@veraxhq/verax 0.3.0 → 0.4.0

package/src/verax/cli/init.js

@@ -6,7 +6,6 @@
 
 import { existsSync, writeFileSync, mkdirSync } from 'fs';
 import { resolve } from 'path';
-import { getDefaultConfig } from '../shared/config-loader.js';
 
 /**
  * Initialize VERAX configuration
@@ -27,16 +26,8 @@ export async function runInit(options = {}) {
   // Create .verax directory if needed
   const veraxDir = resolve(projectRoot, '.verax');
   mkdirSync(veraxDir, { recursive: true });
-  
-  // Create config.json
-  const configPath = resolve(veraxDir, 'config.json');
-  if (existsSync(configPath) && !yes) {
-    skipped.push('config.json');
-  } else {
-    const defaultConfig = getDefaultConfig();
-    writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2) + '\n');
-    created.push('config.json');
-  }
+
+  // Zero-config enforcement: do not scaffold config files
   
   // Create CI template if requested
   if (ciTemplate === 'github') {
@@ -75,7 +66,7 @@ jobs:
       - name: Start fixture server
         id: fixture-server
         run: |
-          node test/helpers/fixture-server.js &
+          node test/infrastructure/fixture-server.js &
           SERVER_PID=$!
           echo "SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
           sleep 3
@@ -211,12 +202,7 @@ export function printInitResults(results) {
     });
   }
   
-  if (results.created.includes('config.json')) {
-    console.error('\n📝 Next Steps:');
-    console.error('  1. Review .verax/config.json and adjust settings');
-    console.error('  2. Run: verax doctor (to verify setup)');
-    console.error('  3. Run: verax run --url <your-url>');
-  }
+  // No config scaffolding in zero-config mode
   
   if (results.created.includes('.github/workflows/verax-ci.yml')) {
     console.error('\n🔧 CI Setup:');

package/src/verax/core/action-classifier.js

@@ -67,18 +67,19 @@ export function classifyAction(interaction) {
 /**
  * Check if action should be blocked based on safety mode and flags
  * @param {Object} interaction - Interaction to check
- * @param {Object} flags - Safety flags { allowWrites: boolean, allowRiskyActions: boolean }
+ * @param {Object} flags - Safety flags { allowRiskyActions: boolean }
  * @returns {Object} { shouldBlock: boolean, classification: string, reason: string }
  */
 export function shouldBlockAction(interaction, flags = {}) {
-  const { allowWrites = false, allowRiskyActions = false } = flags;
+  const { allowRiskyActions = false } = flags;
   const { classification, reason } = classifyAction(interaction);
 
   if (classification === 'RISKY' && !allowRiskyActions) {
     return { shouldBlock: true, classification, reason };
   }
 
-  if (classification === 'WRITE_INTENT' && !allowWrites) {
+  // CONSTITUTIONAL: Always block write intents (read-only mode enforced)
+  if (classification === 'WRITE_INTENT') {
     return { shouldBlock: true, classification, reason };
   }
 

package/src/verax/core/artifacts/registry.js

@@ -105,20 +105,6 @@ export const ARTIFACT_REGISTRY = {
     stage: 'observe',
     contractVersion: 1,
     type: 'file'
-  },
-  determinismReport: {
-    key: 'determinismReport',
-    filename: 'determinism.report.json',
-    stage: 'verify',
-    contractVersion: 1,
-    type: 'file'
-  },
-  runMeta: {
-    key: 'runMeta',
-    filename: 'run.meta.json',
-    stage: 'learn',
-    contractVersion: 1,
-    type: 'file'
   }
 };
 
@@ -148,7 +134,6 @@ export function buildRunArtifactPaths(baseDir) {
     confidenceReportJson: join(baseDir, ARTIFACT_REGISTRY.confidenceReport.filename),
     determinismContractJson: join(baseDir, ARTIFACT_REGISTRY.determinismContract.filename),
     determinismReportJson: join(baseDir, ARTIFACT_REGISTRY.determinismReport.filename),
-    runMetaJson: join(baseDir, ARTIFACT_REGISTRY.runMeta.filename),
     artifactVersions: getArtifactVersions()
   };
 }

package/src/verax/core/artifacts/verifier.js

@@ -90,6 +90,7 @@ export function verifyRun(runDir, registrySnapshot = null) {
       if (def.filename.endsWith('.json')) {
         try {
           const content = readFileSync(artifactPath, 'utf-8');
+  // @ts-expect-error - readFileSync with encoding returns string
           const data = JSON.parse(content);
           
           // Check contractVersion
@@ -162,6 +163,7 @@ export function verifyRun(runDir, registrySnapshot = null) {
               if (existsSync(evidenceIntentPath)) {
                 try {
                   const intentContent = readFileSync(evidenceIntentPath, 'utf-8');
+  // @ts-expect-error - readFileSync with encoding returns string
                   evidenceIntentLedger = JSON.parse(intentContent);
                 } catch (e) {
                   // Will be caught by artifact validation
@@ -213,7 +215,7 @@ export function verifyRun(runDir, registrySnapshot = null) {
                       // PHASE 21.1: HARD FAILURE - blocking error, not warning
                       enforcementSummary.findingsWithoutEvidence++;
                       errors.push(
-                        `EVIDENCE_LAW_VIOLATION: Finding marked CONFIRMED but evidencePackage is incomplete. ` +
+                        `Evidence Law violation: Finding marked CONFIRMED but evidencePackage is incomplete. ` +
                         `Missing fields: ${error.missingFields?.join(', ') || 'unknown'}. ` +
                         `(finding type: ${finding.type || 'unknown'}, index: ${i})`
                       );
@@ -222,7 +224,7 @@ export function verifyRun(runDir, registrySnapshot = null) {
                     // PHASE 21.1: CONFIRMED without evidencePackage and without substantive evidence → HARD FAILURE
                     enforcementSummary.findingsWithoutEvidence++;
                     errors.push(
-                      `EVIDENCE_LAW_VIOLATION: Finding marked CONFIRMED but lacks evidencePackage and evidence is insufficient. ` +
+                      `Evidence Law violation: Finding marked CONFIRMED but lacks evidencePackage and has insufficient evidence. ` +
                       `(finding type: ${finding.type || 'unknown'}, index: ${i})`
                     );
                   }
@@ -372,11 +374,11 @@ export function verifyRun(runDir, registrySnapshot = null) {
   }
   
   // Determine overall verdict
-  // PHASE 21.1: EVIDENCE_LAW_VIOLATION errors are blocking - do not allow VALID_WITH_WARNINGS
+  // PHASE 21.1: Evidence Law violation errors are blocking - do not allow VALID_WITH_WARNINGS
   // PHASE 22: EVIDENCE_INTENT_MISMATCH errors mark run as VERIFIED_WITH_ERRORS
   // PHASE 23: GUARDRAILS_REPORT_MISMATCH errors mark run as VERIFIED_WITH_ERRORS
   // PHASE 24: CONFIDENCE_INVARIANT_VIOLATION and CONFIDENCE_REPORT_MISMATCH errors mark run as VERIFIED_WITH_ERRORS
-  const hasEvidenceLawViolations = errors.some(e => e.includes('EVIDENCE_LAW_VIOLATION'));
+  const hasEvidenceLawViolations = errors.some(e => e.includes('Evidence Law violation'));
   const hasEvidenceIntentMismatches = errors.some(e => e.includes('EVIDENCE_INTENT_MISMATCH'));
   const hasGuardrailsReportMismatches = errors.some(e => e.includes('GUARDRAILS_REPORT_MISMATCH'));
   const hasConfidenceInvariantViolations = errors.some(e => e.includes('CONFIDENCE_INVARIANT_VIOLATION'));
@@ -398,7 +400,7 @@ export function verifyRun(runDir, registrySnapshot = null) {
     enforcementSummary,
     verifiedAt: new Date().toISOString(),
     // PHASE 21.1: Track evidence law violations separately
-    evidenceLawViolations: hasEvidenceLawViolations ? errors.filter(e => e.includes('EVIDENCE_LAW_VIOLATION')) : [],
+    evidenceLawViolations: hasEvidenceLawViolations ? errors.filter(e => e.includes('Evidence Law violation')) : [],
     // PHASE 22: Track evidence intent mismatches separately
     evidenceIntentMismatches: hasEvidenceIntentMismatches ? errors.filter(e => e.includes('EVIDENCE_INTENT_MISMATCH')) : [],
     // PHASE 23: Track guardrails report mismatches separately
@@ -453,9 +455,9 @@ function validateFindingsArtifact(findingsData, runDir) {
             validateEvidencePackageStrict(finding.evidencePackage, severity);
             // If we get here, evidencePackage is complete
           } catch (error) {
-            // PHASE 21.1: HARD FAILURE - blocking error with EVIDENCE_LAW_VIOLATION code
+            // PHASE 21.1: HARD FAILURE - blocking error with Evidence Law violation code
             errors.push(
-              `EVIDENCE_LAW_VIOLATION: Finding at index ${i} is marked CONFIRMED but evidencePackage is incomplete. ` +
+              `Evidence Law violation: Finding at index ${i} is marked CONFIRMED but evidencePackage is incomplete. ` +
               `Missing fields: ${error.missingFields?.join(', ') || 'unknown'}. ` +
               `(type: ${finding.type || 'unknown'})`
             );
@@ -463,7 +465,7 @@ function validateFindingsArtifact(findingsData, runDir) {
         } else if (!finding.evidence || !isEvidenceSubstantive(finding.evidence)) {
           // PHASE 21.1: CONFIRMED without evidencePackage and without substantive evidence → HARD FAILURE
           errors.push(
-            `EVIDENCE_LAW_VIOLATION: Finding at index ${i} is marked CONFIRMED but lacks evidencePackage and evidence is insufficient. ` +
+            `Evidence Law violation: Finding at index ${i} is marked CONFIRMED but lacks evidencePackage and has insufficient evidence. ` +
             `(type: ${finding.type || 'unknown'})`
           );
         }
@@ -658,6 +660,7 @@ function validateGuardrailsReportArtifact(reportData, runDir) {
   if (existsSync(findingsPath)) {
     try {
       const findingsContent = readFileSync(findingsPath, 'utf-8');
+  // @ts-expect-error - readFileSync with encoding returns string
       const findingsData = JSON.parse(findingsContent);
       
       if (findingsData.findings && Array.isArray(findingsData.findings)) {
@@ -763,6 +766,7 @@ function validateConfidenceReportArtifact(reportData, runDir) {
   if (existsSync(findingsPath)) {
     try {
       const findingsContent = readFileSync(findingsPath, 'utf-8');
+  // @ts-expect-error - readFileSync with encoding returns string
       const findingsData = JSON.parse(findingsContent);
       
       if (findingsData.findings && Array.isArray(findingsData.findings)) {
@@ -820,6 +824,7 @@ function checkCrossArtifactConsistency(runDir) {
     
     if (existsSync(statusPath)) {
       try {
+  // @ts-expect-error - readFileSync with encoding returns string
         const statusData = JSON.parse(readFileSync(statusPath, 'utf-8'));
         runId = statusData.runId;
         
@@ -832,6 +837,7 @@ function checkCrossArtifactConsistency(runDir) {
           const findingsPath = join(runDir, ARTIFACT_REGISTRY.findings.filename);
           if (existsSync(findingsPath)) {
             try {
+  // @ts-expect-error - readFileSync with encoding returns string
               const findingsData = JSON.parse(readFileSync(findingsPath, 'utf-8'));
               // Findings don't always have runId, so this is optional
               if (findingsData.runId && findingsData.runId !== runId) {
@@ -848,6 +854,7 @@ function checkCrossArtifactConsistency(runDir) {
           const summaryPath = join(runDir, ARTIFACT_REGISTRY.summary.filename);
           if (existsSync(summaryPath)) {
             try {
+  // @ts-expect-error - readFileSync with encoding returns string
               const summaryData = JSON.parse(readFileSync(summaryPath, 'utf-8'));
               if (summaryData.runId && summaryData.runId !== runId) {
                 warnings.push(
@@ -870,6 +877,7 @@ function checkCrossArtifactConsistency(runDir) {
       const findingsPathForTimestamp = join(runDir, ARTIFACT_REGISTRY.findings.filename);
       if (existsSync(findingsPathForTimestamp)) {
         try {
+  // @ts-expect-error - readFileSync with encoding returns string
           const findingsDataForTimestamp = JSON.parse(readFileSync(findingsPathForTimestamp, 'utf-8'));
           if (findingsDataForTimestamp.detectedAt) timestamps.push({ artifact: 'findings', time: findingsDataForTimestamp.detectedAt });
         } catch (e) {
@@ -881,6 +889,7 @@ function checkCrossArtifactConsistency(runDir) {
       const findingsPathForTimestamp = join(runDir, ARTIFACT_REGISTRY.findings.filename);
       if (existsSync(findingsPathForTimestamp)) {
         try {
+  // @ts-expect-error - readFileSync with encoding returns string
           const findingsDataForTimestamp = JSON.parse(readFileSync(findingsPathForTimestamp, 'utf-8'));
           if (findingsDataForTimestamp.detectedAt) timestamps.push({ artifact: 'findings', time: findingsDataForTimestamp.detectedAt });
         } catch (e) {
@@ -891,6 +900,7 @@ function checkCrossArtifactConsistency(runDir) {
     
     // Sort timestamps and check monotonicity
     if (timestamps.length > 1) {
+      // @ts-expect-error - Date arithmetic for sorting
       timestamps.sort((a, b) => new Date(a.time) - new Date(b.time));
       for (let i = 1; i < timestamps.length; i++) {
         if (new Date(timestamps[i].time) < new Date(timestamps[i - 1].time)) {

package/src/verax/core/baseline/baseline.snapshot.js

@@ -62,6 +62,7 @@ function isGitDirty() {
  */
 function getVeraxVersion() {
   try {
+  // @ts-expect-error - readFileSync with encoding returns string
     const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf-8'));
     return packageJson.version || 'unknown';
   } catch {
@@ -223,6 +224,7 @@ export function loadBaselineSnapshot(projectDir) {
   }
   
   try {
+  // @ts-expect-error - readFileSync with encoding returns string
     return JSON.parse(readFileSync(snapshotPath, 'utf-8'));
   } catch {
     return null;

package/src/verax/core/capabilities/gates.js

@@ -60,7 +60,7 @@ export function evaluateCapabilityGates(capabilityId, context) {
     testMatrix,
     fixtureIndex,
     docsIndex,
-    artifactsRegistry,
+    _artifactsRegistry,
     guardrailsRules,
     determinismTests,
   } = context;
@@ -333,6 +333,7 @@ function buildFixtureIndex(projectRoot) {
           const readmeContent = readFileSync(readmePath, 'utf-8');
         // Extract capability IDs from README (look for patterns like "capability-id" or "capabilityId")
         // Also check for capability mentions in test matrix format
+        // @ts-expect-error - readFileSync with encoding returns string
         const capabilityMatches = readmeContent.match(/(['"])([a-z0-9-]+)(['"])/g);
         if (capabilityMatches) {
           capabilities = capabilityMatches.map(m => {
@@ -342,6 +343,7 @@ function buildFixtureIndex(projectRoot) {
         }
         
         // Also look for capability registry format
+        // @ts-expect-error - readFileSync with encoding returns string
         const registryMatches = readmeContent.match(/([a-z0-9-]+-[a-z0-9-]+)/g);
         if (registryMatches) {
           capabilities.push(...registryMatches.filter(m => m.includes('-')));
@@ -382,6 +384,7 @@ function buildDocsIndex(projectRoot) {
         
         // Extract capability IDs from docs (look for patterns)
         const capabilities = [];
+        // @ts-expect-error - readFileSync with encoding returns string
         const capabilityMatches = docContent.match(/([a-z0-9-]+-[a-z0-9-]+)/g);
         if (capabilityMatches) {
           // Filter to likely capability IDs (contain hyphens, reasonable length)
@@ -427,6 +430,7 @@ function buildGuardrailsIndex(projectRoot) {
         // Extract capability categories from test content
         const capabilities = [];
         // Look for capability mentions or category mentions
+        // @ts-expect-error - readFileSync with encoding returns string
         const categoryMatches = testContent.match(/(network|navigation|routes|ui-feedback|validation)/gi);
         if (categoryMatches) {
           capabilities.push(...categoryMatches.map(m => m.toLowerCase()));
@@ -467,6 +471,7 @@ function buildDeterminismTestsIndex(projectRoot) {
         // Extract capability IDs from test content by looking at test matrix references
         const capabilities = [];
         // Look for test matrix references or capability mentions
+        // @ts-expect-error - readFileSync with encoding returns string
         const testMatrixMatches = testContent.match(/testMatrix\[['"]([a-z0-9-]+)['"]\]/g);
         if (testMatrixMatches) {
           for (const match of testMatrixMatches) {
@@ -478,6 +483,7 @@ function buildDeterminismTestsIndex(projectRoot) {
         }
         
         // Also look for capability mentions in test descriptions
+        // @ts-expect-error - readFileSync with encoding returns string
         const capabilityMentions = testContent.match(/([a-z0-9-]+-[a-z0-9-]+)/g);
         if (capabilityMentions) {
           capabilities.push(...capabilityMentions.filter(m => m.includes('-')));

package/src/verax/core/confidence/confidence-compute.js

@@ -6,8 +6,8 @@
  */
 
 import { computeConfidenceForFinding } from '../confidence-engine.js';
-import { CONFIDENCE_WEIGHTS } from './confidence-weights.js';
-import { checkConfidenceInvariants, enforceConfidenceInvariants } from './confidence-invariants.js';
+import { CONFIDENCE_WEIGHTS as _CONFIDENCE_WEIGHTS } from './confidence-weights.js';
+import { checkConfidenceInvariants, enforceConfidenceInvariants as _enforceConfidenceInvariants } from './confidence-invariants.js';
 
 /**
  * Compute final confidence with full truth-aware reconciliation
@@ -39,6 +39,7 @@ export function computeFinalConfidence(params) {
   
   // Step 1: Compute raw confidence using unified engine
   const rawConfidenceResult = computeConfidenceForFinding({
+    // @ts-expect-error - Optional params structure
     findingType: params.findingType || 'unknown',
     expectation,
     sensors: rawSignals || sensors,
@@ -112,6 +113,9 @@ export function computeFinalConfidence(params) {
   // Step 6: Determine final confidence level
   const confidenceLevel = determineConfidenceLevel(confidenceAfter);
   
+  // Extract top 2-4 reasons for contract compliance
+  const topReasons = explanation.slice(0, 4).filter((r, idx) => idx < 2 || idx < 4);
+  
   return {
     confidenceBefore,
     confidenceAfter,
@@ -119,6 +123,7 @@ export function computeFinalConfidence(params) {
     appliedInvariants,
     invariantViolations,
     explanation: explanation.slice(0, 20), // Limit to 20 for determinism
+    topReasons, // Contract v1: 2-4 reasons
     truthStatus: finalTruthStatus,
     expectationProof,
     verificationStatus
@@ -126,12 +131,14 @@ export function computeFinalConfidence(params) {
 }
 
 /**
- * Determine confidence level from score
+ * Determine confidence level from score01 (Contract v1)
+ * HIGH: score01 >= 0.85
+ * MEDIUM: 0.60 <= score01 < 0.85
+ * LOW: score01 < 0.60
  */
 function determineConfidenceLevel(score) {
-  if (score >= 0.80) return 'HIGH';
-  if (score >= 0.50) return 'MEDIUM';
-  if (score >= 0.20) return 'LOW';
-  return 'UNPROVEN';
+  if (score >= 0.85) return 'HIGH';
+  if (score >= 0.60) return 'MEDIUM';
+  return 'LOW';
 }
 

package/src/verax/core/confidence/confidence.loader.js

@@ -36,6 +36,7 @@ export function loadConfidencePolicy(policyPath = null, projectDir = null) {
   let policy;
   try {
     const policyContent = readFileSync(resolvedPath, 'utf-8');
+  // @ts-expect-error - readFileSync with encoding returns string
     policy = JSON.parse(policyContent);
   } catch (error) {
     throw new Error(`Failed to load confidence policy: ${error.message}`);

package/src/verax/core/confidence-engine-refactor.js

@@ -283,7 +283,7 @@ function assessCorrelationQuality(expectation, sensors, comparisons, evidence, r
 /**
  * Assess guardrails & contradictions (Pillar D) using policy
  */
-function assessGuardrails(sensors, comparisons, findingType, reasons, policy) {
+function assessGuardrails(sensors, comparisons, findingType, reasons, _policy) {
   let guardrailScore = 1.0;
   
   const networkSensor = sensors.network || {};
@@ -406,6 +406,7 @@ export function computeConfidenceForFinding(params) {
   }
   
   // === TRUTH LOCKS: Evidence Law cap ===
+  // @ts-expect-error - Optional params structure
   const evidencePackage = options.evidencePackage || params.evidence?.evidencePackage || {};
   if (evidencePackage.severity === 'CONFIRMED' || evidencePackage.status === 'CONFIRMED') {
     if (policy.truthLocks.evidenceCompleteRequired && !evidencePackage.isComplete) {
@@ -415,10 +416,14 @@ export function computeConfidenceForFinding(params) {
   }
   
   // Determine level using policy thresholds
+  // @ts-expect-error - params has expectation property
+  const promiseStrength = assessPromiseStrength(params.expectation, [], policy);
+  // @ts-expect-error - params has evidence and sensors properties
+  const evidenceComplete = assessEvidenceCompleteness(params.evidence || {}, params.sensors || {}, [], policy);
   const level = determineConfidenceLevel(
     normalizedScore,
-    assessPromiseStrength(params.expectation, [], policy),
-    assessEvidenceCompleteness(params.evidence || {}, params.sensors || {}, [], policy),
+    promiseStrength,
+    evidenceComplete,
     policy
   );