@senpi/runtime 3.0.55 → 3.0.57

package/dist/validate/proof.js

@@ -0,0 +1,256 @@
+/**
+ * The proof of a passing run, and the function that checks it.
+ *
+ * A proof is a claim about *content*: this exact recipe and these exact scanner files passed a
+ * full, unscoped, live validation. It is content-addressed — hash the authored bytes, nothing
+ * else — so a copied package is still proven (same content, same claim) and a one-character edit
+ * is not. There is no expiry: content that has not changed does not become less proven by sitting
+ * still, and a TTL would only train people to re-run validation ritually rather than when it
+ * means something.
+ *
+ * `verifyProof` is deliberately pure observation: it reports, it never enforces and never throws.
+ * The deploy verb owns the decision; this module owns the fact. It also never parses the recipe —
+ * the record carries the file list and the scanner roots, so verification is a re-hash and a
+ * comparison. A recipe that no longer parses necessarily hashes differently than the one that
+ * passed, which is the answer, not an error.
+ *
+ * Per-file hashes are stored so a refusal can say *what* changed. "The package differs" sends an
+ * agent diffing blindly; "scan.py changed, scoring.py is new" is an answer.
+ */
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { recordProofVerification } from "../telemetry/metrics.js";
+import { VERSION } from "../version.js";
+import { VALIDATE_CODE } from "./codes.js";
+/** Lives at the package root, beside the recipe. Excluded from its own fingerprint. */
+export const PROOF_FILENAME = ".senpi-proof.json";
+/**
+ * Not authored content. Interpreter caches and OS litter appear and vanish without anyone editing
+ * anything; hashing them would invalidate proofs for reasons no diff can show.
+ */
+const EXCLUDED = new Set([PROOF_FILENAME, ".DS_Store"]);
+const EXCLUDED_DIRS = new Set(["__pycache__", ".git"]);
+const EXCLUDED_SUFFIXES = [".pyc"];
+function sha256(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+function excluded(name) {
+    return EXCLUDED.has(name) || EXCLUDED_SUFFIXES.some((s) => name.endsWith(s));
+}
+/** Every authored file under a root, relative to the package root. Deterministic order. */
+function walk(root, packageRoot, into) {
+    let entries;
+    try {
+        entries = readdirSync(root);
+    }
+    catch {
+        return; // a root that vanished shows up as its files being absent, which is the honest answer
+    }
+    for (const name of entries.sort()) {
+        if (excluded(name))
+            continue;
+        const full = join(root, name);
+        let stat;
+        try {
+            stat = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isDirectory()) {
+            if (!EXCLUDED_DIRS.has(name))
+                walk(full, packageRoot, into);
+        }
+        else {
+            into.set(relative(packageRoot, full), sha256(readFileSync(full)));
+        }
+    }
+}
+/** Hash the authored content: the recipe as written, every scanner file verbatim. */
+export function fingerprintPackage(recipePath, scannerRoots) {
+    const packageRoot = dirname(recipePath);
+    const map = new Map();
+    try {
+        map.set(relative(packageRoot, recipePath), sha256(readFileSync(recipePath)));
+    }
+    catch {
+        // An unreadable recipe simply is not in the map; comparison reports it as changed/removed.
+    }
+    for (const root of scannerRoots)
+        walk(resolve(packageRoot, root), packageRoot, map);
+    const sorted = [...map.entries()].sort(([a], [b]) => (a < b ? -1 : 1));
+    return {
+        fingerprint: sha256(JSON.stringify(sorted)),
+        files: Object.fromEntries(sorted),
+    };
+}
+/**
+ * Record a passing run. Atomic — a crash mid-write must not leave a half-proof that
+ * `verifyProof` would read as corrupt-and-therefore-absent *after* a genuine pass.
+ *
+ * Returns the finding to attach when the write fails: the run still passed — the package is no
+ * less runnable because a disk was full — but the deploy gate will not find a proof, and whoever
+ * operates the environment is the one who can do something about that. Post-verdict by design:
+ * it must not flip a pass, even under --strict.
+ */
+export function writeProof(inputs) {
+    const packageRoot = dirname(inputs.recipePath);
+    const { fingerprint, files } = fingerprintPackage(inputs.recipePath, inputs.scannerRoots);
+    const record = {
+        record_version: 1,
+        fingerprint,
+        files,
+        recipe: relative(packageRoot, inputs.recipePath),
+        scanner_roots: inputs.scannerRoots,
+        runtime_version: VERSION,
+        verdict: "PASS",
+        ...(inputs.wallet
+            ? { wallet: { address: inputs.wallet.address, source: inputs.wallet.source, book: inputs.wallet.book } }
+            : {}),
+        observations: inputs.observations,
+        created_at: new Date().toISOString(),
+    };
+    const path = join(packageRoot, PROOF_FILENAME);
+    try {
+        const tmp = `${path}.tmp-${process.pid}`;
+        writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, "utf8");
+        renameSync(tmp, path);
+        return { recorded: true };
+    }
+    catch (err) {
+        return {
+            recorded: false,
+            finding: {
+                code: VALIDATE_CODE.proofNotRecorded,
+                severity: "warning",
+                stage: "proof",
+                actor: "ops",
+                fix_kind: "command",
+                what: `The run passed but its proof could not be written to ${path}`,
+                why: "The package is no less runnable — but the deploy gate reads the proof, not this output, so without the record the pass cannot be acted on.",
+                fix: `Make ${packageRoot} writable and run the validation again.`,
+                evidence: { error: String(err) },
+            },
+        };
+    }
+}
+function readRecord(packageRoot) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(packageRoot, PROOF_FILENAME), "utf8"));
+        // A record this code cannot vouch for is treated as absent, not as an error: the remedy is
+        // identical (run validation), and failing loudly on version 2 would make old runtimes refuse
+        // packages that newer ones proved.
+        if (parsed.record_version !== 1 || typeof parsed.fingerprint !== "string" || typeof parsed.files !== "object") {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch {
+        return undefined; // absent and corrupt are the same fact: there is no proof here
+    }
+}
+function refusal(reason, parts) {
+    const code = reason === "no_proof"
+        ? VALIDATE_CODE.noProof
+        : reason === "content_changed"
+            ? VALIDATE_CODE.contentChanged
+            : VALIDATE_CODE.runtimeVersionChanged;
+    return { code, severity: "error", stage: "proof", actor: "agent", fix_kind: "command", ...parts };
+}
+/**
+ * Is this package's content the content that passed?
+ *
+ * Pure observation for the deploy verb to act on. Every failure reason has the same remedy —
+ * `senpi validate <packageDir>` — stated on the finding, so the caller can surface it unmodified
+ * and an agent can close the loop without knowing anything about proofs.
+ */
+export function verifyProof(packageDir, options = {}) {
+    const instances = options.instances ?? [];
+    const result = instances.length === 0
+        ? verifyProofInner(packageDir)
+        : verifyInstances(packageDir, instances);
+    recordProofVerification(result.ok ? "ok" : result.reason);
+    return result;
+}
+/**
+ * Every named instance must be proven, and the first that is not decides the answer.
+ *
+ * Reported as one verdict rather than a list, because the caller's decision is binary and the
+ * remedy — revalidate the package — is the same whichever instance failed. The failing instance is
+ * named so the report still points somewhere.
+ */
+function verifyInstances(packageDir, instances) {
+    const packageRoot = resolve(packageDir);
+    for (const instance of instances) {
+        const result = verifyProofInner(join(packageRoot, instance));
+        if (!result.ok) {
+            const finding = result.finding;
+            return {
+                ...result,
+                changedFiles: result.changedFiles?.map((f) => join(instance, f)),
+                finding: {
+                    ...finding,
+                    what: `Instance '${instance}': ${finding.what}`,
+                    fix: `Run: senpi validate ${join(packageRoot, instance)}`,
+                },
+            };
+        }
+    }
+    return { ok: true };
+}
+function verifyProofInner(packageDir) {
+    const packageRoot = resolve(packageDir);
+    const record = readRecord(packageRoot);
+    if (record === undefined) {
+        return {
+            ok: false,
+            reason: "no_proof",
+            finding: refusal("no_proof", {
+                what: `No proof of a passing validation exists for ${packageRoot}`,
+                why: "Funding requires evidence the strategy runs. Only a full, unscoped `senpi validate` that passes writes that evidence — a scoped or shallow run deliberately does not.",
+                fix: `Run: senpi validate ${packageRoot}`,
+            }),
+        };
+    }
+    const current = fingerprintPackage(join(packageRoot, record.recipe), record.scanner_roots);
+    if (current.fingerprint !== record.fingerprint) {
+        const changed = new Set();
+        for (const [file, hash] of Object.entries(record.files)) {
+            if (current.files[file] !== hash)
+                changed.add(file); // edited or removed
+        }
+        for (const file of Object.keys(current.files)) {
+            if (!(file in record.files))
+                changed.add(file); // added — new code is unproven code
+        }
+        const changedFiles = [...changed].sort();
+        return {
+            ok: false,
+            reason: "content_changed",
+            changedFiles,
+            record,
+            finding: refusal("content_changed", {
+                what: `The package differs from the content that passed: ${changedFiles.slice(0, 5).join(", ")}${changedFiles.length > 5 ? ` and ${changedFiles.length - 5} more` : ""}`,
+                why: "The proof is a claim about exact content. These files are not the bytes that were validated, so nothing is known about how they behave.",
+                fix: `Run: senpi validate ${packageRoot}`,
+                evidence: { changed_files: changedFiles, proved_at: record.created_at },
+            }),
+        };
+    }
+    if (record.runtime_version !== VERSION) {
+        return {
+            ok: false,
+            reason: "runtime_version_changed",
+            record,
+            finding: refusal("runtime_version_changed", {
+                what: `The proof was recorded under runtime ${record.runtime_version}; this is ${VERSION}`,
+                why: "A pass is a claim about the package running under a specific runtime. The runtime changed, so the claim no longer covers what would actually execute.",
+                fix: `Run: senpi validate ${packageRoot}`,
+                evidence: { proved_under: record.runtime_version, current: VERSION },
+            }),
+        };
+    }
+    return { ok: true, record };
+}
+//# sourceMappingURL=proof.js.map

package/dist/validate/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../../src/validate/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AACxD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,CAAC;AAqCnC,SAAS,MAAM,CAAC,IAAqB;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,IAAY,EAAE,WAAmB,EAAE,IAAyB;IACxE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sFAAsF;IAChG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,YAAsB;IAEtB,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;IAC7F,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;KAClC,CAAC;AACJ,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAgB;QAC1B,cAAc,EAAE,CAAC;QACjB,WAAW;QACX,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;QAChD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,eAAe,EAAE,OAAO;QACxB,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;YACxG,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa,CAAC,gBAAgB;gBACpC,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,wDAAwD,IAAI,EAAE;gBACpE,GAAG,EAAE,4IAA4I;gBACjJ,GAAG,EAAE,QAAQ,WAAW,yCAAyC;gBACjE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;aACjC;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;QAClG,2FAA2F;QAC3F,6FAA6F;QAC7F,mCAAmC;QACnC,IAAI,MAAM,CAAC,cAAc,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9G,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,+DAA+D;IACnF,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAoB,EAAE,KAAqF;IAC1H,MAAM,IAAI,GACR,MAAM,KAAK,UAAU;QACnB,CAAC,CAAC,aAAa,CAAC,OAAO;QACvB,CAAC,CAAC,MAAM,KAAK,iBAAiB;YAC5B,CAAC,CAAC,aAAa,CAAC,cAAc;YAC9B,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;AACpG,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,UAAyB,EAAE;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,SAAmB;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAQ,CAAC;YAChC,OAAO;gBACL,GAAG,MAAM;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,EAAE;oBACP,GAAG,OAAO;oBACV,IAAI,EAAE,aAAa,QAAQ,MAAM,OAAO,CAAC,IAAI,EAAE;oBAC/C,GAAG,EAAE,uBAAuB,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE;iBAC1D;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC3B,IAAI,EAAE,+CAA+C,WAAW,EAAE;gBAClE,GAAG,EAAE,uKAAuK;gBAC5K,GAAG,EAAE,uBAAuB,WAAW,EAAE;aAC1C,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAChC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAChC,MAAM,CAAC,aAAa,CACrB,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;QAC3E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC;QACtF,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;YACzB,YAAY;YACZ,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,iBAAiB,EAAE;gBAClC,IAAI,EAAE,qDAAqD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxK,GAAG,EAAE,yIAAyI;gBAC9I,GAAG,EAAE,uBAAuB,WAAW,EAAE;gBACzC,QAAQ,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;aACxE,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB;YACjC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,wCAAwC,MAAM,CAAC,eAAe,aAAa,OAAO,EAAE;gBAC1F,GAAG,EAAE,uJAAuJ;gBAC5J,GAAG,EAAE,uBAAuB,WAAW,EAAE;gBACzC,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE;aACrE,CAAC;SACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/validate/recipe-checks.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Semantic checks on a parsed recipe — the things a schema cannot express.
+ *
+ * Each is a pure function over the parsed config, exported individually so the same check can run
+ * from `senpi validate` and, later, from the install and boot paths. One implementation, several
+ * callers, rather than a validation copy that drifts from the enforcement copy.
+ *
+ * ## Every check here was measured against the fleet before it was written
+ *
+ * A check that refuses a working strategy is worse than no check: it trains people to bypass the
+ * gate. Each of these was run against all 125 production instances first, and each fires on **none**
+ * of them. Two were narrowed as a direct result — see `findUnsizedStrategy` and
+ * `findMarginPctFraction`, where the obvious version of the check would have been wrong.
+ */
+import type { RuntimeConfig } from "../runtime/runtime-schema.js";
+import type { Finding } from "./types.js";
+/**
+ * An entry action for which **no margin source can ever resolve**.
+ *
+ * The runtime resolves margin in priority order: a per-signal `marginPct`, then config
+ * `margin_pct`, then `margin_per_slot`, then budget ÷ slots. If none produces a value the signal is
+ * skipped as `no_margin_configured` — the failure class behind thousands of declined signals.
+ *
+ * ## Why this is narrower than "no configured margin"
+ *
+ * **49% of production instances (61 of 125) declare no config margin at all.** They size from a
+ * per-signal `marginPct` their scanner emits, with config margin as an optional fallback — that is
+ * the fleet norm, not an oversight. Refusing them would have made this command reject half of a
+ * working fleet on its first day.
+ *
+ * So this fires only when *nothing could supply a margin*: no config source, no external scanner
+ * that could emit one, and no model-mode decision that could override. That condition is provable
+ * from the recipe alone, and it matches none of the 125.
+ *
+ * The weaker case — config margin absent and the scanner simply never emits one — is not knowable
+ * statically. It is caught at the live stage, where the signals a tick actually emits can be read.
+ */
+export declare function findUnsizedStrategy(config: RuntimeConfig): Finding[];
+/**
+ * An entry action with no risk guardrails.
+ *
+ * With no guardrail block the risk gate evaluates fully open: no daily loss limit, no drawdown
+ * ceiling, no trade cap. Every one of the 125 production instances declares one, so requiring it
+ * matches practice rather than imposing a new rule.
+ */
+export declare function findUngatedStrategy(config: RuntimeConfig): Finding[];
+/**
+ * `strategy.margin_pct` given as a fraction where a percent is required.
+ *
+ * `margin_pct: 0.20` is accepted by the schema — it is positive and under 100 — and sizes **0.2%**
+ * of withdrawable rather than 20%. A hundred times too small, with no error at any point.
+ *
+ * ## Scope: only what the runtime reads as a percent
+ *
+ * Deliberately not a walk of the whole document. Scanner `inputs` are private tunables in whatever
+ * units their scanner defines, and at least one production strategy carries fractional tier values
+ * there on purpose, converting them before emitting. Flagging those would accuse a correct strategy
+ * of a bug — so this reads only the field the runtime itself interprets as a percent.
+ *
+ * An emitted per-signal value is checked separately at the live stage, where the real value is
+ * visible rather than inferred.
+ */
+export declare function findMarginPctFraction(config: RuntimeConfig): Finding[];
+/** A model-mode decision action with no model configured — the decision step cannot run. */
+export declare function findLlmActionsWithoutModel(config: RuntimeConfig): Finding[];
+/**
+ * A declared entrypoint that is not on disk.
+ *
+ * Needs the resolved scanner root, so it takes what the target resolver worked out rather than
+ * re-deriving it. Without this the failure surfaces only when the scanner process starts and dies.
+ */
+export declare function findMissingEntrypoints(config: RuntimeConfig, resolveScannerRoot: (scannerPath: string) => {
+    ok: true;
+    root: string;
+} | {
+    ok: false;
+    reason: string;
+}, exists: (path: string) => boolean, join: (...parts: string[]) => string): Finding[];
+//# sourceMappingURL=recipe-checks.d.ts.map

package/dist/validate/recipe-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-checks.d.ts","sourceRoot":"","sources":["../../src/validate/recipe-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAW,MAAM,YAAY,CAAC;AA0BnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,EAAE,CAkCpE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,EAAE,CAoBpE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,EAAE,CAqBtE;AAED,4FAA4F;AAC5F,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,EAAE,CAc3E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACvG,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,EACjC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,GACnC,OAAO,EAAE,CAsCX"}

package/dist/validate/recipe-checks.js

@@ -0,0 +1,202 @@
+/**
+ * Semantic checks on a parsed recipe — the things a schema cannot express.
+ *
+ * Each is a pure function over the parsed config, exported individually so the same check can run
+ * from `senpi validate` and, later, from the install and boot paths. One implementation, several
+ * callers, rather than a validation copy that drifts from the enforcement copy.
+ *
+ * ## Every check here was measured against the fleet before it was written
+ *
+ * A check that refuses a working strategy is worse than no check: it trains people to bypass the
+ * gate. Each of these was run against all 125 production instances first, and each fires on **none**
+ * of them. Two were narrowed as a direct result — see `findUnsizedStrategy` and
+ * `findMarginPctFraction`, where the obvious version of the check would have been wrong.
+ */
+import { basename } from "node:path";
+import { VALIDATE_CODE } from "./codes.js";
+const OPEN_POSITION = "OPEN_POSITION";
+function staticFinding(code, fixKind, parts) {
+    return { code, severity: "error", stage: "static", actor: "agent", fix_kind: fixKind, ...parts };
+}
+/** Actions that can open a position — the only ones for which sizing and guardrails matter. */
+function entryActions(config) {
+    return (config.actions ?? [])
+        .map((action, index) => ({ action: action, index }))
+        .filter(({ action }) => action.action_type === OPEN_POSITION);
+}
+/** Read a possibly-absent numeric field without asserting it exists on the schema type. */
+function numberField(source, key) {
+    if (source === null || typeof source !== "object")
+        return undefined;
+    const value = source[key];
+    return typeof value === "number" ? value : undefined;
+}
+/**
+ * An entry action for which **no margin source can ever resolve**.
+ *
+ * The runtime resolves margin in priority order: a per-signal `marginPct`, then config
+ * `margin_pct`, then `margin_per_slot`, then budget ÷ slots. If none produces a value the signal is
+ * skipped as `no_margin_configured` — the failure class behind thousands of declined signals.
+ *
+ * ## Why this is narrower than "no configured margin"
+ *
+ * **49% of production instances (61 of 125) declare no config margin at all.** They size from a
+ * per-signal `marginPct` their scanner emits, with config margin as an optional fallback — that is
+ * the fleet norm, not an oversight. Refusing them would have made this command reject half of a
+ * working fleet on its first day.
+ *
+ * So this fires only when *nothing could supply a margin*: no config source, no external scanner
+ * that could emit one, and no model-mode decision that could override. That condition is provable
+ * from the recipe alone, and it matches none of the 125.
+ *
+ * The weaker case — config margin absent and the scanner simply never emits one — is not knowable
+ * statically. It is caught at the live stage, where the signals a tick actually emits can be read.
+ */
+export function findUnsizedStrategy(config) {
+    const entries = entryActions(config);
+    if (entries.length === 0)
+        return [];
+    const strategy = config.strategy;
+    const hasConfigMargin = numberField(strategy, "margin_pct") !== undefined ||
+        numberField(strategy, "margin_per_slot") !== undefined ||
+        numberField(strategy, "budget") !== undefined;
+    if (hasConfigMargin)
+        return [];
+    const scanners = config.scanners ?? [];
+    const hasExternalScanner = scanners.some((s) => s.type === "external_scanner");
+    const hasModelDecision = (config.actions ?? []).some((a) => a.decision_mode === "llm");
+    if (hasExternalScanner || hasModelDecision)
+        return [];
+    const { action, index } = entries[0];
+    return [
+        staticFinding(VALIDATE_CODE.unsized, "edit", {
+            what: `Action '${action.name}' opens positions, but nothing in this recipe can determine how large they should be`,
+            why: "The runtime sizes from a per-signal margin, then config margin_pct, then margin_per_slot. " +
+                "This recipe declares none of them, and has no external scanner or model-mode decision that " +
+                "could supply one per signal — so every signal is skipped as no_margin_configured. The " +
+                "strategy runs, reports healthy, and never trades.",
+            fix: "Set one under `strategy:` — `margin_pct: <n>` (percent of withdrawable, 0-100) " +
+                "or `margin_per_slot: <usd>`.",
+            where: { yaml_path: "strategy" },
+            evidence: { action: action.name, action_index: index },
+        }),
+    ];
+}
+/**
+ * An entry action with no risk guardrails.
+ *
+ * With no guardrail block the risk gate evaluates fully open: no daily loss limit, no drawdown
+ * ceiling, no trade cap. Every one of the 125 production instances declares one, so requiring it
+ * matches practice rather than imposing a new rule.
+ */
+export function findUngatedStrategy(config) {
+    const entries = entryActions(config);
+    if (entries.length === 0)
+        return [];
+    const guardRails = config.risk?.guard_rails;
+    if (guardRails !== undefined && guardRails !== null)
+        return [];
+    const { action } = entries[0];
+    return [
+        staticFinding(VALIDATE_CODE.ungated, "edit", {
+            what: `Action '${action.name}' opens positions with no risk guardrails configured`,
+            why: "With no guardrail block the risk gate evaluates fully open — no daily loss limit, no " +
+                "drawdown ceiling, no trade cap. Nothing stops a losing run except the exit engine on each " +
+                "individual position.",
+            fix: "Add a `risk.guard_rails:` block setting the limits this strategy should stop at.",
+            where: { yaml_path: "risk" },
+            evidence: { action: action.name },
+        }),
+    ];
+}
+/**
+ * `strategy.margin_pct` given as a fraction where a percent is required.
+ *
+ * `margin_pct: 0.20` is accepted by the schema — it is positive and under 100 — and sizes **0.2%**
+ * of withdrawable rather than 20%. A hundred times too small, with no error at any point.
+ *
+ * ## Scope: only what the runtime reads as a percent
+ *
+ * Deliberately not a walk of the whole document. Scanner `inputs` are private tunables in whatever
+ * units their scanner defines, and at least one production strategy carries fractional tier values
+ * there on purpose, converting them before emitting. Flagging those would accuse a correct strategy
+ * of a bug — so this reads only the field the runtime itself interprets as a percent.
+ *
+ * An emitted per-signal value is checked separately at the live stage, where the real value is
+ * visible rather than inferred.
+ */
+export function findMarginPctFraction(config) {
+    const marginPct = numberField(config.strategy, "margin_pct");
+    // Strictly below 1. Exactly 1 is ambiguous — it reads as either a fraction meaning 100% or a
+    // plain 1%, and 1% is an ordinary size for a many-slot strategy. Refusing it would block a
+    // working recipe to catch a mistake whose worst outcome is positions that open too small and are
+    // immediately visible. The asymmetry favours letting it through.
+    if (marginPct === undefined || marginPct >= 1)
+        return [];
+    const asPercent = marginPct * 100;
+    return [
+        staticFinding(VALIDATE_CODE.marginPctFraction, "edit", {
+            what: `strategy.margin_pct is ${marginPct}, which the runtime reads as ${marginPct}% of withdrawable`,
+            why: `This field is a PERCENT in (0,100], not a fraction — the runtime sizes ` +
+                `(margin_pct / 100) × withdrawable. A value of ${marginPct} sizes every position a hundred ` +
+                `times smaller than ${asPercent}%, and nothing errors: the positions simply open tiny.`,
+            fix: `Write ${asPercent} if you meant ${asPercent}%. Keep ${marginPct} only if you genuinely want ${marginPct}% of withdrawable.`,
+            where: { yaml_path: "strategy.margin_pct" },
+            evidence: { declared: marginPct, interpreted_as_percent: marginPct, likely_intended: asPercent },
+        }),
+    ];
+}
+/** A model-mode decision action with no model configured — the decision step cannot run. */
+export function findLlmActionsWithoutModel(config) {
+    return (config.actions ?? [])
+        .map((action, index) => ({ action: action, index }))
+        .filter(({ action }) => action.decision_mode === "llm")
+        .filter(({ action }) => !action.decision_model || action.decision_model.trim() === "")
+        .map(({ action, index }) => staticFinding(VALIDATE_CODE.llmNoModel, "edit", {
+        what: `Action '${action.name}' is in model decision mode but names no model`,
+        why: "The decision step has nothing to call, so the action cannot evaluate a signal.",
+        fix: `Set \`decision_model:\` on action '${action.name}', or change \`decision_mode\` to \`rule\` if the scanner already applies every filter.`,
+        where: { yaml_path: `actions.${index}` },
+        evidence: { action: action.name, action_index: index },
+    }));
+}
+/**
+ * A declared entrypoint that is not on disk.
+ *
+ * Needs the resolved scanner root, so it takes what the target resolver worked out rather than
+ * re-deriving it. Without this the failure surfaces only when the scanner process starts and dies.
+ */
+export function findMissingEntrypoints(config, resolveScannerRoot, exists, join) {
+    const findings = [];
+    (config.scanners ?? []).forEach((scanner, index) => {
+        if (scanner.type !== "external_scanner")
+            return;
+        const declaredPath = scanner.path;
+        const entrypoint = scanner.entrypoint;
+        if (!declaredPath || !entrypoint)
+            return; // absence is a schema concern, not this check's
+        const resolved = resolveScannerRoot(declaredPath);
+        if (!resolved.ok) {
+            findings.push(staticFinding(VALIDATE_CODE.unresolvableScannerPath, "edit", {
+                what: `Scanner '${scanner.name}' declares path '${declaredPath}', which cannot be resolved`,
+                why: `${resolved.reason} An unresolved relative path is interpreted against whatever directory the runtime happens to be started from, which is rarely the one you meant.`,
+                fix: "Make the path absolute, or validate from a target that has a directory to resolve against.",
+                where: { yaml_path: `scanners.${index}.path` },
+                evidence: { declared_path: declaredPath, scanner: scanner.name },
+            }));
+            return;
+        }
+        const expected = join(resolved.root, entrypoint);
+        if (exists(expected))
+            return;
+        findings.push(staticFinding(VALIDATE_CODE.entrypointMissing, "edit", {
+            what: `Scanner '${scanner.name}' declares entrypoint '${entrypoint}', which is not at ${expected}`,
+            why: "The runtime imports this file by name when the scanner starts. If it is missing the scanner dies on launch and never produces a signal.",
+            fix: `Create ${basename(expected)} in ${resolved.root}, or correct \`entrypoint\` to name the file that is actually there.`,
+            where: { yaml_path: `scanners.${index}.entrypoint` },
+            evidence: { expected_path: expected, scanner: scanner.name, declared_entrypoint: entrypoint },
+        }));
+    });
+    return findings;
+}
+//# sourceMappingURL=recipe-checks.js.map

package/dist/validate/recipe-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-checks.js","sourceRoot":"","sources":["../../src/validate/recipe-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,aAAa,CACpB,IAAY,EACZ,OAAgB,EAChB,KAA+G;IAE/G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACnG,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAA+C,EAAE,KAAK,EAAE,CAAC,CAAC;SAC5F,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;AAClE,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,MAAe,EAAE,GAAW;IAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,KAAK,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAmB,CAAC;IAC5C,MAAM,eAAe,GACnB,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,SAAS;QACjD,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,KAAK,SAAS;QACtD,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;IAChD,IAAI,eAAe;QAAE,OAAO,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC/E,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAgC,CAAC,aAAa,KAAK,KAAK,CACjE,CAAC;IACF,IAAI,kBAAkB,IAAI,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAEtD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACtC,OAAO;QACL,aAAa,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE;YAC3C,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,sFAAsF;YAClH,GAAG,EACD,4FAA4F;gBAC5F,6FAA6F;gBAC7F,wFAAwF;gBACxF,mDAAmD;YACrD,GAAG,EACD,iFAAiF;gBACjF,8BAA8B;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;YAChC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;SACvD,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,UAAU,GAAI,MAAM,CAAC,IAA8C,EAAE,WAAW,CAAC;IACvF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC/B,OAAO;QACL,aAAa,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE;YAC3C,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,sDAAsD;YAClF,GAAG,EACD,uFAAuF;gBACvF,4FAA4F;gBAC5F,sBAAsB;YACxB,GAAG,EAAE,kFAAkF;YACvF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;SAClC,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,QAAmB,EAAE,YAAY,CAAC,CAAC;IACxE,6FAA6F;IAC7F,2FAA2F;IAC3F,iGAAiG;IACjG,iEAAiE;IACjE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,SAAS,GAAG,SAAS,GAAG,GAAG,CAAC;IAClC,OAAO;QACL,aAAa,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE;YACrD,IAAI,EAAE,0BAA0B,SAAS,gCAAgC,SAAS,mBAAmB;YACrG,GAAG,EACD,yEAAyE;gBACzE,iDAAiD,SAAS,kCAAkC;gBAC5F,sBAAsB,SAAS,wDAAwD;YACzF,GAAG,EAAE,SAAS,SAAS,iBAAiB,SAAS,WAAW,SAAS,+BAA+B,SAAS,oBAAoB;YACjI,KAAK,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE;YAC3C,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE;SACjG,CAAC;KACH,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,0BAA0B,CAAC,MAAqB;IAC9D,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAA2E,EAAE,KAAK,EAAE,CAAC,CAAC;SACxH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC;SACtD,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;SACrF,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CACzB,aAAa,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE;QAC9C,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,gDAAgD;QAC5E,GAAG,EAAE,gFAAgF;QACrF,GAAG,EAAE,sCAAsC,MAAM,CAAC,IAAI,yFAAyF;QAC/I,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,KAAK,EAAE,EAAE;QACxC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;KACvD,CAAC,CACH,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,kBAAuG,EACvG,MAAiC,EACjC,IAAoC;IAEpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO;QAChD,MAAM,YAAY,GAAI,OAA6B,CAAC,IAAI,CAAC;QACzD,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,gDAAgD;QAE1F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,aAAa,CAAC,uBAAuB,EAAE,MAAM,EAAE;gBAC3D,IAAI,EAAE,YAAY,OAAO,CAAC,IAAI,oBAAoB,YAAY,6BAA6B;gBAC3F,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,mJAAmJ;gBAC1K,GAAG,EAAE,4FAA4F;gBACjG,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,KAAK,OAAO,EAAE;gBAC9C,QAAQ,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;aACjE,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE7B,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE;YACrD,IAAI,EAAE,YAAY,OAAO,CAAC,IAAI,0BAA0B,UAAU,sBAAsB,QAAQ,EAAE;YAClG,GAAG,EAAE,yIAAyI;YAC9I,GAAG,EAAE,UAAU,QAAQ,CAAC,QAAQ,CAAC,OAAO,QAAQ,CAAC,IAAI,sEAAsE;YAC3H,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,KAAK,aAAa,EAAE;YACpD,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE;SAC9F,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validate/recipe.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The static depth: read a recipe and report what is wrong with it.
+ *
+ * Mirrors the loading path the runtime itself uses — same parser, same schema, same hint table, same
+ * semantic asserts — but collects findings instead of throwing at the first one. The throwing loader
+ * is untouched and remains the runtime's entry point; this is a second reading of the same rules for
+ * a different audience.
+ *
+ * ## Ordering: fail fast at dependency boundaries, report together within one
+ *
+ * A config that will not parse cannot be schema-checked, and one that fails the schema cannot be
+ * semantically checked — running those anyway produces findings derived from a shape that does not
+ * exist. So each boundary stops the pass.
+ *
+ * Within a boundary the opposite applies: schema issues are independent of one another, as are the
+ * semantic checks, so all of them are reported at once. An agent fixing one thing per round trip is
+ * an agent making N round trips for information we already had.
+ */
+import { type RuntimeConfig } from "../runtime/runtime-schema.js";
+import type { Finding } from "./types.js";
+export interface RecipeSource {
+    /** Absolute path to read, when the recipe is on disk. */
+    path?: string;
+    /** Recipe text, when supplied directly. */
+    content?: string;
+    /** Absolute directory relative scanner paths resolve against, when there is one. */
+    baseDir?: string;
+}
+export interface RecipeValidation {
+    findings: Finding[];
+    /** Present only when the recipe parsed and satisfied the schema. */
+    config?: RuntimeConfig;
+}
+/**
+ * Read a recipe and report every problem the static depth can see.
+ *
+ * Returns the parsed config alongside the findings when it got that far, so a caller running deeper
+ * depths does not parse a second time.
+ */
+export declare function collectRecipeFindings(source: RecipeSource): Promise<RecipeValidation>;
+//# sourceMappingURL=recipe.d.ts.map

package/dist/validate/recipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe.d.ts","sourceRoot":"","sources":["../../src/validate/recipe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUvF,OAAO,KAAK,EAAE,OAAO,EAA4B,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAkID;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2F3F"}