@riddledc/riddle-proof 0.8.33 → 0.8.35

package/dist/{chunk-U73JPBZW.js → chunk-UGHN77PS.js}

@@ -65,6 +65,7 @@ var KNOWN_CLI_OPTIONS = /* @__PURE__ */ new Set([
   "format",
   "framework",
   "help",
+  "hostedRiddle",
   "image",
   "input",
   "inputDir",
@@ -136,7 +137,7 @@ function usage() {
     "  riddle-proof-loop run-profile --profile <file|json|-> --url <base-url> [--base-url <base-url>] [--runner riddle] [--viewport-name <name[,name...]>] [--strict true|false; default false] [--split-viewports true|false; default false] [--balance-preflight true|false; default true] [--poll-attempts n] [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json] [--quiet]",
     "  riddle-proof-loop run-profile aggregate --profile <file|json|-> --url <base-url> [--base-url <base-url>] --input-dir <dir>|--inputs <path[,path...]> [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json]",
     "  riddle-proof-loop run-profile recover --profile <file|json|-> --url <base-url> [--base-url <base-url>] --job <job-id> [--viewport-name <name[,name...]>] [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json]",
-    "  riddle-proof-loop regression-pack run [--pack oc-flow-regression|--pack-file <file>] [--local-core true|false; default true] [--format json|markdown|compact-json; default json] [--output <dir>|--output-dir <dir>]",
+    "  riddle-proof-loop regression-pack run [--pack oc-flow-regression|--pack-file <file>] [--local-core true|false; default true] [--hosted-riddle true|false; default false] [--format json|markdown|compact-json; default json] [--output <dir>|--output-dir <dir>]",
     "  riddle-proof-loop profile-body-assertions --artifact <file|url|-> --candidates-json <file|json|-> [--required-json <file|json|->] [--format json|body-contains]",
     "  riddle-proof-loop profile-http-status-preflight --profile <file|json|-> --url <base-url> [--format json|summary]",
     "  riddle-proof-loop riddle-preview-deploy <build-dir> <label> [--framework spa|static]",
@@ -447,6 +448,244 @@ function runRegressionPackLocalCore(pack) {
     stdout_tail: ok ? void 0 : tailLines(child.stdout || "")
   };
 }
+function regressionPackHostedRiddleRequested(options) {
+  return optionBoolean(options, "hostedRiddle") ?? false;
+}
+function regressionPackHostedRiddleSuite(pack) {
+  return regressionPackRecord(pack.hosted_riddle_suite);
+}
+function regressionPackHostedRiddleCases(pack) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  return Array.isArray(suite.cases) ? suite.cases.map(regressionPackRecord) : [];
+}
+function regressionPackHostedRiddleExpectedStatus(testCase) {
+  const expect = regressionPackRecord(testCase.expect);
+  return cliString(expect.profile_status) || cliString(expect.status);
+}
+function regressionPackHostedRiddleExpectedMessage(testCase) {
+  const expect = regressionPackRecord(testCase.expect);
+  return cliString(expect.message_contains);
+}
+function regressionPackHostedRiddlePlan(pack) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const cases = regressionPackHostedRiddleCases(pack);
+  return {
+    requested: false,
+    configured: cases.length > 0,
+    ok: true,
+    runner: cliString(suite.runner) || "riddle",
+    target: regressionPackRecord(suite.target),
+    case_count: cases.length,
+    case_ids: cases.map((item) => cliString(item.id)).filter(Boolean)
+  };
+}
+function regressionPackHostedRiddleCaseOutputDir(outputDir, caseId) {
+  return outputDir ? path.join(outputDir, "hosted-riddle", safeProfileOutputSegment(caseId)) : void 0;
+}
+function compactHostedRiddleCaseResult(testCase, result, ok) {
+  const expectedMessage = regressionPackHostedRiddleExpectedMessage(testCase);
+  return {
+    id: cliString(testCase.id) || result.profile_name,
+    intent: cliString(testCase.intent) || null,
+    ok,
+    expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+    expected_message_contains: expectedMessage || null,
+    expected_message_found: expectedMessage ? JSON.stringify(result).includes(expectedMessage) : void 0,
+    status: result.status,
+    profile_name: result.profile_name,
+    summary: result.summary,
+    route: result.route,
+    riddle: result.riddle,
+    artifacts: result.artifacts,
+    environment_blocker: result.environment_blocker,
+    error: result.error
+  };
+}
+function hostedRiddleBlockedCaseResult(testCase, error, environmentBlocker) {
+  const rawProfile = regressionPackRecord(testCase.profile);
+  return {
+    id: cliString(testCase.id) || cliString(rawProfile.name) || "hosted-riddle-case",
+    intent: cliString(testCase.intent) || null,
+    ok: false,
+    expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+    expected_message_contains: regressionPackHostedRiddleExpectedMessage(testCase) || null,
+    status: "environment_blocked",
+    profile_name: cliString(rawProfile.name) || null,
+    summary: error,
+    environment_blocker: environmentBlocker,
+    error
+  };
+}
+async function hostedRiddleSuiteEnvironmentBlocker(cases, options) {
+  if (!runProfileBalancePreflightOption(options) || !cases.length) return void 0;
+  const client = createRiddleApiClient(riddleClientConfig(options));
+  const requiredSeconds = cases.length * RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB;
+  let balance;
+  try {
+    balance = await client.getBalance();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      error: message,
+      environment_blocker: {
+        source: "riddle_api",
+        endpoint: "/v1/balance",
+        reason: "balance_preflight_failed",
+        balance_preflight: true,
+        job_count: cases.length,
+        seconds_per_job: RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB,
+        required_seconds: requiredSeconds,
+        ...riddleApiErrorBlockerMetadata(error),
+        ...apiKeySourceBlockerMetadata(client)
+      }
+    };
+  }
+  const availableSeconds = riddleBalanceAvailableSeconds(balance);
+  if (availableSeconds === void 0 || availableSeconds >= requiredSeconds) return void 0;
+  const reservedSeconds = cliFiniteNumber(balance.reserved_seconds);
+  const totalSeconds = cliFiniteNumber(balance.total_seconds);
+  const holdsCount = cliFiniteNumber(balance.holds_count);
+  return {
+    error: `Riddle hosted regression balance preflight failed: ${availableSeconds}s available for ${cases.length} serial hosted job(s), minimum ${requiredSeconds}s required.`,
+    environment_blocker: {
+      source: "riddle_api",
+      endpoint: "/v1/balance",
+      reason: "insufficient_balance",
+      error: "Insufficient available balance",
+      balance_preflight: true,
+      job_count: cases.length,
+      seconds_per_job: RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB,
+      required_seconds: requiredSeconds,
+      available_seconds: availableSeconds,
+      deficit_seconds: requiredSeconds - availableSeconds,
+      ...reservedSeconds === void 0 ? {} : { reserved_seconds: reservedSeconds },
+      ...totalSeconds === void 0 ? {} : { total_seconds: totalSeconds },
+      ...holdsCount === void 0 ? {} : { holds_count: holdsCount },
+      ...apiKeySourceBlockerMetadata(client)
+    }
+  };
+}
+async function runRegressionPackHostedRiddle(pack, options) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const cases = regressionPackHostedRiddleCases(pack);
+  const runner = cliString(suite.runner) || "riddle";
+  const target = regressionPackRecord(suite.target);
+  const baseUrl = cliString(target.url) || cliString(target.base_url) || cliString(target.baseUrl) || optionString(options, "url") || optionString(options, "baseUrl");
+  const outputDir = profileOutputDirOption(options);
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const results = [];
+  const suiteBlocker = await hostedRiddleSuiteEnvironmentBlocker(cases, options);
+  if (suiteBlocker) {
+    const blockedCases = cases.map((testCase) => hostedRiddleBlockedCaseResult(testCase, suiteBlocker.error, suiteBlocker.environment_blocker));
+    return {
+      requested: true,
+      configured: cases.length > 0,
+      ok: false,
+      runner,
+      target,
+      started_at: startedAt,
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      case_count: cases.length,
+      passed_case_count: 0,
+      failed_cases: blockedCases.map((item) => cliString(item.id)).filter((item) => Boolean(item)),
+      environment_blocked_cases: blockedCases.map((item) => cliString(item.id)).filter((item) => Boolean(item)),
+      environment_blocker: suiteBlocker.environment_blocker,
+      error: suiteBlocker.error,
+      cases: blockedCases
+    };
+  }
+  for (const testCase of cases) {
+    const caseId = cliString(testCase.id) || `case-${results.length + 1}`;
+    const rawProfile = regressionPackRecord(testCase.profile);
+    if (!Object.keys(rawProfile).length) {
+      results.push({
+        id: caseId,
+        intent: cliString(testCase.intent) || null,
+        ok: false,
+        expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+        status: "configuration_error",
+        error: "hosted_riddle_suite case requires profile."
+      });
+      continue;
+    }
+    let result;
+    const caseOutputDir = regressionPackHostedRiddleCaseOutputDir(outputDir, caseId);
+    const caseOptions = {
+      ...options,
+      runner,
+      ...caseOutputDir ? { output: caseOutputDir, outputDir: caseOutputDir } : {}
+    };
+    try {
+      const profile = profileWithSelectedViewportNamesForCli(
+        normalizeRiddleProofProfile(rawProfile, { url: baseUrl }),
+        options
+      );
+      result = await runProfileForCli(profile, caseOptions);
+      writeProfileOutput(caseOutputDir, result);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      results.push({
+        id: caseId,
+        intent: cliString(testCase.intent) || null,
+        ok: false,
+        expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+        status: "configuration_error",
+        error: message,
+        output_dir: caseOutputDir || null
+      });
+      continue;
+    }
+    const expectedStatus = regressionPackHostedRiddleExpectedStatus(testCase);
+    const expectedMessage = regressionPackHostedRiddleExpectedMessage(testCase);
+    const statusOk = expectedStatus ? result.status === expectedStatus : result.status === "passed";
+    const messageOk = expectedMessage ? JSON.stringify(result).includes(expectedMessage) : true;
+    const ok = statusOk && messageOk;
+    results.push({
+      ...compactHostedRiddleCaseResult(testCase, result, ok),
+      output_dir: caseOutputDir || null
+    });
+  }
+  const failedCases = results.filter((item) => item.ok !== true).map((item) => cliString(item.id)).filter((item) => Boolean(item));
+  const environmentBlockedCases = results.filter((item) => cliString(item.status) === "environment_blocked").map((item) => cliString(item.id)).filter((item) => Boolean(item));
+  return {
+    requested: true,
+    configured: cases.length > 0,
+    ok: cases.length > 0 && !failedCases.length,
+    runner,
+    target,
+    started_at: startedAt,
+    finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+    case_count: cases.length,
+    passed_case_count: results.length - failedCases.length,
+    failed_cases: failedCases,
+    environment_blocked_cases: environmentBlockedCases,
+    cases: results
+  };
+}
+function hostedRiddleHandoffPromptForRegressionPack(pack) {
+  const cases = regressionPackHostedRiddleCases(pack);
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const target = regressionPackRecord(suite.target);
+  const lines = [
+    "Run the hosted Riddle generic regression suite before involving OpenClaw.",
+    "",
+    "Command:",
+    "riddle-proof-loop regression-pack run --pack oc-flow-regression --local-core true --hosted-riddle true --format markdown --output-dir artifacts/riddle-proof/hosted-regression",
+    "",
+    "Target:",
+    ...Object.entries(target).map(([key, value]) => `- ${key}: ${JSON.stringify(value)}`),
+    "",
+    "Cases:",
+    ...cases.map((testCase, index) => {
+      const expect = regressionPackRecord(testCase.expect);
+      return `${index + 1}. ${cliString(testCase.id) || "unnamed-case"}: ${cliString(testCase.intent) || "no intent"}
+   Expect: ${JSON.stringify(expect)}`;
+    }),
+    "",
+    "Only pass the batch to OC after local_core.ok and hosted_riddle.ok are both true."
+  ].filter((line) => line !== "");
+  return lines.join("\n");
+}
 function openClawHandoffPromptForRegressionPack(pack, input) {
   const minimumVersions = regressionPackRecord(pack.minimum_versions);
   const runtimeGate = regressionPackRecord(pack.runtime_gate);
@@ -468,6 +707,7 @@ function openClawHandoffPromptForRegressionPack(pack, input) {
     "- Run cases serially, not as one broad parallel batch.",
     "- If loaded metadata is stale, stop and restart/reload the gateway before counting results.",
     "- If any generic lifecycle marker appears, report the exact marker and artifact, then stop the counted batch.",
+    input.localCoreOk ? input.hostedRiddleOk ? "- Generic local core and hosted Riddle suites are green; OC should only validate wrapper/runtime adapter behavior." : input.hostedRiddleRequested ? "- Hosted Riddle generic suite did not pass; do not treat OC failures as wrapper-only until it is green." : "- Hosted Riddle generic suite was not run in this regression-pack invocation; run it before counting OC as the late adapter gate." : "- Local generic core suite is not green or was not run; keep OC as blocked-on-generic until local core is green.",
     `- Forbidden terminal markers: ${forbiddenMarkers.join(", ") || "none"}.`,
     fields.length ? `- Log fields for every counted run: ${fields.join(", ")}.` : "",
     "",
@@ -480,12 +720,13 @@ function openClawHandoffPromptForRegressionPack(pack, input) {
       ].join("\n");
     }),
     "",
-    input.localCoreOk ? "Local generic core suite is green, so OC should only be validating wrapper/runtime behavior." : "Local generic core suite is not green or was not run; do not count OC failures as wrapper-only until local core is green."
+    input.localCoreOk ? "Local generic core suite is green." : "Local generic core suite is not green or was not run; do not count OC failures as wrapper-only until local core is green."
   ].filter((line) => line !== "");
   return lines.join("\n");
 }
 function compactRegressionPackRunResult(result) {
   const localCore = regressionPackRecord(result.local_core);
+  const hostedRiddle = regressionPackRecord(result.hosted_riddle);
   const openClaw = regressionPackRecord(result.openclaw_live_suite);
   return {
     version: result.version,
@@ -500,12 +741,22 @@ function compactRegressionPackRunResult(result) {
       failed_cases: localCore.failed_cases,
       forbidden_terminal_markers_seen: localCore.forbidden_terminal_markers_seen
     },
+    hosted_riddle: {
+      requested: hostedRiddle.requested,
+      configured: hostedRiddle.configured,
+      ok: hostedRiddle.ok,
+      runner: hostedRiddle.runner,
+      case_count: hostedRiddle.case_count,
+      failed_cases: hostedRiddle.failed_cases,
+      environment_blocked_cases: hostedRiddle.environment_blocked_cases
+    },
     openclaw_live_case_count: openClaw.case_count,
     output_dir: result.output_dir
   };
 }
 function regressionPackRunMarkdown(result) {
   const localCore = regressionPackRecord(result.local_core);
+  const hostedRiddle = regressionPackRecord(result.hosted_riddle);
   const runtimeGate = regressionPackRecord(result.runtime_gate);
   const minimumVersions = regressionPackRecord(result.minimum_versions);
   const openClaw = regressionPackRecord(result.openclaw_live_suite);
@@ -525,6 +776,16 @@ function regressionPackRunMarkdown(result) {
     `- failed cases: ${regressionPackStringArray(localCore.failed_cases).join(", ") || "none"}`,
     `- forbidden markers seen: ${regressionPackStringArray(localCore.forbidden_terminal_markers_seen).join(", ") || "none"}`,
     "",
+    "## Hosted Riddle",
+    "",
+    `- requested: ${hostedRiddle.requested === true}`,
+    `- configured: ${hostedRiddle.configured === true}`,
+    `- ok: ${hostedRiddle.ok === true}`,
+    `- runner: ${cliString(hostedRiddle.runner) || "n/a"}`,
+    `- cases: ${hostedRiddle.case_count ?? "n/a"}`,
+    `- failed cases: ${regressionPackStringArray(hostedRiddle.failed_cases).join(", ") || "none"}`,
+    `- environment blocked cases: ${regressionPackStringArray(hostedRiddle.environment_blocked_cases).join(", ") || "none"}`,
+    "",
     "## Runtime Gate",
     "",
     `- tool: ${cliString(runtimeGate.tool) || "n/a"}`,
@@ -535,6 +796,12 @@ function regressionPackRunMarkdown(result) {
     `- case count: ${openClaw.case_count ?? "n/a"}`,
     `- result log fields: ${regressionPackStringArray(openClaw.result_log_fields).join(", ") || "n/a"}`,
     "",
+    "## Hosted Riddle Handoff",
+    "",
+    "```text",
+    cliString(result.hosted_riddle_handoff_prompt) || "",
+    "```",
+    "",
     "## OC Handoff Prompt",
     "",
     "```text",
@@ -551,22 +818,29 @@ function writeRegressionPackOutput(outputDir, result) {
   writeFileSync(path.join(outputDir, "regression-pack-result.json"), `${JSON.stringify(result, null, 2)}
 `);
   writeFileSync(path.join(outputDir, "summary.md"), regressionPackRunMarkdown(result));
+  writeFileSync(path.join(outputDir, "hosted-riddle-handoff.md"), `${cliString(result.hosted_riddle_handoff_prompt) || ""}
+`);
   writeFileSync(path.join(outputDir, "oc-handoff.md"), `${cliString(result.openclaw_handoff_prompt) || ""}
 `);
 }
-function runRegressionPackForCli(options) {
+async function runRegressionPackForCli(options) {
   const { filePath, pack } = readRegressionPackForCli(options);
   const localCoreRequested = optionBoolean(options, "localCore") ?? true;
+  const hostedRiddleRequested = regressionPackHostedRiddleRequested(options);
   const localCore = localCoreRequested ? runRegressionPackLocalCore(pack) : { requested: false, ok: true, command: regressionPackCommandForLocalCore(pack) };
+  const hostedRiddle = hostedRiddleRequested ? await runRegressionPackHostedRiddle(pack, options) : regressionPackHostedRiddlePlan(pack);
   const liveSuite = regressionPackRecord(pack.openclaw_live_suite);
   const liveCases = Array.isArray(liveSuite.cases) ? liveSuite.cases : [];
   const localCoreRecord = regressionPackRecord(localCore);
+  const hostedRiddleRecord = regressionPackRecord(hostedRiddle);
   const localCoreValidated = localCoreRecord.requested === true && localCoreRecord.ok === true;
-  const ok = localCoreRequested ? localCoreValidated : true;
+  const hostedRiddleValidated = hostedRiddleRecord.requested === true && hostedRiddleRecord.ok === true;
+  const ok = (localCoreRequested ? localCoreValidated : true) && (hostedRiddleRequested ? hostedRiddleValidated : true);
   const result = {
     version: "riddle-proof.regression-pack-run-result.v1",
     ok,
     local_core_validated: localCoreValidated,
+    hosted_riddle_validated: hostedRiddleValidated,
     generated_at: (/* @__PURE__ */ new Date()).toISOString(),
     pack_path: filePath,
     pack_id: cliString(pack.pack_id) || null,
@@ -576,13 +850,19 @@ function runRegressionPackForCli(options) {
     runtime_gate: regressionPackRecord(pack.runtime_gate),
     forbidden_terminal_markers: regressionPackStringArray(pack.forbidden_terminal_markers),
     local_core: localCore,
+    hosted_riddle: hostedRiddle,
     openclaw_live_suite: {
       target: regressionPackRecord(liveSuite.target),
       result_log_fields: regressionPackStringArray(liveSuite.result_log_fields),
       case_count: liveCases.length,
       case_ids: liveCases.map((item) => cliString(regressionPackRecord(item).id)).filter(Boolean)
     },
-    openclaw_handoff_prompt: openClawHandoffPromptForRegressionPack(pack, { localCoreOk: localCoreValidated }),
+    hosted_riddle_handoff_prompt: hostedRiddleHandoffPromptForRegressionPack(pack),
+    openclaw_handoff_prompt: openClawHandoffPromptForRegressionPack(pack, {
+      localCoreOk: localCoreValidated,
+      hostedRiddleOk: hostedRiddleValidated,
+      hostedRiddleRequested
+    }),
     output_dir: profileOutputDirOption(options) || null
   };
   writeRegressionPackOutput(profileOutputDirOption(options), result);
@@ -4269,7 +4549,7 @@ async function main() {
   if (command === "regression-pack") {
     const action = positional[1] || "run";
     if (action !== "run") throw new Error("Only `regression-pack run` is supported.");
-    const result = runRegressionPackForCli(options);
+    const result = await runRegressionPackForCli(options);
     writeRegressionPackRunResult(result, options);
     process.exitCode = result.ok ? 0 : 1;
     return;

package/dist/cli/index.js

@@ -1,4 +1,4 @@
-import "../chunk-U73JPBZW.js";
+import "../chunk-UGHN77PS.js";
 import "../chunk-PEWAIEER.js";
 import "../chunk-TWTEUS7R.js";
 import "../chunk-ZREWMTFA.js";

package/dist/cli.cjs

@@ -17157,6 +17157,7 @@ var KNOWN_CLI_OPTIONS = /* @__PURE__ */ new Set([
   "format",
   "framework",
   "help",
+  "hostedRiddle",
   "image",
   "input",
   "inputDir",
@@ -17228,7 +17229,7 @@ function usage() {
     "  riddle-proof-loop run-profile --profile <file|json|-> --url <base-url> [--base-url <base-url>] [--runner riddle] [--viewport-name <name[,name...]>] [--strict true|false; default false] [--split-viewports true|false; default false] [--balance-preflight true|false; default true] [--poll-attempts n] [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json] [--quiet]",
     "  riddle-proof-loop run-profile aggregate --profile <file|json|-> --url <base-url> [--base-url <base-url>] --input-dir <dir>|--inputs <path[,path...]> [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json]",
     "  riddle-proof-loop run-profile recover --profile <file|json|-> --url <base-url> [--base-url <base-url>] --job <job-id> [--viewport-name <name[,name...]>] [--output <dir>|--output-dir <dir>] [--result-format json|compact-json|summary|none; default json]",
-    "  riddle-proof-loop regression-pack run [--pack oc-flow-regression|--pack-file <file>] [--local-core true|false; default true] [--format json|markdown|compact-json; default json] [--output <dir>|--output-dir <dir>]",
+    "  riddle-proof-loop regression-pack run [--pack oc-flow-regression|--pack-file <file>] [--local-core true|false; default true] [--hosted-riddle true|false; default false] [--format json|markdown|compact-json; default json] [--output <dir>|--output-dir <dir>]",
     "  riddle-proof-loop profile-body-assertions --artifact <file|url|-> --candidates-json <file|json|-> [--required-json <file|json|->] [--format json|body-contains]",
     "  riddle-proof-loop profile-http-status-preflight --profile <file|json|-> --url <base-url> [--format json|summary]",
     "  riddle-proof-loop riddle-preview-deploy <build-dir> <label> [--framework spa|static]",
@@ -17539,6 +17540,244 @@ function runRegressionPackLocalCore(pack) {
     stdout_tail: ok ? void 0 : tailLines(child.stdout || "")
   };
 }
+function regressionPackHostedRiddleRequested(options) {
+  return optionBoolean(options, "hostedRiddle") ?? false;
+}
+function regressionPackHostedRiddleSuite(pack) {
+  return regressionPackRecord(pack.hosted_riddle_suite);
+}
+function regressionPackHostedRiddleCases(pack) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  return Array.isArray(suite.cases) ? suite.cases.map(regressionPackRecord) : [];
+}
+function regressionPackHostedRiddleExpectedStatus(testCase) {
+  const expect = regressionPackRecord(testCase.expect);
+  return cliString(expect.profile_status) || cliString(expect.status);
+}
+function regressionPackHostedRiddleExpectedMessage(testCase) {
+  const expect = regressionPackRecord(testCase.expect);
+  return cliString(expect.message_contains);
+}
+function regressionPackHostedRiddlePlan(pack) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const cases = regressionPackHostedRiddleCases(pack);
+  return {
+    requested: false,
+    configured: cases.length > 0,
+    ok: true,
+    runner: cliString(suite.runner) || "riddle",
+    target: regressionPackRecord(suite.target),
+    case_count: cases.length,
+    case_ids: cases.map((item) => cliString(item.id)).filter(Boolean)
+  };
+}
+function regressionPackHostedRiddleCaseOutputDir(outputDir, caseId) {
+  return outputDir ? import_node_path6.default.join(outputDir, "hosted-riddle", safeProfileOutputSegment(caseId)) : void 0;
+}
+function compactHostedRiddleCaseResult(testCase, result, ok) {
+  const expectedMessage = regressionPackHostedRiddleExpectedMessage(testCase);
+  return {
+    id: cliString(testCase.id) || result.profile_name,
+    intent: cliString(testCase.intent) || null,
+    ok,
+    expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+    expected_message_contains: expectedMessage || null,
+    expected_message_found: expectedMessage ? JSON.stringify(result).includes(expectedMessage) : void 0,
+    status: result.status,
+    profile_name: result.profile_name,
+    summary: result.summary,
+    route: result.route,
+    riddle: result.riddle,
+    artifacts: result.artifacts,
+    environment_blocker: result.environment_blocker,
+    error: result.error
+  };
+}
+function hostedRiddleBlockedCaseResult(testCase, error, environmentBlocker) {
+  const rawProfile = regressionPackRecord(testCase.profile);
+  return {
+    id: cliString(testCase.id) || cliString(rawProfile.name) || "hosted-riddle-case",
+    intent: cliString(testCase.intent) || null,
+    ok: false,
+    expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+    expected_message_contains: regressionPackHostedRiddleExpectedMessage(testCase) || null,
+    status: "environment_blocked",
+    profile_name: cliString(rawProfile.name) || null,
+    summary: error,
+    environment_blocker: environmentBlocker,
+    error
+  };
+}
+async function hostedRiddleSuiteEnvironmentBlocker(cases, options) {
+  if (!runProfileBalancePreflightOption(options) || !cases.length) return void 0;
+  const client = createRiddleApiClient(riddleClientConfig(options));
+  const requiredSeconds = cases.length * RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB;
+  let balance;
+  try {
+    balance = await client.getBalance();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      error: message,
+      environment_blocker: {
+        source: "riddle_api",
+        endpoint: "/v1/balance",
+        reason: "balance_preflight_failed",
+        balance_preflight: true,
+        job_count: cases.length,
+        seconds_per_job: RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB,
+        required_seconds: requiredSeconds,
+        ...riddleApiErrorBlockerMetadata(error),
+        ...apiKeySourceBlockerMetadata(client)
+      }
+    };
+  }
+  const availableSeconds = riddleBalanceAvailableSeconds(balance);
+  if (availableSeconds === void 0 || availableSeconds >= requiredSeconds) return void 0;
+  const reservedSeconds = cliFiniteNumber(balance.reserved_seconds);
+  const totalSeconds = cliFiniteNumber(balance.total_seconds);
+  const holdsCount = cliFiniteNumber(balance.holds_count);
+  return {
+    error: `Riddle hosted regression balance preflight failed: ${availableSeconds}s available for ${cases.length} serial hosted job(s), minimum ${requiredSeconds}s required.`,
+    environment_blocker: {
+      source: "riddle_api",
+      endpoint: "/v1/balance",
+      reason: "insufficient_balance",
+      error: "Insufficient available balance",
+      balance_preflight: true,
+      job_count: cases.length,
+      seconds_per_job: RIDDLE_PROFILE_BALANCE_PREFLIGHT_MIN_SECONDS_PER_JOB,
+      required_seconds: requiredSeconds,
+      available_seconds: availableSeconds,
+      deficit_seconds: requiredSeconds - availableSeconds,
+      ...reservedSeconds === void 0 ? {} : { reserved_seconds: reservedSeconds },
+      ...totalSeconds === void 0 ? {} : { total_seconds: totalSeconds },
+      ...holdsCount === void 0 ? {} : { holds_count: holdsCount },
+      ...apiKeySourceBlockerMetadata(client)
+    }
+  };
+}
+async function runRegressionPackHostedRiddle(pack, options) {
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const cases = regressionPackHostedRiddleCases(pack);
+  const runner = cliString(suite.runner) || "riddle";
+  const target = regressionPackRecord(suite.target);
+  const baseUrl = cliString(target.url) || cliString(target.base_url) || cliString(target.baseUrl) || optionString(options, "url") || optionString(options, "baseUrl");
+  const outputDir = profileOutputDirOption(options);
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const results = [];
+  const suiteBlocker = await hostedRiddleSuiteEnvironmentBlocker(cases, options);
+  if (suiteBlocker) {
+    const blockedCases = cases.map((testCase) => hostedRiddleBlockedCaseResult(testCase, suiteBlocker.error, suiteBlocker.environment_blocker));
+    return {
+      requested: true,
+      configured: cases.length > 0,
+      ok: false,
+      runner,
+      target,
+      started_at: startedAt,
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      case_count: cases.length,
+      passed_case_count: 0,
+      failed_cases: blockedCases.map((item) => cliString(item.id)).filter((item) => Boolean(item)),
+      environment_blocked_cases: blockedCases.map((item) => cliString(item.id)).filter((item) => Boolean(item)),
+      environment_blocker: suiteBlocker.environment_blocker,
+      error: suiteBlocker.error,
+      cases: blockedCases
+    };
+  }
+  for (const testCase of cases) {
+    const caseId = cliString(testCase.id) || `case-${results.length + 1}`;
+    const rawProfile = regressionPackRecord(testCase.profile);
+    if (!Object.keys(rawProfile).length) {
+      results.push({
+        id: caseId,
+        intent: cliString(testCase.intent) || null,
+        ok: false,
+        expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+        status: "configuration_error",
+        error: "hosted_riddle_suite case requires profile."
+      });
+      continue;
+    }
+    let result;
+    const caseOutputDir = regressionPackHostedRiddleCaseOutputDir(outputDir, caseId);
+    const caseOptions = {
+      ...options,
+      runner,
+      ...caseOutputDir ? { output: caseOutputDir, outputDir: caseOutputDir } : {}
+    };
+    try {
+      const profile = profileWithSelectedViewportNamesForCli(
+        normalizeRiddleProofProfile(rawProfile, { url: baseUrl }),
+        options
+      );
+      result = await runProfileForCli(profile, caseOptions);
+      writeProfileOutput(caseOutputDir, result);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      results.push({
+        id: caseId,
+        intent: cliString(testCase.intent) || null,
+        ok: false,
+        expected_status: regressionPackHostedRiddleExpectedStatus(testCase) || null,
+        status: "configuration_error",
+        error: message,
+        output_dir: caseOutputDir || null
+      });
+      continue;
+    }
+    const expectedStatus = regressionPackHostedRiddleExpectedStatus(testCase);
+    const expectedMessage = regressionPackHostedRiddleExpectedMessage(testCase);
+    const statusOk = expectedStatus ? result.status === expectedStatus : result.status === "passed";
+    const messageOk = expectedMessage ? JSON.stringify(result).includes(expectedMessage) : true;
+    const ok = statusOk && messageOk;
+    results.push({
+      ...compactHostedRiddleCaseResult(testCase, result, ok),
+      output_dir: caseOutputDir || null
+    });
+  }
+  const failedCases = results.filter((item) => item.ok !== true).map((item) => cliString(item.id)).filter((item) => Boolean(item));
+  const environmentBlockedCases = results.filter((item) => cliString(item.status) === "environment_blocked").map((item) => cliString(item.id)).filter((item) => Boolean(item));
+  return {
+    requested: true,
+    configured: cases.length > 0,
+    ok: cases.length > 0 && !failedCases.length,
+    runner,
+    target,
+    started_at: startedAt,
+    finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+    case_count: cases.length,
+    passed_case_count: results.length - failedCases.length,
+    failed_cases: failedCases,
+    environment_blocked_cases: environmentBlockedCases,
+    cases: results
+  };
+}
+function hostedRiddleHandoffPromptForRegressionPack(pack) {
+  const cases = regressionPackHostedRiddleCases(pack);
+  const suite = regressionPackHostedRiddleSuite(pack);
+  const target = regressionPackRecord(suite.target);
+  const lines = [
+    "Run the hosted Riddle generic regression suite before involving OpenClaw.",
+    "",
+    "Command:",
+    "riddle-proof-loop regression-pack run --pack oc-flow-regression --local-core true --hosted-riddle true --format markdown --output-dir artifacts/riddle-proof/hosted-regression",
+    "",
+    "Target:",
+    ...Object.entries(target).map(([key, value]) => `- ${key}: ${JSON.stringify(value)}`),
+    "",
+    "Cases:",
+    ...cases.map((testCase, index) => {
+      const expect = regressionPackRecord(testCase.expect);
+      return `${index + 1}. ${cliString(testCase.id) || "unnamed-case"}: ${cliString(testCase.intent) || "no intent"}
+   Expect: ${JSON.stringify(expect)}`;
+    }),
+    "",
+    "Only pass the batch to OC after local_core.ok and hosted_riddle.ok are both true."
+  ].filter((line) => line !== "");
+  return lines.join("\n");
+}
 function openClawHandoffPromptForRegressionPack(pack, input) {
   const minimumVersions = regressionPackRecord(pack.minimum_versions);
   const runtimeGate = regressionPackRecord(pack.runtime_gate);
@@ -17560,6 +17799,7 @@ function openClawHandoffPromptForRegressionPack(pack, input) {
     "- Run cases serially, not as one broad parallel batch.",
     "- If loaded metadata is stale, stop and restart/reload the gateway before counting results.",
     "- If any generic lifecycle marker appears, report the exact marker and artifact, then stop the counted batch.",
+    input.localCoreOk ? input.hostedRiddleOk ? "- Generic local core and hosted Riddle suites are green; OC should only validate wrapper/runtime adapter behavior." : input.hostedRiddleRequested ? "- Hosted Riddle generic suite did not pass; do not treat OC failures as wrapper-only until it is green." : "- Hosted Riddle generic suite was not run in this regression-pack invocation; run it before counting OC as the late adapter gate." : "- Local generic core suite is not green or was not run; keep OC as blocked-on-generic until local core is green.",
     `- Forbidden terminal markers: ${forbiddenMarkers.join(", ") || "none"}.`,
     fields.length ? `- Log fields for every counted run: ${fields.join(", ")}.` : "",
     "",
@@ -17572,12 +17812,13 @@ function openClawHandoffPromptForRegressionPack(pack, input) {
       ].join("\n");
     }),
     "",
-    input.localCoreOk ? "Local generic core suite is green, so OC should only be validating wrapper/runtime behavior." : "Local generic core suite is not green or was not run; do not count OC failures as wrapper-only until local core is green."
+    input.localCoreOk ? "Local generic core suite is green." : "Local generic core suite is not green or was not run; do not count OC failures as wrapper-only until local core is green."
   ].filter((line) => line !== "");
   return lines.join("\n");
 }
 function compactRegressionPackRunResult(result) {
   const localCore = regressionPackRecord(result.local_core);
+  const hostedRiddle = regressionPackRecord(result.hosted_riddle);
   const openClaw = regressionPackRecord(result.openclaw_live_suite);
   return {
     version: result.version,
@@ -17592,12 +17833,22 @@ function compactRegressionPackRunResult(result) {
       failed_cases: localCore.failed_cases,
       forbidden_terminal_markers_seen: localCore.forbidden_terminal_markers_seen
     },
+    hosted_riddle: {
+      requested: hostedRiddle.requested,
+      configured: hostedRiddle.configured,
+      ok: hostedRiddle.ok,
+      runner: hostedRiddle.runner,
+      case_count: hostedRiddle.case_count,
+      failed_cases: hostedRiddle.failed_cases,
+      environment_blocked_cases: hostedRiddle.environment_blocked_cases
+    },
     openclaw_live_case_count: openClaw.case_count,
     output_dir: result.output_dir
   };
 }
 function regressionPackRunMarkdown(result) {
   const localCore = regressionPackRecord(result.local_core);
+  const hostedRiddle = regressionPackRecord(result.hosted_riddle);
   const runtimeGate = regressionPackRecord(result.runtime_gate);
   const minimumVersions = regressionPackRecord(result.minimum_versions);
   const openClaw = regressionPackRecord(result.openclaw_live_suite);
@@ -17617,6 +17868,16 @@ function regressionPackRunMarkdown(result) {
     `- failed cases: ${regressionPackStringArray(localCore.failed_cases).join(", ") || "none"}`,
     `- forbidden markers seen: ${regressionPackStringArray(localCore.forbidden_terminal_markers_seen).join(", ") || "none"}`,
     "",
+    "## Hosted Riddle",
+    "",
+    `- requested: ${hostedRiddle.requested === true}`,
+    `- configured: ${hostedRiddle.configured === true}`,
+    `- ok: ${hostedRiddle.ok === true}`,
+    `- runner: ${cliString(hostedRiddle.runner) || "n/a"}`,
+    `- cases: ${hostedRiddle.case_count ?? "n/a"}`,
+    `- failed cases: ${regressionPackStringArray(hostedRiddle.failed_cases).join(", ") || "none"}`,
+    `- environment blocked cases: ${regressionPackStringArray(hostedRiddle.environment_blocked_cases).join(", ") || "none"}`,
+    "",
     "## Runtime Gate",
     "",
     `- tool: ${cliString(runtimeGate.tool) || "n/a"}`,
@@ -17627,6 +17888,12 @@ function regressionPackRunMarkdown(result) {
     `- case count: ${openClaw.case_count ?? "n/a"}`,
     `- result log fields: ${regressionPackStringArray(openClaw.result_log_fields).join(", ") || "n/a"}`,
     "",
+    "## Hosted Riddle Handoff",
+    "",
+    "```text",
+    cliString(result.hosted_riddle_handoff_prompt) || "",
+    "```",
+    "",
     "## OC Handoff Prompt",
     "",
     "```text",
@@ -17643,22 +17910,29 @@ function writeRegressionPackOutput(outputDir, result) {
   (0, import_node_fs6.writeFileSync)(import_node_path6.default.join(outputDir, "regression-pack-result.json"), `${JSON.stringify(result, null, 2)}
 `);
   (0, import_node_fs6.writeFileSync)(import_node_path6.default.join(outputDir, "summary.md"), regressionPackRunMarkdown(result));
+  (0, import_node_fs6.writeFileSync)(import_node_path6.default.join(outputDir, "hosted-riddle-handoff.md"), `${cliString(result.hosted_riddle_handoff_prompt) || ""}
+`);
   (0, import_node_fs6.writeFileSync)(import_node_path6.default.join(outputDir, "oc-handoff.md"), `${cliString(result.openclaw_handoff_prompt) || ""}
 `);
 }
-function runRegressionPackForCli(options) {
+async function runRegressionPackForCli(options) {
   const { filePath, pack } = readRegressionPackForCli(options);
   const localCoreRequested = optionBoolean(options, "localCore") ?? true;
+  const hostedRiddleRequested = regressionPackHostedRiddleRequested(options);
   const localCore = localCoreRequested ? runRegressionPackLocalCore(pack) : { requested: false, ok: true, command: regressionPackCommandForLocalCore(pack) };
+  const hostedRiddle = hostedRiddleRequested ? await runRegressionPackHostedRiddle(pack, options) : regressionPackHostedRiddlePlan(pack);
   const liveSuite = regressionPackRecord(pack.openclaw_live_suite);
   const liveCases = Array.isArray(liveSuite.cases) ? liveSuite.cases : [];
   const localCoreRecord = regressionPackRecord(localCore);
+  const hostedRiddleRecord = regressionPackRecord(hostedRiddle);
   const localCoreValidated = localCoreRecord.requested === true && localCoreRecord.ok === true;
-  const ok = localCoreRequested ? localCoreValidated : true;
+  const hostedRiddleValidated = hostedRiddleRecord.requested === true && hostedRiddleRecord.ok === true;
+  const ok = (localCoreRequested ? localCoreValidated : true) && (hostedRiddleRequested ? hostedRiddleValidated : true);
   const result = {
     version: "riddle-proof.regression-pack-run-result.v1",
     ok,
     local_core_validated: localCoreValidated,
+    hosted_riddle_validated: hostedRiddleValidated,
     generated_at: (/* @__PURE__ */ new Date()).toISOString(),
     pack_path: filePath,
     pack_id: cliString(pack.pack_id) || null,
@@ -17668,13 +17942,19 @@ function runRegressionPackForCli(options) {
     runtime_gate: regressionPackRecord(pack.runtime_gate),
     forbidden_terminal_markers: regressionPackStringArray(pack.forbidden_terminal_markers),
     local_core: localCore,
+    hosted_riddle: hostedRiddle,
     openclaw_live_suite: {
       target: regressionPackRecord(liveSuite.target),
       result_log_fields: regressionPackStringArray(liveSuite.result_log_fields),
       case_count: liveCases.length,
       case_ids: liveCases.map((item) => cliString(regressionPackRecord(item).id)).filter(Boolean)
     },
-    openclaw_handoff_prompt: openClawHandoffPromptForRegressionPack(pack, { localCoreOk: localCoreValidated }),
+    hosted_riddle_handoff_prompt: hostedRiddleHandoffPromptForRegressionPack(pack),
+    openclaw_handoff_prompt: openClawHandoffPromptForRegressionPack(pack, {
+      localCoreOk: localCoreValidated,
+      hostedRiddleOk: hostedRiddleValidated,
+      hostedRiddleRequested
+    }),
     output_dir: profileOutputDirOption(options) || null
   };
   writeRegressionPackOutput(profileOutputDirOption(options), result);
@@ -21361,7 +21641,7 @@ async function main() {
   if (command === "regression-pack") {
     const action = positional[1] || "run";
     if (action !== "run") throw new Error("Only `regression-pack run` is supported.");
-    const result = runRegressionPackForCli(options);
+    const result = await runRegressionPackForCli(options);
     writeRegressionPackRunResult(result, options);
     process.exitCode = result.ok ? 0 : 1;
     return;

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-U73JPBZW.js";
+import "./chunk-UGHN77PS.js";
 import "./chunk-PEWAIEER.js";
 import "./chunk-TWTEUS7R.js";
 import "./chunk-ZREWMTFA.js";

package/examples/regression-packs/oc-flow-regression.json

@@ -40,6 +40,204 @@
       "no-diff-prod-audit-default-capture-pass"
     ]
   },
+  "hosted_riddle_suite": {
+    "runner": "riddle",
+    "target": {
+      "url": "https://riddledc.com/"
+    },
+    "result_log_fields": [
+      "case_id",
+      "profile_name",
+      "profile_status",
+      "route",
+      "riddle.job_id",
+      "riddle.status",
+      "artifacts",
+      "environment_blocker"
+    ],
+    "cases": [
+      {
+        "id": "hosted-home-to-proof-route-change-pass",
+        "intent": "Run the generic hosted Riddle profile runner against production home, click Proof, and prove terminal /proof/ before involving OC.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-home-to-proof",
+          "target": {
+            "route": "/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }],
+            "setup_actions": [
+              { "type": "click", "selector": "a[href*='/proof']", "after_ms": 750 }
+            ]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/proof/" },
+            { "type": "selector_visible", "selector": "main#main-content" },
+            { "type": "text_visible", "text": "Proof" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "passed" }
+      },
+      {
+        "id": "hosted-proof-to-home-route-change-pass",
+        "intent": "Run the generic hosted Riddle profile runner from /proof/, click the root/Home link, and prove terminal /.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-proof-to-home",
+          "target": {
+            "route": "/proof/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }],
+            "setup_actions": [
+              { "type": "click", "selector": "a[href='/'], a[href='https://riddledc.com/']", "after_ms": 750 }
+            ]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/" },
+            { "type": "selector_visible", "selector": "main#main-content" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "passed" }
+      },
+      {
+        "id": "hosted-pricing-query-hash-positive-pass",
+        "intent": "Run the hosted profile runner directly against Pricing with query/hash and prove slash, query, and hash are preserved.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-pricing-query-hash",
+          "target": {
+            "route": "/pricing/?rp_probe=1#pricing-probe",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }],
+            "setup_actions": [
+              {
+                "type": "window_eval",
+                "script": "return window.location.hash;",
+                "expect_return": "#pricing-probe",
+                "store_return_to": "__riddleProof.pricingHash",
+                "capture_return": true
+              }
+            ]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/pricing/" },
+            { "type": "url_search_param_equals", "param": "rp_probe", "expected_value": "1" },
+            { "type": "selector_visible", "selector": "main#main-content" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "passed" }
+      },
+      {
+        "id": "hosted-pricing-query-hash-dropped-blocker",
+        "intent": "Run a hosted negative control where Pricing lacks the expected query/hash and require a product_regression profile result.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-pricing-query-hash-dropped",
+          "target": {
+            "route": "/pricing/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/pricing/" },
+            { "type": "url_search_param_equals", "param": "rp_probe", "expected_value": "1" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "product_regression" }
+      },
+      {
+        "id": "hosted-no-diff-prod-audit-pass",
+        "intent": "Run a hosted no-diff production audit profile with no implementation or OC wrapper involved.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-no-diff-prod-audit",
+          "target": {
+            "route": "/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/" },
+            { "type": "selector_visible", "selector": "main#main-content" },
+            { "type": "no_fatal_console_errors" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "passed" }
+      },
+      {
+        "id": "hosted-missing-selector-timeout-blocker",
+        "intent": "Run a hosted profile with a missing selector and require a clean product_regression result, not a lifecycle failure.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-missing-selector",
+          "target": {
+            "route": "/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }]
+          },
+          "checks": [
+            { "type": "selector_visible", "selector": "#riddle-proof-missing-selector-timeout-smoke-20260604" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": { "profile_status": "product_regression" }
+      },
+      {
+        "id": "hosted-thrown-error-specific-blocker",
+        "intent": "Run a hosted profile whose setup action throws a marker and require the marker to surface as a product_regression result.",
+        "profile": {
+          "version": "riddle-proof.profile.v1",
+          "name": "riddle-site-hosted-thrown-error",
+          "target": {
+            "route": "/",
+            "wait_for_selector": "main#main-content",
+            "viewports": [{ "name": "desktop", "width": 1280, "height": 900 }],
+            "setup_actions": [
+              {
+                "type": "window_eval",
+                "script": "throw new Error('RIDDLE_PROOF_HOSTED_THROWN_ERROR_SMOKE_20260604');",
+                "timeout_ms": 1000
+              }
+            ]
+          },
+          "checks": [
+            { "type": "route_loaded", "expected_path": "/" }
+          ],
+          "metadata": {
+            "pack_id": "riddle_proof_hosted_flow",
+            "pack_public_name": "Riddle Proof Hosted Flow"
+          }
+        },
+        "expect": {
+          "profile_status": "product_regression",
+          "message_contains": "RIDDLE_PROOF_HOSTED_THROWN_ERROR_SMOKE_20260604"
+        }
+      }
+    ]
+  },
   "openclaw_live_suite": {
     "target": {
       "repo": "davisdiehl/riddle-site",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.8.33",
+  "version": "0.8.35",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",

package/runtime/lib/ship.py

@@ -320,7 +320,20 @@ def local_artifact_sources_fingerprint(local_sources):
 def public_proof_artifacts(state):
     published = state.get('proof_artifact_publication') or {}
     artifacts = published.get('artifacts') if isinstance(published, dict) else []
-    public = [artifact for artifact in artifacts or [] if isinstance(artifact, dict) and (artifact.get('raw_url') or artifact.get('html_url'))]
+    attachments = state.get('proof_image_attachments') or {}
+    attachment_artifacts = attachments.get('artifacts') if isinstance(attachments, dict) else []
+    public = [
+        {
+            **artifact,
+            'raw_url': artifact.get('attachment_url'),
+            'html_url': artifact.get('attachment_url'),
+            'embeddable': True,
+            'attachment': True,
+        }
+        for artifact in attachment_artifacts or []
+        if isinstance(artifact, dict) and artifact.get('attachment_url')
+    ]
+    public.extend([artifact for artifact in artifacts or [] if isinstance(artifact, dict) and (artifact.get('raw_url') or artifact.get('html_url'))])
     for artifact in collect_proof_artifact_sources(state):
         url = str(artifact.get('url') or '').strip()
         if is_http_url(url):
@@ -328,6 +341,7 @@ def public_proof_artifacts(state):
                 **artifact,
                 'raw_url': url,
                 'html_url': url,
+                'embeddable': True,
                 'published': False,
             })
     deduped = []
@@ -346,6 +360,8 @@ def first_public_artifact_url(state, role, kind=None):
             continue
         if kind and artifact.get('kind') != kind:
             continue
+        if artifact.get('kind') == 'image' and artifact.get('embeddable') is False:
+            continue
         return artifact.get('raw_url') or artifact.get('html_url') or artifact.get('url') or ''
     return ''
 
@@ -362,11 +378,92 @@ def resolve_github_repo_name(repo_dir):
     return ''
 
 
+def resolve_github_repo_private(repo_dir):
+    result = sp.run(['gh', 'repo', 'view', '--json', 'isPrivate', '--jq', '.isPrivate'],
+                    cwd=repo_dir, capture_output=True, text=True, timeout=30)
+    if result.returncode == 0:
+        text = result.stdout.strip().lower()
+        if text in ('true', 'false'):
+            return text == 'true'
+    return None
+
+
 def github_file_url(repo_name, ref, path_value, mode='blob'):
     safe_path = urllib.parse.quote(str(path_value or '').lstrip('/'), safe='/._-')
     return 'https://github.com/' + repo_name + '/' + mode + '/' + ref + '/' + safe_path
 
 
+def parse_github_image_markdown(line):
+    match = re.search(r'!\[[^\]]*\]\((https://github\.com/user-attachments/assets/[^)\s]+)\)', str(line or '').strip())
+    return match.group(1) if match else ''
+
+
+def upload_local_images_to_github_attachments(state, repo_dir):
+    if truthy(os.environ.get('RIDDLE_PROOF_DISABLE_GITHUB_IMAGE_ATTACHMENTS')):
+        state['proof_image_attachments'] = {'ok': False, 'skipped': True, 'reason': 'disabled'}
+        save_state(state)
+        return state['proof_image_attachments']
+
+    image_sources = [
+        artifact for artifact in local_proof_artifact_sources(state)
+        if artifact.get('kind') == 'image' and artifact.get('path')
+    ]
+    if not image_sources:
+        state['proof_image_attachments'] = {'ok': True, 'skipped': True, 'reason': 'no local image artifacts'}
+        save_state(state)
+        return state['proof_image_attachments']
+
+    repo_name = resolve_github_repo_name(repo_dir)
+    if not repo_name:
+        state['proof_image_attachments'] = {'ok': False, 'skipped': True, 'reason': 'repo name unavailable'}
+        save_state(state)
+        return state['proof_image_attachments']
+
+    timeout_seconds = int(os.environ.get('RIDDLE_PROOF_GH_IMAGE_TIMEOUT_SECONDS') or '15')
+    command = ['gh', 'image'] + [artifact.get('path') for artifact in image_sources] + ['--repo', repo_name]
+    try:
+        result = sp.run(command, cwd=repo_dir, capture_output=True, text=True, timeout=timeout_seconds)
+    except sp.TimeoutExpired:
+        state['proof_image_attachments'] = {'ok': False, 'skipped': True, 'reason': 'gh image timed out'}
+        save_state(state)
+        return state['proof_image_attachments']
+
+    if result.returncode != 0:
+        state['proof_image_attachments'] = {
+            'ok': False,
+            'skipped': True,
+            'reason': 'gh image failed',
+            'stderr': (result.stderr or result.stdout or '')[:500],
+        }
+        save_state(state)
+        return state['proof_image_attachments']
+
+    urls = [parse_github_image_markdown(line) for line in result.stdout.splitlines()]
+    urls = [url for url in urls if url]
+    if not urls:
+        state['proof_image_attachments'] = {'ok': False, 'skipped': True, 'reason': 'gh image returned no attachment URLs'}
+        save_state(state)
+        return state['proof_image_attachments']
+
+    artifacts = []
+    for index, artifact in enumerate(image_sources):
+        if index >= len(urls):
+            break
+        artifacts.append({
+            **artifact,
+            'attachment_url': urls[index],
+            'attachment': True,
+            'embeddable': True,
+        })
+    state['proof_image_attachments'] = {
+        'ok': True,
+        'repo': repo_name,
+        'artifacts': artifacts,
+    }
+    save_state(state)
+    return state['proof_image_attachments']
+
+
 def write_artifact_readme(path_value, state, artifacts):
     lines = [
         '# Riddle Proof Artifacts',
@@ -408,6 +505,7 @@ def publish_local_proof_artifacts_to_github(state, repo_dir, pr_num):
     repo_name = resolve_github_repo_name(repo_dir)
     if not repo_name:
         raise SystemExit('Could not resolve GitHub repository name for proof artifact publication.')
+    repo_private = resolve_github_repo_private(repo_dir)
 
     run_id = safe_slug(state.get('run_id') or str(int(time.time())), 'run')
     pr_slug = safe_slug('pr-' + str(pr_num or 'unknown'), 'pr')
@@ -474,11 +572,13 @@ def publish_local_proof_artifacts_to_github(state, repo_dir, pr_num):
                 published_path = artifact.get('published_path')
                 artifact['raw_url'] = github_file_url(repo_name, commit, published_path, 'raw')
                 artifact['html_url'] = github_file_url(repo_name, commit, published_path, 'blob')
+                artifact['embeddable'] = False if repo_private is True and artifact.get('kind') == 'image' else True
         publication = {
             'ok': True,
             'branch': artifact_branch,
             'commit': commit,
             'repo': repo_name,
+            'repo_private': repo_private,
             'html_url': github_file_url(repo_name, commit, artifact_dir_name, 'tree'),
             'manifest_url': github_file_url(repo_name, commit, artifact_dir_name + '/proof-artifacts.json', 'blob'),
             'readme_url': github_file_url(repo_name, commit, artifact_dir_name + '/README.md', 'blob'),
@@ -1080,6 +1180,12 @@ if publication.get('ok') and not publication.get('skipped'):
 elif publication.get('skipped'):
     print('Proof artifact publication skipped: ' + publication.get('reason', 'unknown'))
 
+image_attachments = upload_local_images_to_github_attachments(s, repo_dir)
+if image_attachments.get('ok') and not image_attachments.get('skipped'):
+    print('Proof images attached: ' + str(len(image_attachments.get('artifacts') or [])))
+elif image_attachments.get('skipped'):
+    print('Proof image attachment skipped: ' + image_attachments.get('reason', 'unknown'))
+
 # Post proof comment on PR
 body = '## Riddle Proof — Proof of Fix\n\n'
 body += '**Goal:** ' + s.get('change_request', '') + '\n\n'
@@ -1099,15 +1205,34 @@ if publication.get('ok') and not publication.get('skipped'):
 before_image = first_public_artifact_url(s, 'before', 'image')
 prod_image = first_public_artifact_url(s, 'prod', 'image')
 after_image = first_public_artifact_url(s, 'after', 'image')
+linked_image_artifacts = [
+    artifact for artifact in public_artifacts
+    if artifact.get('kind') == 'image'
+    and artifact.get('embeddable') is False
+    and (artifact.get('html_url') or artifact.get('raw_url'))
+]
 if before_image:
     body += '### Before\n![before](' + before_image + ')\n\n'
 if prod_image:
     body += '### Prod\n![prod](' + prod_image + ')\n\n'
 if after_image:
     body += '### After\n![after](' + after_image + ')\n\n'
+elif linked_image_artifacts:
+    body += '### After evidence\nA screenshot artifact was captured, but GitHub attachment upload was unavailable; linked image artifacts are listed below.\n\n'
 else:
     body += '### After evidence\nNo after screenshot was captured for this verification mode; structured evidence is summarized below.\n\n'
 
+if linked_image_artifacts:
+    body += '### Image artifacts\n'
+    for artifact in linked_image_artifacts[:12]:
+        label = artifact.get('name') or artifact.get('filename') or 'image'
+        url = artifact.get('html_url') or artifact.get('raw_url')
+        body += '- [' + str(label) + '](' + str(url) + ')'
+        if artifact.get('role'):
+            body += ' (' + str(artifact.get('role')) + ')'
+        body += '\n'
+    body += '\n'
+
 data_artifacts = [
     artifact for artifact in public_artifacts
     if artifact.get('kind') != 'image' and (artifact.get('html_url') or artifact.get('raw_url'))

package/runtime/tests/ship_artifact_publication.py

@@ -27,7 +27,15 @@ import sys
 
 args = sys.argv[1:]
 if args[:3] == ["repo", "view", "--json"]:
-    print("example/test-repo")
+    if "isPrivate" in args:
+        print("true")
+    else:
+        print("example/test-repo")
+    raise SystemExit(0)
+if args and args[0] == "image":
+    image_paths = [arg for arg in args[1:] if not arg.startswith("--") and arg != "example/test-repo"]
+    for index, image_path in enumerate(image_paths):
+        print(f"![{os.path.basename(image_path)}](https://github.com/user-attachments/assets/00000000-0000-4000-8000-{index:012d})")
     raise SystemExit(0)
 if args[:2] == ["pr", "list"]:
     print("")
@@ -163,16 +171,16 @@ def main():
         assert publication.get("ok") is True, "proof artifact publication should be recorded"
         assert publication.get("artifacts"), "published artifact list should be recorded"
         assert updated.get("ship_report", {}).get("after_artifact_url", "").startswith(
-            "https://github.com/example/test-repo/raw/"
-        ), "ship report should expose a GitHub-hosted after artifact URL"
+            "https://github.com/user-attachments/assets/"
+        ), "ship report should expose a GitHub-hosted attachment URL for the after artifact"
 
         comment = comment_body_path.read_text(encoding="utf-8")
         assert "file://" not in comment, "PR proof comment must not expose local file URLs"
         assert "raw.githubusercontent.com" not in comment, (
             "PR proof comment must not depend on unauthenticated raw GitHub URLs"
         )
-        assert "![after](https://github.com/example/test-repo/raw/" in comment, (
-            "PR proof comment should embed the GitHub-hosted after screenshot using a private-repo-safe URL"
+        assert "![after](https://github.com/user-attachments/assets/" in comment, (
+            "PR proof comment should embed the GitHub user-attachments screenshot when available"
         )
         assert "[proof.json](https://github.com/example/test-repo/blob/" in comment, (
             "PR proof comment should link the structured proof JSON"