@surlymochan/evalid 0.5.12 → 0.5.14

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project are documented here. Detailed notes live in
 
 ## [Unreleased]
 
+## [0.5.14] - 2026-11-09
+
+### Added
+- **PR comment ledger (#75)**: the proof-ledger workflow now posts the claim-vs-evidence ledger as a PR comment (`action/ledger-comment.mjs`, `.github/workflows/proof-ledger.yml`). A green proof gets a ✅ comment naming the verified change; a tampered proof fails the `ledger` check and gets a ❌ comment naming the exact break point, so a replay mismatch can no longer pass CI silently. Test evidence: 18 new tests in `test/github-action-ledger-comment.test.js` 18/18 pass; local full `npm test` 464 tests / 463 pass / 0 fail / 1 skipped (pre-existing); PR CI run 42505482112 success.
+
+Milestone M1 "GitHub Action end-to-end" acceptance evidence (issue #73, comment 6724800077): ① green path — PR #75 merged af88e2da, proof-ledger run 42505482067 success, ✅ ledger comment 6724656930; ② red path — demo PR #76 (closed unmerged by plan) turned the `ledger` check red (run 42505769769) and the ❌ comment 6724768829 names the break point `green_tree_mismatch: test/demo-tamper.test.js`; ③ CI replay and local replay agree on both verdicts (`valid` green, `green_tree_mismatch` tampered) through the same validator entry.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
+## [0.5.13] - 2026-11-09
+
+### Added
+- **Proof-seal verification GitHub Action (#71)**: new JavaScript action (`action.yml`, node22) that runs the existing i6b seal validator for one change-id/phase/attempt and exits non-zero unless the seal verifies and the clean replay matches the claim. Inputs: change-id, phase, attempt, project-root, tdd-mode; outputs: ok, verdict. Test evidence: 6 new tests in `test/github-action-verify-proof.test.js` (valid sealed green proof verifies; tampered proof fails with `binding_mismatch`; test drift after the seal fails with `green_tree_mismatch`; missing proof fails with `missing`; CLI entry exit 0/1; action.yml declares inputs and entry) 6/6 pass; RED→GREEN verified (`ERR_MODULE_NOT_FOUND` before the entry existed); PR CI run 42494536803 success.
+
+### Changed
+- **Removed dead phase-run-dispatch atom wrapper (#68)**: `src/agent_team/atoms/phase-run-dispatch.js` had zero callers — repo-wide grep finds only its own definition site, it is absent from `atoms/registry.json` and from the public `src/index.js` surface, and registry entry `I2.phase_run.dispatch` points elsewhere. No runtime behaviour changed. Test evidence: local full `npm test` 440 tests / 439 pass / 0 fail / 1 skipped (pre-existing); PR CI run 42483989723 verify pass.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
 ## [0.5.12] - 2026-11-08
 
 ### Added

package/README.md

@@ -149,6 +149,67 @@ node bin/xflow.js compare codex-goal
 node bin/xflow.js launch copy
 ```
 
+## GitHub Action: verify proofs in CI
+
+evalid ships as a GitHub Action (`action.yml` at the repo root). Add it to a
+workflow to verify a sealed TDD proof on every PR: a valid proof keeps the
+check green, a broken seal (or a test edited after the seal) turns it red —
+and the claim-vs-evidence ledger is posted as a PR comment either way, so
+the reviewer sees the claim next to the replay evidence without opening
+the workflow log.
+
+```yaml
+name: Proof ledger
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  ledger:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0  # replay materializes files from the recorded HEAD
+      - uses: actions/setup-node@v7.1.0
+        with:
+          node-version: '22'
+      - uses: surlymochan/evalid@main  # or a release tag (see CHANGELOG)
+        with:
+          change-id: my-change
+          phase: green
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+```
+
+Inputs: `change-id` (required), `phase` (`green`, default), `attempt` (`0`,
+default), `project-root` (`.`, default), `tdd-mode` (auto-detect, default),
+`post-comment` (`true`, default — set `false` to skip the comment),
+`github-token` (defaults to `$GITHUB_TOKEN`), `pr-number` (auto-detects
+from the event payload or ref when empty).
+
+The comment is upserted on a stable marker
+(`<!-- evalid-ledger: <change-id>/<phase>/<attempt> -->`), so re-runs
+update the same comment instead of posting a new one per push. A failed
+comment post never masks the verdict: the step still exits on the proof
+result, and `comment_posted` / `comment_url` are exposed as outputs.
+The check fails (exit 1) on `binding_mismatch`, `snapshot_mismatch`,
+`green_tree_mismatch`, replay mismatches, or a missing proof; the comment
+names the breakage point (for example the test files that drifted after
+the seal).
+
+Local equivalent of the CI replay — same validator, same entry:
+
+```bash
+node action/verify-proof.mjs --project-root . --change-id my-change --phase green
+```
+
+This repo dogfoods the Action on its own PRs via
+`.github/workflows/proof-ledger.yml`: it discovers every sealed proof
+added or changed by the PR (`specs/changes/*/tdd/*.json`) and verifies
+each one.
+
 ## Commands
 
 The installed binary is `xflow` (`npm install -g evalid` installs the `xflow` CLI). Every

package/RELEASE_NOTES.md

@@ -1,5 +1,25 @@
 # Release Notes
 
+## 0.5.14 - PR comment ledger (milestone M1 accepted)
+
+Patch release. One new feature since 0.5.13, verified end to end in CI and locally.
+
+**PR comment ledger (#75).** The proof-ledger workflow now posts the claim-vs-evidence ledger as a PR comment: a green proof gets a ✅ comment on the PR, and a tampered proof fails the `ledger` check and gets a ❌ comment naming the exact break point, so a replay mismatch can no longer pass CI silently. Test evidence: 18 new tests in `test/github-action-ledger-comment.test.js` 18/18 pass; local full `npm test` 464 tests / 463 pass / 0 fail / 1 skipped (pre-existing); PR CI run 42505482112 success.
+
+**Milestone M1 "GitHub Action end-to-end" — accepted.** Evidence in issue #73, comment 6724800077: ① green path — PR #75 merged (af88e2da), proof-ledger run 42505482067 success, ✅ ledger comment 6724656930; ② red path — demo PR #76 (closed unmerged by plan) turned the `ledger` check red (run 42505769769) and the ❌ comment 6724768829 names the break point `green_tree_mismatch: test/demo-tamper.test.js`; ③ CI replay and local replay agree on both verdicts (`valid` green, `green_tree_mismatch` tampered) through the same validator entry.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
+## 0.5.13 - Proof-seal verification action
+
+Patch release. One new feature and one dead-code removal since 0.5.12, both verified by the test suite.
+
+**Proof-seal verification GitHub Action (#71).** A new JavaScript GitHub Action (`action.yml`, node22) runs the existing i6b seal validator for one change-id/phase/attempt and fails the check unless the seal verifies and the clean replay matches the claim, so a replay mismatch can no longer pass CI silently. Test evidence: 6 new tests in `test/github-action-verify-proof.test.js` 6/6 pass (valid sealed green proof verifies; tampered proof fails with `binding_mismatch`; test drift after the seal fails with `green_tree_mismatch`; missing proof fails with `missing`; CLI entry exit 0/1; action.yml declares inputs and entry); RED→GREEN verified; PR CI run 42494536803 success.
+
+**Removed dead phase-run-dispatch atom wrapper (#68).** `src/agent_team/atoms/phase-run-dispatch.js` had zero callers and is absent from the atom registry and the public surface, so the wrapper is gone with no behaviour change. Test evidence: local full `npm test` 440 tests / 439 pass / 0 fail / 1 skipped (pre-existing); PR CI run 42483989723 verify pass.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
 ## 0.5.12 - Policy resolve atom test coverage
 
 Patch release. One test-coverage addition since 0.5.11, verified by the full test suite. No runtime behaviour changed.

package/docs/launch-dossier.md

@@ -1,6 +1,6 @@
 # evalid Launch Dossier
 
-Generated: 2026-11-08T01:34:24.683Z
+Generated: 2026-11-09T01:50:00.000Z
 Mode: post_publish
 Verdict: conditionally ready: engine and adoption evidence are strong, registry publication remains required for a splash launch
 Launch ready: not yet
@@ -117,7 +117,7 @@ Evidence:
 - Adoption records: 1; status: pass
 - Goal audit: pass; goal: Keep evalid credible as an open-source agent delivery runtime: repo-owned workflow contracts, executable verification gates, durable project context, and honest benchmark evidence.
 - Package evidence: missing; source: registry_json
-- Package name/version: @surlymochan/evalid@0.5.12
+- Package name/version: @surlymochan/evalid@0.5.14
 
 ## Passing Evidence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surlymochan/evalid",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "Claimed != verified: a runtime verification layer for coding agents. It seals each test run and replays it from a clean snapshot, with a zero-judge gate pipeline (spec clarification, code review, TDD proof) and the xflow CLI.",
   "keywords": [
     "ai-agents",

package/src/agent_team/atoms/phase-run-dispatch.js

@@ -1,8 +0,0 @@
-import { synthesizePhaseArtifact } from '../common.js';
-
-export async function phaseRunDispatch(input = {}, context = {}) {
-  return synthesizePhaseArtifact(input, context, {
-    phase: input.phase || context.phase?.id || 'execute',
-    summary: 'Phase-run dispatch completed and execution evidence was recorded.',
-  });
-}