@treeseed/sdk 0.11.0 → 0.12.5

package/dist/reconcile/live-acceptance.js

@@ -1,13 +1,13 @@
 import { execFileSync } from "node:child_process";
 import { createServer } from "node:net";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { performance } from "node:perf_hooks";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import {
   createTreeseedCanonicalReconcileReport
 } from "./platform.js";
+import { runTreeseedGit } from "../operations/services/git-runner.js";
 import {
   deleteRailwayProject,
   ensureRailwayEnvironment,
@@ -26,12 +26,92 @@ import {
   upsertRailwayVariables
 } from "../operations/services/railway-api.js";
 import { resolveGitHubCredentialForRepository } from "../operations/services/github-credentials.js";
+import { MarketClient } from "../market-client.js";
+import { MarketProviderClient } from "../capacity-provider.js";
 const PROVIDER_CAPABILITIES = {
-  railway: ["project", "environment", "service", "image-service", "postgres", "volume", "domain", "variables", "deployment-health"],
+  railway: ["project", "environment", "service", "image-service", "postgres", "volume", "domain", "variables", "deployment-health", "capacity-provider-runtime-assignment-proof"],
   cloudflare: ["pages", "worker", "d1", "r2", "kv", "queue", "dns", "turnstile", "secrets", "cache-rules"],
   github: ["environment", "secret", "variable", "workflow-dispatch", "workflow-observation", "repository-scoped-token"],
-  local: ["process", "port", "local-db", "local-runner", "docker-compose-capacity-provider"]
+  local: ["process", "port", "local-db", "local-runner", "docker-compose-capacity-provider", "capacity-provider-assignment-proof"]
 };
+function isCapacityRuntimeProofCapability(capability) {
+  return capability === "capacity-provider-assignment-proof" || capability === "capacity-provider-runtime-assignment-proof";
+}
+function scenarioResourceKind(provider, capability) {
+  if (provider === "railway") return capability === "volume" ? "railway-volume" : "railway-service";
+  if (provider === "cloudflare") return "cloudflare-resource";
+  if (provider === "github") {
+    if (capability === "environment") return "github-environment";
+    if (capability === "secret") return "github-secret-binding";
+    if (capability === "variable") return "github-secret-binding";
+    return "package-workflow";
+  }
+  if (isCapacityRuntimeProofCapability(capability)) return "capacity-provider";
+  if (capability === "docker-compose-capacity-provider") return "local-docker-compose";
+  if (capability === "process") return "local-process";
+  if (capability === "local-runner") return "capacity-provider";
+  return "local-process";
+}
+function scenarioResourceProvider(provider, capability) {
+  if (provider === "cloudflare") return "cloudflare";
+  if (provider === "github") return "github";
+  if (provider === "local") return "local";
+  return "railway";
+}
+function liveAcceptanceDesiredResource(input) {
+  const id = `live-acceptance:${input.environment}:${input.provider}:${input.capability}:${input.runId}`;
+  const kind = scenarioResourceKind(input.provider, input.capability);
+  return {
+    id,
+    kind,
+    provider: scenarioResourceProvider(input.provider, input.capability),
+    environment: input.environment,
+    packageId: null,
+    serviceId: input.capability,
+    logicalName: input.capability,
+    spec: {
+      liveAcceptance: true,
+      provider: input.provider,
+      capability: input.capability,
+      runId: input.runId,
+      prefix: providerPrefix(input.environment, input.provider, input.runId),
+      tenantRoot: input.tenantRoot
+    },
+    dependencies: [],
+    source: { type: "package-adapter", id }
+  };
+}
+function compileTreeseedLiveAcceptanceScenarios(input) {
+  const providers = input.provider === "all" ? ["railway", "cloudflare", "github", "local"] : [input.provider];
+  return providers.flatMap((provider) => PROVIDER_CAPABILITIES[provider].map((capability) => {
+    const probeOnly = input.mode === "smoke" || provider === "github" && ["workflow-observation", "repository-scoped-token"].includes(capability) || provider === "cloudflare" && capability === "cache-rules" || isCapacityRuntimeProofCapability(capability);
+    const desiredResources = probeOnly ? [] : [liveAcceptanceDesiredResource({
+      tenantRoot: input.tenantRoot,
+      environment: input.environment,
+      provider,
+      capability,
+      runId: input.runId
+    })];
+    const selector = {
+      environment: input.environment,
+      host: [provider],
+      resourceKind: desiredResources.map((resource) => resource.kind),
+      serviceType: [capability]
+    };
+    return {
+      id: `live-acceptance:${input.environment}:${provider}:${capability}:${input.runId}`,
+      provider,
+      capability,
+      desiredResources,
+      selector,
+      expectedActions: input.mode === "cleanup" ? ["delete", "noop"] : probeOnly ? ["noop"] : ["create", "update", "replace", "reattach", "noop"],
+      cleanupSelector: selector,
+      required: true,
+      probeOnly,
+      cleanupRequired: input.mode !== "smoke" && !probeOnly
+    };
+  }));
+}
 function configuredValue(env, keys) {
   for (const key of keys) {
     const value = env[key];
@@ -39,6 +119,268 @@ function configuredValue(env, keys) {
   }
   return "";
 }
+function capacityAcceptanceConfig(env, environment) {
+  const local = environment === "local";
+  const apiUrl = configuredValue(env, [
+    "TREESEED_CAPACITY_ACCEPTANCE_API_URL",
+    "TREESEED_MARKET_URL",
+    "TREESEED_MANAGEMENT_API_URL",
+    "TREESEED_API_BASE_URL"
+  ]) || (local ? "http://127.0.0.1:3000" : "");
+  const adminToken = configuredValue(env, ["TREESEED_CAPACITY_ACCEPTANCE_ADMIN_TOKEN"]) || (local ? "tsk_local_treeseed_acceptance_admin" : "");
+  const teamId = configuredValue(env, ["TREESEED_CAPACITY_ACCEPTANCE_TEAM_ID"]) || (local ? "d8a613c2-bbdb-4474-9c96-31e985beafd4" : "");
+  const projectId = configuredValue(env, ["TREESEED_CAPACITY_ACCEPTANCE_PROJECT_ID"]) || (local ? "90764af2-5a13-42b9-a2fa-fb3af5882323" : "");
+  const providerId = configuredValue(env, ["TREESEED_CAPACITY_ACCEPTANCE_PROVIDER_ID", "TREESEED_CAPACITY_PROVIDER_ID"]) || (local ? "ff48ce97-6959-46b5-be9f-9b7062161fe3" : "");
+  const agentClassId = configuredValue(env, ["TREESEED_CAPACITY_ACCEPTANCE_AGENT_CLASS_ID"]) || (local ? "planning" : "");
+  const providerApiKey = configuredValue(env, ["TREESEED_CAPACITY_PROVIDER_API_KEY"]) || (local ? "tsp_local_treeseed_demo_capacity_provider" : "");
+  const missing = [
+    ["TREESEED_CAPACITY_ACCEPTANCE_API_URL or TREESEED_MARKET_URL", apiUrl],
+    ["TREESEED_CAPACITY_ACCEPTANCE_ADMIN_TOKEN", adminToken],
+    ["TREESEED_CAPACITY_ACCEPTANCE_TEAM_ID", teamId],
+    ["TREESEED_CAPACITY_ACCEPTANCE_PROJECT_ID", projectId],
+    ["TREESEED_CAPACITY_ACCEPTANCE_PROVIDER_ID or TREESEED_CAPACITY_PROVIDER_ID", providerId],
+    ["TREESEED_CAPACITY_ACCEPTANCE_AGENT_CLASS_ID", agentClassId],
+    ["TREESEED_CAPACITY_PROVIDER_API_KEY", providerApiKey]
+  ].filter(([, value]) => !value).map(([key]) => String(key));
+  return {
+    apiUrl,
+    adminToken,
+    teamId,
+    projectId,
+    providerId,
+    agentClassId,
+    providerApiKey,
+    missing
+  };
+}
+function capacityGrantForAcceptance(grants, config, environment) {
+  return grants.map((entry) => entry && typeof entry === "object" ? entry : null).find(
+    (grant) => grant && grant.id && grant.capacityProviderId === config.providerId && grant.projectId === config.projectId && (grant.teamId === config.teamId || !grant.teamId) && (grant.state === "active" || !grant.state) && (grant.environment === environment || !grant.environment)
+  ) ?? null;
+}
+async function createTreeDxProxyAuditEvidence(input) {
+  const response = await input.fetchImpl(
+    `${input.apiUrl.replace(/\/$/u, "")}/v1/dx/projects/${encodeURIComponent(input.projectId)}/repos/${encodeURIComponent(`capacity-proof-${input.runId}`)}/files/read`,
+    {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${input.providerApiKey}`,
+        "content-type": "application/json",
+        "x-treeseed-assignment-id": input.assignmentId
+      },
+      body: JSON.stringify({
+        paths: [`src/content/agent-platform-proof/${input.runId}.mdx`],
+        ref: "HEAD"
+      })
+    }
+  );
+  if (response.status !== 403) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`Capacity acceptance TreeDX proxy audit probe expected 403 but received ${response.status}${text ? `: ${text}` : ""}.`);
+  }
+}
+async function runCapacityProviderAssignmentProof(input) {
+  const config = capacityAcceptanceConfig(input.env, input.environment);
+  if (config.missing.length > 0) {
+    throw new Error(`Missing capacity acceptance configuration: ${config.missing.join(", ")}.`);
+  }
+  const runnerId = `${input.prefix}-runner`;
+  const assignmentId = `${input.prefix}-assignment`;
+  const mode = configuredValue(input.env, ["TREESEED_CAPACITY_ACCEPTANCE_MODE"]) || "planning";
+  const metadata = {
+    liveAcceptance: true,
+    runId: input.runId,
+    prefix: input.prefix,
+    provider: input.provider,
+    capability: input.provider === "railway" ? "capacity-provider-runtime-assignment-proof" : "capacity-provider-assignment-proof",
+    priority: 1e6
+  };
+  const adminClient = new MarketClient({
+    profile: {
+      id: "capacity-acceptance",
+      label: "Capacity Acceptance",
+      baseUrl: config.apiUrl,
+      kind: "specialized",
+      teamId: config.teamId
+    },
+    accessToken: config.adminToken,
+    fetchImpl: input.fetchImpl,
+    userAgent: `treeseed-live-acceptance/${input.runId}`
+  });
+  const providerClient = new MarketProviderClient({
+    marketUrl: config.apiUrl,
+    marketId: input.environment,
+    apiKey: config.providerApiKey,
+    fetchImpl: input.fetchImpl,
+    userAgent: `treeseed-live-acceptance/${input.runId}`
+  });
+  const existingClasses = await adminClient.projectAgentClasses(config.projectId).catch(() => ({ payload: [] }));
+  const hasAgentClass = Array.isArray(existingClasses.payload) && existingClasses.payload.some((entry) => {
+    const record = entry && typeof entry === "object" ? entry : {};
+    return record.id === config.agentClassId || record.slug === config.agentClassId;
+  });
+  if (!hasAgentClass) {
+    await adminClient.createProjectAgentClass(config.projectId, {
+      id: config.agentClassId,
+      slug: config.agentClassId,
+      name: "Planning",
+      status: "active",
+      allowedModes: ["planning"],
+      requiredCapabilities: ["agent_mode_run"],
+      metadata
+    });
+  }
+  const grants = await adminClient.capacityGrants(config.teamId).catch(() => ({ payload: [] }));
+  const acceptanceGrant = capacityGrantForAcceptance(Array.isArray(grants.payload) ? grants.payload : [], config, input.environment);
+  if (!acceptanceGrant) {
+    throw new Error(`Capacity acceptance did not find an active checked-in grant for project ${config.projectId} and provider ${config.providerId}.`);
+  }
+  const reservation = await adminClient.createCapacityReservation(config.projectId, {
+    id: `${input.prefix}-reservation`,
+    capacityProviderId: config.providerId,
+    laneId: typeof acceptanceGrant.laneId === "string" && acceptanceGrant.laneId ? acceptanceGrant.laneId : `${config.providerId}:agent-capacity`,
+    reservedCredits: 1,
+    nativeUnit: "request",
+    reservedNativeAmount: 1,
+    mode,
+    metadata
+  });
+  const reservationId = String(reservation.payload?.id ?? "");
+  if (!reservationId) throw new Error("Capacity acceptance reservation creation did not return an id.");
+  const checkIn = await providerClient.checkIn({
+    id: `${input.prefix}-session`,
+    environment: input.environment,
+    status: "open",
+    capabilities: ["repo_read", "agent_mode_run", "usage_report"],
+    grants: [{
+      grantId: String(acceptanceGrant.id),
+      projectId: config.projectId,
+      teamId: config.teamId,
+      grantScope: typeof acceptanceGrant.grantScope === "string" ? acceptanceGrant.grantScope : "project"
+    }],
+    nativeLimits: { wallMinutes: { session: 30 } },
+    runnerPressure: { activeRunners: 0, maxConcurrentRunners: 1 },
+    constraints: { liveAcceptance: true, outboundOnly: true },
+    metadata
+  });
+  const sessionId = String(checkIn.payload.id ?? "");
+  if (!sessionId) throw new Error("Capacity acceptance check-in did not return a session id.");
+  await adminClient.createProviderAssignment(config.teamId, {
+    id: assignmentId,
+    projectId: config.projectId,
+    capacityProviderId: config.providerId,
+    providerSessionId: sessionId,
+    projectAgentClassId: config.agentClassId,
+    reservationId,
+    mode,
+    capacityEnvelope: {
+      teamId: config.teamId,
+      projectId: config.projectId,
+      providerId: config.providerId,
+      laneId: typeof acceptanceGrant.laneId === "string" && acceptanceGrant.laneId ? acceptanceGrant.laneId : `${config.providerId}:agent-capacity`,
+      reservationId,
+      mode,
+      limits: { wallMinutes: 5 },
+      metadata
+    },
+    decisionInput: {
+      kind: "capacity_acceptance_diagnostic",
+      runId: input.runId,
+      mode,
+      instructions: "Execute the isolated capacity acceptance diagnostic without widening project or provider scope."
+    },
+    workspaceContext: {
+      liveAcceptance: true,
+      runId: input.runId
+    },
+    metadata
+  });
+  let leased = null;
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    leased = await providerClient.nextAssignment({
+      sessionId,
+      runnerId,
+      leaseSeconds: 120,
+      metadata
+    });
+    const leasedId = leased.payload?.id ? String(leased.payload.id) : "";
+    if (!leasedId) throw new Error("Capacity acceptance did not lease an assignment.");
+    if (leasedId === assignmentId) break;
+    const leasedMetadata = leased.payload?.metadata && typeof leased.payload.metadata === "object" ? leased.payload.metadata : {};
+    if (leasedMetadata.liveAcceptance !== true) {
+      throw new Error(`Capacity acceptance leased ${leasedId} instead of diagnostic assignment ${assignmentId}.`);
+    }
+    const staleLeaseToken = leased.leaseToken ?? leased.payload.leaseToken ?? null;
+    if (!staleLeaseToken) throw new Error(`Capacity acceptance leased stale diagnostic ${leasedId} without a lease token.`);
+    await providerClient.completeAssignment(leasedId, {
+      runnerId,
+      leaseToken: staleLeaseToken,
+      output: { summary: "Retired stale capacity acceptance diagnostic.", runId: input.runId },
+      summary: { runId: input.runId, retiredAssignmentId: leasedId },
+      metadata: {
+        ...metadata,
+        retiredStaleAcceptanceAssignment: true,
+        retiredAssignmentId: leasedId
+      }
+    });
+    leased = null;
+  }
+  if (!leased?.payload?.id) throw new Error("Capacity acceptance did not lease an assignment.");
+  if (leased.payload.id !== assignmentId) {
+    throw new Error(`Capacity acceptance leased stale diagnostics but did not reach diagnostic assignment ${assignmentId}.`);
+  }
+  const leaseToken = leased.leaseToken ?? leased.payload.leaseToken ?? null;
+  if (!leaseToken) throw new Error("Capacity acceptance lease did not include a lease token.");
+  await createTreeDxProxyAuditEvidence({
+    fetchImpl: input.fetchImpl,
+    apiUrl: config.apiUrl,
+    providerApiKey: config.providerApiKey,
+    projectId: config.projectId,
+    assignmentId,
+    runId: input.runId
+  });
+  const modeRun = await providerClient.createAssignmentModeRun(assignmentId, {
+    status: "succeeded",
+    selectedInput: { kind: "capacity_acceptance_diagnostic", runId: input.runId, mode },
+    outputs: { summary: "Capacity acceptance diagnostic completed.", runId: input.runId },
+    usageActual: {
+      actualCredits: 0,
+      nativeUsage: { nativeUnit: "request", amount: 1, source: "capacity_acceptance" },
+      metadata
+    },
+    traceRefs: { liveAcceptanceRunId: input.runId },
+    metadata
+  });
+  const modeRunId = String(modeRun.payload.id ?? "");
+  if (!modeRunId) throw new Error("Capacity acceptance mode-run creation did not return an id.");
+  const completed = await providerClient.completeAssignment(assignmentId, {
+    runnerId,
+    leaseToken,
+    modeRunId,
+    actualCredits: 0.25,
+    nativeUsage: { nativeUnit: "request", amount: 1, source: "capacity_acceptance" },
+    output: { summary: "Capacity acceptance diagnostic completed.", runId: input.runId },
+    summary: { runId: input.runId, modeRunId },
+    metadata
+  });
+  const finalStatus = String(completed.payload?.status ?? "");
+  if (finalStatus !== "completed") {
+    throw new Error(`Capacity acceptance assignment finished with status "${finalStatus || "unknown"}".`);
+  }
+  const modeRuns = await adminClient.projectAgentModeRuns(config.projectId, { assignmentId });
+  const modeRunCount = Array.isArray(modeRuns.payload) ? modeRuns.payload.length : 0;
+  if (!modeRunCount) throw new Error("Capacity acceptance mode-run was not visible through project mode-run inspection.");
+  return {
+    sessionId,
+    assignmentId,
+    modeRunId,
+    finalStatus,
+    mode,
+    runnerId,
+    modeRunCount
+  };
+}
 function shortRunId(now = /* @__PURE__ */ new Date()) {
   return now.toISOString().replace(/[^0-9]/gu, "").slice(0, 14);
 }
@@ -62,7 +404,7 @@ function emitProgress(onProgress, event) {
   });
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function waitForLiveObservation(description, observe, isReady, options = {}) {
   const attempts = Math.max(1, options.attempts ?? 8);
@@ -94,11 +436,10 @@ function parseGitHubRepository(value) {
 function resolveCurrentGitHubRepository(cwd, env) {
   const configured = configuredValue(env, ["TREESEED_REPOSITORY", "GITHUB_REPOSITORY"]);
   if (configured) return parseGitHubRepository(configured);
-  const remote = execFileSync("git", ["config", "--get", "remote.origin.url"], {
+  const remote = runTreeseedGit(["config", "--get", "remote.origin.url"], {
     cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  }).trim();
+    mode: "read"
+  }).stdout.trim();
   return parseGitHubRepository(remote);
 }
 function domainFromWorkspace(cwd) {
@@ -377,8 +718,8 @@ function reportForProvider({
   };
 }
 async function cloudflareRequestPayload(path, env, fetchImpl, init = {}) {
-  const token = configuredValue(env, ["CLOUDFLARE_API_TOKEN"]);
-  if (!token) throw new Error("Missing CLOUDFLARE_API_TOKEN.");
+  const token = configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"]);
+  if (!token) throw new Error("Missing TREESEED_CLOUDFLARE_API_TOKEN.");
   const response = await fetchImpl(`https://api.cloudflare.com/client/v4${path}`, {
     ...init,
     headers: {
@@ -399,9 +740,28 @@ async function cloudflareRequest(path, env, fetchImpl, init = {}) {
   const payload = await cloudflareRequestPayload(path, env, fetchImpl, init);
   return payload.result;
 }
+function isTransientCloudflareError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /\b(500|502|503|504|520|521|522|523|524)\b|internal server error|unknown error occurred|temporar(?:y|ily)|timeout|rate limit/iu.test(message);
+}
+async function withCloudflareTransientRetry(operation, options = {}) {
+  const attempts = Math.max(1, options.attempts ?? 4);
+  const delayMs = Math.max(0, options.delayMs ?? 1500);
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      lastError = error;
+      if (!isTransientCloudflareError(error) || attempt >= attempts) break;
+      await sleep(delayMs * attempt);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
 async function cloudflareRawRequest(path, env, fetchImpl, init = {}) {
-  const token = configuredValue(env, ["CLOUDFLARE_API_TOKEN"]);
-  if (!token) throw new Error("Missing CLOUDFLARE_API_TOKEN.");
+  const token = configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"]);
+  if (!token) throw new Error("Missing TREESEED_CLOUDFLARE_API_TOKEN.");
   const response = await fetchImpl(`https://api.cloudflare.com/client/v4${path}`, {
     ...init,
     headers: {
@@ -443,7 +803,7 @@ async function runSmokeProvider({
   fetchImpl
 }) {
   if (provider === "railway") {
-    if (!configuredValue(env, ["RAILWAY_API_TOKEN"])) {
+    if (!configuredValue(env, ["TREESEED_RAILWAY_API_TOKEN"])) {
       return PROVIDER_CAPABILITIES.railway.map((capability) => scenario({
         provider,
         mode,
@@ -452,7 +812,7 @@ async function runSmokeProvider({
         ok: false,
         phase: "blocked",
         action: "blocked",
-        reason: "Missing RAILWAY_API_TOKEN for Railway live reconciliation tests."
+        reason: "Missing TREESEED_RAILWAY_API_TOKEN for Railway live reconciliation tests."
       }));
     }
     try {
@@ -479,7 +839,8 @@ async function runSmokeProvider({
         scenario({ provider, mode, prefix, capability: "volume", ok: volumes.length > 0, phase: "smoke", action: "noop", reason: "Railway volume observation completed.", locators: base }),
         scenario({ provider, mode, prefix, capability: "domain", ok: true, phase: "smoke", action: "noop", reason: "Railway domain API uses authenticated provider surface.", locators: base }),
         scenario({ provider, mode, prefix, capability: "variables", ok: Boolean(selectedEnvironment), phase: "smoke", action: "noop", reason: `Railway variables API observed ${Object.keys(variables).length} variables.`, locators: base }),
-        scenario({ provider, mode, prefix, capability: "deployment-health", ok: services.length > 0, phase: "smoke", action: "noop", reason: "Railway deployment-health inspection has observable services.", locators: base })
+        scenario({ provider, mode, prefix, capability: "deployment-health", ok: services.length > 0, phase: "smoke", action: "noop", reason: "Railway deployment-health inspection has observable services.", locators: base }),
+        scenario({ provider, mode, prefix, capability: "capacity-provider-runtime-assignment-proof", ok: true, phase: "smoke", action: "noop", reason: "Railway capacity runtime proof is available through explicit acceptance mode.", locators: base })
       ];
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error);
@@ -487,8 +848,8 @@ async function runSmokeProvider({
     }
   }
   if (provider === "cloudflare") {
-    const accountId = configuredValue(env, ["CLOUDFLARE_ACCOUNT_ID"]);
-    if (!configuredValue(env, ["CLOUDFLARE_API_TOKEN"]) || !accountId) {
+    const accountId = configuredValue(env, ["TREESEED_CLOUDFLARE_ACCOUNT_ID"]);
+    if (!configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"]) || !accountId) {
       return PROVIDER_CAPABILITIES.cloudflare.map((capability) => scenario({
         provider,
         mode,
@@ -497,7 +858,7 @@ async function runSmokeProvider({
         ok: false,
         phase: "blocked",
         action: "blocked",
-        reason: "Missing CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID for Cloudflare live reconciliation tests."
+        reason: "Missing TREESEED_CLOUDFLARE_API_TOKEN or TREESEED_CLOUDFLARE_ACCOUNT_ID for Cloudflare live reconciliation tests."
       }));
     }
     const checks = [
@@ -527,7 +888,7 @@ async function runSmokeProvider({
       repository = resolveCurrentGitHubRepository(cwd, env);
       const credential = resolveGitHubCredentialForRepository(repository, { values: env, env });
       if (!credential.token) {
-        throw new Error(`Missing GitHub credential for ${repository}; expected ${credential.envName} or GH_TOKEN fallback.`);
+        throw new Error(`Missing GitHub credential for ${repository}; expected ${credential.envName} or TREESEED_GITHUB_TOKEN fallback.`);
       }
       const [owner, repo] = credential.repository.split("/");
       const checks = [
@@ -566,27 +927,28 @@ async function runSmokeProvider({
 async function requireAcceptanceConfig(provider, cwd, env, fetchImpl) {
   const missing = [];
   if (provider === "railway") {
-    if (!configuredValue(env, ["RAILWAY_API_TOKEN"])) missing.push("RAILWAY_API_TOKEN");
+    if (!configuredValue(env, ["TREESEED_RAILWAY_API_TOKEN"])) missing.push("TREESEED_RAILWAY_API_TOKEN");
     if (!resolveLiveTestDomain(cwd, env)) missing.push("TREESEED_LIVE_TEST_DOMAIN or treeseed.site.yaml siteUrl");
+    missing.push(...capacityAcceptanceConfig(env).missing);
   }
   if (provider === "cloudflare") {
-    if (!configuredValue(env, ["CLOUDFLARE_API_TOKEN"])) missing.push("CLOUDFLARE_API_TOKEN");
-    if (!configuredValue(env, ["CLOUDFLARE_ACCOUNT_ID"])) missing.push("CLOUDFLARE_ACCOUNT_ID");
+    if (!configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"])) missing.push("TREESEED_CLOUDFLARE_API_TOKEN");
+    if (!configuredValue(env, ["TREESEED_CLOUDFLARE_ACCOUNT_ID"])) missing.push("TREESEED_CLOUDFLARE_ACCOUNT_ID");
     const domain = resolveLiveTestDomain(cwd, env);
     if (!domain) {
       missing.push("TREESEED_LIVE_TEST_DOMAIN or treeseed.site.yaml siteUrl");
-    } else if (configuredValue(env, ["CLOUDFLARE_API_TOKEN"]) && !await resolveCloudflareZoneId(domain, env, fetchImpl)) {
+    } else if (configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"]) && !await resolveCloudflareZoneId(domain, env, fetchImpl)) {
       missing.push("TREESEED_LIVE_TEST_CLOUDFLARE_ZONE_ID or visible Cloudflare zone for live-test domain");
     }
   }
   if (provider === "github") {
-    if (!configuredValue(env, ["GH_TOKEN", "GITHUB_TOKEN"])) {
+    if (!configuredValue(env, ["TREESEED_GITHUB_TOKEN"])) {
       try {
         const repository = configuredValue(env, ["TREESEED_REPOSITORY", "GITHUB_REPOSITORY"]);
         const credential = repository ? resolveGitHubCredentialForRepository(repository, { values: env, env }) : null;
-        if (!credential?.token) missing.push("GH_TOKEN or repository-scoped TREESEED_GITHUB_TOKEN_*");
+        if (!credential?.token) missing.push("TREESEED_GITHUB_TOKEN or repository-scoped TREESEED_GITHUB_TOKEN_*");
       } catch {
-        missing.push("GH_TOKEN or repository-scoped TREESEED_GITHUB_TOKEN_*");
+        missing.push("TREESEED_GITHUB_TOKEN or repository-scoped TREESEED_GITHUB_TOKEN_*");
       }
     }
   }
@@ -923,6 +1285,30 @@ mutation TreeseedLiveRailwayCustomDomainCreate($input: CustomDomainCreateInput!)
       () => listRailwayServices({ projectId, env, fetchImpl }),
       (services) => services.some((candidate) => candidate.id === serviceId)
     )));
+    results.push(await measuredScenario({
+      provider: "railway",
+      mode,
+      environment,
+      runId,
+      prefix,
+      capability: "capacity-provider-runtime-assignment-proof",
+      phase: "verify",
+      action: "noop",
+      startMessage: "railway:capacity-provider-runtime-assignment-proof: running assignment lifecycle proof",
+      successReason: "Railway capacity acceptance created a diagnostic assignment, leased it through the provider protocol, emitted mode-run telemetry, and completed it.",
+      locators: { projectId, environmentId },
+      retainedResources: (value) => {
+        const proof = value;
+        return [providerNode("railway", environment, "capacity-runtime-proof", proof.assignmentId, {
+          sessionId: proof.sessionId,
+          modeRunId: proof.modeRunId,
+          finalStatus: proof.finalStatus,
+          mode: proof.mode,
+          modeRunCount: proof.modeRunCount
+        })];
+      },
+      onProgress
+    }, async () => runCapacityProviderAssignmentProof({ provider: "railway", environment, runId, prefix, env, fetchImpl })));
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     for (const capability of PROVIDER_CAPABILITIES.railway) {
@@ -982,7 +1368,7 @@ function cloudflareListItems(value, keys = []) {
   return [];
 }
 async function runCloudflareCleanup(cwd, environment, prefix, mode, env, fetchImpl) {
-  const accountId = configuredValue(env, ["CLOUDFLARE_ACCOUNT_ID"]);
+  const accountId = configuredValue(env, ["TREESEED_CLOUDFLARE_ACCOUNT_ID"]);
   const domain = resolveLiveTestDomain(cwd, env);
   const zoneId = domain ? await resolveCloudflareZoneId(domain, env, fetchImpl) : configuredValue(env, ["TREESEED_LIVE_TEST_CLOUDFLARE_ZONE_ID", "CLOUDFLARE_ZONE_ID"]);
   const destroyed = [];
@@ -1024,10 +1410,10 @@ async function runCloudflareCleanup(cwd, environment, prefix, mode, env, fetchIm
     }
     return items;
   };
-  if (!configuredValue(env, ["CLOUDFLARE_API_TOKEN"]) || !accountId) {
-    cleanupDrift.push(blocking("cloudflare", "account", "Cloudflare cleanup requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID."));
+  if (!configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"]) || !accountId) {
+    cleanupDrift.push(blocking("cloudflare", "account", "Cloudflare cleanup requires TREESEED_CLOUDFLARE_API_TOKEN and TREESEED_CLOUDFLARE_ACCOUNT_ID."));
   }
-  if (accountId && configuredValue(env, ["CLOUDFLARE_API_TOKEN"])) {
+  if (accountId && configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"])) {
     if (mode === "acceptance") {
       await attempt("worker", prefix, () => cloudflareRequest(`/accounts/${accountId}/workers/scripts/${prefix}`, env, fetchImpl, { method: "DELETE" }).catch((error) => {
         const message = error instanceof Error ? error.message : String(error);
@@ -1068,7 +1454,7 @@ async function runCloudflareCleanup(cwd, environment, prefix, mode, env, fetchIm
       if (name.startsWith(prefixRoot) && id) await attempt("turnstile", id, () => cloudflareRequest(`/accounts/${accountId}/challenges/widgets/${id}`, env, fetchImpl, { method: "DELETE" }));
     }
   }
-  if (zoneId && configuredValue(env, ["CLOUDFLARE_API_TOKEN"])) {
+  if (zoneId && configuredValue(env, ["TREESEED_CLOUDFLARE_API_TOKEN"])) {
     for (const record of await list("dns", `/zones/${zoneId}/dns_records?per_page=100`)) {
       const name = cloudflareName(record);
       const id = cloudflareId(record);
@@ -1099,7 +1485,7 @@ async function runCloudflareAcceptance(cwd, environment, runId, prefix, env, fet
   }
   emitProgress(onProgress, { provider: "cloudflare", mode, environment, runId, resourcePrefix: prefix, phase: "cleanup", message: `cloudflare: removing old live-test resources for ${prefix}` });
   await runCloudflareCleanup(cwd, environment, prefix, mode, env, fetchImpl);
-  const accountId = configuredValue(env, ["CLOUDFLARE_ACCOUNT_ID"]);
+  const accountId = configuredValue(env, ["TREESEED_CLOUDFLARE_ACCOUNT_ID"]);
   const domain = resolveLiveTestDomain(cwd, env);
   const zoneId = await resolveCloudflareZoneId(domain, env, fetchImpl);
   const results = [];
@@ -1163,10 +1549,10 @@ async function runCloudflareAcceptance(cwd, environment, runId, prefix, env, fet
     () => cloudflareRawRequest(`/accounts/${accountId}/workers/scripts/${prefix}`, env, fetchImpl),
     (value) => typeof value === "string" && value.includes("treeseed-live-test-worker")
   ));
-  await attempt("pages", "pages", () => cloudflareRequest(`/accounts/${accountId}/pages/projects`, env, fetchImpl, {
+  await attempt("pages", "pages", () => withCloudflareTransientRetry(() => cloudflareRequest(`/accounts/${accountId}/pages/projects`, env, fetchImpl, {
     method: "POST",
     body: JSON.stringify({ name: prefix, production_branch: "main" })
-  }), () => waitForLiveObservation(
+  })), () => waitForLiveObservation(
     `Cloudflare Pages project ${prefix}`,
     () => cloudflareRequest(`/accounts/${accountId}/pages/projects/${prefix}`, env, fetchImpl),
     (value) => Boolean(value && typeof value === "object")
@@ -1281,7 +1667,7 @@ async function runGitHubAcceptance(cwd, environment, runId, prefix, env, fetchIm
   try {
     repository = resolveCurrentGitHubRepository(cwd, env);
     const credential = resolveGitHubCredentialForRepository(repository, { values: env, env });
-    if (!credential.token) throw new Error(`Missing GitHub credential for ${repository}; expected ${credential.envName} or GH_TOKEN fallback.`);
+    if (!credential.token) throw new Error(`Missing GitHub credential for ${repository}; expected ${credential.envName} or TREESEED_GITHUB_TOKEN fallback.`);
     const [owner, repo] = credential.repository.split("/");
     const environmentName = prefix;
     const variableName = `TREESEED_LIVE_TEST_${prefix.toUpperCase().replace(/[^A-Z0-9]/gu, "_")}`;
@@ -1408,24 +1794,26 @@ async function runGitHubAcceptance(cwd, environment, runId, prefix, env, fetchIm
   }
 }
 async function listenOnEphemeralPort(server) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
-      if (address && typeof address === "object") resolve(address.port);
+      if (address && typeof address === "object") resolve2(address.port);
       else reject(new Error("Local server did not expose an address."));
     });
   });
 }
 async function closeServer(server) {
-  return new Promise((resolve, reject) => {
-    server.close((error) => error ? reject(error) : resolve());
+  return new Promise((resolve2, reject) => {
+    server.close((error) => error ? reject(error) : resolve2());
   });
 }
-async function runLocalAcceptance(environment, prefix, mode, runId, onProgress) {
+async function runLocalAcceptance(environment, prefix, mode, runId, env, fetchImpl, onProgress) {
   const created = [];
   const destroyed = [];
-  const dir = await mkdtemp(join(tmpdir(), `${prefix}-`));
+  const tempBase = resolve(process.cwd(), ".treeseed", "tmp", "live-acceptance");
+  await mkdir(tempBase, { recursive: true });
+  const dir = await mkdtemp(join(tempBase, `${prefix}-`));
   const results = [];
   let server = null;
   try {
@@ -1520,6 +1908,29 @@ async function runLocalAcceptance(environment, prefix, mode, runId, onProgress)
         return { docker: error instanceof Error ? error.message : String(error), available: false };
       }
     }));
+    results.push(await measuredScenario({
+      provider: "local",
+      mode,
+      environment,
+      runId,
+      prefix,
+      capability: "capacity-provider-assignment-proof",
+      phase: "verify",
+      action: "noop",
+      startMessage: "local:capacity-provider-assignment-proof: running assignment lifecycle proof",
+      successReason: "Local capacity acceptance created a diagnostic assignment, leased it through the provider protocol, emitted mode-run telemetry, and completed it.",
+      retainedResources: (value) => {
+        const proof = value;
+        return [providerNode("local", environment, "capacity-runtime-proof", proof.assignmentId, {
+          sessionId: proof.sessionId,
+          modeRunId: proof.modeRunId,
+          finalStatus: proof.finalStatus,
+          mode: proof.mode,
+          modeRunCount: proof.modeRunCount
+        })];
+      },
+      onProgress
+    }, async () => runCapacityProviderAssignmentProof({ provider: "local", environment, runId, prefix, env, fetchImpl })));
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     for (const capability of PROVIDER_CAPABILITIES.local) {
@@ -1571,7 +1982,7 @@ async function runProvider({
     emitProgress(onProgress, { provider, mode, environment, runId, resourcePrefix: prefix, phase: report2.ok ? "complete" : "blocked", elapsedMs: Date.now() - started, message: `${provider}: ${report2.ok ? "passed" : "blocked"} in ${Date.now() - started}ms` });
     return report2;
   }
-  const { results, cleanupDrift } = await runLocalAcceptance(environment, prefix, mode, runId, onProgress);
+  const { results, cleanupDrift } = await runLocalAcceptance(environment, prefix, mode, runId, env, fetchImpl, onProgress);
   const report = reportForProvider({ provider, mode, runId, prefix, environment, results, cleanupDrift });
   emitProgress(onProgress, { provider, mode, environment, runId, resourcePrefix: prefix, phase: report.ok ? "complete" : "blocked", elapsedMs: Date.now() - started, message: `${provider}: ${report.ok ? "passed" : "blocked"} in ${Date.now() - started}ms` });
   return report;
@@ -1609,6 +2020,7 @@ async function runTreeseedLiveReconcileTests(options) {
   };
 }
 export {
+  compileTreeseedLiveAcceptanceScenarios,
   runTreeseedLiveReconcileTests,
   treeseedLiveReconcileProviderCapabilities,
   treeseedLiveReconcileResourcePrefix