@veewo/gitnexus 1.4.11-rc.2 → 1.5.0-rc

package/dist/mcp/local/runtime-chain-verify.test.js

@@ -2,13 +2,15 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { describe, expect, it } from 'vitest';
-import { verifyRuntimeChainOnDemand } from './runtime-chain-verify.js';
+import { verifyRuntimeChainOnDemand, verifyRuntimeClaimOnDemand } from './runtime-chain-verify.js';
+import { promoteCuratedRules } from '../../rule-lab/promote.js';
 async function makeTempRepo() {
     const repoPath = await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-verify-'));
     await fs.mkdir(path.join(repoPath, 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb'), { recursive: true });
     await fs.mkdir(path.join(repoPath, 'Assets/NEON/Graphs/PlayerGun/Gungraph_use'), { recursive: true });
     await fs.mkdir(path.join(repoPath, 'Assets/NEON/Code/Game/Graph/Nodes/Reloads'), { recursive: true });
     await fs.writeFile(path.join(repoPath, 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset'), 'gungraph: {guid: 69199acacbf8a7e489ad4aa872efcabd}\n');
+    await fs.writeFile(path.join(repoPath, 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset.meta'), 'guid: 69199acacbf8a7e489ad4aa872efcabd\n');
     await fs.writeFile(path.join(repoPath, 'Assets/NEON/Graphs/PlayerGun/Gungraph_use/1_weapon_orb_key.asset'), 'ResultRPM: GunOutput.RPM\n');
     await fs.writeFile(path.join(repoPath, 'Assets/NEON/Code/Game/Graph/Nodes/Reloads/Reload.cs.meta'), 'guid: bd387039cacb475381a86f156b54bac2\n');
     await fs.mkdir(path.join(repoPath, 'Assets/NEON/Code/Game/PowerUps'), { recursive: true });
@@ -18,39 +20,564 @@ async function makeTempRepo() {
     await fs.writeFile(path.join(repoPath, 'Assets/NEON/Code/Game/Graph/Nodes/Reloads/ReloadBase.cs'), 'void GetValue() {}\n');
     return repoPath;
 }
+async function fileExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function resolveWorkspaceRulesRoot() {
+    const candidates = [
+        path.resolve('.gitnexus/rules'),
+        path.resolve('../.gitnexus/rules'),
+    ];
+    for (const candidate of candidates) {
+        if (await fileExists(path.join(candidate, 'catalog.json'))) {
+            return candidate;
+        }
+    }
+    return candidates[0];
+}
+function makeExecuteParameterized(repoPath) {
+    return async (query, params) => {
+        const q = String(query || '');
+        const weaponPath = 'Assets/NEON/Code/Game/PowerUps/WeaponPowerUp.cs';
+        const gunGraphPath = 'Assets/NEON/Code/Game/Core/GunGraph.cs';
+        const reloadBasePath = 'Assets/NEON/Code/Game/Graph/Nodes/Reloads/ReloadBase.cs';
+        const symbolRows = {
+            WeaponPowerUp: {
+                id: `Class:${weaponPath}:WeaponPowerUp`,
+                name: 'WeaponPowerUp',
+                type: 'Class',
+                filePath: weaponPath,
+                startLine: 1,
+            },
+            GunGraph: {
+                id: `Class:${gunGraphPath}:GunGraph`,
+                name: 'GunGraph',
+                type: 'Class',
+                filePath: gunGraphPath,
+                startLine: 1,
+            },
+            ReloadBase: {
+                id: `Class:${reloadBasePath}:ReloadBase`,
+                name: 'ReloadBase',
+                type: 'Class',
+                filePath: reloadBasePath,
+                startLine: 1,
+            },
+        };
+        const reloadBasePresent = await fileExists(path.join(repoPath, reloadBasePath));
+        if (q.includes('WHERE n.filePath = $filePath')) {
+            const filePath = String(params?.filePath || '');
+            const symbolName = String(params?.symbolName || '');
+            const candidates = Object.values(symbolRows).filter((row) => row.filePath === filePath && (row.name !== 'ReloadBase' || reloadBasePresent));
+            if (!symbolName)
+                return candidates;
+            return candidates.filter((row) => row.name === symbolName);
+        }
+        if (q.includes('WHERE n.name IN $symbolNames')) {
+            const names = Array.isArray(params?.symbolNames) ? params?.symbolNames : [];
+            return names
+                .map((name) => symbolRows[String(name)])
+                .filter((row) => row && (row.name !== 'ReloadBase' || reloadBasePresent))
+                .filter(Boolean);
+        }
+        if (q.includes("MATCH (s {id: $symbolId})-[r:CodeRelation {type: 'CALLS'}]->(t)")) {
+            const symbolId = String(params?.symbolId || '');
+            if (symbolId === symbolRows.ReloadBase.id && reloadBasePresent) {
+                return [{
+                        sourceId: symbolRows.ReloadBase.id,
+                        sourceName: 'ReloadBase',
+                        sourceFilePath: reloadBasePath,
+                        sourceStartLine: 1,
+                        targetId: `Method:${reloadBasePath}:CheckReload`,
+                        targetName: 'CheckReload',
+                        targetFilePath: reloadBasePath,
+                        targetStartLine: 12,
+                    }];
+            }
+            if (symbolId === symbolRows.WeaponPowerUp.id) {
+                return [{
+                        sourceId: symbolRows.WeaponPowerUp.id,
+                        sourceName: 'WeaponPowerUp',
+                        sourceFilePath: weaponPath,
+                        sourceStartLine: 1,
+                        targetId: `Method:${weaponPath}:Equip`,
+                        targetName: 'Equip',
+                        targetFilePath: weaponPath,
+                        targetStartLine: 1,
+                    }];
+            }
+            return [];
+        }
+        if (q.includes("MATCH (s)-[r:CodeRelation {type: 'CALLS'}]->(t {id: $symbolId})")) {
+            const symbolId = String(params?.symbolId || '');
+            if (symbolId === symbolRows.ReloadBase.id && reloadBasePresent) {
+                return [{
+                        sourceId: `Method:${weaponPath}:Equip`,
+                        sourceName: 'Equip',
+                        sourceFilePath: weaponPath,
+                        sourceStartLine: 1,
+                        targetId: symbolRows.ReloadBase.id,
+                        targetName: 'ReloadBase',
+                        targetFilePath: reloadBasePath,
+                        targetStartLine: 1,
+                    }];
+            }
+            return [];
+        }
+        if (q.includes("MATCH (n {id: $symbolId})-[:CodeRelation {type: 'HAS_METHOD'}]->(m)")
+            && q.includes("MATCH (m)-[r:CodeRelation {type: 'CALLS'}]->(t)")) {
+            const symbolId = String(params?.symbolId || '');
+            if (symbolId === symbolRows.ReloadBase.id && reloadBasePresent) {
+                return [{
+                        sourceId: `Method:${reloadBasePath}:OnEquip`,
+                        sourceName: 'OnEquip',
+                        sourceFilePath: reloadBasePath,
+                        sourceStartLine: 5,
+                        targetId: `Method:${reloadBasePath}:CheckReload`,
+                        targetName: 'CheckReload',
+                        targetFilePath: reloadBasePath,
+                        targetStartLine: 12,
+                    }];
+            }
+            return [];
+        }
+        if (q.includes("MATCH (n {id: $symbolId})-[:CodeRelation {type: 'HAS_METHOD'}]->(m)")
+            && q.includes("MATCH (s)-[r:CodeRelation {type: 'CALLS'}]->(m)")) {
+            const symbolId = String(params?.symbolId || '');
+            if (symbolId === symbolRows.ReloadBase.id && reloadBasePresent) {
+                return [{
+                        sourceId: `Method:${weaponPath}:Equip`,
+                        sourceName: 'Equip',
+                        sourceFilePath: weaponPath,
+                        sourceStartLine: 1,
+                        targetId: `Method:${reloadBasePath}:OnEquip`,
+                        targetName: 'OnEquip',
+                        targetFilePath: reloadBasePath,
+                        targetStartLine: 5,
+                    }];
+            }
+            return [];
+        }
+        if (q.includes("r.reason STARTS WITH 'unity-rule-'") && q.includes('r.reason CONTAINS $ruleId')) {
+            const ruleId = String(params?.ruleId || '');
+            if (ruleId && reloadBasePresent) {
+                return [{
+                        sourceName: 'unity-runtime-root',
+                        sourceFilePath: '',
+                        sourceStartLine: 1,
+                        targetName: 'ReloadBase',
+                        targetFilePath: reloadBasePath,
+                        targetStartLine: 1,
+                        reason: `unity-rule-resource-load:${ruleId}`,
+                    }];
+            }
+            return [];
+        }
+        return [];
+    };
+}
+function hasBalancedShellQuotes(command) {
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    for (const ch of String(command || '')) {
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (!inDouble && ch === '\'') {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (!inSingle && ch === '"') {
+            inDouble = !inDouble;
+        }
+    }
+    return !inSingle && !inDouble && !escaped;
+}
+async function writeRules(repoPath, ruleYamlByFile, rootDirName = 'rules') {
+    const rulesRoot = path.join(repoPath, '.gitnexus', rootDirName);
+    await fs.mkdir(path.join(rulesRoot, 'approved'), { recursive: true });
+    const entries = Object.entries(ruleYamlByFile).map(([file, content]) => {
+        const id = String(content.match(/^id:\s*(.+)$/m)?.[1] || '').trim();
+        const version = String(content.match(/^version:\s*(.+)$/m)?.[1] || '').trim();
+        return { id, version, file };
+    });
+    await fs.writeFile(path.join(rulesRoot, 'catalog.json'), JSON.stringify({ rules: entries }, null, 2), 'utf-8');
+    for (const [file, content] of Object.entries(ruleYamlByFile)) {
+        await fs.writeFile(path.join(rulesRoot, file), content, 'utf-8');
+    }
+    return rulesRoot;
+}
 describe('runtime chain verify', () => {
-    it('v1 runtime chain verify on demand builds reload chain hops', async () => {
+    it('does not run reload fallback when no rule is matched', async () => {
         const repoPath = await makeTempRepo();
         const out = await verifyRuntimeChainOnDemand({
             repoPath,
             queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
-            executeParameterized: async (query, params) => {
-                if (String(params?.filePathPattern || '').includes('WeaponPowerUp.cs')) {
-                    return [{ filePath: 'Assets/NEON/Code/Game/PowerUps/WeaponPowerUp.cs', startLine: 1 }];
-                }
-                if (String(params?.filePathPattern || '').includes('GunGraph')) {
-                    return [{ filePath: 'Assets/NEON/Code/Game/Core/GunGraph.cs', startLine: 1 }];
-                }
-                if (String(params?.filePathPattern || '').includes('ReloadBase.cs')) {
-                    return [{ filePath: 'Assets/NEON/Code/Game/Graph/Nodes/Reloads/ReloadBase.cs', startLine: 1 }];
-                }
-                return [];
-            },
+            executeParameterized: makeExecuteParameterized(repoPath),
             resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
         });
-        expect(out?.evidence_level).toBe('verified_chain');
-        expect(out?.hops.some((hop) => hop.hop_type === 'guid_map')).toBe(true);
-        const loader = out?.hops.find((hop) => hop.hop_type === 'code_loader');
-        expect(loader?.snippet || '').toMatch(/CurGunGraph\s*=/i);
+        expect(out).toBeUndefined();
+        await fs.rm(repoPath, { recursive: true, force: true });
     });
-    it('v1 runtime chain gaps are actionable', async () => {
+    it('runtime chain gaps are actionable under matched rule execution', async () => {
         const out = await verifyRuntimeChainOnDemand({
             repoPath: await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-gaps-')),
             queryText: 'Reload',
             executeParameterized: async () => [],
             resourceBindings: [],
+            rule: {
+                id: 'demo.reload.strict.v2',
+                version: '2.0.0',
+                trigger_family: 'reload',
+                resource_types: ['asset'],
+                host_base_type: ['ReloadBase'],
+                required_hops: ['resource', 'guid_map', 'code_loader', 'code_runtime'],
+                guarantees: ['strict_chain_closed'],
+                non_guarantees: ['strict_no_runtime_execution'],
+                next_action: 'node strict',
+                file_path: '.gitnexus/rules/approved/demo.reload.strict.v2.yaml',
+            },
+            requiredHops: ['resource', 'guid_map', 'code_loader', 'code_runtime'],
         });
         expect(out?.gaps.length).toBeGreaterThan(0);
         expect(out?.gaps.every((gap) => !!gap.next_command)).toBe(true);
     });
+    it('accepts seed-to-mapped resource equivalence for resource hop verification', async () => {
+        const repoPath = await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-mapped-resource-'));
+        const out = await verifyRuntimeChainOnDemand({
+            repoPath,
+            queryText: 'EnergyByAttackCount Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/0_初始武器/1_weapon_0_james_new.asset',
+            resourceSeedPath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/0_初始武器/1_weapon_0_james_new.asset',
+            mappedSeedTargets: ['Assets/NEON/Graphs/PlayerGun/Gungraph_use/1_weapon_0_james1.asset'],
+            executeParameterized: async () => [],
+            resourceBindings: [{ resourcePath: 'Assets/NEON/Graphs/PlayerGun/Gungraph_use/1_weapon_0_james1.asset' }],
+            rule: {
+                id: 'demo.energy.seed-map.v1',
+                version: '1.0.0',
+                trigger_family: 'energy',
+                resource_types: ['asset'],
+                host_base_type: ['GunGraphNode'],
+                required_hops: ['resource'],
+                guarantees: ['seed_mapped_resource_is_accepted'],
+                non_guarantees: ['does_not_verify_full_runtime_order'],
+                next_action: 'node mapped-resource',
+                file_path: '.gitnexus/rules/approved/demo.energy.seed-map.v1.yaml',
+            },
+            requiredHops: ['resource'],
+        });
+        expect(out?.status).toBe('verified_full');
+        expect(out?.gaps.length).toBe(0);
+        expect(out?.hops[0]?.note || '').toContain('mapped resource equivalence');
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 runtime claim returns explicit rule_not_matched', async () => {
+        const workspaceRulesRoot = await resolveWorkspaceRulesRoot();
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath: path.resolve('.'),
+            queryText: 'CompletelyUnrelatedChain',
+            executeParameterized: async () => [],
+            resourceBindings: [],
+            rulesRoot: workspaceRulesRoot,
+        });
+        expect(out.status).toBe('failed');
+        expect(out.reason).toBe('rule_not_matched');
+        expect(out.next_action).toBeTruthy();
+    });
+    it('phase2 runtime claim maps missing catalog to rule_not_matched', async () => {
+        const repoPath = await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-missing-catalog-'));
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
+            executeParameterized: async () => [],
+            resourceBindings: [],
+            rulesRoot: path.join(repoPath, '.gitnexus', 'rules'),
+        });
+        expect(out.status).toBe('failed');
+        expect(out.reason).toBe('rule_not_matched');
+        expect(out.next_action).toBeTruthy();
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 runtime claim maps missing rule file to rule_not_matched', async () => {
+        const repoPath = await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-missing-rule-file-'));
+        const rulesRoot = path.join(repoPath, '.gitnexus', 'rules');
+        await fs.mkdir(path.join(rulesRoot, 'approved'), { recursive: true });
+        await fs.writeFile(path.join(rulesRoot, 'catalog.json'), JSON.stringify({
+            rules: [{ id: 'demo.reload.rule.v1', version: '1.0.0', file: 'approved/demo.reload.rule.v1.yaml' }],
+        }), 'utf-8');
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
+            executeParameterized: async () => [],
+            resourceBindings: [],
+            rulesRoot,
+        });
+        expect(out.status).toBe('failed');
+        expect(out.reason).toBe('rule_not_matched');
+        expect(out.next_action).toBeTruthy();
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 runtime claim uses bootstrap reload rule metadata', async () => {
+        const repoPath = await makeTempRepo();
+        const workspaceRulesRoot = await resolveWorkspaceRulesRoot();
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
+            executeParameterized: makeExecuteParameterized(repoPath),
+            resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
+            rulesRoot: workspaceRulesRoot,
+        });
+        expect(out.rule_id).toBe('unity.gungraph.reload.output-getvalue.v1');
+        expect(out.rule_version).toBe('1.0.0');
+    });
+    it('phase2 next_action remains shell-parsable when unmatched', async () => {
+        const workspaceRulesRoot = await resolveWorkspaceRulesRoot();
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath: path.resolve('.'),
+            queryText: 'CompletelyUnrelatedChain',
+            executeParameterized: async () => [],
+            resourceBindings: [],
+            rulesRoot: workspaceRulesRoot,
+        });
+        expect(out.reason).toBe('rule_not_matched');
+        expect(typeof out.next_action).toBe('string');
+        expect(hasBalancedShellQuotes(String(out.next_action || ''))).toBe(true);
+    });
+    it('phase2 runtime claim required_hops are rule-driven', async () => {
+        const repoPath = await makeTempRepo();
+        const executeParameterized = makeExecuteParameterized(repoPath);
+        const strictExecuteParameterized = async (query, params) => {
+            const q = String(query || '');
+            if (q.includes("MATCH (n {id: $symbolId})-[:CodeRelation {type: 'HAS_METHOD'}]->(m)")) {
+                return [];
+            }
+            return executeParameterized(query, params);
+        };
+        const strictRulesRoot = await writeRules(repoPath, {
+            'approved/demo.reload.strict.v1.yaml': [
+                'id: demo.reload.strict.v1',
+                'version: 1.0.0',
+                'trigger_family: reload',
+                'resource_types:',
+                '  - asset',
+                'host_base_type:',
+                '  - ReloadBase',
+                'required_hops:',
+                '  - resource',
+                '  - guid_map',
+                '  - code_loader',
+                '  - code_runtime',
+                'guarantees:',
+                '  - strict_chain_closed',
+                'non_guarantees:',
+                '  - strict_no_runtime_execution',
+                'next_action: node strict',
+            ].join('\n'),
+        }, 'rules-strict');
+        const relaxedRulesRoot = await writeRules(repoPath, {
+            'approved/demo.reload.relaxed.v1.yaml': [
+                'id: demo.reload.relaxed.v1',
+                'version: 1.0.0',
+                'trigger_family: reload',
+                'resource_types:',
+                '  - asset',
+                'host_base_type:',
+                '  - ReloadBase',
+                'required_hops:',
+                '  - resource',
+                '  - guid_map',
+                '  - code_loader',
+                'guarantees:',
+                '  - relaxed_chain_closed',
+                'non_guarantees:',
+                '  - relaxed_no_runtime_execution',
+                'next_action: node relaxed',
+            ].join('\n'),
+        }, 'rules-relaxed');
+        const strict = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
+            executeParameterized: strictExecuteParameterized,
+            resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
+            rulesRoot: strictRulesRoot,
+        });
+        const relaxed = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload NEON.Game.Graph.Nodes.Reloads',
+            executeParameterized,
+            resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
+            rulesRoot: relaxedRulesRoot,
+        });
+        expect(strict.status).toBe('verified_partial');
+        expect(relaxed.status).toBe('verified_full');
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 runtime claim guarantees/non_guarantees come from matched rule', async () => {
+        const repoPath = await makeTempRepo();
+        const rulesRoot = await writeRules(repoPath, {
+            'approved/demo.reload.claim-semantics.v1.yaml': [
+                'id: demo.reload.claim-semantics.v1',
+                'version: 2.0.0',
+                'trigger_family: reload',
+                'resource_types:',
+                '  - asset',
+                'host_base_type:',
+                '  - ReloadBase',
+                'required_hops:',
+                '  - resource',
+                '  - guid_map',
+                '  - code_loader',
+                '  - code_runtime',
+                'guarantees:',
+                '  - custom_guarantee_from_rule',
+                'non_guarantees:',
+                '  - custom_non_guarantee_from_rule',
+                'next_action: node claim-semantics',
+                'match:',
+                '  trigger_tokens:',
+                '    - reload',
+                'topology:',
+                '  - hop: resource',
+                '    from:',
+                '      entity: resource',
+                '    to:',
+                '      entity: script',
+                '    edge:',
+                '      kind: binds_script',
+                'closure:',
+                '  required_hops:',
+                '    - resource',
+                '    - guid_map',
+                '    - code_loader',
+                '    - code_runtime',
+                '  failure_map:',
+                '    missing_evidence: rule_matched_but_evidence_missing',
+                'claims:',
+                '  guarantees:',
+                '    - custom_guarantee_from_rule',
+                '  non_guarantees:',
+                '    - custom_non_guarantee_from_rule',
+                '  next_action: node claim-semantics',
+            ].join('\n'),
+        });
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload runtime start sequence',
+            executeParameterized: makeExecuteParameterized(repoPath),
+            resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
+            rulesRoot,
+        });
+        expect(out.rule_id).toBe('demo.reload.claim-semantics.v1');
+        expect(out.rule_version).toBe('2.0.0');
+        expect(out.guarantees).toEqual(['custom_guarantee_from_rule']);
+        expect(out.non_guarantees).toEqual(['custom_non_guarantee_from_rule']);
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 non-reload trigger family executes rule-driven verifier', async () => {
+        const repoPath = await makeTempRepo();
+        const rulesRoot = await writeRules(repoPath, {
+            'approved/demo.startup.v1.yaml': [
+                'id: demo.startup.v1',
+                'version: 1.0.0',
+                'trigger_family: startup',
+                'resource_types:',
+                '  - asset',
+                'host_base_type:',
+                '  - StartupNode',
+                'required_hops:',
+                '  - resource',
+                'guarantees:',
+                '  - startup_chain_closed',
+                'non_guarantees:',
+                '  - startup_not_executed',
+                'next_action: node startup',
+            ].join('\n'),
+        });
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Startup Graph Trigger',
+            executeParameterized: makeExecuteParameterized(repoPath),
+            resourceBindings: [{ resourcePath: 'Assets/Custom/Rules/startup.asset' }],
+            rulesRoot,
+        });
+        expect(out.rule_id).toBe('demo.startup.v1');
+        expect(out.status).toBe('verified_full');
+        expect(out.evidence_level).toBe('verified_segment');
+        expect(out.reason).toBeUndefined();
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase2 rule_not_matched does not leak first rule next_action', async () => {
+        const repoPath = await makeTempRepo();
+        const rulesRoot = await writeRules(repoPath, {
+            'approved/demo.startup.v1.yaml': [
+                'id: demo.startup.v1',
+                'version: 1.0.0',
+                'trigger_family: startup',
+                'resource_types:',
+                '  - asset',
+                'host_base_type:',
+                '  - StartupNode',
+                'required_hops:',
+                '  - resource',
+                'guarantees:',
+                '  - startup_chain_closed',
+                'non_guarantees:',
+                '  - startup_not_executed',
+                'next_action: node startup-only-action',
+            ].join('\n'),
+        });
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Reload runtime start sequence',
+            executeParameterized: makeExecuteParameterized(repoPath),
+            resourceBindings: [{ resourcePath: 'Assets/NEON/DataAssets/Powerups/1_newWeapon/0_pick/法器_Orb/1_weapon_orb_key.asset' }],
+            rulesRoot,
+        });
+        expect(out.reason).toBe('rule_not_matched');
+        expect(String(out.next_action || '')).not.toContain('startup-only-action');
+        expect(String(out.next_action || '')).toContain('Reload runtime start sequence');
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
+    it('phase5 rule-lab promoted rule is loadable', async () => {
+        const repoPath = await fs.mkdtemp(path.join(os.tmpdir(), 'runtime-chain-rule-lab-promote-'));
+        const sliceDir = path.join(repoPath, '.gitnexus', 'rules', 'lab', 'runs', 'run-x', 'slices', 'slice-a');
+        await fs.mkdir(sliceDir, { recursive: true });
+        await fs.writeFile(path.join(sliceDir, 'curated.json'), JSON.stringify({
+            run_id: 'run-x',
+            slice_id: 'slice-a',
+            curated: [
+                {
+                    id: 'candidate-startup-1',
+                    rule_id: 'demo.startup.v1',
+                    title: 'startup startup graph',
+                    confirmed_chain: {
+                        steps: [{ hop_type: 'resource', anchor: 'Assets/Rules/startup.asset:1', snippet: 'Startup Graph Trigger' }],
+                    },
+                    guarantees: ['startup trigger matching is confirmed'],
+                    non_guarantees: ['does not prove full runtime ordering'],
+                },
+            ],
+        }, null, 2), 'utf-8');
+        await promoteCuratedRules({ repoPath, runId: 'run-x', sliceId: 'slice-a', version: '1.0.0' });
+        const out = await verifyRuntimeClaimOnDemand({
+            repoPath,
+            queryText: 'Startup Graph Trigger',
+            executeParameterized: async () => [],
+            resourceBindings: [{ resourcePath: 'Assets/Rules/startup.asset' }],
+        });
+        expect(out.rule_id).toBe('demo.startup.v1');
+        expect(out.reason).toBeUndefined();
+        await fs.rm(repoPath, { recursive: true, force: true });
+    });
 });

package/dist/mcp/local/runtime-claim-rule-registry.d.ts

@@ -0,0 +1,63 @@
+import type { UnityResourceBinding, LifecycleOverrides } from '../../rule-lab/types.js';
+export interface RuntimeClaimRuleCatalogEntry {
+    id: string;
+    version: string;
+    file?: string;
+    enabled?: boolean;
+    family?: 'analyze_rules' | 'verification_rules';
+}
+export interface RuntimeClaimRule {
+    id: string;
+    version: string;
+    trigger_family: string;
+    resource_types: string[];
+    host_base_type: string[];
+    match?: {
+        trigger_tokens: string[];
+        symbol_kind?: string[];
+        module_scope?: string[];
+        resource_types?: string[];
+        host_base_type?: string[];
+    };
+    required_hops: string[];
+    guarantees: string[];
+    non_guarantees: string[];
+    next_action?: string;
+    family?: 'analyze_rules' | 'verification_rules';
+    resource_bindings?: UnityResourceBinding[];
+    lifecycle_overrides?: LifecycleOverrides;
+    file_path: string;
+    topology?: Array<{
+        hop: string;
+        from: Record<string, unknown>;
+        to: Record<string, unknown>;
+        edge: {
+            kind: string;
+        };
+        constraints?: Record<string, unknown>;
+    }>;
+    closure?: {
+        required_hops: string[];
+        failure_map: Record<string, string>;
+    };
+    claims?: {
+        guarantees: string[];
+        non_guarantees: string[];
+        next_action: string;
+    };
+}
+export interface RuntimeClaimRuleRegistry {
+    repoPath: string;
+    rulesRoot: string;
+    catalogPath: string;
+    activeRules: RuntimeClaimRule[];
+}
+export type RuleRegistryLoadErrorCode = 'rule_catalog_missing' | 'rule_catalog_invalid' | 'rule_file_missing';
+export declare class RuleRegistryLoadError extends Error {
+    code: RuleRegistryLoadErrorCode;
+    details?: Record<string, string>;
+    constructor(code: RuleRegistryLoadErrorCode, message: string, details?: Record<string, string>);
+}
+export declare function parseRuleYaml(raw: string, filePath: string): RuntimeClaimRule;
+export declare function loadRuleRegistry(repoPath: string, rulesRoot?: string): Promise<RuntimeClaimRuleRegistry>;
+export declare function loadAnalyzeRules(repoPath: string, rulesRoot?: string): Promise<RuntimeClaimRule[]>;