@treeseed/sdk 0.12.44 → 0.12.46

package/dist/guarantees/index.js

@@ -1,10 +1,10 @@
-import { execFile } from "node:child_process";
+import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve, sep } from "node:path";
-import { promisify } from "node:util";
 import { parse as parseYaml } from "yaml";
 const TREESEED_GUARANTEE_SCHEMA_VERSION = "treeseed.guarantee/v1";
 const TREESEED_GUARANTEE_VERIFIERS_SCHEMA_VERSION = "treeseed.guarantee-verifiers/v1";
+const TREESEED_GUARANTEE_JOURNEY_AUDIT_SCHEMA_VERSION = "treeseed.guarantee-journey-audit/v1";
 const TAXONOMY_PATTERN = /^[a-z][a-z0-9-]*$/u;
 const GUARANTEE_ID_PATTERN = /^guarantee\.[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*){2,}\.\d{3}$/u;
 const KNOWN_GATES = /* @__PURE__ */ new Set(["smoke", "core", "release", "security", "migration", "demo", "backlog", "future"]);
@@ -13,7 +13,6 @@ const KNOWN_SURFACES = /* @__PURE__ */ new Set(["admin-ui", "agent-runtime", "ap
 const KNOWN_DEVICES = /* @__PURE__ */ new Set(["desktop_chromium", "desktop_firefox", "desktop_webkit", "tablet_chromium", "mobile_chromium", "mobile_webkit"]);
 const KNOWN_VERIFIER_KINDS = /* @__PURE__ */ new Set(["apiAcceptanceCase", "vitestCase", "nodeScript", "packageScript", "scene", "manualEvidence", "todo"]);
 const EXCLUDED_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".treeseed", "coverage"]);
-const execFileAsync = promisify(execFile);
 function diagnostic(severity, code, message, path, sourcePath) {
   return { severity, code, message, ...path ? { path } : {}, ...sourcePath ? { sourcePath } : {} };
 }
@@ -344,39 +343,200 @@ function selectedByFilter(manifest, filter = {}) {
   if (filter.type && manifest.type !== filter.type) return false;
   if (filter.subtype && manifest.subtype !== filter.subtype) return false;
   if (filter.ownerPackage && manifest.ownerPackage !== filter.ownerPackage) return false;
+  if (filter.ownerPackages && filter.ownerPackages.length > 0 && !filter.ownerPackages.includes(manifest.ownerPackage)) return false;
+  if (filter.sceneBacked === true && !manifest.scene?.manifest) return false;
   if (filter.status && manifest.status !== filter.status) return false;
   if (filter.ids && filter.ids.length > 0 && !filter.ids.includes(manifest.id)) return false;
   if (filter.journeyIndexes && filter.journeyIndexes.length > 0 && (!manifest.journeyIndex || !filter.journeyIndexes.includes(manifest.journeyIndex))) return false;
   return true;
 }
+function sortGuaranteeEntries(a, b) {
+  return (a.manifest.journeyIndex ?? 99999) - (b.manifest.journeyIndex ?? 99999) || a.manifest.id.localeCompare(b.manifest.id);
+}
 function validateFilter(filter, diagnostics) {
   for (const field of ["type", "subtype"]) {
     const value = filter?.[field];
     if (value && !TAXONOMY_PATTERN.test(value)) diagnostics.push(diagnostic("error", `guarantee_filter.invalid_${field}`, `Filter ${field} must be lowercase kebab-case. Try "${normalizeTreeseedGuaranteeTaxonomy(value)}".`, field));
   }
 }
-function filterTreeseedGuarantees(input) {
-  const valid = input.guarantees.filter((entry) => Boolean(entry.manifest));
+function readSceneYaml(scenePath) {
+  try {
+    const value = parseYaml(readFileSync(scenePath, "utf8"));
+    return isRecord(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function sceneManifestPathForGuarantee(entry) {
+  const manifest = entry.manifest.scene?.manifest;
+  if (!manifest) return void 0;
+  return resolve(dirname(entry.sourcePath), manifest);
+}
+function sceneRouteFromYaml(value) {
+  const workflow = Array.isArray(value?.workflow) ? value.workflow : [];
+  for (const step of workflow) {
+    const action = isRecord(step) && isRecord(step.action) ? step.action : null;
+    const goto = isRecord(action?.goto) ? action.goto : null;
+    const url = stringValue(goto?.url) || stringValue(goto?.path) || stringValue(action?.goto);
+    if (url) return url;
+  }
+  return void 0;
+}
+function sceneStateKeys(value, key) {
+  const journey = isRecord(value?.journey) ? value.journey : null;
+  const entries = Array.isArray(journey?.[key]) ? journey[key] : [];
+  return entries.map((entry) => isRecord(entry) ? stringValue(entry.key) : stringValue(entry)).filter(Boolean);
+}
+function implicitAuthDependencyFor(entry) {
+  if (entry.manifest.type === "user" && entry.manifest.subtype === "auth") return void 0;
+  const entryRoute = entry.manifest.scene?.entryRoute;
+  const scenePath = sceneManifestPathForGuarantee(entry);
+  const sceneRoute = scenePath && existsSync(scenePath) ? sceneRouteFromYaml(readSceneYaml(scenePath)) : void 0;
+  const route = entryRoute || sceneRoute;
+  return route?.startsWith("/app/") || route === "/app" ? "guarantee.user.auth.user-login.004" : void 0;
+}
+function dependencyIdsForGuarantee(input) {
+  const deps = /* @__PURE__ */ new Map();
+  const add = (id, reason) => {
+    if (!id || id === input.entry.manifest.id || !input.byId.has(id)) return;
+    const reasons = deps.get(id) ?? /* @__PURE__ */ new Set();
+    reasons.add(reason);
+    deps.set(id, reasons);
+  };
+  for (const id of input.entry.manifest.dependencies.guarantees ?? []) add(id, "explicit-guarantee");
+  for (const journeyIndex of input.entry.manifest.dependencies.journeys ?? []) add(input.byJourneyIndex.get(journeyIndex)?.manifest.id, "journey-index");
+  for (const dep of input.entry.manifest.dependsOnGuarantees ?? []) {
+    const [ownerPackage, ref] = dep.includes(":") ? dep.split(/:(.+)/u).filter(Boolean) : ["", dep];
+    const match = input.valid.find((candidate) => (!ownerPackage || candidate.manifest.ownerPackage === ownerPackage) && candidate.manifest.status === "active" && (candidate.manifest.id === ref || allVerifierRefs(candidate.manifest).includes(ref)));
+    add(match?.manifest.id, "depends-on-verifier");
+  }
+  add(implicitAuthDependencyFor(input.entry), "implicit-auth");
+  return deps;
+}
+function buildTreeseedGuaranteeDependencyGraph(input) {
+  const valid = input.guarantees.filter((entry) => Boolean(entry.manifest)).sort(sortGuaranteeEntries);
   const byId = new Map(valid.map((entry) => [entry.manifest.id, entry]));
-  const selected = /* @__PURE__ */ new Map();
-  for (const entry of valid) {
-    if (selectedByFilter(entry.manifest, input.filter)) selected.set(entry.manifest.id, entry);
+  const byJourneyIndex = new Map(valid.flatMap((entry) => entry.manifest.journeyIndex ? [[entry.manifest.journeyIndex, entry]] : []));
+  const selectedIds = new Set(valid.filter((entry) => selectedByFilter(entry.manifest, input.filter)).map((entry) => entry.manifest.id));
+  const includeIds = new Set(selectedIds);
+  const reasonById = /* @__PURE__ */ new Map();
+  const diagnostics = [];
+  const visitInclude = (id, chain) => {
+    const entry = byId.get(id);
+    if (!entry) return;
+    if (chain.includes(id)) {
+      diagnostics.push(diagnostic("error", "guarantee.dependency_cycle", `Guarantee dependency cycle: ${[...chain, id].join(" -> ")}.`, "dependencies", entry.sourcePath));
+      return;
+    }
+    const deps = dependencyIdsForGuarantee({ entry, byId, byJourneyIndex, valid });
+    for (const [depId, reasons] of deps) {
+      for (const reason of reasons) {
+        const existing = reasonById.get(depId) ?? /* @__PURE__ */ new Set();
+        existing.add(reason);
+        reasonById.set(depId, existing);
+      }
+      if (input.includeDependencies !== false && !includeIds.has(depId)) includeIds.add(depId);
+      if (input.includeDependencies !== false) visitInclude(depId, [...chain, id]);
+    }
+  };
+  for (const id of [...selectedIds]) visitInclude(id, []);
+  const included = valid.filter((entry) => includeIds.has(entry.manifest.id));
+  const includedIds = new Set(included.map((entry) => entry.manifest.id));
+  const depMap = /* @__PURE__ */ new Map();
+  const reasonMap = /* @__PURE__ */ new Map();
+  const stateProduces = /* @__PURE__ */ new Map();
+  const stateConsumes = /* @__PURE__ */ new Map();
+  for (const entry of included) {
+    const scenePath = sceneManifestPathForGuarantee(entry);
+    const scene = scenePath && existsSync(scenePath) ? readSceneYaml(scenePath) : null;
+    stateProduces.set(entry.manifest.id, sceneStateKeys(scene, "producesState"));
+    stateConsumes.set(entry.manifest.id, sceneStateKeys(scene, "consumesState"));
+    const deps = dependencyIdsForGuarantee({ entry, byId, byJourneyIndex, valid });
+    const filtered = [...deps.keys()].filter((id) => includedIds.has(id)).sort((a, b) => sortGuaranteeEntries(byId.get(a), byId.get(b)));
+    depMap.set(entry.manifest.id, filtered);
+    const reasons = /* @__PURE__ */ new Set();
+    for (const depId of filtered) for (const reason of deps.get(depId) ?? []) reasons.add(reason);
+    for (const reason of reasonById.get(entry.manifest.id) ?? []) reasons.add(reason);
+    reasonMap.set(entry.manifest.id, reasons);
   }
-  if (input.includeDependencies !== false) {
-    const visit = (id) => {
-      const entry = byId.get(id);
-      if (!entry) return;
-      for (const dep of entry.manifest.dependencies.guarantees ?? []) {
-        const depEntry = byId.get(dep);
-        if (depEntry && !selected.has(dep)) {
-          selected.set(dep, depEntry);
-          visit(dep);
-        }
+  const producersByStateKey = /* @__PURE__ */ new Map();
+  for (const [id, keys] of stateProduces) {
+    for (const key of keys) {
+      producersByStateKey.set(key, [...producersByStateKey.get(key) ?? [], id]);
+    }
+  }
+  for (const [key, producers] of producersByStateKey) {
+    const unique = [...new Set(producers)];
+    if (unique.length > 1) {
+      diagnostics.push(diagnostic(
+        "error",
+        "guarantee.state_duplicate_producer",
+        `State key ${key} is produced by multiple included guarantees: ${unique.join(", ")}.`,
+        "journey.producesState",
+        byId.get(unique[0])?.sourcePath
+      ));
+    }
+    producersByStateKey.set(key, unique);
+  }
+  for (const [id, keys] of stateConsumes) {
+    for (const key of keys) {
+      const producers = producersByStateKey.get(key) ?? [];
+      const producer = producers.length === 1 ? producers[0] : void 0;
+      if (producer && producer !== id && includedIds.has(producer)) {
+        const deps = depMap.get(id) ?? [];
+        if (!deps.includes(producer)) deps.push(producer);
+        depMap.set(id, deps.sort((a, b) => sortGuaranteeEntries(byId.get(a), byId.get(b))));
+        const reasons = reasonMap.get(id) ?? /* @__PURE__ */ new Set();
+        reasons.add("state");
+        reasonMap.set(id, reasons);
       }
-    };
-    for (const id of [...selected.keys()]) visit(id);
+    }
   }
-  return [...selected.values()].sort((a, b) => (a.manifest.journeyIndex ?? 99999) - (b.manifest.journeyIndex ?? 99999) || a.manifest.id.localeCompare(b.manifest.id));
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const ordered = [];
+  const visitOrder = (id, chain) => {
+    if (visited.has(id)) return;
+    if (visiting.has(id)) {
+      diagnostics.push(diagnostic("error", "guarantee.dependency_cycle", `Guarantee dependency cycle: ${[...chain, id].join(" -> ")}.`, "dependencies", byId.get(id)?.sourcePath));
+      return;
+    }
+    visiting.add(id);
+    for (const dep of depMap.get(id) ?? []) visitOrder(dep, [...chain, id]);
+    visiting.delete(id);
+    visited.add(id);
+    ordered.push(id);
+  };
+  for (const entry of included) visitOrder(entry.manifest.id, []);
+  const inverse = /* @__PURE__ */ new Map();
+  for (const [id, deps] of depMap) for (const dep of deps) inverse.set(dep, [...inverse.get(dep) ?? [], id]);
+  const depthCache = /* @__PURE__ */ new Map();
+  const depth = (id, chain = []) => {
+    if (depthCache.has(id)) return depthCache.get(id);
+    if (chain.includes(id)) {
+      diagnostics.push(diagnostic("error", "guarantee.dependency_cycle", `Guarantee dependency cycle: ${[...chain, id].join(" -> ")}.`, "dependencies", byId.get(id)?.sourcePath));
+      return 0;
+    }
+    const value = Math.max(0, ...(depMap.get(id) ?? []).map((dep) => depth(dep, [...chain, id]) + 1));
+    depthCache.set(id, value);
+    return value;
+  };
+  const meta = /* @__PURE__ */ new Map();
+  for (const [index, id] of ordered.entries()) {
+    meta.set(id, {
+      dependsOn: depMap.get(id) ?? [],
+      dependencyOf: (inverse.get(id) ?? []).sort((a, b) => sortGuaranteeEntries(byId.get(a), byId.get(b))),
+      dependencyReason: [...reasonMap.get(id) ?? /* @__PURE__ */ new Set()],
+      dependencyDepth: depth(id),
+      executionOrder: index,
+      producesState: stateProduces.get(id) ?? [],
+      consumesState: stateConsumes.get(id) ?? []
+    });
+  }
+  return { entries: ordered.map((id) => byId.get(id)).filter(Boolean), selectedIds, meta, diagnostics };
+}
+function filterTreeseedGuarantees(input) {
+  return buildTreeseedGuaranteeDependencyGraph(input).entries;
 }
 function validateTreeseedGuaranteeRegistry(input) {
   const diagnostics = [
@@ -470,35 +630,47 @@ function refs(contract) {
 function planTreeseedGuarantees(input) {
   const registry = discoverTreeseedGuarantees({ workspaceRoot: input.workspaceRoot, filter: input.filter });
   const selectedWithoutDeps = filterTreeseedGuarantees({ guarantees: registry.guarantees, filter: input.filter, includeDependencies: false });
-  const selectedIds = new Set(selectedWithoutDeps.map((entry) => entry.manifest.id));
-  const entries = filterTreeseedGuarantees({ guarantees: registry.guarantees, filter: input.filter, includeDependencies: input.includeDependencies !== false }).map((entry) => ({
-    id: entry.manifest.id,
-    ...entry.manifest.journeyIndex ? { journeyIndex: entry.manifest.journeyIndex } : {},
-    type: entry.manifest.type,
-    subtype: entry.manifest.subtype,
-    journey: entry.manifest.journey,
-    ownerPackage: entry.manifest.ownerPackage,
-    ...entry.manifest.surface ? { surface: entry.manifest.surface } : {},
-    status: entry.manifest.status,
-    gates: entry.manifest.gates,
-    sourcePath: entry.relativePath,
-    selected: selectedIds.has(entry.manifest.id),
-    dependency: !selectedIds.has(entry.manifest.id),
-    ...entry.manifest.scene?.manifest ? { sceneManifest: entry.manifest.scene.manifest } : {},
-    apiVerifierRefs: refs(entry.manifest.api),
-    contentVerifierRefs: refs(entry.manifest.content),
-    auditVerifierRefs: refs(entry.manifest.audit),
-    evidenceRequired: entry.manifest.evidence.required
-  }));
-  const errors = registry.diagnostics.filter((entry) => entry.severity === "error").length;
-  const warnings = registry.diagnostics.filter((entry) => entry.severity === "warning").length;
+  const graph = buildTreeseedGuaranteeDependencyGraph({ guarantees: registry.guarantees, filter: input.filter, includeDependencies: input.includeDependencies !== false });
+  const selectedIds = graph.selectedIds;
+  const entries = graph.entries.map((entry) => {
+    const meta = graph.meta.get(entry.manifest.id);
+    return {
+      id: entry.manifest.id,
+      ...entry.manifest.journeyIndex ? { journeyIndex: entry.manifest.journeyIndex } : {},
+      type: entry.manifest.type,
+      subtype: entry.manifest.subtype,
+      journey: entry.manifest.journey,
+      ownerPackage: entry.manifest.ownerPackage,
+      ...entry.manifest.surface ? { surface: entry.manifest.surface } : {},
+      status: entry.manifest.status,
+      gates: entry.manifest.gates,
+      sourcePath: entry.relativePath,
+      selected: selectedIds.has(entry.manifest.id),
+      dependency: !selectedIds.has(entry.manifest.id),
+      ...entry.manifest.scene?.manifest ? { sceneManifest: entry.manifest.scene.manifest } : {},
+      apiVerifierRefs: refs(entry.manifest.api),
+      contentVerifierRefs: refs(entry.manifest.content),
+      auditVerifierRefs: refs(entry.manifest.audit),
+      evidenceRequired: entry.manifest.evidence.required,
+      dependencyDepth: meta?.dependencyDepth ?? 0,
+      dependencyOf: meta?.dependencyOf ?? [],
+      dependsOn: meta?.dependsOn ?? [],
+      dependencyReason: meta?.dependencyReason ?? [],
+      executionOrder: meta?.executionOrder ?? 0,
+      ...meta?.producesState.length ? { producesState: meta.producesState } : {},
+      ...meta?.consumesState.length ? { consumesState: meta.consumesState } : {}
+    };
+  });
+  const diagnostics = [...registry.diagnostics, ...graph.diagnostics];
+  const errors = diagnostics.filter((entry) => entry.severity === "error").length;
+  const warnings = diagnostics.filter((entry) => entry.severity === "warning").length;
   return {
-    ok: registry.ok,
+    ok: errors === 0,
     workspaceRoot: resolve(input.workspaceRoot),
     filter: input.filter ?? {},
     environment: input.environment ?? "local",
     entries,
-    diagnostics: registry.diagnostics,
+    diagnostics,
     counts: {
       total: registry.counts.total,
       selected: selectedWithoutDeps.length,
@@ -508,6 +680,181 @@ function planTreeseedGuarantees(input) {
     }
   };
 }
+function collectFiles(root, predicate, out = []) {
+  if (!existsSync(root)) return out;
+  for (const name of readdirSync(root)) {
+    if (EXCLUDED_DIRS.has(name)) continue;
+    const path = resolve(root, name);
+    let stat;
+    try {
+      stat = statSync(path);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) collectFiles(path, predicate, out);
+    else if (stat.isFile() && predicate(path)) out.push(path);
+  }
+  return out;
+}
+function astroRoutePatternFromPath(root, filePath) {
+  const relativePath = relative(root, filePath).replace(/\\/gu, "/");
+  const withoutExtension = relativePath.replace(/\.(astro|tsx|ts|jsx|js)$/u, "");
+  const segments = withoutExtension.split("/").filter(Boolean);
+  if (segments.at(-1) === "index") segments.pop();
+  return `/${segments.map((segment) => {
+    if (/^\[\.\.\..+\]$/u.test(segment)) return "**";
+    if (/^\[.+\]$/u.test(segment)) return "*";
+    return segment;
+  }).join("/")}`.replace(/\/+$/u, "") || "/";
+}
+function collectAstroRoutePatterns(workspaceRoot) {
+  const roots = [
+    resolve(workspaceRoot, "src/pages"),
+    resolve(workspaceRoot, "packages/admin/src/pages"),
+    resolve(workspaceRoot, "packages/core/src/pages")
+  ];
+  const patterns = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    for (const path of collectFiles(root, (entry) => /\.(astro|tsx|ts|jsx|js)$/u.test(entry))) {
+      patterns.add(astroRoutePatternFromPath(root, path));
+    }
+  }
+  return patterns;
+}
+function normalizeRoutePath(route) {
+  if (!route) return void 0;
+  if (/^https?:\/\//u.test(route)) {
+    try {
+      return new URL(route).pathname || "/";
+    } catch {
+      return route;
+    }
+  }
+  return route.split(/[?#]/u)[0] || "/";
+}
+function routePatternMatches(pattern, route) {
+  const patternSegments = pattern.split("/").filter(Boolean);
+  const routeSegments = route.split("/").filter(Boolean);
+  if (patternSegments.includes("**")) {
+    const index = patternSegments.indexOf("**");
+    return patternSegments.slice(0, index).every((segment, segmentIndex) => segment === "*" || segment === routeSegments[segmentIndex]);
+  }
+  if (patternSegments.length !== routeSegments.length) return false;
+  return patternSegments.every((segment, index) => segment === "*" || segment === routeSegments[index]);
+}
+function actionKindFromSceneStep(step) {
+  const action = isRecord(step) && isRecord(step.action) ? step.action : null;
+  return action ? Object.keys(action)[0] ?? "unknown" : "unknown";
+}
+function sceneHasAcceptanceAssertions(step) {
+  return isRecord(step) && isRecord(step.expect) && Object.keys(step.expect).length > 0;
+}
+function sceneUsesOnlyStableSelectors(value) {
+  const text = JSON.stringify(value ?? {});
+  if (!text.includes('"selector"')) return true;
+  return /data-scene|data-testid|testId|getByRole|getByLabel|getByText|"internal":true/iu.test(text);
+}
+function auditTreeseedGuaranteeJourneys(input) {
+  const workspaceRoot = resolve(input.workspaceRoot);
+  const registry = discoverTreeseedGuarantees({ workspaceRoot, filter: input.filter });
+  const routes = collectAstroRoutePatterns(workspaceRoot);
+  const valid = registry.guarantees.filter((entry) => Boolean(entry.manifest));
+  const graph = buildTreeseedGuaranteeDependencyGraph({ guarantees: registry.guarantees, filter: input.filter, includeDependencies: true });
+  const items = [];
+  for (const entry of valid.filter((candidate) => selectedByFilter(candidate.manifest, input.filter))) {
+    const scenePath = sceneManifestPathForGuarantee(entry);
+    if (!scenePath) {
+      items.push({
+        guaranteeId: entry.manifest.id,
+        status: entry.manifest.status,
+        ownerPackage: entry.manifest.ownerPackage,
+        type: entry.manifest.type,
+        subtype: entry.manifest.subtype,
+        journey: entry.manifest.journey,
+        sourcePath: entry.relativePath,
+        routeExists: true,
+        sceneWorkflowStepCount: 0,
+        interactiveStepCount: 0,
+        classification: "non-ui-guarantee",
+        requiredAction: "none",
+        diagnostics: []
+      });
+      continue;
+    }
+    const scene = existsSync(scenePath) ? readSceneYaml(scenePath) : null;
+    const workflow = Array.isArray(scene?.workflow) ? scene.workflow : [];
+    const journey = isRecord(scene?.journey) ? scene.journey : null;
+    const serviceJourney = journey?.kind === "service";
+    const minimumSteps = typeof journey?.minimumSteps === "number" ? journey.minimumSteps : 2;
+    const actionKinds = workflow.map(actionKindFromSceneStep);
+    const interactiveStepCount = actionKinds.filter((kind) => kind !== "goto" && kind !== "pause").length;
+    const currentRoute = normalizeRoutePath(entry.manifest.scene?.entryRoute || sceneRouteFromYaml(scene));
+    const routeExists = Boolean(currentRoute && !currentRoute.includes(":") && [...routes].some((pattern) => routePatternMatches(pattern, currentRoute))) || !currentRoute;
+    const missingSelectors2 = entry.manifest.status === "active" && !sceneUsesOnlyStableSelectors(scene);
+    const weak = workflow.length < minimumSteps || interactiveStepCount === 0 || entry.manifest.status === "active" && (!serviceJourney || workflow.some((step) => !sceneHasAcceptanceAssertions(step)));
+    const diagnostics2 = [];
+    if (!existsSync(scenePath)) diagnostics2.push(diagnostic("error", "guarantee.scene_missing_manifest", `Scene manifest does not exist: ${relative(workspaceRoot, scenePath)}.`, "scene.manifest", entry.sourcePath));
+    if (!routeExists) diagnostics2.push(diagnostic(entry.manifest.status === "active" ? "error" : "warning", "guarantee.scene_missing_route", `Scene entry route ${currentRoute ?? "(unknown)"} does not map to a known Astro route.`, "scene.entryRoute", entry.sourcePath));
+    if (entry.manifest.status === "active" && !serviceJourney) diagnostics2.push(diagnostic("error", "guarantee.scene_missing_service_journey", "Active scene-backed guarantees must declare journey.kind: service in the scene manifest.", "scene.journey.kind", entry.sourcePath));
+    if (weak) diagnostics2.push(...validateGuaranteeSceneJourneyContract({ scenePath, sourcePath: entry.sourcePath }).map((item) => entry.manifest.status === "active" ? item : { ...item, severity: "warning" }));
+    if (missingSelectors2) diagnostics2.push(diagnostic("error", "guarantee.scene_missing_stable_selectors", "Active service journey scenes must use stable data-scene, data-testid, or role/text selectors instead of brittle CSS selectors.", "scene.workflow", entry.sourcePath));
+    const classification = !routeExists ? "missing-product-route" : missingSelectors2 ? "missing-stable-selectors" : entry.manifest.status !== "active" && weak ? "planned-product-contract" : weak ? "weak-page-only-scene" : "valid-service-journey";
+    const requiredAction = classification === "missing-product-route" ? entry.manifest.status === "active" ? "downgrade-status" : "fix-route" : classification === "missing-stable-selectors" ? "add-selectors" : classification === "weak-page-only-scene" ? "author-scene" : "none";
+    items.push({
+      guaranteeId: entry.manifest.id,
+      status: entry.manifest.status,
+      ownerPackage: entry.manifest.ownerPackage,
+      type: entry.manifest.type,
+      subtype: entry.manifest.subtype,
+      journey: entry.manifest.journey,
+      sourcePath: entry.relativePath,
+      scenePath: relative(workspaceRoot, scenePath),
+      ...currentRoute ? { currentRoute, resolvedRoute: currentRoute } : {},
+      routeExists,
+      sceneWorkflowStepCount: workflow.length,
+      interactiveStepCount,
+      classification,
+      requiredAction,
+      diagnostics: diagnostics2
+    });
+  }
+  const sceneBackedItems = items.filter((entry) => entry.scenePath);
+  const activeSceneBacked = sceneBackedItems.filter((entry) => entry.status === "active");
+  const weakSceneContracts = sceneBackedItems.filter((entry) => entry.classification === "weak-page-only-scene" || entry.classification === "planned-product-contract").length;
+  const missingRoutes = sceneBackedItems.filter((entry) => entry.classification === "missing-product-route").length;
+  const missingSelectors = sceneBackedItems.filter((entry) => entry.classification === "missing-stable-selectors").length;
+  const activeSceneBackedWeak = activeSceneBacked.filter((entry) => entry.classification === "weak-page-only-scene").length;
+  const activeMissingRoutes = activeSceneBacked.filter((entry) => entry.classification === "missing-product-route").length;
+  const activeMissingSelectors = activeSceneBacked.filter((entry) => entry.classification === "missing-stable-selectors").length;
+  const diagnostics = [...registry.diagnostics, ...graph.diagnostics, ...items.flatMap((entry) => entry.diagnostics)];
+  const audit = {
+    schemaVersion: TREESEED_GUARANTEE_JOURNEY_AUDIT_SCHEMA_VERSION,
+    workspaceRoot,
+    generatedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    totals: {
+      guarantees: valid.length,
+      sceneBacked: sceneBackedItems.length,
+      activeSceneBacked: activeSceneBacked.length,
+      weakSceneContracts,
+      missingRoutes,
+      missingSelectors,
+      dependencyErrors: graph.diagnostics.filter((entry) => entry.severity === "error").length,
+      activeSceneBackedWeak,
+      activeMissingRoutes,
+      activeMissingSelectors
+    },
+    items,
+    diagnostics,
+    ok: activeSceneBackedWeak === 0 && activeMissingRoutes === 0 && activeMissingSelectors === 0 && diagnostics.every((entry) => entry.severity !== "error")
+  };
+  if (input.writeReport) {
+    const outputPath = assertPathInsideWorkspace(workspaceRoot, resolve(workspaceRoot, input.writeReport));
+    mkdirSync(dirname(outputPath), { recursive: true });
+    writeFileSync(outputPath, `${JSON.stringify(audit, null, 2)}
+`);
+  }
+  return audit;
+}
 function csvEscape(value) {
   const text = Array.isArray(value) ? value.join("; ") : String(value ?? "");
   return /[",\n\r]/u.test(text) ? `"${text.replace(/"/gu, '""')}"` : text;
@@ -642,13 +989,23 @@ async function writeCommandEvidence(input) {
   const evidencePath = resolve(input.outputRoot, "evidence", `${safeRef}.json`);
   mkdirSync(dirname(evidencePath), { recursive: true });
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const cwd = input.cwd ? resolve(input.workspaceRoot, input.cwd) : resolve(input.workspaceRoot);
+  const renderedCommand = [input.command, ...input.args].join(" ");
+  input.onProgress?.(`[guarantees][verifier] ${input.ref}: running ${renderedCommand}`);
   try {
-    const result = await execFileAsync(input.command, input.args, {
-      cwd: input.cwd ? resolve(input.workspaceRoot, input.cwd) : resolve(input.workspaceRoot),
+    const result = await runVerifierCommand({
+      command: input.command,
+      args: input.args,
+      cwd,
       env: input.env ? { ...process.env, ...input.env } : process.env,
-      timeout: Math.max(1, input.timeoutSeconds ?? 300) * 1e3,
-      maxBuffer: 1024 * 1024 * 20
+      timeoutMs: Math.max(1, input.timeoutSeconds ?? 300) * 1e3,
+      onProgress: input.onProgress,
+      ref: input.ref
     });
+    const successError = input.validateSuccess?.(result);
+    if (successError) {
+      throw Object.assign(new Error(successError), { stdout: result.stdout, stderr: result.stderr, code: 1 });
+    }
     const completedAt = (/* @__PURE__ */ new Date()).toISOString();
     writeFileSync(evidencePath, `${JSON.stringify({
       ref: input.ref,
@@ -663,6 +1020,7 @@ async function writeCommandEvidence(input) {
       stderr: result.stderr
     }, null, 2)}
 `, "utf8");
+    input.onProgress?.(`[guarantees][verifier] ${input.ref}: passed`);
     return {
       status: "passed",
       summary: `${input.ref} passed.`,
@@ -685,6 +1043,7 @@ async function writeCommandEvidence(input) {
       error: commandError.message
     }, null, 2)}
 `, "utf8");
+    input.onProgress?.(`[guarantees][verifier] ${input.ref}: failed - ${commandError.message}`, "stderr");
     return {
       status: "failed",
       summary: `${input.ref} failed.`,
@@ -693,6 +1052,75 @@ async function writeCommandEvidence(input) {
     };
   }
 }
+function stripAnsi(value) {
+  return value.replace(/\u001B\[[0-9;]*m/gu, "");
+}
+function vitestExecutedAssertionCount(output) {
+  const text = stripAnsi(output).replace(/\r\n/gu, "\n");
+  const testsLine = text.split("\n").find((line) => /^\s*Tests\s+/u.test(line));
+  if (!testsLine) return 0;
+  const passed = [...testsLine.matchAll(/(\d+)\s+passed/gu)].reduce((total, match) => total + Number(match[1] ?? 0), 0);
+  const failed = [...testsLine.matchAll(/(\d+)\s+failed/gu)].reduce((total, match) => total + Number(match[1] ?? 0), 0);
+  return passed + failed;
+}
+function validateTreeseedVitestVerifierOutput(result) {
+  const output = `${result.stdout}
+${result.stderr}`;
+  if (vitestExecutedAssertionCount(output) > 0) return null;
+  return "Vitest verifier completed without executing any assertions. Check the verifier testName/testFile; skipped-only or no-match runs are not valid guarantee evidence.";
+}
+function runVerifierCommand(input) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(input.command, input.args, {
+      cwd: input.cwd,
+      env: input.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      input.onProgress?.(`[guarantees][verifier] ${input.ref}: timed out after ${Math.round(input.timeoutMs / 1e3)}s`, "stderr");
+      child.kill("SIGTERM");
+      setTimeout(() => {
+        if (!settled) child.kill("SIGKILL");
+      }, 2e3).unref();
+    }, input.timeoutMs);
+    timer.unref();
+    child.stdout.on("data", (chunk) => {
+      const text = chunk.toString();
+      stdout += text;
+      for (const line of text.split(/\r?\n/u)) {
+        if (line.trim()) input.onProgress?.(`[guarantees][verifier][stdout] ${input.ref}: ${line}`);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString();
+      stderr += text;
+      for (const line of text.split(/\r?\n/u)) {
+        if (line.trim()) input.onProgress?.(`[guarantees][verifier][stderr] ${input.ref}: ${line}`, "stderr");
+      }
+    });
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(Object.assign(error, { stdout, stderr }));
+    });
+    child.on("close", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (code === 0) {
+        resolvePromise({ stdout, stderr });
+        return;
+      }
+      const message = signal ? `${input.command} ${input.args.join(" ")} exited with signal ${signal}` : `${input.command} ${input.args.join(" ")} exited with code ${code ?? 1}`;
+      reject(Object.assign(new Error(message), { stdout, stderr, code: code ?? signal ?? 1 }));
+    });
+  });
+}
 function evidenceEnvSummary(env) {
   if (!env) return void 0;
   return Object.fromEntries(Object.entries(env).map(([key, value]) => [
@@ -700,6 +1128,52 @@ function evidenceEnvSummary(env) {
     /SECRET|TOKEN|KEY|PASSWORD/iu.test(key) && value ? "<redacted>" : value
   ]));
 }
+function sceneActionKindFromManifestAction(action) {
+  if (!action || typeof action !== "object") return "unknown";
+  const keys = Object.keys(action);
+  return keys[0] ?? "unknown";
+}
+function validateGuaranteeSceneJourneyContract(input) {
+  const diagnostics = [];
+  let value = null;
+  try {
+    value = parseYaml(readFileSync(input.scenePath, "utf8"));
+  } catch (error) {
+    diagnostics.push(diagnostic("error", "guarantee.scene_unreadable", error instanceof Error ? error.message : String(error ?? "Scene manifest could not be read."), "scene.manifest", input.sourcePath));
+    return diagnostics;
+  }
+  if (!value || typeof value !== "object") {
+    diagnostics.push(diagnostic("error", "guarantee.scene_invalid_manifest", "Scene manifest must be an object.", "scene.manifest", input.sourcePath));
+    return diagnostics;
+  }
+  const workflow = Array.isArray(value.workflow) ? value.workflow : [];
+  if (workflow.length === 0) {
+    diagnostics.push(diagnostic("error", "guarantee.scene_empty_journey", "Active scene guarantee has no workflow steps.", "scene.workflow", input.sourcePath));
+    return diagnostics;
+  }
+  const journey = isRecord(value.journey) ? value.journey : null;
+  const minimumSteps = typeof journey?.minimumSteps === "number" ? journey.minimumSteps : 2;
+  if (journey?.kind !== "service") {
+    diagnostics.push(diagnostic("error", "guarantee.scene_missing_service_journey", "Scene-backed active guarantees must declare journey.kind: service so evidence is tied to a service journey contract.", "scene.journey.kind", input.sourcePath));
+  }
+  const actionKinds = workflow.map((step) => sceneActionKindFromManifestAction(step?.action));
+  const interactiveActions = actionKinds.filter((kind) => kind !== "goto" && kind !== "pause");
+  if (workflow.length < minimumSteps || interactiveActions.length === 0) {
+    diagnostics.push(diagnostic(
+      "error",
+      "guarantee.scene_weak_journey_contract",
+      `Scene workflow has ${workflow.length} step${workflow.length === 1 ? "" : "s"} (${actionKinds.join(", ")}). A service journey guarantee must exercise user/service actions after opening the entry route, so evidence captures the actual journey instead of only the first page.`,
+      "scene.workflow",
+      input.sourcePath
+    ));
+  }
+  for (const [index, step] of workflow.entries()) {
+    if (!sceneHasAcceptanceAssertions(step)) {
+      diagnostics.push(diagnostic("error", "guarantee.scene_step_missing_assertions", `Workflow step ${index + 1} is missing acceptance assertions.`, `scene.workflow[${index}].expect`, input.sourcePath));
+    }
+  }
+  return diagnostics;
+}
 function apiAcceptanceEnvironment(environment) {
   const baseUrl = apiAcceptanceBaseUrl(environment);
   const serviceId = process.env.TREESEED_ACCEPTANCE_SERVICE_ID ?? process.env.TREESEED_API_WEB_SERVICE_ID ?? process.env.TREESEED_WEB_SERVICE_ID ?? (environment === "local" ? "web" : void 0);
@@ -759,7 +1233,8 @@ async function defaultTreeseedGuaranteeVerifierExecutor(input) {
       command: "npm",
       args: ["-w", "packages/api", "run", "test:acceptance", "--", "--environment", input.environment, "--base-url", apiAcceptanceBaseUrl(input.environment), "--case", definition.caseId, "--json"],
       timeoutSeconds: definition.timeoutSeconds,
-      env: apiAcceptanceEnvironment(input.environment)
+      env: apiAcceptanceEnvironment(input.environment),
+      onProgress: input.onProgress
     });
   }
   if (definition.kind === "vitestCase") {
@@ -772,7 +1247,9 @@ async function defaultTreeseedGuaranteeVerifierExecutor(input) {
       ref: input.ref,
       command: "npm",
       args: ["-w", workspace, "exec", "--", "vitest", "run", "--config", "./vitest.config.js", definition.testFile, ...definition.testName ? ["-t", definition.testName] : []],
-      timeoutSeconds: definition.timeoutSeconds
+      timeoutSeconds: definition.timeoutSeconds,
+      onProgress: input.onProgress,
+      validateSuccess: validateTreeseedVitestVerifierOutput
     });
   }
   if (definition.kind === "packageScript") {
@@ -785,7 +1262,8 @@ async function defaultTreeseedGuaranteeVerifierExecutor(input) {
       ref: input.ref,
       command: "npm",
       args: ["-w", workspace, "run", definition.command, "--", ...definition.args ?? []],
-      timeoutSeconds: definition.timeoutSeconds
+      timeoutSeconds: definition.timeoutSeconds,
+      onProgress: input.onProgress
     });
   }
   if (definition.kind === "nodeScript") {
@@ -799,7 +1277,8 @@ async function defaultTreeseedGuaranteeVerifierExecutor(input) {
       command: "node",
       args: ["--import", "tsx", definition.command, ...definition.args ?? []],
       cwd: definition.cwd,
-      timeoutSeconds: definition.timeoutSeconds
+      timeoutSeconds: definition.timeoutSeconds,
+      onProgress: input.onProgress
     });
   }
   return {
@@ -808,41 +1287,88 @@ async function defaultTreeseedGuaranteeVerifierExecutor(input) {
     diagnostics: [diagnostic("error", "guarantee.unsupported_verifier_kind", `Unsupported verifier kind "${definition.kind}".`, input.ref, input.guarantee.sourcePath)]
   };
 }
+function sceneAuthRoleForGuarantee(manifest) {
+  if (manifest.actors.allowed.includes("anonymous_user") || manifest.actors.allowed.includes("anonymous")) return void 0;
+  const actors = manifest.actors.allowed.map((actor) => actor.toLowerCase());
+  if (actors.some((actor) => /owner|operator|seller|platform|host/iu.test(actor))) return "owner";
+  if (actors.some((actor) => /admin|manager|lead/iu.test(actor))) return "admin";
+  if (actors.some((actor) => /member|contributor|authenticated|participant|viewer/iu.test(actor))) return "member";
+  return "owner";
+}
+function browserForGuaranteeDevice(device) {
+  if (device?.includes("firefox")) return "firefox";
+  if (device?.includes("webkit")) return "webkit";
+  return "chromium";
+}
+function sceneDeviceRunsForGuarantee(devices) {
+  const requested = devices.length > 0 ? devices : ["desktop_chromium"];
+  return requested.map((device) => ({
+    id: device.toLowerCase().replace(/[^a-z0-9._-]+/gu, "-"),
+    device,
+    browser: browserForGuaranteeDevice(device)
+  }));
+}
+function sceneReportEvidencePaths(workspaceRoot, report) {
+  const primaryScreenshots = [
+    ...(report.steps ?? []).map((step) => step.screenshotPath).filter(Boolean),
+    ...report.artifacts?.screenshotPaths ?? []
+  ].filter((path) => Boolean(path && !path.includes("/screenshots/viewport/")));
+  return sortedUnique([
+    ...primaryScreenshots,
+    report.playwrightTracePath ?? void 0,
+    report.artifacts?.runRoot
+  ].filter(Boolean).map((entry) => relativeEvidencePath(workspaceRoot, entry)));
+}
 async function defaultTreeseedGuaranteeSceneExecutor(input) {
   try {
+    const contractDiagnostics = validateGuaranteeSceneJourneyContract({ scenePath: input.scenePath, sourcePath: input.guarantee.sourcePath });
     const scenes = await import("../scenes/index.js");
-    const devices = input.guarantee.manifest.devices.required;
-    if (devices.length > 1 && typeof scenes.runTreeseedSceneDeviceMatrix === "function") {
-      const report2 = await scenes.runTreeseedSceneDeviceMatrix({
-        projectRoot: input.workspaceRoot,
-        scene: input.scenePath,
-        environment: input.environment,
-        record: input.record,
-        artifactMode: input.artifactMode,
-        mode: "acceptance",
-        devices
-      });
+    const authRole = sceneAuthRoleForGuarantee(input.guarantee.manifest);
+    const runs = sceneDeviceRunsForGuarantee(input.device ? [input.device] : input.guarantee.manifest.devices.required);
+    if (runs.length > 1) {
+      const runReports = [];
+      for (const run2 of runs) {
+        const report2 = await scenes.runTreeseedScene({
+          projectRoot: input.workspaceRoot,
+          scene: input.scenePath,
+          environment: input.environment,
+          device: run2.device,
+          browser: run2.browser,
+          authRole,
+          record: input.record,
+          artifactMode: input.artifactMode,
+          mode: "acceptance",
+          runId: `${input.runId}-${run2.id}`
+        });
+        runReports.push(report2);
+      }
+      const ok2 = contractDiagnostics.length === 0 && runReports.every((entry) => entry.ok);
       return {
-        status: report2.ok ? "passed" : "failed",
-        summary: report2.ok ? "Scene device matrix passed." : "Scene device matrix failed.",
-        evidence: [report2.matrixPath, ...(report2.runReports ?? []).map((entry) => entry.artifacts?.runRoot)].filter(Boolean).map((entry) => relativeEvidencePath(input.workspaceRoot, entry)),
-        diagnostics: report2.diagnostics ?? []
+        status: ok2 ? "passed" : "failed",
+        summary: ok2 ? "Scene device matrix passed." : contractDiagnostics.length > 0 ? "Scene is not a complete service journey." : "Scene device matrix failed.",
+        evidence: runReports.flatMap((entry) => sceneReportEvidencePaths(input.workspaceRoot, entry)),
+        diagnostics: [...contractDiagnostics, ...runReports.flatMap((entry) => entry.diagnostics ?? [])]
       };
     }
+    const run = runs[0];
     const report = await scenes.runTreeseedScene({
       projectRoot: input.workspaceRoot,
       scene: input.scenePath,
       environment: input.environment,
-      device: input.device ?? devices[0],
+      device: run.device,
+      browser: run.browser,
+      authRole,
       record: input.record,
       artifactMode: input.artifactMode,
-      mode: "acceptance"
+      mode: "acceptance",
+      runId: `${input.runId}-${run.id}`
     });
+    const ok = contractDiagnostics.length === 0 && report.ok;
     return {
-      status: report.ok ? "passed" : "failed",
-      summary: report.ok ? "Scene passed." : "Scene failed.",
-      evidence: [report.artifacts?.runRoot, report.playwrightTracePath].filter(Boolean).map((entry) => relativeEvidencePath(input.workspaceRoot, entry)),
-      diagnostics: report.diagnostics ?? []
+      status: ok ? "passed" : "failed",
+      summary: ok ? "Scene passed." : contractDiagnostics.length > 0 ? "Scene is not a complete service journey." : "Scene failed.",
+      evidence: sceneReportEvidencePaths(input.workspaceRoot, report),
+      diagnostics: [...contractDiagnostics, ...report.diagnostics ?? []]
     };
   } catch (error) {
     return {
@@ -916,6 +1442,7 @@ async function runGuaranteeSteps(input) {
   const evidence = [];
   const addStep = async (step, run) => {
     const stepStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    input.onProgress?.(`[guarantees][step] ${input.guarantee.manifest.id}: starting ${step.kind}${step.ref ? ` ${step.ref}` : ""}`);
     const result = await run();
     const completedAt = (/* @__PURE__ */ new Date()).toISOString();
     const nextStep = {
@@ -930,6 +1457,7 @@ async function runGuaranteeSteps(input) {
     steps.push(nextStep);
     evidence.push(...nextStep.evidence ?? []);
     diagnostics.push(...nextStep.diagnostics ?? []);
+    input.onProgress?.(`[guarantees][step] ${input.guarantee.manifest.id}: ${nextStep.status} ${step.kind}${step.ref ? ` ${step.ref}` : ""}`);
   };
   const scene = input.guarantee.manifest.scene;
   if (scene?.required && scene.manifest) {
@@ -973,7 +1501,8 @@ async function runGuaranteeSteps(input) {
           guarantee: input.guarantee,
           ref,
           definition: resolution.definition,
-          kind: group.kind
+          kind: group.kind,
+          onProgress: input.onProgress
         });
         input.verifierCache.set(cacheKey, result);
         return result;
@@ -1012,16 +1541,64 @@ async function runTreeseedGuarantees(input) {
   const diagnostics = [...registry.diagnostics, ...plan.diagnostics];
   const allResolutions = verifierDefinitionsByRef(registry.verifierRegistries);
   const verifierCache = /* @__PURE__ */ new Map();
-  const selectedWithoutDeps = filterTreeseedGuarantees({ guarantees: registry.guarantees, filter, includeDependencies: false });
-  const selectedIds = new Set(selectedWithoutDeps.map((entry) => entry.manifest.id));
-  const runEntries = filterTreeseedGuarantees({ guarantees: registry.guarantees, filter, includeDependencies: input.includeDependencies !== false });
+  const graph = buildTreeseedGuaranteeDependencyGraph({ guarantees: registry.guarantees, filter, includeDependencies: input.includeDependencies !== false });
+  diagnostics.push(...graph.diagnostics);
+  const selectedIds = graph.selectedIds;
+  const runEntries = graph.entries;
+  const planEntryById = new Map(plan.entries.map((entry) => [entry.id, entry]));
+  const resultById = /* @__PURE__ */ new Map();
   const results = [];
+  input.onProgress?.(`[guarantees][run] planned ${runEntries.length} guarantee entries for ${environment}`);
   if (registry.ok && plan.ok) {
-    for (const entry of runEntries) {
+    for (const [index, entry] of runEntries.entries()) {
+      input.onProgress?.(`[guarantees][run] ${index + 1}/${runEntries.length} ${entry.manifest.id} (${entry.manifest.ownerPackage}) ${entry.manifest.journey}`);
+      const planEntry = planEntryById.get(entry.manifest.id);
+      const blockingDependencies = (planEntry?.dependsOn ?? []).map((id) => resultById.get(id)).filter((result2) => Boolean(result2 && result2.status !== "passed"));
+      if (blockingDependencies.length > 0) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const blockedBy = blockingDependencies.map((result2) => result2.id);
+        const dependencyDiagnostic = diagnostic(
+          "error",
+          "guarantee.dependency_failed",
+          `Dependency ${blockedBy.join(", ")} failed before ${entry.manifest.id}.`,
+          "dependencies.guarantees",
+          entry.sourcePath
+        );
+        const blocked = {
+          id: entry.manifest.id,
+          ...entry.manifest.journeyIndex ? { journeyIndex: entry.manifest.journeyIndex } : {},
+          type: entry.manifest.type,
+          subtype: entry.manifest.subtype,
+          journey: entry.manifest.journey,
+          ownerPackage: entry.manifest.ownerPackage,
+          status: "blocked",
+          selected: selectedIds.has(entry.manifest.id),
+          dependency: !selectedIds.has(entry.manifest.id),
+          sourcePath: entry.relativePath,
+          startedAt: now,
+          completedAt: now,
+          steps: [{
+            id: "dependency",
+            kind: "verifier",
+            status: "blocked",
+            summary: `Blocked by failed prerequisite: ${blockedBy.join(", ")}.`,
+            diagnostics: [dependencyDiagnostic],
+            startedAt: now,
+            completedAt: now
+          }],
+          evidence: [],
+          diagnostics: [dependencyDiagnostic]
+        };
+        results.push(blocked);
+        resultById.set(blocked.id, blocked);
+        input.onProgress?.(`[guarantees][run] ${entry.manifest.id}: blocked by ${blockedBy.join(", ")}`, "stderr");
+        continue;
+      }
       if (entry.manifest.status !== "active") {
         if (input.includePlanned) {
           const now = (/* @__PURE__ */ new Date()).toISOString();
-          results.push({
+          input.onProgress?.(`[guarantees][run] ${entry.manifest.id}: skipped because status is ${entry.manifest.status}`);
+          const skipped = {
             id: entry.manifest.id,
             ...entry.manifest.journeyIndex ? { journeyIndex: entry.manifest.journeyIndex } : {},
             type: entry.manifest.type,
@@ -1037,7 +1614,9 @@ async function runTreeseedGuarantees(input) {
             steps: [{ id: "status", kind: "verifier", status: "skipped", summary: `Guarantee is ${entry.manifest.status}.`, startedAt: now, completedAt: now }],
             evidence: [],
             diagnostics: []
-          });
+          };
+          results.push(skipped);
+          resultById.set(skipped.id, skipped);
         }
         continue;
       }
@@ -1050,7 +1629,8 @@ async function runTreeseedGuarantees(input) {
       diagnostics.push(...resolution.diagnostics);
       if (!resolution.ok) {
         const now = (/* @__PURE__ */ new Date()).toISOString();
-        results.push({
+        input.onProgress?.(`[guarantees][run] ${entry.manifest.id}: blocked by unresolved verifier refs`, "stderr");
+        const blocked = {
           id: entry.manifest.id,
           ...entry.manifest.journeyIndex ? { journeyIndex: entry.manifest.journeyIndex } : {},
           type: entry.manifest.type,
@@ -1066,10 +1646,12 @@ async function runTreeseedGuarantees(input) {
           steps: [],
           evidence: [],
           diagnostics: resolution.diagnostics
-        });
+        };
+        results.push(blocked);
+        resultById.set(blocked.id, blocked);
         continue;
       }
-      results.push(await runGuaranteeSteps({
+      const result = await runGuaranteeSteps({
         workspaceRoot,
         environment,
         runId,
@@ -1083,8 +1665,12 @@ async function runTreeseedGuarantees(input) {
         verifierCache,
         record: input.record,
         sceneArtifacts: input.sceneArtifacts,
-        device: input.device
-      }));
+        device: input.device,
+        onProgress: input.onProgress
+      });
+      results.push(result);
+      resultById.set(result.id, result);
+      input.onProgress?.(`[guarantees][run] ${entry.manifest.id}: ${result.status}`);
     }
   }
   const completedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1109,11 +1695,20 @@ async function runTreeseedGuarantees(input) {
     startedAt,
     completedAt,
     outputRoot,
+    statePath: relativeEvidencePath(workspaceRoot, resolve(outputRoot, "state.json")),
     plan,
     results,
     diagnostics,
     counts
   };
+  mkdirSync(outputRoot, { recursive: true });
+  const state = {
+    schemaVersion: "treeseed.guarantee-run-state/v1",
+    runId,
+    values: {}
+  };
+  writeFileSync(resolve(outputRoot, "state.json"), `${JSON.stringify(state, null, 2)}
+`);
   const writeResult = writeTreeseedGuaranteeRunReport({ report, registry });
   if (!writeResult.ok) {
     report.ok = false;
@@ -1153,9 +1748,12 @@ function fileExists(path) {
   return existsSync(path) && statSync(path).isFile();
 }
 export {
+  TREESEED_GUARANTEE_JOURNEY_AUDIT_SCHEMA_VERSION,
   TREESEED_GUARANTEE_SCHEMA_VERSION,
   TREESEED_GUARANTEE_VERIFIERS_SCHEMA_VERSION,
   assertPathInsideWorkspace,
+  auditTreeseedGuaranteeJourneys,
+  browserForGuaranteeDevice,
   createTreeseedGuaranteeStatusReport,
   discoverTreeseedGuarantees,
   exportTreeseedGuaranteesCsv,
@@ -1169,9 +1767,13 @@ export {
   planTreeseedGuarantees,
   resolveTreeseedGuaranteeVerifierRefs,
   runTreeseedGuarantees,
+  sceneAuthRoleForGuarantee,
+  sceneDeviceRunsForGuarantee,
   slugifyTreeseedGuaranteeJourney,
+  validateGuaranteeSceneJourneyContract,
   validateTreeseedGuarantee,
   validateTreeseedGuaranteeRegistry,
+  validateTreeseedVitestVerifierOutput,
   writeTreeseedGuaranteeRunReport,
   writeTreeseedGuaranteesExport
 };