@taskforcehq/taskforce 0.3.326 → 0.3.327

package/dist/mcp/server.js

@@ -1,2 +1,29 @@
-import { startTaskforceMcpStdioServer } from './runtime.js';
-await startTaskforceMcpStdioServer();
+import { existsSync, realpathSync } from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { startLocalServiceMcpProxy } from './localServiceProxy.js';
+import { observeTaskforceMcpStdioShutdown } from './stdioLifecycle.js';
+let fatalResolve;
+const fatal = new Promise((resolve) => { fatalResolve = resolve; });
+process.env.TASKFORCE_SHARED_LOCAL_MCP_ENABLED ??= 'true';
+const moduleDirectory = path.dirname(fileURLToPath(import.meta.url));
+const cliEntryPath = realpathSync(existsSync(path.resolve(moduleDirectory, '..', 'cli.js'))
+    ? path.resolve(moduleDirectory, '..', 'cli.js')
+    : path.resolve(moduleDirectory, '..', 'cli.ts'));
+const runtime = await startLocalServiceMcpProxy({
+    projectRoot: process.argv[2] || process.cwd(),
+    executablePath: process.execPath,
+    cliEntryPath,
+    execArgv: process.execArgv,
+    onFatal: () => {
+        process.exitCode = 1;
+        fatalResolve();
+    },
+});
+const lifecycle = observeTaskforceMcpStdioShutdown({
+    stdin: process.stdin,
+    process,
+    close: runtime.close,
+});
+await Promise.race([lifecycle.closed, fatal]);
+await runtime.close();

package/dist/mcp/sharedLocalServiceGateD.d.ts

@@ -0,0 +1,115 @@
+export declare const SHARED_LOCAL_GATE_D_SCHEMA_VERSION: 1;
+export declare const REQUIRED_LOCAL_MCP_HOST_IDS: readonly ["general", "antigravity", "claude-code", "cline", "codex", "cursor", "gemini-cli", "grok", "kiro", "openclaw", "vscode", "windsurf"];
+export type RequiredLocalMcpHostId = typeof REQUIRED_LOCAL_MCP_HOST_IDS[number];
+export type GateDEvidenceStatus = 'passed' | 'failed' | 'blocked' | 'not-run';
+export declare const REQUIRED_HOST_WORKFLOW_CHECKS: readonly ["generatedConfig", "toolsList", "profilelessRead", "resolveProfile", "createReadCommentLifecycle", "profileAttribution", "reconnect", "serviceRestart", "persistenceAfterRestart"];
+export type GateDHostWorkflowCheck = typeof REQUIRED_HOST_WORKFLOW_CHECKS[number];
+export interface GateDHostEvidence {
+    clientId: RequiredLocalMcpHostId;
+    status: GateDEvidenceStatus;
+    hostKind: 'generic' | 'cli' | 'gui' | 'agent';
+    provenance: 'actual-host' | 'generic-conformance';
+    binary: string;
+    version: string;
+    capturedAt: string;
+    checks: Partial<Record<GateDHostWorkflowCheck, boolean>>;
+    generatedConfigPath: string;
+    generatedConfigSha256: string;
+    transcriptPath: string;
+    transcriptSha256: string;
+    blocker?: string;
+}
+export interface GateDPrerequisiteEvidence {
+    status: GateDEvidenceStatus;
+    runId: string;
+    generatedAt: string;
+    taskforceVersion: string;
+    gitCommit: string;
+    reportPath: string;
+    reportSha256: string;
+}
+export interface SharedLocalGateDEvidence {
+    schemaVersion: typeof SHARED_LOCAL_GATE_D_SCHEMA_VERSION;
+    initializedAt: string;
+    finalizedAt: string;
+    taskforceVersion: string;
+    gitCommit: string;
+    runId: string;
+    hosts: GateDHostEvidence[];
+    prerequisites: {
+        gateB: GateDPrerequisiteEvidence;
+        gateC: GateDPrerequisiteEvidence;
+    };
+    resources: {
+        coreOwnerProcesses: number;
+        taskforceDatabaseOpenFiles: number;
+        defaultProfileToolBytes: number;
+        defaultProfileApproximateTokens: number;
+        fullProfileToolBytes: number;
+        fullProfileApproximateTokens: number;
+        serviceRssKb: number;
+        proxyRssKb: {
+            total: number;
+            p50: number;
+            max: number;
+        };
+    };
+    performance: {
+        attachLatencyMs: Record<'1' | '5' | '10', {
+            p50: number;
+            p95: number;
+        }>;
+        processCountDeviationAcknowledged: boolean;
+    };
+    observation: {
+        status: GateDEvidenceStatus;
+        startedAt: string;
+        endedAt: string;
+        durationMinutes: number;
+        sampleCount: number;
+        maxSampleGapSeconds: number;
+        readCount: number;
+        writeCount: number;
+        startHostSmokeSha256: string;
+        endHostSmokeSha256: string;
+        anomalies: {
+            crashes: number;
+            unexpectedOwnershipChanges: number;
+            staleSessionAccepted: number;
+            duplicateWrites: number;
+            attributionErrors: number;
+            unexpectedDatabaseHolders: number;
+            contextCeilingRegressions: number;
+        };
+        artifactPath: string;
+        artifactSha256: string;
+    };
+    rollback: {
+        status: GateDEvidenceStatus;
+        capturedAt: string;
+        legacySmoke: boolean;
+        exclusiveLeaseVerified: boolean;
+        serviceRecoveryVerified: boolean;
+        exactTaskforceVersion: string;
+        artifactPath: string;
+        artifactSha256: string;
+    };
+}
+export interface SharedLocalGateDDecision {
+    readyToRetireDirectRuntime: boolean;
+    reasons: string[];
+}
+export declare function hasContinuousGateDOperationCadence(input: {
+    timestamps: string[];
+    startedAt: string;
+    endedAt: string;
+    maximumGapSeconds: number;
+}): boolean;
+export declare function createEmptyGateDHostEvidence(): GateDHostEvidence[];
+export declare function evaluateSharedLocalGateD(evidence: SharedLocalGateDEvidence, options?: {
+    now?: Date;
+}): SharedLocalGateDDecision;
+export declare function validateSharedLocalGateDEvidence(value: unknown): {
+    evidence: SharedLocalGateDEvidence | null;
+    errors: string[];
+};

package/dist/mcp/sharedLocalServiceGateD.js

@@ -0,0 +1,344 @@
+import { MCP_CLIENT_REGISTRY } from './clientRegistry.js';
+export const SHARED_LOCAL_GATE_D_SCHEMA_VERSION = 1;
+export const REQUIRED_LOCAL_MCP_HOST_IDS = [
+    'general',
+    'antigravity',
+    'claude-code',
+    'cline',
+    'codex',
+    'cursor',
+    'gemini-cli',
+    'grok',
+    'kiro',
+    'openclaw',
+    'vscode',
+    'windsurf',
+];
+export const REQUIRED_HOST_WORKFLOW_CHECKS = [
+    'generatedConfig',
+    'toolsList',
+    'profilelessRead',
+    'resolveProfile',
+    'createReadCommentLifecycle',
+    'profileAttribution',
+    'reconnect',
+    'serviceRestart',
+    'persistenceAfterRestart',
+];
+export function hasContinuousGateDOperationCadence(input) {
+    const start = Date.parse(input.startedAt);
+    const end = Date.parse(input.endedAt);
+    const times = input.timestamps.map((timestamp) => Date.parse(timestamp)).sort((left, right) => left - right);
+    if (!Number.isFinite(start) || !Number.isFinite(end) || times.length === 0 || times.some((time) => !Number.isFinite(time)))
+        return false;
+    const maximumGapMs = input.maximumGapSeconds * 1000;
+    return times[0] >= start && times[times.length - 1] <= end
+        && times[0] - start <= maximumGapMs
+        && end - times[times.length - 1] <= maximumGapMs
+        && times.slice(1).every((time, index) => time - times[index] <= maximumGapMs);
+}
+const DEFAULT_TOOL_BYTES_CEILING = 64 * 1024;
+const DEFAULT_TOOL_TOKENS_CEILING = 16_384;
+const TRANSCRIPT_SHA256_PATTERN = /^[a-f0-9]{64}$/;
+export function createEmptyGateDHostEvidence() {
+    return REQUIRED_LOCAL_MCP_HOST_IDS.map((clientId) => ({
+        clientId,
+        status: 'not-run',
+        hostKind: clientId === 'general'
+            ? 'generic'
+            : MCP_CLIENT_REGISTRY[clientId].surfaceHint === 'cli'
+                ? 'cli'
+                : MCP_CLIENT_REGISTRY[clientId].surfaceHint === 'agent'
+                    ? 'agent'
+                    : 'gui',
+        provenance: clientId === 'general' ? 'generic-conformance' : 'actual-host',
+        binary: '',
+        version: '',
+        capturedAt: '',
+        checks: {},
+        generatedConfigPath: '',
+        generatedConfigSha256: '',
+        transcriptPath: '',
+        transcriptSha256: '',
+    }));
+}
+function validatePrerequisite(label, evidence, prerequisite, reasons) {
+    if (prerequisite.status !== 'passed')
+        reasons.push(`${label} evidence is ${prerequisite.status}.`);
+    if (!prerequisite.runId.trim())
+        reasons.push(`${label} run identity is missing.`);
+    if (prerequisite.taskforceVersion !== evidence.taskforceVersion)
+        reasons.push(`${label} was not produced by Taskforce ${evidence.taskforceVersion}.`);
+    if (prerequisite.gitCommit !== evidence.gitCommit)
+        reasons.push(`${label} was not produced from git commit ${evidence.gitCommit}.`);
+    if (!Number.isFinite(Date.parse(prerequisite.generatedAt)))
+        reasons.push(`${label} has an invalid generatedAt timestamp.`);
+    if (!prerequisite.reportPath.trim())
+        reasons.push(`${label} report path is missing.`);
+    if (!TRANSCRIPT_SHA256_PATTERN.test(prerequisite.reportSha256))
+        reasons.push(`${label} report SHA-256 is missing.`);
+    const evidenceTime = Date.parse(evidence.finalizedAt);
+    const prerequisiteTime = Date.parse(prerequisite.generatedAt);
+    if (Number.isFinite(evidenceTime) && Number.isFinite(prerequisiteTime)
+        && (prerequisiteTime > evidenceTime || evidenceTime - prerequisiteTime > 7 * 24 * 60 * 60 * 1000)) {
+        reasons.push(`${label} evidence is stale or from the future.`);
+    }
+}
+export function evaluateSharedLocalGateD(evidence, options) {
+    const reasons = [];
+    if (evidence.schemaVersion !== SHARED_LOCAL_GATE_D_SCHEMA_VERSION)
+        reasons.push('Unsupported Gate D evidence schema.');
+    if (!Number.isFinite(Date.parse(evidence.initializedAt)))
+        reasons.push('Gate D has an invalid initializedAt timestamp.');
+    if (!Number.isFinite(Date.parse(evidence.finalizedAt)))
+        reasons.push('Gate D has not been finalized.');
+    if (!evidence.taskforceVersion.trim())
+        reasons.push('Taskforce version is missing.');
+    if (!evidence.gitCommit.trim())
+        reasons.push('Git commit is missing.');
+    if (!evidence.runId.trim())
+        reasons.push('Gate D run identity is missing.');
+    const now = options?.now?.getTime() ?? Date.now();
+    const initializedTime = Date.parse(evidence.initializedAt);
+    const finalizedTime = Date.parse(evidence.finalizedAt);
+    if (Number.isFinite(initializedTime) && Number.isFinite(finalizedTime) && finalizedTime < initializedTime)
+        reasons.push('Gate D finalization predates initialization.');
+    if (Number.isFinite(finalizedTime) && (finalizedTime > now + 5 * 60 * 1000 || now - finalizedTime > 24 * 60 * 60 * 1000))
+        reasons.push('Gate D evidence is expired or finalized in the future.');
+    const hostIds = evidence.hosts.map((host) => host.clientId);
+    for (const clientId of REQUIRED_LOCAL_MCP_HOST_IDS) {
+        const matches = evidence.hosts.filter((host) => host.clientId === clientId);
+        if (matches.length !== 1) {
+            reasons.push(`${clientId} must have exactly one host evidence row.`);
+            continue;
+        }
+        const host = matches[0];
+        if (host.status !== 'passed') {
+            reasons.push(`${clientId} host evidence is ${host.status}${host.blocker ? `: ${host.blocker}` : '.'}`);
+            continue;
+        }
+        const expectedProvenance = clientId === 'general' ? 'generic-conformance' : 'actual-host';
+        if (host.provenance !== expectedProvenance)
+            reasons.push(`${clientId} has invalid host provenance.`);
+        const expectedHostKind = clientId === 'general'
+            ? 'generic'
+            : MCP_CLIENT_REGISTRY[clientId].surfaceHint === 'cli'
+                ? 'cli'
+                : MCP_CLIENT_REGISTRY[clientId].surfaceHint === 'agent'
+                    ? 'agent'
+                    : 'gui';
+        if (host.hostKind !== expectedHostKind)
+            reasons.push(`${clientId} has invalid host kind.`);
+        if (!host.binary.trim())
+            reasons.push(`${clientId} is missing its host binary or harness identity.`);
+        if (!host.version.trim())
+            reasons.push(`${clientId} is missing its host version.`);
+        const capturedTime = Date.parse(host.capturedAt);
+        const earliestCapture = Math.max(initializedTime, Date.parse(evidence.prerequisites.gateB.generatedAt), Date.parse(evidence.prerequisites.gateC.generatedAt));
+        if (!Number.isFinite(capturedTime) || capturedTime < earliestCapture || capturedTime > finalizedTime)
+            reasons.push(`${clientId} capture timestamp is outside the evidence window.`);
+        for (const check of REQUIRED_HOST_WORKFLOW_CHECKS)
+            if (host.checks[check] !== true)
+                reasons.push(`${clientId} did not pass ${check}.`);
+        if (!host.generatedConfigPath.trim())
+            reasons.push(`${clientId} is missing its generated-config artifact path.`);
+        if (!TRANSCRIPT_SHA256_PATTERN.test(host.generatedConfigSha256))
+            reasons.push(`${clientId} is missing a valid generated-config SHA-256.`);
+        if (!host.transcriptPath.trim())
+            reasons.push(`${clientId} is missing its redacted transcript path.`);
+        if (!TRANSCRIPT_SHA256_PATTERN.test(host.transcriptSha256))
+            reasons.push(`${clientId} is missing a valid transcript SHA-256.`);
+    }
+    for (const clientId of new Set(hostIds)) {
+        if (!REQUIRED_LOCAL_MCP_HOST_IDS.includes(clientId))
+            reasons.push(`Unexpected local host evidence: ${clientId}.`);
+    }
+    validatePrerequisite('Gate B', evidence, evidence.prerequisites.gateB, reasons);
+    validatePrerequisite('Gate C', evidence, evidence.prerequisites.gateC, reasons);
+    if (!evidence.prerequisites.gateB.runId || evidence.prerequisites.gateB.runId !== evidence.prerequisites.gateC.runId) {
+        reasons.push('Gate B and Gate C were not recorded in the same evidence run.');
+    }
+    if (evidence.runId !== evidence.prerequisites.gateB.runId)
+        reasons.push('Gate D run identity does not match its prerequisites.');
+    const finiteNonnegative = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+    const nonnegativeInteger = (value) => finiteNonnegative(value) && Number.isInteger(value);
+    if (!finiteNonnegative(evidence.resources.coreOwnerProcesses) || evidence.resources.coreOwnerProcesses !== 1)
+        reasons.push('Exactly one Core owner process is required.');
+    if (!finiteNonnegative(evidence.resources.taskforceDatabaseOpenFiles) || evidence.resources.taskforceDatabaseOpenFiles > 4)
+        reasons.push('Taskforce database open-file count must be between 0 and 4.');
+    if (!finiteNonnegative(evidence.resources.defaultProfileToolBytes) || evidence.resources.defaultProfileToolBytes > DEFAULT_TOOL_BYTES_CEILING)
+        reasons.push('Default-profile tool payload must be between 0 and 64 KiB.');
+    if (!finiteNonnegative(evidence.resources.defaultProfileApproximateTokens) || evidence.resources.defaultProfileApproximateTokens > DEFAULT_TOOL_TOKENS_CEILING)
+        reasons.push('Default-profile tool payload must be between 0 and approximately 16,384 tokens.');
+    if (!finiteNonnegative(evidence.resources.fullProfileToolBytes))
+        reasons.push('Full-profile tool bytes must be recorded.');
+    if (!finiteNonnegative(evidence.resources.fullProfileApproximateTokens))
+        reasons.push('Full-profile approximate tokens must be recorded.');
+    if (!finiteNonnegative(evidence.resources.serviceRssKb))
+        reasons.push('Service RSS must be recorded.');
+    for (const label of ['total', 'p50', 'max'])
+        if (!finiteNonnegative(evidence.resources.proxyRssKb[label]))
+            reasons.push(`Proxy RSS ${label} must be recorded.`);
+    for (const cohort of ['1', '5', '10']) {
+        const latency = evidence.performance.attachLatencyMs[cohort];
+        if (!latency || !finiteNonnegative(latency.p50) || !finiteNonnegative(latency.p95) || latency.p95 <= 0 || latency.p95 < latency.p50)
+            reasons.push(`Attach latency for ${cohort} client(s) is invalid.`);
+    }
+    if (!evidence.performance.processCountDeviationAcknowledged)
+        reasons.push('The thin-proxy process-count deviation has not been acknowledged.');
+    if (evidence.observation.status !== 'passed')
+        reasons.push(`Observation evidence is ${evidence.observation.status}.`);
+    const observationStart = Date.parse(evidence.observation.startedAt);
+    const observationEnd = Date.parse(evidence.observation.endedAt);
+    if (!Number.isFinite(observationStart) || !Number.isFinite(observationEnd) || observationStart < initializedTime || observationEnd > finalizedTime || observationEnd < observationStart)
+        reasons.push('Observation timestamps are outside the evidence window.');
+    if (!finiteNonnegative(evidence.observation.durationMinutes) || evidence.observation.durationMinutes < 30)
+        reasons.push('Observation duration is shorter than 30 minutes.');
+    const requiredSamples = finiteNonnegative(evidence.observation.durationMinutes)
+        ? Math.floor((evidence.observation.durationMinutes * 60) / 5) + 1
+        : Number.POSITIVE_INFINITY;
+    if (!nonnegativeInteger(evidence.observation.sampleCount) || evidence.observation.sampleCount < requiredSamples)
+        reasons.push('Observation does not contain five-second sample coverage.');
+    if (!finiteNonnegative(evidence.observation.maxSampleGapSeconds) || evidence.observation.maxSampleGapSeconds > 5)
+        reasons.push('Observation sample gap exceeds five seconds.');
+    const minimumReads = finiteNonnegative(evidence.observation.durationMinutes) ? Math.floor(evidence.observation.durationMinutes * 4) : Number.POSITIVE_INFINITY;
+    const minimumWrites = finiteNonnegative(evidence.observation.durationMinutes) ? Math.floor(evidence.observation.durationMinutes) : Number.POSITIVE_INFINITY;
+    if (!nonnegativeInteger(evidence.observation.readCount) || evidence.observation.readCount < minimumReads)
+        reasons.push('Observation requires reads at least every 15 seconds.');
+    if (!nonnegativeInteger(evidence.observation.writeCount) || evidence.observation.writeCount < minimumWrites)
+        reasons.push('Observation requires writes at least every 60 seconds.');
+    if (!TRANSCRIPT_SHA256_PATTERN.test(evidence.observation.startHostSmokeSha256))
+        reasons.push('Observation start host smoke is missing.');
+    if (!TRANSCRIPT_SHA256_PATTERN.test(evidence.observation.endHostSmokeSha256))
+        reasons.push('Observation end host smoke is missing.');
+    if (evidence.observation.startHostSmokeSha256 === evidence.observation.endHostSmokeSha256)
+        reasons.push('Observation boundary smokes must be distinct host transcripts.');
+    if (!evidence.observation.artifactPath.trim() || !TRANSCRIPT_SHA256_PATTERN.test(evidence.observation.artifactSha256))
+        reasons.push('Observation artifact is missing.');
+    for (const label of ['crashes', 'unexpectedOwnershipChanges', 'staleSessionAccepted', 'duplicateWrites', 'attributionErrors', 'unexpectedDatabaseHolders', 'contextCeilingRegressions']) {
+        const value = evidence.observation.anomalies[label];
+        if (!finiteNonnegative(value) || value !== 0)
+            reasons.push(`Observation anomaly ${label} must be zero.`);
+    }
+    if (evidence.rollback.status !== 'passed')
+        reasons.push(`Rollback evidence is ${evidence.rollback.status}.`);
+    const rollbackTime = Date.parse(evidence.rollback.capturedAt);
+    if (!Number.isFinite(rollbackTime) || rollbackTime < initializedTime || rollbackTime > finalizedTime)
+        reasons.push('Rollback timestamp is outside the evidence window.');
+    if (!evidence.rollback.legacySmoke)
+        reasons.push('Legacy rollback smoke test did not pass.');
+    if (!evidence.rollback.exclusiveLeaseVerified)
+        reasons.push('Legacy rollback exclusive lease was not verified.');
+    if (!evidence.rollback.serviceRecoveryVerified)
+        reasons.push('Shared-service recovery after rollback was not verified.');
+    if (evidence.rollback.exactTaskforceVersion !== evidence.taskforceVersion)
+        reasons.push('Rollback did not use the exact Taskforce version under test.');
+    if (!evidence.rollback.artifactPath.trim() || !TRANSCRIPT_SHA256_PATTERN.test(evidence.rollback.artifactSha256))
+        reasons.push('Rollback artifact is missing.');
+    return { readyToRetireDirectRuntime: reasons.length === 0, reasons };
+}
+export function validateSharedLocalGateDEvidence(value) {
+    const errors = [];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { evidence: null, errors: ['Evidence must be a JSON object.'] };
+    const record = value;
+    const isRecord = (input) => Boolean(input) && typeof input === 'object' && !Array.isArray(input);
+    const requiredObjects = ['prerequisites', 'resources', 'performance', 'observation', 'rollback'];
+    for (const key of requiredObjects)
+        if (!record[key] || typeof record[key] !== 'object' || Array.isArray(record[key]))
+            errors.push(`${key} must be an object.`);
+    if (!Array.isArray(record.hosts))
+        errors.push('hosts must be an array.');
+    if (record.schemaVersion !== SHARED_LOCAL_GATE_D_SCHEMA_VERSION)
+        errors.push(`schemaVersion must be ${SHARED_LOCAL_GATE_D_SCHEMA_VERSION}.`);
+    if (typeof record.initializedAt !== 'string')
+        errors.push('initializedAt must be a string.');
+    if (typeof record.finalizedAt !== 'string')
+        errors.push('finalizedAt must be a string.');
+    if (typeof record.taskforceVersion !== 'string')
+        errors.push('taskforceVersion must be a string.');
+    if (typeof record.gitCommit !== 'string')
+        errors.push('gitCommit must be a string.');
+    if (typeof record.runId !== 'string')
+        errors.push('runId must be a string.');
+    if (Array.isArray(record.hosts)) {
+        record.hosts.forEach((host, index) => {
+            if (!isRecord(host)) {
+                errors.push(`hosts[${index}] must be an object.`);
+                return;
+            }
+            for (const key of ['clientId', 'status', 'hostKind', 'provenance', 'binary', 'version', 'capturedAt', 'generatedConfigPath', 'generatedConfigSha256', 'transcriptPath', 'transcriptSha256']) {
+                if (typeof host[key] !== 'string')
+                    errors.push(`hosts[${index}].${key} must be a string.`);
+            }
+            if (!isRecord(host.checks))
+                errors.push(`hosts[${index}].checks must be an object.`);
+        });
+    }
+    if (isRecord(record.prerequisites)) {
+        for (const key of ['gateB', 'gateC']) {
+            const prerequisite = record.prerequisites[key];
+            if (!isRecord(prerequisite)) {
+                errors.push(`prerequisites.${key} must be an object.`);
+                continue;
+            }
+            for (const field of ['status', 'runId', 'generatedAt', 'taskforceVersion', 'gitCommit', 'reportPath', 'reportSha256']) {
+                if (typeof prerequisite[field] !== 'string')
+                    errors.push(`prerequisites.${key}.${field} must be a string.`);
+            }
+        }
+    }
+    if (isRecord(record.resources)) {
+        for (const field of ['coreOwnerProcesses', 'taskforceDatabaseOpenFiles', 'defaultProfileToolBytes', 'defaultProfileApproximateTokens', 'fullProfileToolBytes', 'fullProfileApproximateTokens', 'serviceRssKb']) {
+            if (typeof record.resources[field] !== 'number')
+                errors.push(`resources.${field} must be a number.`);
+        }
+        if (!isRecord(record.resources.proxyRssKb))
+            errors.push('resources.proxyRssKb must be an object.');
+        else
+            for (const field of ['total', 'p50', 'max'])
+                if (typeof record.resources.proxyRssKb[field] !== 'number')
+                    errors.push(`resources.proxyRssKb.${field} must be a number.`);
+    }
+    if (isRecord(record.performance)) {
+        const attach = record.performance.attachLatencyMs;
+        if (!isRecord(attach))
+            errors.push('performance.attachLatencyMs must be an object.');
+        else
+            for (const cohort of ['1', '5', '10']) {
+                if (!isRecord(attach[cohort]))
+                    errors.push(`performance.attachLatencyMs.${cohort} must be an object.`);
+                else
+                    for (const field of ['p50', 'p95'])
+                        if (typeof attach[cohort][field] !== 'number')
+                            errors.push(`performance.attachLatencyMs.${cohort}.${field} must be a number.`);
+            }
+        if (typeof record.performance.processCountDeviationAcknowledged !== 'boolean')
+            errors.push('performance.processCountDeviationAcknowledged must be a boolean.');
+    }
+    if (isRecord(record.observation)) {
+        for (const field of ['status', 'startedAt', 'endedAt', 'startHostSmokeSha256', 'endHostSmokeSha256', 'artifactPath', 'artifactSha256'])
+            if (typeof record.observation[field] !== 'string')
+                errors.push(`observation.${field} must be a string.`);
+        for (const field of ['durationMinutes', 'sampleCount', 'maxSampleGapSeconds', 'readCount', 'writeCount'])
+            if (typeof record.observation[field] !== 'number')
+                errors.push(`observation.${field} must be a number.`);
+        if (!isRecord(record.observation.anomalies))
+            errors.push('observation.anomalies must be an object.');
+        else
+            for (const field of ['crashes', 'unexpectedOwnershipChanges', 'staleSessionAccepted', 'duplicateWrites', 'attributionErrors', 'unexpectedDatabaseHolders', 'contextCeilingRegressions'])
+                if (typeof record.observation.anomalies[field] !== 'number')
+                    errors.push(`observation.anomalies.${field} must be a number.`);
+    }
+    if (isRecord(record.rollback)) {
+        for (const field of ['status', 'capturedAt', 'exactTaskforceVersion', 'artifactPath', 'artifactSha256'])
+            if (typeof record.rollback[field] !== 'string')
+                errors.push(`rollback.${field} must be a string.`);
+        for (const field of ['legacySmoke', 'exclusiveLeaseVerified', 'serviceRecoveryVerified'])
+            if (typeof record.rollback[field] !== 'boolean')
+                errors.push(`rollback.${field} must be a boolean.`);
+    }
+    if (errors.length > 0)
+        return { evidence: null, errors };
+    return { evidence: value, errors: [] };
+}

package/dist/mcp/stdioLifecycle.d.ts

@@ -0,0 +1,22 @@
+export interface TaskforceMcpStdioCloseInput {
+    closeServer(): Promise<void>;
+    closeOwnedCore?: () => void;
+}
+export declare function createTaskforceMcpStdioClose(input: TaskforceMcpStdioCloseInput): () => Promise<void>;
+interface ShutdownEventSource {
+    once(event: string, listener: () => void): unknown;
+    off(event: string, listener: () => void): unknown;
+}
+interface ShutdownProcess extends ShutdownEventSource {
+    exitCode?: string | number | null;
+}
+export declare function observeTaskforceMcpStdioShutdown(input: {
+    stdin: ShutdownEventSource;
+    process: ShutdownProcess;
+    close(): Promise<void>;
+}): {
+    closed: Promise<void>;
+    dispose(): void;
+    shutdown(): Promise<void>;
+};
+export {};

package/dist/mcp/stdioLifecycle.js

@@ -0,0 +1,54 @@
+export function createTaskforceMcpStdioClose(input) {
+    let closePromise = null;
+    return () => {
+        if (!closePromise) {
+            closePromise = (async () => {
+                try {
+                    await input.closeServer();
+                }
+                finally {
+                    input.closeOwnedCore?.();
+                }
+            })();
+        }
+        return closePromise;
+    };
+}
+export function observeTaskforceMcpStdioShutdown(input) {
+    let resolveClosed = null;
+    let rejectClosed = null;
+    const closed = new Promise((resolve, reject) => {
+        resolveClosed = resolve;
+        rejectClosed = reject;
+    });
+    let shutdownPromise = null;
+    const dispose = () => {
+        input.stdin.off('end', onInputEnd);
+        input.stdin.off('close', onInputClose);
+        input.process.off('SIGINT', onSigint);
+        input.process.off('SIGTERM', onSigterm);
+    };
+    const shutdown = () => {
+        if (!shutdownPromise) {
+            dispose();
+            shutdownPromise = input.close();
+            void shutdownPromise.then(() => resolveClosed?.(), (error) => rejectClosed?.(error));
+        }
+        return shutdownPromise;
+    };
+    const onInputEnd = () => { void shutdown(); };
+    const onInputClose = () => { void shutdown(); };
+    const onSigint = () => {
+        input.process.exitCode ??= 130;
+        void shutdown();
+    };
+    const onSigterm = () => {
+        input.process.exitCode ??= 143;
+        void shutdown();
+    };
+    input.stdin.once('end', onInputEnd);
+    input.stdin.once('close', onInputClose);
+    input.process.once('SIGINT', onSigint);
+    input.process.once('SIGTERM', onSigterm);
+    return { closed, dispose, shutdown };
+}