+
+# Mode-specific validation
+if mode == 'server':
+    for k in ('server_image', 'server_command', 'server_port'):
+        if not s.get(k):
+            missing.append(k)
+
+# Derived fields
+repo_short = s['repo'].split('/')[-1] if s.get('repo') else ''
+s['repo_short'] = repo_short
+base_branch = (s.get('base_branch') or 'main').strip() or 'main'
+s['base_branch'] = base_branch
+if not (s.get('before_ref') or '').strip() and not (s.get('base_ref') or '').strip():
+    s['before_ref'] = 'origin/' + base_branch
+workspace = os.environ.get('OPENCLAW_WORKSPACE')
+if not workspace:
+    for candidate in ('/mnt/efs/openclaw/workspace', os.path.expanduser('~/.openclaw/workspace')):
+        if os.path.exists(candidate):
+            workspace = candidate
+            break
+workspace = workspace or os.path.expanduser('~/.openclaw/workspace')
+s['repo_dir'] = s.get('repo_dir') or (workspace + '/' + repo_short if repo_short else '')
+
+if not mode:
+    repo_dir = s.get('repo_dir', '')
+    pkg = load_package_json(repo_dir) if repo_dir else {}
+    scripts = pkg.get('scripts') or {}
+    script_blob = ' '.join(str(scripts.get(k, '')).lower() for k in ('start', 'preview', 'dev'))
+    mode = 'static' if 'vite' in script_blob or 'react-scripts' in script_blob else 'server'
+s['mode'] = mode or 'static'
+mode = s['mode']
+
+run_id = time.strftime('%Y%m%dT%H%M%SZ', time.gmtime()) + '-' + uuid.uuid4().hex[:8]
+s['run_id'] = run_id
+s['stage'] = 'preflight'
+s['status'] = 'ready' if not missing else 'needs_input'
+s['missing'] = missing
+
+# Auth context can be supplied directly for public-plugin use, while use_auth
+# remains a private/configured Cognito helper for Riddle-owned environments.
+explicit_local_storage = parse_json_arg('auth_localStorage_json', (dict,), {})
+explicit_cookies = parse_json_arg('auth_cookies_json', (dict, list), {})
+explicit_headers = parse_json_arg('auth_headers_json', (dict,), {})
+s['auth_explicit_localStorage'] = explicit_local_storage
+s['auth_cookies'] = explicit_cookies
+s['auth_headers'] = explicit_headers
+s['auth_localStorage'] = dict(explicit_local_storage)
+
+if truthy(s.get('use_auth')):
+    print('Fetching Cognito auth tokens...')
+    auth = invoke('auth_cognito_tokens', {}, timeout=60)
+    if auth.get('ok') and auth.get('localStorage'):
+        merged_local_storage = dict(auth['localStorage'])
+        merged_local_storage.update(explicit_local_storage)
+        s['auth_localStorage'] = merged_local_storage
+        print('Auth tokens fetched (' + str(len(auth['localStorage'])) + ' keys)')
+    else:
+        raise SystemExit('Failed to fetch auth tokens for use_auth=true: ' + str(auth.get('error', 'unknown')))
+
+# Init capture/proof fields
+s['before_cdn'] = ''
+s['after_cdn'] = ''
+s['prod_cdn'] = ''
+s['before_preview_id'] = ''
+s['after_preview_id'] = ''
+s['before_worktree'] = ''
+s['after_worktree'] = ''
+s['after_worktree_branch'] = ''
+s['pr_url'] = s.get('pr_url', '')
+s['pr_number'] = s.get('pr_number', '')
+s['recon_results'] = {}
+s['verify_results'] = {}
+s['capture_diagnostics'] = []
+s['review_passed'] = False
+s['finalized'] = False
+s['proof_summary'] = ''
+s['proof_plan'] = (s.get('proof_plan') or '').strip()
+s['proof_plan_request'] = s.get('proof_plan_request') or {}
+s['author_request'] = s.get('author_request') or {}
+s['author_summary'] = ''
+authored = bool((s.get('capture_script') or '').strip()) and bool((s.get('proof_plan') or '').strip())
+s['author_status'] = 'ready' if authored else 'pending_recon'
+s['proof_plan_status'] = 'ready' if authored else 'pending_recon'
+s['recon_summary'] = ''
+s['recon_hypothesis'] = s.get('recon_hypothesis') or {}
+s['assertion_status'] = 'not_run'
+s['merge_recommendation'] = ''
+s['evidence_notes'] = []
+s['implementation_status'] = 'pending_recon'
+s['implementation_summary'] = ''
+s['implementation_notes'] = (s.get('implementation_notes') or '').strip()
+
+print('RIDDLE PROOF — PREFLIGHT (' + mode.upper() + ' / ' + reference.upper() + ')')
+print('=' * 50)
+display_keys = ['repo', 'branch', 'target_branch', 'ship_target_branch', 'base_branch', 'before_ref', 'change_request', 'commit_message',
+                'reference', 'verification_mode', 'success_criteria', 'prod_url', 'build_command',
+                'allow_static_preview_fallback']
+if mode == 'server':
+    display_keys += ['server_image', 'server_command', 'server_port', 'server_path']
+if s.get('auth_localStorage'):
+    print('auth: localStorage loaded (' + str(len(s['auth_localStorage'])) + ' keys)')
+if s.get('auth_cookies'):
+    print('auth: cookies supplied')
+if s.get('auth_headers'):
+    print('auth: headers supplied (' + str(len(s['auth_headers'])) + ' keys)')
+for k in display_keys:
+    v = str(s.get(k, ''))
+    if len(v) > 120:
+        v = v[:120] + '...'
+    print(k + ': ' + v)
+if parsed_assertions is not None:
+    print('assertions_json: parsed')
+if not (s.get('capture_script') or '').strip():
+    print('NOTE: capture_script can be added later after recon and before verify.')
+if reference_note:
+    print('NOTE: ' + reference_note)
+if missing:
+    print('MISSING: ' + ', '.join(missing))
+print('=' * 50)
+
+save_state(s)
+
+if missing:
+    raise SystemExit('Missing required fields: ' + ', '.join(missing))
+print(json.dumps({'ok': True, 'run_id': run_id, 'mode': mode, 'reference': reference, 'verification_mode': verification_mode}))