@trycore/spec-build-harness 0.8.4 → 0.10.0

package/scripts/tests/test-install.sh

@@ -53,9 +53,15 @@ check() { # <ruta relativa a .claude> <descripción>
 
 check "hooks/build/reconcile-build-state.py"
 check "hooks/build/lib/state-io.sh"
+check "hooks/build/lib/config.sh"
 check "hooks/build/context-monitor.sh"
 check "hooks/build/statusline-bridge.sh"
 check "scripts/lib/front-plan.py"
+check "hooks/build/slice-ops.sh"
+check "hooks/build/release-ops.sh"
+check "hooks/build/lib/runtime-ops.sh"
+check "hooks/build/dual-compare.sh"
+check "scripts/lib/graph-bundle.py"
 
 # 3) Bit ejecutable en los .py/.sh copiados (modo copy no preserva +x por defecto — el
 #    instalador debe forzarlo con chmodExec tras copiar).
@@ -71,7 +77,12 @@ checkexec() {
 }
 checkexec "hooks/build/reconcile-build-state.py"
 checkexec "hooks/build/lib/state-io.sh"
+checkexec "hooks/build/lib/config.sh"
 checkexec "scripts/lib/front-plan.py"
+checkexec "hooks/build/slice-ops.sh"
+checkexec "hooks/build/release-ops.sh"
+checkexec "hooks/build/dual-compare.sh"
+checkexec "scripts/lib/graph-bundle.py"
 
 # 4) `update` (canal de refresco tras `npm i` del paquete) también debe dejarlos — re-correr
 #    sobre la misma instalación no debe romper nada ni perder archivos.
@@ -84,7 +95,12 @@ if [ $rc -ne 0 ]; then
 fi
 check "hooks/build/reconcile-build-state.py"
 check "hooks/build/lib/state-io.sh"
+check "hooks/build/lib/config.sh"
 check "scripts/lib/front-plan.py"
+check "hooks/build/slice-ops.sh"
+check "hooks/build/release-ops.sh"
+check "hooks/build/dual-compare.sh"
+check "scripts/lib/graph-bundle.py"
 
 # project_kind: el TMP de init es un directorio vacío → greenfield detectado (auto)
 if python3 -c "
@@ -138,6 +154,25 @@ else
   echo "FAIL install: project_kind no detectado como brownfield con historial git"
   fail=1
 fi
+
+# asset-types.json [EP-OR-08-D]: versionado como schema/README, sembrado en .claude/.
+[ -f "$TMP_BF/.claude/asset-types.json" ] \
+  && echo "OK install: .claude/asset-types.json sembrado" \
+  || { echo "FAIL install: .claude/asset-types.json NO sembrado"; fail=1; }
+
+# .gitignore [EP-OR-08-D]: las credenciales del runtime y sus derivados nunca deben
+# poder llegar a un \`git add\` descuidado (repo git real: TMP_BF ya tiene uno).
+GI="$TMP_BF/.gitignore"
+if [ -f "$GI" ] \
+  && grep -q '^\.claude/state/runtime\.credentials$' "$GI" \
+  && grep -q '^\.claude/state/outbox/$' "$GI" \
+  && grep -q '^\.claude/state/context\.lock$' "$GI" \
+  && grep -q '^\.claude/state/runtime-projection\.json$' "$GI"; then
+  echo "OK install: .gitignore protege runtime.credentials/outbox/lock/projection"
+else
+  echo "FAIL install: .gitignore no protege los artefactos del runtime"
+  fail=1
+fi
 rm -rf "$TMP_BF"
 
 # 6) Ambiguo: manifiesto + código pero SIN repo git (sin historial) → project_kind null.
@@ -174,4 +209,26 @@ else
 fi
 rm -rf "$TMP_AMB"
 
+# 7) `migrate` [EP-OR-08-D]: prepara el bundle de estado sin tocar la red (TMP ya tiene
+#    build-state.json vacío sembrado por el init de la sección 2/3).
+node "$ROOT/dist/cli.js" migrate "$TMP" --project-ref acme >"$TMP/.migrate.log" 2>&1
+rc=$?
+BUNDLE="$TMP/.claude/state/migration-bundle.json"
+if [ $rc -eq 0 ] && [ -f "$BUNDLE" ] \
+  && python3 -c "
+import json
+d=json.load(open('$BUNDLE'))
+assert d['kind']=='state', d
+assert d['bundle_version']==2, d
+assert d['project_ref']=='acme', d
+assert d['history']==[], d
+assert d['releases']==[], d
+" 2>/dev/null; then
+  echo "OK install: migrate prepara el bundle de estado (kind/version/project_ref/history/releases)"
+else
+  echo "FAIL install: migrate no preparó el bundle de estado esperado (rc=$rc)"
+  cat "$TMP/.migrate.log"
+  fail=1
+fi
+
 exit $fail

package/scripts/tests/test-runtime-client.sh

@@ -0,0 +1,298 @@
+#!/usr/bin/env bash
+set -uo pipefail
+ROOT="$(git rev-parse --show-toplevel)"
+source "$ROOT/hooks/build/lib/runtime-client.sh" 2>/dev/null || { echo "FAIL no existe lib/runtime-client.sh"; exit 1; }
+fail=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+# --- runtime_mode ---
+echo '{}' > "$TMP/cfg.json"
+got="$(BUILD_CONFIG_FILE="$TMP/cfg.json" runtime_mode)"
+[ "$got" = legacy ] && echo "OK runtime_mode default legacy" || { echo "FAIL runtime_mode default ($got)"; fail=1; }
+
+echo '{"runtime":{"mode":"dual"}}' > "$TMP/cfg.json"
+got="$(BUILD_CONFIG_FILE="$TMP/cfg.json" runtime_mode)"
+[ "$got" = dual ] && echo "OK runtime_mode desde config" || { echo "FAIL runtime_mode config ($got)"; fail=1; }
+
+got="$(TRYCORE_RUNTIME_MODE=runtime BUILD_CONFIG_FILE="$TMP/cfg.json" runtime_mode)"
+[ "$got" = runtime ] && echo "OK runtime_mode env gana a config" || { echo "FAIL runtime_mode env ($got)"; fail=1; }
+
+# --- credenciales ---
+export CLAUDE_PROJECT_DIR="$TMP/proj"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+
+got="$(runtime_field project_token)"
+[ "$got" = "" ] && echo "OK runtime_field sin fichero" || { echo "FAIL runtime_field sin fichero ($got)"; fail=1; }
+
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9","project_token":"tok-abc"}'
+perm="$(stat -f '%Lp' "$CLAUDE_PROJECT_DIR/.claude/state/runtime.credentials" 2>/dev/null || stat -c '%a' "$CLAUDE_PROJECT_DIR/.claude/state/runtime.credentials")"
+[ "$perm" = 600 ] && echo "OK credenciales 0600" || { echo "FAIL permisos ($perm)"; fail=1; }
+got="$(runtime_field project_token)"
+[ "$got" = "tok-abc" ] && echo "OK runtime_field lee tras merge" || { echo "FAIL runtime_field tras merge ($got)"; fail=1; }
+
+runtime_credentials_merge '{"agent_key":"ak-1"}'
+got="$(runtime_field project_token)"
+[ "$got" = "tok-abc" ] && echo "OK merge preserva claves previas" || { echo "FAIL merge no preserva ($got)"; fail=1; }
+got="$(runtime_field agent_key)"
+[ "$got" = "ak-1" ] && echo "OK merge añade clave nueva" || { echo "FAIL merge no añade ($got)"; fail=1; }
+
+unset CLAUDE_PROJECT_DIR
+
+# --- HTTP contra stub local ---
+PORT="$(python3 -c "import socket;s=socket.socket();s.bind(('',0));print(s.getsockname()[1]);s.close()")"
+cat > "$TMP/routes.json" <<JSON
+{"GET /ping": {"status": 200, "body": {"ok": true}},
+ "POST /echo": {"status": 200, "body": {"received": true}}}
+JSON
+: > "$TMP/calls.jsonl"
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT" "$TMP/routes.json" "$TMP/calls.jsonl" &
+STUB_PID=$!
+trap 'kill $STUB_PID 2>/dev/null; rm -rf "$TMP"' EXIT
+sleep 0.3
+
+export CLAUDE_PROJECT_DIR="$TMP/proj2"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT\",\"project_token\":\"tok-xyz\"}"
+
+body="$(runtime_get /ping)"
+echo "$body" | grep -q '"ok": true' && echo "OK runtime_get body" || { echo "FAIL runtime_get body ($body)"; fail=1; }
+st="$(runtime_http_status)"
+[ "$st" = 200 ] && echo "OK runtime_get status" || { echo "FAIL runtime_get status ($st)"; fail=1; }
+
+body="$(runtime_post /echo '{"a":1}')"
+echo "$body" | grep -q '"received": true' && echo "OK runtime_post body" || { echo "FAIL runtime_post body ($body)"; fail=1; }
+
+auth_sent="$(tail -1 "$TMP/calls.jsonl" | python3 -c 'import json,sys;print(json.load(sys.stdin)["auth"])')"
+[ "$auth_sent" = "Bearer tok-xyz" ] && echo "OK Authorization Bearer" || { echo "FAIL Authorization ($auth_sent)"; fail=1; }
+
+kill "$STUB_PID" 2>/dev/null; wait "$STUB_PID" 2>/dev/null
+
+# offline: puerto cerrado, nunca debe colgar ni lanzar
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:1\"}"
+body="$(runtime_get /ping)"
+st="$(runtime_http_status)"
+[ "$st" = 000 ] && echo "OK offline status 000" || { echo "FAIL offline status ($st)"; fail=1; }
+
+unset CLAUDE_PROJECT_DIR
+
+# --- runtime_register ---
+PORT2="$(python3 -c "import socket;s=socket.socket();s.bind(('',0));print(s.getsockname()[1]);s.close()")"
+cat > "$TMP/routes2.json" <<JSON
+{"POST /agents/register": {"status": 200, "body": {"agent_key": "ak-9", "project_id": "proj-9", "poll_interval_s": 30, "lease_ttl_s": 300, "manifest_hash": "sha256:abc"}}}
+JSON
+: > "$TMP/calls2.jsonl"
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT2" "$TMP/routes2.json" "$TMP/calls2.jsonl" &
+STUB_PID2=$!
+trap 'kill $STUB_PID 2>/dev/null; kill $STUB_PID2 2>/dev/null; rm -rf "$TMP"' EXIT
+sleep 0.3
+
+export CLAUDE_PROJECT_DIR="$TMP/proj3"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT2\",\"project_token\":\"tok-r\"}"
+
+runtime_register "0.9.0"
+rc=$?
+[ $rc -eq 0 ] && echo "OK runtime_register rc 0" || { echo "FAIL runtime_register rc ($rc)"; fail=1; }
+got="$(runtime_field agent_key)"
+[ "$got" = "ak-9" ] && echo "OK runtime_register persiste agent_key" || { echo "FAIL agent_key ($got)"; fail=1; }
+got="$(runtime_field lease_ttl_s)"
+[ "$got" = 300 ] && echo "OK runtime_register persiste lease_ttl_s" || { echo "FAIL lease_ttl_s ($got)"; fail=1; }
+got="$(runtime_field project_token)"
+[ "$got" = "tok-r" ] && echo "OK runtime_register preserva project_token" || { echo "FAIL project_token pisado ($got)"; fail=1; }
+
+hv_sent="$(tail -1 "$TMP/calls2.jsonl" | python3 -c 'import json,sys;print(json.loads(json.load(sys.stdin)["body"])["harness_version"])')"
+[ "$hv_sent" = "0.9.0" ] && echo "OK register envia harness_version" || { echo "FAIL harness_version no enviado ($hv_sent)"; fail=1; }
+
+# 409 incompatible_version: no debe corromper credenciales existentes, rc distinguible
+cat > "$TMP/routes2.json" <<JSON
+{"POST /agents/register": {"status": 409, "body": {"error": "incompatible_version", "min_version": "0.9.0"}}}
+JSON
+runtime_register "0.8.5"
+rc=$?
+[ $rc -eq 2 ] && echo "OK runtime_register 409 rc 2" || { echo "FAIL 409 rc ($rc)"; fail=1; }
+got="$(runtime_field agent_key)"
+[ "$got" = "ak-9" ] && echo "OK 409 no corrompe credenciales" || { echo "FAIL 409 corrompio credenciales ($got)"; fail=1; }
+
+kill "$STUB_PID2" 2>/dev/null; wait "$STUB_PID2" 2>/dev/null
+unset CLAUDE_PROJECT_DIR
+
+# --- context.lock ---
+export CLAUDE_PROJECT_DIR="$TMP/proj4"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+
+got="$(runtime_lock_manifest_hash)"
+[ "$got" = "" ] && echo "OK lock vacio sin fichero" || { echo "FAIL lock vacio ($got)"; fail=1; }
+
+runtime_lock_write "sha256:deadbeef" '[{"path":"config/stack-allowlist.json","sha256":"aa"}]'
+got="$(runtime_lock_manifest_hash)"
+[ "$got" = "sha256:deadbeef" ] && echo "OK lock_write + manifest_hash" || { echo "FAIL lock_write ($got)"; fail=1; }
+got="$(python3 -c "import json;print(len(json.load(open('$CLAUDE_PROJECT_DIR/.claude/state/context.lock'))['files']))")"
+[ "$got" = 1 ] && echo "OK lock_write persiste files" || { echo "FAIL lock files ($got)"; fail=1; }
+
+unset CLAUDE_PROJECT_DIR
+
+# --- caché de proyección ---
+export CLAUDE_PROJECT_DIR="$TMP/proj5"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+
+got="$(runtime_projection_read)"
+[ "$got" = "{}" ] && echo "OK projection_read vacio" || { echo "FAIL projection_read vacio ($got)"; fail=1; }
+
+runtime_projection_write '{"phase":"tdd","gates":{"dor":true}}'
+got="$(runtime_projection_read | python3 -c 'import json,sys;print(json.load(sys.stdin)["phase"])')"
+[ "$got" = "tdd" ] && echo "OK projection_write + read" || { echo "FAIL projection_write ($got)"; fail=1; }
+
+# fichero JSON corrupto: debe degradar a {}
+echo "not json at all" > "$CLAUDE_PROJECT_DIR/.claude/state/runtime-projection.json"
+got="$(runtime_projection_read)"
+[ "$got" = "{}" ] && echo "OK projection_read JSON corrupto" || { echo "FAIL projection_read corrupto ($got)"; fail=1; }
+
+unset CLAUDE_PROJECT_DIR
+
+# --- outbox: enqueue + cota ---
+export CLAUDE_PROJECT_DIR="$TMP/proj6"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+
+runtime_enqueue_event "checkpoint_created" '{"branch":"feature/x"}'
+n="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" = 1 ] && echo "OK enqueue crea archivo" || { echo "FAIL enqueue ($n)"; fail=1; }
+cid1="$(python3 -c "import json,glob;print(json.load(open(glob.glob('$CLAUDE_PROJECT_DIR/.claude/state/outbox/*.json')[0]))['client_event_id'])")"
+[ -n "$cid1" ] && echo "OK enqueue asigna client_event_id" || { echo "FAIL client_event_id vacio"; fail=1; }
+
+runtime_enqueue_event "checkpoint_created" '{"branch":"feature/y"}'
+n="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" = 2 ] && echo "OK enqueue no pisa eventos previos" || { echo "FAIL enqueue pisa ($n)"; fail=1; }
+
+# cota por edad: un evento evictable (tipo genérico) viejo se descarta; uno protegido sobrevive
+old_file="$CLAUDE_PROJECT_DIR/.claude/state/outbox/00000000000000-old.json"
+python3 -c "import json;json.dump({'client_event_id':'old-1','type':'tool_use_recorded','payload':{},'enqueued_at':'2020-01-01T00:00:00Z'},open('$old_file','w'))"
+touch -t 202001010000 "$old_file"
+dropped="$(runtime_outbox_enforce_cap | tail -1)"
+[ "$dropped" -ge 1 ] && echo "OK enforce_cap descarta evento viejo evictable" || { echo "FAIL enforce_cap no descarto ($dropped)"; fail=1; }
+[ ! -f "$old_file" ] && echo "OK evento viejo evictable eliminado" || { echo "FAIL evento viejo sigue ($old_file)"; fail=1; }
+gap_found="$(grep -l '"type": "telemetry_gap"' "$CLAUDE_PROJECT_DIR"/.claude/state/outbox/*.json 2>/dev/null | wc -l | tr -d ' ')"
+[ "$gap_found" -ge 1 ] && echo "OK descarte emite telemetry_gap" || { echo "FAIL sin telemetry_gap"; fail=1; }
+still_protected="$(grep -l '"type": "checkpoint_created"' "$CLAUDE_PROJECT_DIR"/.claude/state/outbox/*.json 2>/dev/null | wc -l | tr -d ' ')"
+[ "$still_protected" = 2 ] && echo "OK eventos protegidos sobreviven la cota" || { echo "FAIL protegidos descartados ($still_protected)"; fail=1; }
+
+# cota alcanza MÁS ALLÁ de un protegido: el protegido es el más viejo (primero en orden
+# por mtime) pero sobrevive por `continue`; el siguiente evictable, más joven, sí se
+# descarta — no basta con mirar/parar en el primer archivo de la cola
+export CLAUDE_PROJECT_DIR="$TMP/proj6b"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state/outbox"
+protected_old="$CLAUDE_PROJECT_DIR/.claude/state/outbox/00000000000001-protected.json"
+python3 -c "import json;json.dump({'client_event_id':'prot-1','type':'checkpoint_created','payload':{},'enqueued_at':'2019-01-01T00:00:00Z'},open('$protected_old','w'))"
+touch -t 201901010000 "$protected_old"
+evictable_younger="$CLAUDE_PROJECT_DIR/.claude/state/outbox/00000000000002-evictable.json"
+python3 -c "import json;json.dump({'client_event_id':'evict-1','type':'tool_use_recorded','payload':{},'enqueued_at':'2021-01-01T00:00:00Z'},open('$evictable_younger','w'))"
+touch -t 202101010000 "$evictable_younger"
+runtime_outbox_enforce_cap >/dev/null
+[ -f "$protected_old" ] && echo "OK protegido mas viejo sobrevive" || { echo "FAIL protegido mas viejo fue descartado"; fail=1; }
+[ ! -f "$evictable_younger" ] && echo "OK eviccion alcanza mas alla del protegido" || { echo "FAIL eviccion no alcanzo al evictable mas joven"; fail=1; }
+unset CLAUDE_PROJECT_DIR
+
+# --- outbox: despacho con backoff ---
+PORT3="$(python3 -c "import socket;s=socket.socket();s.bind(('',0));print(s.getsockname()[1]);s.close()")"
+: > "$TMP/calls3.jsonl"
+
+export CLAUDE_PROJECT_DIR="$TMP/proj7"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+BUILD_CONFIG_FILE="$TMP/proj7-cfg.json"
+echo '{"runtime":{"mode":"dual"}}' > "$BUILD_CONFIG_FILE"
+export BUILD_CONFIG_FILE
+
+# legacy: dispatch es no-op aunque haya cola
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT3\",\"project_token\":\"tok-d\"}"
+runtime_enqueue_event "checkpoint_created" '{"n":1}'
+TRYCORE_RUNTIME_MODE=legacy runtime_dispatch_outbox
+n="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" -ge 1 ] && echo "OK dispatch no-op en legacy" || { echo "FAIL dispatch corrio en legacy"; fail=1; }
+
+# runtime caido: reintenta sin bloquear, agenda backoff, no borra la cola
+runtime_dispatch_outbox
+rc=$?
+[ $rc -eq 1 ] && echo "OK dispatch rc 1 sin servidor" || { echo "FAIL dispatch rc sin servidor ($rc)"; fail=1; }
+n="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" -ge 1 ] && echo "OK dispatch preserva cola si falla" || { echo "FAIL dispatch borro cola en fallo"; fail=1; }
+[ -f "$CLAUDE_PROJECT_DIR/.claude/state/outbox/.dispatch-state.json" ] && echo "OK dispatch agenda backoff" || { echo "FAIL sin estado de backoff"; fail=1; }
+
+# segundo intento inmediato: respeta el backoff, no vuelve a intentar (no golpea la red)
+before="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+runtime_dispatch_outbox
+after="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$before" = "$after" ] && echo "OK dispatch respeta backoff" || { echo "FAIL dispatch ignoro backoff"; fail=1; }
+
+# servidor arriba: despacha, borra SOLO lo confirmado por el server, preserva lo no
+# confirmado (ack parcial en el mismo lote) y limpia el estado de backoff. El stub carga
+# routes3.json UNA vez al arrancar, así que el client_event_id que va a confirmar debe
+# conocerse ANTES de lanzarlo — se lee del primer archivo ya encolado.
+runtime_enqueue_event "checkpoint_created" '{"n":2}'
+cid="$(python3 -c "
+import json,glob
+files=sorted(p for p in glob.glob('$CLAUDE_PROJECT_DIR/.claude/state/outbox/*.json') if not p.endswith('.dispatch-state.json'))
+print(json.load(open(files[0]))['client_event_id'])
+")"
+cat > "$TMP/routes3.json" <<JSON
+{"POST /events": {"status": 200, "body": {"results": [{"client_event_id": "$cid", "status": "accepted"}]}}}
+JSON
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT3" "$TMP/routes3.json" "$TMP/calls3.jsonl" &
+STUB_PID3=$!
+trap 'kill $STUB_PID 2>/dev/null; kill $STUB_PID2 2>/dev/null; kill $STUB_PID3 2>/dev/null; rm -rf "$TMP"' EXIT
+sleep 0.3
+python3 -c "import json;json.dump({'next_attempt_epoch':0,'attempt':0}, open('$CLAUDE_PROJECT_DIR/.claude/state/outbox/.dispatch-state.json','w'))"
+
+runtime_dispatch_outbox
+rc=$?
+[ $rc -eq 0 ] && echo "OK dispatch rc 0 con servidor arriba" || { echo "FAIL dispatch rc con servidor ($rc)"; fail=1; }
+n="$(find "$CLAUDE_PROJECT_DIR/.claude/state/outbox" -maxdepth 1 -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" = 1 ] && echo "OK dispatch borra lo confirmado, preserva lo no confirmado" || { echo "FAIL cola tras ack parcial ($n)"; fail=1; }
+[ ! -f "$CLAUDE_PROJECT_DIR/.claude/state/outbox/.dispatch-state.json" ] && echo "OK dispatch limpia estado de backoff" || { echo "FAIL estado de backoff persiste"; fail=1; }
+
+kill "$STUB_PID3" 2>/dev/null; wait "$STUB_PID3" 2>/dev/null
+unset CLAUDE_PROJECT_DIR BUILD_CONFIG_FILE
+
+# --- [EP-OR-08-B] runtime_put + slice_id opcional en runtime_enqueue_event ---
+PORT4="$(python3 -c "import socket;s=socket.socket();s.bind(('',0));print(s.getsockname()[1]);s.close()")"
+cat > "$TMP/routes4.json" <<JSON
+{"PUT /leases/renew": {"status": 200, "body": {"expires_at": "2026-08-19T12:00:00Z"}}}
+JSON
+: > "$TMP/calls4.jsonl"
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT4" "$TMP/routes4.json" "$TMP/calls4.jsonl" &
+STUB_PID4=$!
+trap 'kill $STUB_PID 2>/dev/null; kill $STUB_PID2 2>/dev/null; kill $STUB_PID3 2>/dev/null; kill $STUB_PID4 2>/dev/null; rm -rf "$TMP"' EXIT
+sleep 0.3
+
+export CLAUDE_PROJECT_DIR="$TMP/proj8"
+mkdir -p "$CLAUDE_PROJECT_DIR/.claude/state"
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT4\",\"project_token\":\"tok-p\"}"
+
+body="$(runtime_put /leases/renew '{"slice_id":"sl-1"}')"
+echo "$body" | grep -q '"expires_at"' && echo "OK runtime_put body" || { echo "FAIL runtime_put body ($body)"; fail=1; }
+[ "$(runtime_http_status)" = 200 ] && echo "OK runtime_put status" || { echo "FAIL runtime_put status"; fail=1; }
+m_sent="$(tail -1 "$TMP/calls4.jsonl" | python3 -c 'import json,sys;print(json.load(sys.stdin)["method"])')"
+[ "$m_sent" = PUT ] && echo "OK runtime_put usa metodo PUT" || { echo "FAIL metodo ($m_sent)"; fail=1; }
+
+# slice_id como TERCER argumento opcional: clave de primer nivel del evento encolado.
+runtime_enqueue_event "tool_use_recorded" '{"tool":"Edit"}' "sl-42"
+sid_written="$(python3 -c "
+import json,glob
+files=sorted(p for p in glob.glob('$CLAUDE_PROJECT_DIR/.claude/state/outbox/*.json') if not p.endswith('.dispatch-state.json'))
+print(json.load(open(files[0])).get('slice_id',''))
+")"
+[ "$sid_written" = "sl-42" ] && echo "OK enqueue escribe slice_id de primer nivel" || { echo "FAIL slice_id ($sid_written)"; fail=1; }
+
+# Regresión de firma: con DOS argumentos el evento NO lleva slice_id (los llamadores del
+# sub-slice A siguen funcionando sin cambios).
+rm -f "$CLAUDE_PROJECT_DIR"/.claude/state/outbox/*.json
+runtime_enqueue_event "checkpoint_created" '{"n":1}'
+has_sid="$(python3 -c "
+import json,glob
+files=sorted(p for p in glob.glob('$CLAUDE_PROJECT_DIR/.claude/state/outbox/*.json') if not p.endswith('.dispatch-state.json'))
+print('slice_id' in json.load(open(files[0])))
+")"
+[ "$has_sid" = False ] && echo "OK enqueue de 2 args no inventa slice_id" || { echo "FAIL enqueue 2 args ($has_sid)"; fail=1; }
+
+kill "$STUB_PID4" 2>/dev/null; wait "$STUB_PID4" 2>/dev/null
+unset CLAUDE_PROJECT_DIR
+
+exit $fail

package/scripts/tests/test-schema.sh

@@ -61,8 +61,31 @@ cat > "$TMP/bad-foundation-item.json" <<'JSON'
    "checklist":[{"applies":true}]},
  "active_slice":null,"history":[],"releases":[]}
 JSON
+cat > "$TMP/valid-wiring-sha.json" <<'JSON'
+{"version":"1.0","harness_phase":"active","scaffold":{"confirmed":true},
+ "active_slice":{"epica":"EP-001","hus":["HU-001"],"openspec_change":"add-login",
+   "branch":"feature/login","phase":"dod","layer":"business",
+   "gates":{"dor":true,"tdd":true,"dod":false},"updated_at":"2026-08-27T00:00:00Z","updated_by":"test",
+   "wiring_checklist":[
+     {"id":"HU-001-AC1","kind":"hu_ac","ref":"HU-001#happy","status":"passing",
+      "evidence":"npm test -- auth.spec (3 passed)","verified_at_sha":"a1b2c3d4e5f6a7b8c9d0a1b2c3d4e5f6a7b8c9d0"},
+     {"id":"INT-spa-gateway","kind":"integration_point","ref":"spa→gateway","status":"failing","evidence":""}]},
+ "history":[],"releases":[]}
+JSON
+cat > "$TMP/bad-wiring-sha-type.json" <<'JSON'
+{"version":"1.0","harness_phase":"active","scaffold":{"confirmed":true},
+ "active_slice":{"epica":"EP-001","hus":["HU-001"],"openspec_change":"add-login",
+   "branch":"feature/login","phase":"dod","layer":"business",
+   "gates":{"dor":true,"tdd":true,"dod":false},"updated_at":"2026-08-27T00:00:00Z","updated_by":"test",
+   "wiring_checklist":[
+     {"id":"HU-001-AC1","kind":"hu_ac","ref":"HU-001#happy","status":"passing",
+      "evidence":"npm test -- auth.spec (3 passed)","verified_at_sha":12345}]},
+ "history":[],"releases":[]}
+JSON
 check "estado válido con campos nuevos" pass "$TMP/valid.json"
 check "layer inválido rechazado" fail "$TMP/bad-layer.json"
+check "wiring_checklist con verified_at_sha válido" pass "$TMP/valid-wiring-sha.json"
+check "verified_at_sha no-string rechazado" fail "$TMP/bad-wiring-sha-type.json"
 check "foundation + project_kind válidos" pass "$TMP/valid-foundation.json"
 check "project_kind inválido rechazado" fail "$TMP/bad-project-kind.json"
 check "checklist item sin 'item' rechazado" fail "$TMP/bad-foundation-item.json"
@@ -73,7 +96,12 @@ if [ -f "$CFG" ] && python3 -c "import json,sys; d=json.load(open('$CFG'))['cont
 else echo "FAIL build-config.template.json con defaults"; fail=1; fi
 
 CMD="$ROOT/commands/build/resume.md"
-{ [ -f "$CMD" ] && grep -q 'reconcile-build-state.py' "$CMD" && grep -q 'session_continuity' "$CMD"; } \
+# [EP-OR-08-C] resume.md ya no menciona session_continuity literal: en dual/runtime la
+# continuidad la trae el checkpoint del runtime (slice-ops.sh), no ese campo del fichero.
+# El campo sigue existiendo para el camino legacy (reconcile-build-state.py lo reconcilia
+# sin que resume.md necesite nombrarlo); aceptamos cualquiera de los dos como señal de que
+# el comando sigue cubriendo continuidad en algún modo.
+{ [ -f "$CMD" ] && grep -q 'reconcile-build-state.py' "$CMD" && { grep -q 'session_continuity' "$CMD" || grep -q 'checkpoint' "$CMD"; }; } \
   && echo "OK   comando resume" || { echo "FAIL comando resume"; fail=1; }
 
 exit $fail