@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/test/repository-preparation-cache.test.js

@@ -0,0 +1,414 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { access, mkdir, mkdtemp, readdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { promisify } from "node:util";
+import { Effect, Fiber } from "effect";
+import { makeRepositoryPreparationCacheV1, RepositoryReadOnlyPnpmStore, replayRepositoryCommandsV1 } from "../adapters/repository-command-runner.js";
+const exec = promisify(execFile);
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function fixture(t) {
+    const root = await realpath(await mkdtemp(join(tmpdir(), "preparation-cache-unit-")));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const marker = `ready-${randomUUID()}.json`;
+    await mkdir(join(root, "tool"));
+    await writeFile(join(root, "package.json"), JSON.stringify({
+        name: "preparation-cache-fixture",
+        private: true,
+        packageManager: "pnpm@11.15.1",
+        dependencies: { "fixture-tool": "workspace:*" }
+    }));
+    await writeFile(join(root, "pnpm-workspace.yaml"), "packages:\n  - tool\n");
+    await writeFile(join(root, "pnpm-lock.yaml"), `lockfileVersion: '9.0'
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+importers:
+  .:
+    dependencies:
+      fixture-tool:
+        specifier: workspace:*
+        version: link:tool
+  tool: {}
+`);
+    await writeFile(join(root, "tool/package.json"), JSON.stringify({
+        name: "fixture-tool",
+        version: "1.0.0",
+        bin: { "fixture-tool": "bin.cjs" }
+    }));
+    await writeFile(join(root, "tool/bin.cjs"), `#!/usr/bin/env node
+console.log(JSON.stringify({ value: require('./value.json'), nodePath: process.env.NODE_PATH, path: __dirname }));
+`, { mode: 0o755 });
+    await writeFile(join(root, "mode.json"), '"clean"');
+    await writeFile(join(root, "template-path.json"), "null");
+    await writeFile(join(root, "case.test.mjs"), `
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { test } from 'node:test';
+test('installed candidate remains isolated', async () => {
+  assert.equal(existsSync(join(process.env.HOME, 'poison')), false);
+  assert.equal(existsSync(join(process.env.TMPDIR, 'poison')), false);
+  const pnpmConfig = key => execFileSync('corepack', ['pnpm@11.15.1', 'config', 'get', key], { encoding: 'utf8' }).trim();
+  assert.equal(pnpmConfig('offline'), 'true');
+  const store = pnpmConfig('store-dir');
+  assert.notEqual(store, 'undefined');
+  assert.equal(store.startsWith(process.env.HOME + '/'), false, 'candidate uses the shared read-only store, not its temporary home');
+  assert.match(store, /routekit-foundry-pnpm-store-/, 'candidate uses the host-selected writable runtime store');
+  const installed = JSON.parse(execFileSync('corepack', ['pnpm@11.15.1', 'exec', 'fixture-tool'], { encoding: 'utf8' }));
+  assert.equal(installed.value, 1);
+  assert.ok(installed.path.startsWith(process.cwd()));
+  assert.ok(installed.nodePath.includes(process.cwd()));
+  assert.equal(installed.nodePath.includes('routekit-foundry-prepared-'), false);
+  const templatePath = JSON.parse(readFileSync('template-path.json', 'utf8'));
+  if (templatePath !== null) {
+    assert.equal(typeof templatePath, 'string');
+    const templateStat = statSync(join(templatePath, 'tool/value.json'));
+    const replayStat = statSync(join(process.cwd(), 'node_modules/fixture-tool/value.json'));
+    assert.equal(
+      templateStat.dev === replayStat.dev && templateStat.ino === replayStat.ino,
+      false,
+      'candidate replay must not hard-link prepared template files'
+    );
+  }
+  const mode = JSON.parse(readFileSync('mode.json', 'utf8'));
+  if (mode === 'poison') {
+    if (process.platform === 'darwin') {
+      assert.throws(() => writeFileSync(join(templatePath, 'tool/value.json'), '999'), error => error.code === 'EACCES' || error.code === 'EPERM');
+    }
+    writeFileSync('node_modules/fixture-tool/value.json', '999');
+    writeFileSync('node_modules/.bin/fixture-tool', 'poison');
+    writeFileSync(join(process.env.HOME, 'poison'), 'poison');
+    writeFileSync(join(process.env.TMPDIR, 'poison'), 'poison');
+  }
+  if (mode === 'wait') {
+    writeFileSync(${JSON.stringify(marker)}, JSON.stringify({ pid: process.pid, checkout: process.cwd(), home: process.env.HOME, temporary: process.env.TMPDIR }));
+    await new Promise(() => setInterval(() => {}, 1000));
+  }
+});
+`);
+    const git = (...args) => exec("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    const commit = async () => {
+        await git("add", ".");
+        await git("-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-qm", "synthetic fixture");
+        return (await git("rev-parse", "HEAD")).stdout.trim();
+    };
+    await writeFile(join(root, "tool/value.json"), "1");
+    const initial = await commit();
+    await writeFile(join(root, "second-commit.txt"), "distinct immutable commit");
+    const reference = await commit();
+    const preparation = [
+        {
+            id: "frozen-install",
+            kind: "custom",
+            cwd: ".",
+            executable: "corepack",
+            args: [
+                "pnpm@11.15.1",
+                "--filter",
+                "preparation-cache-fixture...",
+                "install",
+                "--offline",
+                "--frozen-lockfile",
+                "--ignore-pnpmfile",
+                "--ignore-scripts"
+            ],
+            timeoutMs: 30000
+        }
+    ];
+    const grade = {
+        id: "behavior",
+        kind: "test",
+        cwd: ".",
+        executable: "node",
+        args: ["--test", "case.test.mjs"],
+        timeoutMs: 30000
+    };
+    return { root, initial, reference, preparation, grade, marker };
+}
+test("trusted pnpm preparation does not depend on the operating-system account home", async (t) => {
+    const f = await fixture(t);
+    const [result] = await Effect.runPromise(replayRepositoryCommandsV1({
+        repositoryRoot: f.root,
+        commit: f.initial,
+        recipes: [f.grade],
+        repetitions: 1,
+        trustedPreparationRecipes: f.preparation,
+        fileOverrides: [{ path: "mode.json", content: JSON.stringify("clean") }]
+    }));
+    assert.ok(result);
+    assert.equal(result.exitCode, 0, JSON.stringify(result));
+    assert.equal(result.gradeExecuted, true);
+    assert.equal(result.trustedPreparationResults.length, 1);
+    assert.equal(result.trustedPreparationResults[0]?.exitCode, 0);
+});
+test("an explicitly prehydrated pnpm store stays read-only during offline replay", { timeout: 60_000 }, async (t) => {
+    const f = await fixture(t);
+    const storeRoot = join(f.root, "prehydrated-store");
+    await exec("corepack", [
+        "pnpm@11.15.1", "install", "--offline", "--frozen-lockfile", "--ignore-pnpmfile",
+        "--ignore-scripts", "--store-dir", storeRoot, "--config.enable-global-virtual-store=false"
+    ], { cwd: f.root });
+    const store = await realpath((await exec("corepack", [
+        "pnpm@11.15.1", "store", "path", "--store-dir", storeRoot, "--silent"
+    ], { cwd: f.root })).stdout.trim());
+    const forbiddenWrite = join(store, "candidate-must-not-write");
+    const [result] = await Effect.runPromise(replayRepositoryCommandsV1({
+        repositoryRoot: f.root,
+        commit: f.initial,
+        repetitions: 1,
+        trustedPreparationRecipes: f.preparation,
+        recipes: [{
+                id: "read-only-store",
+                kind: "custom",
+                cwd: ".",
+                executable: "node",
+                args: ["-e", `
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+assert.equal(process.env.pnpm_config_store_dir, ${JSON.stringify(store)});
+assert.equal(process.env.pnpm_config_frozen_store, "true");
+assert.equal(process.env.pnpm_config_offline, "true");
+if (process.platform === "darwin") {
+  assert.throws(() => fs.writeFileSync(${JSON.stringify(forbiddenWrite)}, "forbidden"),
+    error => error.code === "EACCES" || error.code === "EPERM");
+}
+`],
+                timeoutMs: 10_000
+            }]
+    }).pipe(Effect.provideService(RepositoryReadOnlyPnpmStore, store)));
+    assert.ok(result);
+    assert.equal(result.exitCode, 0, JSON.stringify(result));
+    assert.equal(result.trustedPreparationResults[0]?.exitCode, 0, JSON.stringify(result));
+    await assert.rejects(access(forbiddenWrite), { code: "ENOENT" });
+});
+test("read-only pnpm stores reject unavailable paths and online installation", async (t) => {
+    const f = await fixture(t);
+    for (const [store, preparation, message] of [
+        [".", f.preparation, /requires an absolute path and offline installation/],
+        [join(f.root, "missing-store"), f.preparation, /read-only pnpm store is unavailable/],
+        [f.root, [{ ...f.preparation[0], args: f.preparation[0].args.filter((arg) => arg !== "--offline") }],
+            /requires an absolute path and offline installation/]
+    ]) {
+        await assert.rejects(Effect.runPromise(replayRepositoryCommandsV1({
+            repositoryRoot: f.root,
+            commit: f.initial,
+            recipes: [f.grade],
+            trustedPreparationRecipes: preparation
+        }).pipe(Effect.provideService(RepositoryReadOnlyPnpmStore, store))), message);
+    }
+});
+test("pristine frozen installs are single-flight and real pnpm clones cannot contaminate later candidates", async (t) => {
+    if (process.platform !== "darwin" && process.platform !== "linux") {
+        t.skip("pristine reuse is supported on the Unix runners");
+        return;
+    }
+    const f = await fixture(t);
+    const templates = [];
+    const results = await Effect.runPromise(Effect.scoped(Effect.gen(function* () {
+        const cache = yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root,
+            commits: [f.initial, f.reference],
+            trustedPreparationRecipes: f.preparation
+        });
+        const request = { repositoryRoot: f.root, commit: f.initial, recipes: f.preparation };
+        const [first, duplicate] = yield* Effect.all([cache.get(request), cache.get(request)], {
+            concurrency: 2
+        });
+        assert.ok(first);
+        assert.strictEqual(first, duplicate, "concurrent requests share one actual installation resource");
+        templates.push(first.isolated.root);
+        const second = yield* cache.get({ ...request, commit: f.reference });
+        assert.ok(second);
+        templates.push(second.isolated.root);
+        assert.notEqual(first.key, second.key);
+        const replay = (mode) => replayRepositoryCommandsV1({
+            repositoryRoot: f.root,
+            commit: f.initial,
+            recipes: [f.grade],
+            repetitions: 2,
+            trustedPreparationRecipes: f.preparation,
+            preparationCache: cache,
+            fileOverrides: [
+                { path: "mode.json", content: JSON.stringify(mode) },
+                {
+                    path: "template-path.json",
+                    content: JSON.stringify(first.isolated.checkout)
+                }
+            ],
+            candidateValidationRecipes: [
+                {
+                    id: "syntax",
+                    kind: "check",
+                    cwd: ".",
+                    executable: "node",
+                    args: ["--check", "tool/bin.cjs"],
+                    timeoutMs: 10000
+                }
+            ]
+        });
+        const poisoned = yield* replay("poison");
+        const clean = yield* replay("clean");
+        assert.equal(yield* Effect.promise(() => readFile(join(first.isolated.checkout, "tool/value.json"), "utf8")), "1");
+        assert.equal(yield* Effect.promise(() => readFile(join(second.isolated.checkout, "tool/value.json"), "utf8")), "1");
+        return [...poisoned, ...clean];
+    })));
+    assert.equal(results.length, 4);
+    for (const result of results) {
+        assert.equal(result.exitCode, 0, JSON.stringify(result));
+        assert.equal(result.gradeExecuted, true);
+        assert.equal(result.candidateValidationResults.length, 1);
+        assert.equal(result.trustedPreparationResults.length, 0, "shared preparation is not attributed to a candidate repetition");
+        assert.equal(result.preparation?.sharedResults.length, 1);
+        assert.equal(result.preparation?.sharedResults[0]?.repetition, 0);
+        assert.ok((result.preparation?.cloneDurationMs ?? -1) >= 0);
+    }
+    for (const root of templates)
+        await assert.rejects(access(root));
+    assert.equal(await readFile(join(f.root, "tool/value.json"), "utf8"), "1");
+});
+test("preparation reuse rejects changed recipes, unpinned commits, and unsafe install modes", async (t) => {
+    const f = await fixture(t);
+    await Effect.runPromise(Effect.scoped(Effect.gen(function* () {
+        const cache = yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root,
+            commits: [f.initial],
+            trustedPreparationRecipes: f.preparation
+        });
+        assert.equal(yield* cache.get({ repositoryRoot: f.root, commit: f.reference, recipes: f.preparation }), undefined);
+        assert.equal(yield* cache.get({
+            repositoryRoot: f.root,
+            commit: f.initial,
+            recipes: [{ ...f.preparation[0], timeoutMs: 1 }]
+        }), undefined);
+        for (const args of [
+            f.preparation[0].args.filter((arg) => arg !== "--ignore-scripts"),
+            [...f.preparation[0].args, "--ignore-scripts=false"],
+            [...f.preparation[0].args, "--config.pnpmfile=hostile.cjs"]
+        ]) {
+            const recipes = [{ ...f.preparation[0], args }];
+            const unsafe = yield* makeRepositoryPreparationCacheV1({
+                repositoryRoot: f.root,
+                commits: [f.initial],
+                trustedPreparationRecipes: recipes
+            });
+            assert.equal(yield* unsafe.get({ repositoryRoot: f.root, commit: f.initial, recipes }), undefined);
+        }
+    })));
+});
+test("failed frozen installations retain their actual command evidence and are never reused", async (t) => {
+    if (process.platform !== "darwin" && process.platform !== "linux") {
+        t.skip("pristine reuse is supported on the Unix runners");
+        return;
+    }
+    const f = await fixture(t);
+    const manifest = JSON.parse(await readFile(join(f.root, "package.json"), "utf8"));
+    manifest.dependencies["fixture-tool"] = "workspace:^";
+    await writeFile(join(f.root, "package.json"), JSON.stringify(manifest));
+    await exec("git", ["-C", f.root, "add", "."]);
+    await exec("git", [
+        "-C",
+        f.root,
+        "-c",
+        "core.hooksPath=/dev/null",
+        "-c",
+        "commit.gpgsign=false",
+        "-c",
+        "user.name=Fixture",
+        "-c",
+        "user.email=fixture@example.test",
+        "commit",
+        "-qm",
+        "synthetic stale lockfile"
+    ]);
+    const commit = (await exec("git", ["-C", f.root, "rev-parse", "HEAD"])).stdout.trim();
+    await Effect.runPromise(Effect.scoped(Effect.gen(function* () {
+        const cache = yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root,
+            commits: [commit],
+            trustedPreparationRecipes: f.preparation
+        });
+        const causes = [];
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const error = yield* cache
+                .get({ repositoryRoot: f.root, commit, recipes: f.preparation })
+                .pipe(Effect.match({ onFailure: (error) => error, onSuccess: () => undefined }));
+            assert.ok(error, "a stale frozen lockfile cannot publish a prepared template");
+            const cause = error.cause;
+            assert.equal(cause.trustedPreparationResults.length, 1);
+            const command = cause.trustedPreparationResults[0];
+            assert.notEqual(command.exitCode, 0);
+            assert.equal(command.stage, "trusted-preparation");
+            assert.equal(command.repetition, 0);
+            assert.match(command.stdout + command.stderr, /OUTDATED_LOCKFILE|frozen-lockfile/u);
+            causes.push(cause);
+        }
+        assert.notStrictEqual(causes[0], causes[1], "failed installation invokes preparation again on the next request");
+    })));
+});
+test("interrupting a candidate closes its child process, clone, and scoped pristine template", async (t) => {
+    if (process.platform !== "darwin" && process.platform !== "linux") {
+        t.skip("pristine reuse is supported on the Unix runners");
+        return;
+    }
+    const f = await fixture(t);
+    let templateRoot;
+    const fiber = Effect.runFork(Effect.scoped(Effect.gen(function* () {
+        const cache = yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root,
+            commits: [f.initial],
+            trustedPreparationRecipes: f.preparation
+        });
+        const template = yield* cache.get({
+            repositoryRoot: f.root,
+            commit: f.initial,
+            recipes: f.preparation
+        });
+        assert.ok(template);
+        templateRoot = template.isolated.root;
+        yield* replayRepositoryCommandsV1({
+            repositoryRoot: f.root,
+            commit: f.initial,
+            recipes: [f.grade],
+            repetitions: 2,
+            trustedPreparationRecipes: f.preparation,
+            preparationCache: cache,
+            fileOverrides: [{ path: "mode.json", content: '"wait"' }]
+        });
+    })));
+    t.after(() => Effect.runPromise(Fiber.interrupt(fiber)));
+    let running;
+    const deadline = Date.now() + 15000;
+    while (running === undefined && Date.now() < deadline) {
+        for (const entry of await readdir(tmpdir())) {
+            if (!entry.startsWith("routekit-foundry-isolated-"))
+                continue;
+            try {
+                running = JSON.parse(await readFile(join(tmpdir(), entry, "repository", f.marker), "utf8"));
+            }
+            catch { }
+        }
+        if (running === undefined)
+            await delay(20);
+    }
+    assert.ok(running, "real cloned candidate reached its blocking grade");
+    assert.ok(templateRoot);
+    await Effect.runPromise(Fiber.interrupt(fiber));
+    for (const path of [templateRoot, running.checkout, running.home, running.temporary])
+        await assert.rejects(access(path));
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+        try {
+            process.kill(running.pid, 0);
+        }
+        catch {
+            return;
+        }
+        await delay(10);
+    }
+    assert.fail("cancelled candidate child remained alive");
+});

package/dist/test/repository-public-artifact.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-public-artifact.test.js

@@ -0,0 +1,273 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import test from "node:test";
+import { pipelineCheckpointDescriptorDigestV2 } from "../case-pipeline-protocol-v2.js";
+import { decodeRepositoryPublicArtifactProjectionV1, makeRepositoryPublicArtifactProjectionV1 } from "../services/repository-public-artifact/service.js";
+const sha = (digit) => digit.repeat(64);
+const createDigest = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+const commit = "b".repeat(40);
+const quality = [
+    "authenticity",
+    "specification-sufficiency",
+    "oracle-adequacy",
+    "stability",
+    "distinctness",
+    "realism",
+    "leakage",
+    "triviality",
+    "coverage"
+].map((axis) => ({
+    axis: axis,
+    outcome: "pass"
+}));
+const repositoryVisible = {
+    lane: "repository-agent",
+    id: "case-routing",
+    requestText: "Preserve explicit provider routing.",
+    checkoutCommit: commit,
+    allowedTools: ["read", "search", "edit", "shell", "test"],
+    constraints: ["Do not modify unrelated gateway behavior."]
+};
+const input = {
+    version: 1,
+    admitted: true,
+    caseId: "case-routing",
+    capabilityId: "capability-routing",
+    familyId: "family-routing",
+    lane: "repository-agent",
+    visible: repositoryVisible,
+    sourceCommitSha: commit,
+    coverageCellId: "cell-routing",
+    basisDigest: sha("c"),
+    behavioralFingerprint: "routing-explicit-provider",
+    admissionDigest: sha("d"),
+    terminalCheckpoint: {
+        version: 2,
+        checkpointId: "checkpoint-terminal",
+        identityDigest: sha("e"),
+        attemptGeneration: 2,
+        sequence: 8,
+        kind: "terminal",
+        stage: "admit",
+        parentDigest: sha("f"),
+        payloadDigest: sha("1"),
+        payloadBytes: 1024,
+        createdAt: "2026-09-12T00:00:00.000Z"
+    },
+    quality
+};
+test("public projection is deterministic, admitted-source-bound, and compiler-ready", () => {
+    const first = makeRepositoryPublicArtifactProjectionV1(input);
+    const second = makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        quality: [...input.quality].reverse()
+    });
+    assert.deepEqual(first, second);
+    assert.equal(first.admitted, true);
+    assert.equal(first.artifacts.length, 2);
+    assert.equal(first.terminalCheckpointDigest, pipelineCheckpointDescriptorDigestV2(input.terminalCheckpoint));
+    assert.deepEqual({
+        terminalCheckpointDigest: first.terminalCheckpointDigest,
+        projectionDigest: first.projectionDigest,
+        artifacts: first.artifacts.map(({ path, publicArtifactDigest, bytes }) => ({
+            path,
+            publicArtifactDigest,
+            bytes
+        }))
+    }, {
+        terminalCheckpointDigest: "eba11c069310c9ed74c391f60702df8270c676bcfa7e76d5a5915557eee9b318",
+        projectionDigest: "5868cdf8a567e56d8c6c344405c568cd65d4272fab236397b9c4bbbc484cffda",
+        artifacts: [
+            {
+                path: ".routekit/evals/cases/case-routing-c4ce9ac2e022.eval.json",
+                publicArtifactDigest: "7c7017454e45d1b5ca4dedb776c8d62b444067345d599335685e1a3915921da3",
+                bytes: 522
+            },
+            {
+                path: ".routekit/evals/cases/case-routing-c4ce9ac2e022.metadata.json",
+                publicArtifactDigest: "eed9d36602bbc001bc5412c9b32bf3a0a336673d6eda0e9b14891742b54d3255",
+                bytes: 1220
+            }
+        ]
+    });
+    assert.doesNotThrow(() => decodeRepositoryPublicArtifactProjectionV1(first));
+    for (const artifact of first.artifacts) {
+        assert.match(artifact.path, /^\.routekit\/evals\/cases\//u);
+        assert.equal(artifact.caseId, input.caseId);
+        assert.equal(artifact.admissionDigest, input.admissionDigest);
+        assert.equal(artifact.visibility, "public");
+        assert.equal(artifact.fileType, "regular");
+        assert.equal(artifact.bytes, Buffer.byteLength(artifact.content, "utf8"));
+        assert.match(artifact.publicArtifactDigest, /^[a-f0-9]{64}$/u);
+    }
+});
+test("public projection cannot represent or leak private foundry evidence", () => {
+    const privateCanaries = [
+        "HIDDEN_FIXTURE_CANARY",
+        "ORACLE_BODY_CANARY",
+        "SOLUTION_CANARY",
+        "ADVERSARY_CANARY",
+        "RAW_MODEL_RESPONSE_CANARY",
+        "PROVIDER_DIAGNOSTIC_CANARY",
+        "PRIVATE_CHECKPOINT_CANARY",
+        "github_pat-PRIVATE_CANARY_1234567890"
+    ];
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        hiddenFixtures: privateCanaries,
+        oracle: { body: privateCanaries[1] },
+        rawModelResponse: privateCanaries[4],
+        checkpointPayload: privateCanaries
+    }));
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        terminalCheckpoint: {
+            ...input.terminalCheckpoint,
+            payload: { hiddenFixtures: privateCanaries }
+        }
+    }));
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        visible: {
+            ...input.visible,
+            requestText: `Use token ${privateCanaries[5]}`
+        }
+    }), /private foundry evidence/u);
+    const representablePrivateStrings = [
+        {
+            ...input,
+            caseId: privateCanaries[0],
+            visible: { ...repositoryVisible, id: privateCanaries[0] }
+        },
+        { ...input, capabilityId: privateCanaries[1] },
+        { ...input, familyId: privateCanaries[2] },
+        { ...input, visible: { ...repositoryVisible, requestText: privateCanaries[3] } },
+        { ...input, visible: { ...repositoryVisible, constraints: [privateCanaries[4]] } },
+        { ...input, coverageCellId: privateCanaries[5] },
+        { ...input, behavioralFingerprint: privateCanaries[6] },
+        {
+            ...input,
+            terminalCheckpoint: {
+                ...input.terminalCheckpoint,
+                checkpointId: privateCanaries[0]
+            }
+        }
+    ];
+    for (const privateInput of representablePrivateStrings) {
+        assert.throws(() => makeRepositoryPublicArtifactProjectionV1(privateInput), /private foundry evidence/u);
+    }
+    const requestVisible = {
+        lane: "request",
+        id: input.caseId,
+        request: {
+            endpoint: "responses",
+            method: "POST",
+            path: "/v1/responses",
+            headers: [{ name: "content-type", value: "application/json" }],
+            bodyJson: "{}"
+        }
+    };
+    const requestInput = {
+        ...input,
+        lane: "request",
+        visible: requestVisible
+    };
+    for (const visible of [
+        {
+            ...requestVisible,
+            request: { ...requestVisible.request, path: privateCanaries[0] }
+        },
+        {
+            ...requestVisible,
+            request: {
+                ...requestVisible.request,
+                headers: [{ name: privateCanaries[1], value: "application/json" }]
+            }
+        },
+        {
+            ...requestVisible,
+            request: {
+                ...requestVisible.request,
+                headers: [{ name: "x-test", value: privateCanaries[2] }]
+            }
+        },
+        {
+            ...requestVisible,
+            request: { ...requestVisible.request, bodyJson: privateCanaries[4] }
+        }
+    ]) {
+        assert.throws(() => makeRepositoryPublicArtifactProjectionV1({ ...requestInput, visible }), /private foundry evidence/u);
+    }
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        visible: {
+            ...repositoryVisible,
+            requestText: "Use token github_pat-abcdefghijklmnopqrstuvwxyz123456"
+        }
+    }), /credential/u);
+    const projection = makeRepositoryPublicArtifactProjectionV1(input);
+    const output = projection.artifacts.map(({ content }) => content).join("\n");
+    for (const canary of privateCanaries)
+        assert.doesNotMatch(output, new RegExp(canary, "u"));
+});
+test("public projection fails closed on rejected, substituted, failed, and unpinned shapes", () => {
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        admitted: false
+    }));
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        visible: { ...input.visible, id: "other-case" }
+    }), /identity/u);
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        visible: { ...input.visible, checkoutCommit: "a".repeat(40) }
+    }), /pinned/u);
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        terminalCheckpoint: { ...input.terminalCheckpoint, kind: "stage" }
+    }));
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        quality: input.quality.map((finding) => finding.axis === "leakage" ? { ...finding, outcome: "fail" } : finding)
+    }), /admission quality axis/u);
+    assert.throws(() => makeRepositoryPublicArtifactProjectionV1({
+        ...input,
+        version: 2
+    }));
+});
+test("projection schema rejects mutated bytes, provenance, content, and unknown fields", () => {
+    const projection = makeRepositoryPublicArtifactProjectionV1(input);
+    const [definition, metadata] = projection.artifacts;
+    assert.ok(definition);
+    assert.ok(metadata);
+    assert.throws(() => decodeRepositoryPublicArtifactProjectionV1({
+        ...projection,
+        artifacts: [{ ...definition, content: `${definition.content} ` }, metadata]
+    }), /digest/u);
+    const privateContent = definition.content.replace("Preserve explicit provider routing.", "HIDDEN_FIXTURE_CANARY");
+    assert.throws(() => decodeRepositoryPublicArtifactProjectionV1({
+        ...projection,
+        artifacts: [
+            {
+                ...definition,
+                content: privateContent,
+                bytes: Buffer.byteLength(privateContent, "utf8"),
+                publicArtifactDigest: createDigest(privateContent)
+            },
+            metadata
+        ]
+    }), /private foundry evidence/u);
+    assert.throws(() => decodeRepositoryPublicArtifactProjectionV1({
+        ...projection,
+        artifacts: [definition, { ...metadata, admissionDigest: sha("a") }]
+    }), /admission/u);
+    assert.throws(() => decodeRepositoryPublicArtifactProjectionV1({
+        ...projection,
+        artifacts: [definition, { ...metadata, privateCheckpoint: { payload: "hidden" } }]
+    }));
+    assert.throws(() => decodeRepositoryPublicArtifactProjectionV1({
+        ...projection,
+        projectionDigest: sha("9")
+    }), /projection digest/u);
+});