@zaip-ai/cli 2.6.0 → 3.0.0

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-read-model-source-fingerprint.test.ts

@@ -1,6 +1,6 @@
 import { mkdir, mkdtemp, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   type SqliteReadModelSourceCandidate,
   sourceFingerprint,
@@ -21,6 +21,7 @@ const checkpoints = (candidates: SqliteReadModelSourceCandidate[]) =>
   new Map(candidates.map((candidate) => [candidate.source, candidate]));
 
 afterEach(async () => {
+  vi.restoreAllMocks();
   await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
 
@@ -49,6 +50,7 @@ describe("persistent source fingerprint checkpoints", () => {
 
   it("reuses historical content hashes across serialized checkpoints and detects additions and removals", async () => {
     const { root, path } = await fixture();
+    vi.spyOn(Date, "now").mockReturnValue(Date.now() + 5_000);
     const initial = await sourceFingerprint(root);
     const previous = checkpoints(JSON.parse(JSON.stringify(initial.candidates)));
     expect(initial.hashedFiles).toBe(1);
@@ -86,6 +88,57 @@ describe("persistent source fingerprint checkpoints", () => {
     expect(changed).toMatchObject({ hashedFiles: 1, reusedFiles: 0 });
   });
 
+  it("rehashes recent colliding metadata and the first settled checkpoint before reuse", async () => {
+    const { root, path } = await fixture();
+    const metadata = await stat(path);
+    const clock = vi.spyOn(Date, "now").mockReturnValue(metadata.ctimeMs);
+    const initial = await sourceFingerprint(root);
+    // Even a corrupted/stale hash with otherwise identical metadata cannot be
+    // trusted while writes can collide within the filesystem timestamp tick.
+    const stale = checkpoints(
+      initial.candidates.map((item) => ({ ...item, contentHash: "stale" })),
+    );
+    const recent = await sourceFingerprint(root, { previous: stale });
+    expect(recent).toMatchObject({ hashedFiles: 1, reusedFiles: 0 });
+    expect(recent.candidates[0]?.contentHash).toBe(initial.candidates[0]?.contentHash);
+    const serialized = checkpoints(JSON.parse(JSON.stringify(recent.candidates)));
+    clock.mockReturnValue(metadata.ctimeMs + 2_001);
+    const settled = await sourceFingerprint(root, { previous: serialized });
+    expect(settled).toMatchObject({ hashedFiles: 1, reusedFiles: 0 });
+    const reused = await sourceFingerprint(root, { previous: checkpoints(settled.candidates) });
+    expect(reused).toMatchObject({
+      hashedFiles: 0,
+      reusedFiles: 1,
+      fingerprint: settled.fingerprint,
+    });
+    const legacy = checkpoints(
+      settled.candidates.map((item) => ({
+        ...item,
+        contentHash: "stale",
+        fileIdentity: item.fileIdentity.replace("settled-v2:", ""),
+      })),
+    );
+    const upgraded = await sourceFingerprint(root, { previous: legacy });
+    expect(upgraded).toMatchObject({
+      hashedFiles: 1,
+      reusedFiles: 0,
+      fingerprint: settled.fingerprint,
+    });
+  });
+
+  it("detects rapid real same-size rewrites with restored mtime across repeated scans", async () => {
+    const { root, path } = await fixture();
+    const timestamp = new Date("2026-01-01T00:00:00Z");
+    let previous = await sourceFingerprint(root);
+    for (let iteration = 0; iteration < 20; iteration += 1) {
+      await writeFile(path, iteration % 2 ? "# first\n" : "# other\n");
+      await utimes(path, timestamp, timestamp);
+      const next = await sourceFingerprint(root, { previous: checkpoints(previous.candidates) });
+      expect(next.candidates[0]?.contentHash).not.toBe(previous.candidates[0]?.contentHash);
+      previous = next;
+    }
+  });
+
   it("detects atomic file replacement and allows explicit complete content verification", async () => {
     const { root, path } = await fixture();
     const initial = await sourceFingerprint(root);

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-read-model-source-fingerprint.ts

@@ -83,8 +83,10 @@ export async function sourceFingerprint(
   let hashedFiles = 0;
   let reusedFiles = 0;
   // Persisted checkpoints avoid rereading unchanged history across workers.
-  // ctime and identity detect same-size edits with preserved mtime and atomic
-  // replacement. Explicit verification bypasses this metadata shortcut.
+  // Windows can report identical ctime even in nanoseconds for rapid writes.
+  // Never cache a recent timestamp. Mark those hashes as unstable so that the
+  // first scan after the settling window also rehashes before allowing reuse.
+  // Explicit verification still bypasses this metadata shortcut entirely.
   for (let offset = 0; offset < candidates.length; offset += 32) {
     candidatesWithMetadata.push(
       ...(
@@ -94,17 +96,19 @@ export async function sourceFingerprint(
             try {
               for (let attempt = 0; attempt < 3; attempt += 1) {
                 const metadata = await stat(candidate);
+                const metadataSettled = Date.now() - metadata.ctimeMs > 2_000;
                 const current = {
                   path: candidate,
                   source,
                   mtimeMs: metadata.mtimeMs,
                   ctimeMs: metadata.ctimeMs,
                   size: metadata.size,
-                  fileIdentity: `${metadata.dev}:${metadata.ino}:${metadata.birthtimeMs}`,
+                  fileIdentity: `settled-v2:${metadata.dev}:${metadata.ino}:${metadata.birthtimeMs}${metadataSettled ? "" : ":recent"}`,
                 };
                 const previous = options.previous?.get(source);
                 if (
                   !options.verifyContent &&
+                  metadataSettled &&
                   previous !== undefined &&
                   previous.mtimeMs === current.mtimeMs &&
                   previous.ctimeMs === current.ctimeMs &&

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-read-model.test.ts

@@ -46,8 +46,11 @@ describe("SQLite dashboard read model", () => {
     await writeFile(join(root, ".agents/config/project.yaml"), "zaip:\n  enabled: true\n");
     const task = join(root, ".agents/records/tasks/task.md");
     await writeFile(task, "# initial\n");
+    const settledFilesystemTime = Date.now() + 5_000;
     vi.useFakeTimers({ toFake: ["Date"] });
     vi.setSystemTime(new Date("2026-09-05T02:59:00Z"));
+    // Calendar projection time is independent of the real fixture's ctime.
+    vi.spyOn(Date, "now").mockReturnValue(settledFilesystemTime);
     const first = await rebuildSqliteReadModel(root);
     await expect(rebuildSqliteReadModel(root)).resolves.toMatchObject({ cache: "generation" });
     await rm(task);
@@ -174,7 +177,7 @@ describe("SQLite dashboard read model", () => {
         metadata
           .prepare("SELECT value FROM zaip_vw_read_model_metadata WHERE key='schema_version'")
           .get(),
-      ).toEqual({ value: "74" });
+      ).toEqual({ value: "78" });
     } finally {
       metadata.close();
     }

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-risk-population.test.ts

@@ -0,0 +1,98 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { expect, it } from "vitest";
+import { createDashboardApp } from "./server.js";
+import { rebuildSqliteReadModel, SqliteReadModelFileSystem } from "./sqlite-read-model.js";
+
+it("serves risk counts over the same non-draft population as total and statuses", async () => {
+  const parent = resolve(import.meta.dirname, "../../../../../../.local/sqlite/tests");
+  await mkdir(parent, { recursive: true });
+  const root = await mkdtemp(join(parent, "risk-population-"));
+  let filesystem: SqliteReadModelFileSystem | undefined;
+  try {
+    const records = join(root, ".agents/records/tasks/2026/09");
+    await mkdir(records, { recursive: true });
+    await mkdir(join(root, ".agents/config"), { recursive: true });
+    await writeFile(
+      join(root, ".agents/config/project.yaml"),
+      "schema_version: 1\nzaip:\n  enabled: true\nproject:\n  id: sqlite-test\n  name: sqlite-test\n  timezone: UTC\nstack:\n  id: zaip-aios-stack\n  overrides: {}\nclients:\n  codex: true\n  claude: true\ntracking:\n  enabled: true\n  currency: BRL\n  storage_mode: tracked_sanitized\n",
+    );
+    await writeFile(
+      join(root, ".agents/config/framework.lock.yaml"),
+      "lock_version: 1\nframework:\n  version: 2.6.0\n  distribution_sha256: null\nlayout:\n  version: 3\nresolved_profile:\n  id: null\n  sha256: null\nmanaged_files: {}\n",
+    );
+    for (const [id, status, risk] of [
+      ["TASK-DRAFT", "draft", "critical"],
+      ["TASK-PLANNED", "planned", "lite"],
+      ["TASK-SECOND", "planned", "lite"],
+      ["TASK-COMPLETED", "completed", "standard"],
+    ]) {
+      await writeFile(
+        join(records, `${id}.md`),
+        `---\nid: ${id}\ntitle: ${id}\nstatus: ${status}\nrisk: ${risk}\ncreated_at: 2026-09-${id === "TASK-COMPLETED" ? "02" : "01"}T12:00:00.000Z\n---\n`,
+        "utf8",
+      );
+    }
+    await rebuildSqliteReadModel(root);
+    filesystem = new SqliteReadModelFileSystem(root);
+    expect(filesystem.firstFoldViewportAllTime().task_risk_counts).toEqual({
+      lite: 2,
+      standard: 1,
+    });
+    expect(filesystem.firstFoldAllTime().task_risk_counts).toEqual({ lite: 2, standard: 1 });
+    for (const view of [
+      "cost_monitor_daily",
+      "cost_monitor_monthly",
+      "cost_monitor_annual",
+    ] as const) {
+      const page = filesystem.viewPage(view, { limit: 10 });
+      const daily = view === "cost_monitor_daily";
+      expect(page.rows).toHaveLength(daily ? 2 : 1);
+      expect(page.totals).toMatchObject({ task_count: 3 });
+      expect(page).toMatchObject({ period_averages: { BRL: { tasks: daily ? 1.5 : 3 } } });
+    }
+    const first = filesystem.viewPage("cost_monitor_daily", { limit: 1, offset: 0 });
+    const second = filesystem.viewPage("cost_monitor_daily", { limit: 1, offset: 1 });
+    expect(first.rows[0]).toMatchObject({ task_count: 1 });
+    expect(second.rows[0]).toMatchObject({ task_count: 2 });
+    expect(first.period_averages).toEqual(second.period_averages);
+    expect(first).toMatchObject({
+      period_averages: { BRL: { tasks: 1.5, cost: null, tokens: null } },
+    });
+    expect(
+      filesystem.viewPage("cost_monitor_daily", { limit: 1, query: "2026-09-01" }),
+    ).toMatchObject({ total_count: 1, period_averages: { BRL: { tasks: 2 } } });
+    const app = createDashboardApp(root, "fixture-only", undefined, {
+      filesystem,
+      watchSources: false,
+    });
+    for (const scope of ["quick", "overview"]) {
+      const response = await app.request(`/api/v2/operations?scope=${scope}`, {
+        headers: { "x-zaip-session": "fixture-only" },
+      });
+      expect(response.status, await response.clone().text()).toBe(200);
+      const data = (await response.json()) as {
+        summary: {
+          overview_metrics: {
+            task_count: number;
+            task_status_counts: Record<string, number>;
+            task_risk_counts: Record<string, number>;
+          };
+        };
+      };
+      const metric = data.summary.overview_metrics;
+      expect(metric.task_count).toBe(3);
+      expect(metric.task_status_counts).toEqual({ planned: 2, completed: 1 });
+      expect(metric.task_risk_counts).toEqual({ lite: 2, standard: 1 });
+      expect(
+        Object.values(metric.task_risk_counts).reduce<number>(
+          (sum, count) => sum + Number(count),
+          0,
+        ),
+      ).toBe(metric.task_count);
+    }
+  } finally {
+    filesystem?.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-schema-base-views.ts

@@ -16,8 +16,12 @@ export const baseViewSql = `
           WHERE agent_invocation_id IS NOT NULL;
         CREATE INDEX zaip_activities_status ON zaip_aios_activities(activity_source_kind, status, phase);
         CREATE INDEX IF NOT EXISTS zaip_activities_payload ON zaip_aios_activities(payload_type, activity_key);
+        -- File lookups must not parse every JSON payload (including its full
+        -- content) on each read. The file view uses this path-only index for
+        -- binary equality and cheap LIKE scans without changing their semantics.
+        CREATE INDEX zaip_activities_file_path ON zaip_aios_activities(json_extract(payload_json, '$.path')) WHERE payload_type='file';
         CREATE INDEX zaip_activities_work_item_identity ON zaip_aios_activities(json_extract(payload_json, '$.entity_kind'), json_extract(payload_json, '$.id')) WHERE payload_type='work_item';
-        CREATE VIEW files AS SELECT json_extract(payload_json, '$.path') AS path, json_extract(payload_json, '$.content') AS content, json_extract(payload_json, '$.mtime_ms') AS mtime_ms, json_extract(payload_json, '$.size_bytes') AS size_bytes, json_extract(payload_json, '$.content_sha256') AS content_sha256, json_extract(payload_json, '$.artifact_kind') AS artifact_kind, json_extract(payload_json, '$.artifact_id') AS artifact_id, json_extract(payload_json, '$.artifact_occurred_at') AS artifact_occurred_at, json_extract(payload_json, '$.artifact_occurred_day_sp') AS artifact_occurred_day_sp, json_extract(payload_json, '$.artifact_task_id') AS artifact_task_id, json_extract(payload_json, '$.artifact_change_id') AS artifact_change_id, json_extract(payload_json, '$.artifact_run_id') AS artifact_run_id FROM zaip_aios_activities WHERE payload_type='file';
+        CREATE VIEW files AS SELECT json_extract(payload_json, '$.path') AS path, json_extract(payload_json, '$.content') AS content, json_extract(payload_json, '$.mtime_ms') AS mtime_ms, json_extract(payload_json, '$.size_bytes') AS size_bytes, json_extract(payload_json, '$.content_sha256') AS content_sha256, json_extract(payload_json, '$.artifact_kind') AS artifact_kind, json_extract(payload_json, '$.artifact_id') AS artifact_id, json_extract(payload_json, '$.artifact_occurred_at') AS artifact_occurred_at, json_extract(payload_json, '$.artifact_occurred_day_sp') AS artifact_occurred_day_sp, json_extract(payload_json, '$.artifact_task_id') AS artifact_task_id, json_extract(payload_json, '$.artifact_change_id') AS artifact_change_id, json_extract(payload_json, '$.artifact_run_id') AS artifact_run_id FROM zaip_aios_activities INDEXED BY zaip_activities_file_path WHERE payload_type='file';
         CREATE VIEW read_model_source_state AS SELECT json_extract(payload_json, '$.source_path') AS source_path, json_extract(payload_json, '$.source_hash') AS source_hash, json_extract(payload_json, '$.mtime_ms') AS mtime_ms, json_extract(payload_json, '$.ctime_ms') AS ctime_ms, json_extract(payload_json, '$.size_bytes') AS size_bytes, json_extract(payload_json, '$.file_identity') AS file_identity, json_extract(payload_json, '$.source_kind') AS source_kind, json_extract(payload_json, '$.last_processed_at') AS last_processed_at FROM zaip_aios_activities WHERE payload_type='source_state';
         CREATE VIEW read_model_metadata AS SELECT json_extract(payload_json, '$.key') AS key, json_extract(payload_json, '$.value') AS value FROM zaip_aios_activities WHERE payload_type='metadata';
         CREATE VIEW canonical_work_items AS SELECT json_extract(payload_json, '$.entity_kind') AS entity_kind, json_extract(payload_json, '$.id') AS id, json_extract(payload_json, '$.title') AS title, json_extract(payload_json, '$.status') AS status, json_extract(payload_json, '$.stage') AS stage, json_extract(payload_json, '$.risk') AS risk, json_extract(payload_json, '$.spec_id') AS spec_id, json_extract(payload_json, '$.change_id') AS change_id, json_extract(payload_json, '$.creation_run_id') AS creation_run_id, json_extract(payload_json, '$.completed_run_id') AS completed_run_id, json_extract(payload_json, '$.occurred_at') AS occurred_at, json_extract(payload_json, '$.occurred_day_sp') AS occurred_day_sp FROM zaip_aios_activities WHERE payload_type='work_item';
@@ -123,7 +127,8 @@ export const baseViewSql = `
             FROM attributed_token_active_facts GROUP BY occurred_day_sp
           ), work_item_days AS (
             SELECT entity_kind AS kind, id, occurred_day_sp AS day FROM canonical_work_items
-            UNION ALL SELECT 'task', task_id, MIN(occurred_day_sp) FROM activities WHERE task_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM canonical_work_items c WHERE c.entity_kind='task' AND c.id=activities.task_id) GROUP BY task_id
+              WHERE entity_kind <> 'task' OR COALESCE(status, 'draft') <> 'draft'
+            UNION ALL SELECT 'task', task_id, MIN(occurred_day_sp) FROM activities WHERE task_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM canonical_work_items c WHERE c.entity_kind='task' AND c.id=activities.task_id) GROUP BY task_id HAVING COALESCE(MAX(work_item_status), 'draft') <> 'draft'
             UNION ALL SELECT 'spec', spec_id, MIN(occurred_day_sp) FROM activities WHERE spec_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM canonical_work_items c WHERE c.entity_kind='spec' AND c.id=activities.spec_id) GROUP BY spec_id
             UNION ALL SELECT 'prd', prd_id, MIN(occurred_day_sp) FROM activities WHERE prd_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM canonical_work_items c WHERE c.entity_kind='prd' AND c.id=activities.prd_id) GROUP BY prd_id
           ), work_item_daily AS (

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-schema-dashboard-views.ts

@@ -174,7 +174,8 @@ export const dashboardViewSql = `        CREATE VIEW vw_operations_work_list AS
         CREATE VIEW vw_first_fold_task_risk_all_time AS
           WITH counts AS (
             SELECT COALESCE(risk, 'standard') AS risk, COUNT(*) AS task_count
-            FROM task_summary GROUP BY COALESCE(risk, 'standard')
+            FROM task_summary WHERE COALESCE(status, 'draft') <> 'draft'
+            GROUP BY COALESCE(risk, 'standard')
           ), total AS (SELECT SUM(task_count) AS task_count FROM counts)
           SELECT counts.risk, counts.task_count,
             CASE WHEN total.task_count = 0 THEN 0.0 ELSE CAST(counts.task_count AS REAL) / total.task_count END AS task_percentage

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-snapshot-seed.test.ts

@@ -13,6 +13,7 @@ import {
 const roots: string[] = [];
 
 afterEach(async () => {
+  vi.restoreAllMocks();
   await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
 
@@ -60,6 +61,7 @@ describe("SQLite snapshot seed publication", () => {
     await mkdir(join(root, ".agents", "config"), { recursive: true });
     await writeFile(join(root, ".agents", "config", "project.yaml"), "zaip:\n  enabled: true\n");
     const destination = join(root, ".local", "dashboard-sqlite", "read-model.sqlite");
+    vi.spyOn(Date, "now").mockReturnValue(Date.now() + 5_000);
     vi.stubEnv("ZAIP_SQLITE_DB_PATH", destination);
     try {
       await expect(rebuildSqliteReadModel(root)).resolves.toMatchObject({ cache: "rebuilt" });

package/templates/.agents/dashboard/packages/local-runtime/src/verify-project-settings.mjs

@@ -0,0 +1,57 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { stripVTControlCharacters } from "node:util";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, "../../../../..");
+const prefix = ".agents/dashboard/packages/local-runtime/src/";
+const mode = process.argv[2];
+if (!["test", "integration", "check"].includes(mode))
+  throw new Error("Expected test|integration|check");
+if (!existsSync(resolve(root, "node_modules/vitest/vitest.mjs"))) {
+  if (spawnSync("git", ["symbolic-ref", "-q", "HEAD"], { cwd: root }).status !== 1)
+    throw new Error("Prepare dependencies in the Task checkout first");
+  const pnpm = resolve(dirname(process.execPath), "node_modules/corepack/dist/pnpm.js");
+  execute([pnpm, "install", "--offline", "--frozen-lockfile", "--ignore-scripts"], 300_000);
+}
+function execute(args, timeout = 120_000) {
+  const result = spawnSync(process.execPath, args, {
+    cwd: root,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout,
+    maxBuffer: 4_000_000,
+  });
+  const output = stripVTControlCharacters((result.stdout ?? "") + "\n" + (result.stderr ?? ""));
+  if (result.status !== 0) {
+    process.stderr.write(output);
+    throw new Error("Settings validation failed: " + (result.error?.message ?? result.status));
+  }
+  return output;
+}
+if (mode === "check") {
+  execute([
+    "node_modules/typescript/bin/tsc",
+    "--noEmit",
+    "--project",
+    ".agents/dashboard/packages/local-runtime/tsconfig.json",
+  ]);
+  console.log(JSON.stringify({ kind: "settings_typecheck", passed: true, mode }));
+} else {
+  const file =
+    mode === "test" ? "project-installation-summary.test.ts" : "project-settings.test.ts";
+  const output = execute([
+    "node_modules/vitest/vitest.mjs",
+    "run",
+    prefix + file,
+    "--maxWorkers=1",
+  ]);
+  const tests = output
+    .split("\n")
+    .find((line) => /^\s*Tests\s/.test(line))
+    ?.trim();
+  if (!tests || !/\b[1-9]\d* passed\b/.test(tests)) throw new Error("No settings tests executed");
+  console.log(JSON.stringify({ kind: "settings_" + mode, passed: true, mode, tests, output }));
+}

package/templates/.agents/dashboard/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/dashboard-ui",
-  "version": "2.6.0",
+  "version": "3.0.0",
   "private": true,
   "type": "module",
   "exports": {

package/templates/.agents/dashboard/scripts/qualify-observability.mjs

@@ -0,0 +1,130 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { access, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+
+const root = resolve(import.meta.dirname, "../../..");
+const mode = process.argv[2];
+assert(["test", "integration", "check"].includes(mode), "Expected test|integration|check");
+const exec = promisify(execFile);
+async function run(args, timeout = 180_000, cwd = root) {
+  const result = await exec(process.execPath, args, {
+    cwd,
+    timeout,
+    windowsHide: true,
+    maxBuffer: 8 * 1024 * 1024,
+    env: { ...process.env, CI: "true" },
+  });
+  process.stdout.write(result.stdout);
+  process.stderr.write(result.stderr);
+}
+// Fail structural violations before installing dependencies or compiling fixtures.
+if (mode === "test") await run([join(root, "scripts/validate-source-size.mjs")]);
+if (
+  !(await access(join(root, "node_modules/vitest/vitest.mjs")).then(
+    () => true,
+    () => false,
+  ))
+) {
+  await run([
+    join(dirname(process.execPath), "node_modules/corepack/dist/pnpm.js"),
+    "install",
+    "--offline",
+    "--frozen-lockfile",
+    "--ignore-scripts",
+  ]);
+}
+const require = createRequire(join(root, "package.json"));
+const { build } = require("esbuild");
+const alias = {};
+for (const name of await readdir(join(root, "packages"))) {
+  const manifest = join(root, "packages", name, "package.json");
+  if (
+    !(await access(manifest).then(
+      () => true,
+      () => false,
+    ))
+  )
+    continue;
+  const pkg = JSON.parse(await readFile(manifest, "utf8"));
+  if (typeof pkg.exports?.["."] === "string")
+    alias[pkg.name] = join(dirname(manifest), pkg.exports["."]);
+}
+await build({
+  entryPoints: [join(root, "packages/cli/src/index.ts")],
+  outfile: join(root, "packages/cli/dist/index.js"),
+  alias,
+  bundle: true,
+  format: "esm",
+  platform: "node",
+  target: "node22",
+  minifyWhitespace: true,
+  banner: {
+    js: 'import { createRequire as __zaipCreateRequire } from "node:module"; const require = __zaipCreateRequire(import.meta.url);',
+  },
+});
+
+if (mode === "integration") {
+  await run([
+    join(root, ".agents/dashboard/packages/local-runtime/scripts/build-sqlite-dashboard.mjs"),
+  ]);
+  // Match the release text normalization before the candidate cleanliness check.
+  await run([
+    join(root, "scripts/normalize-generated-text.mjs"),
+    ".agents/dashboard/apps/frontend/dist",
+  ]);
+  const evidence =
+    process.argv[3] === undefined
+      ? join(root, ".local/qualification/observability")
+      : resolve(process.argv[3]);
+  await mkdir(evidence, { recursive: true });
+  await run([
+    join(root, ".agents/dashboard/scripts/verify-observability.mjs"),
+    "--evidence",
+    evidence,
+  ]);
+} else if (mode === "check") {
+  await run([join(root, ".agents/dashboard/scripts/verify-project-setup.mjs"), "check"]);
+  await run([
+    join(root, "node_modules/typescript/bin/tsc"),
+    "--noEmit",
+    "-p",
+    "packages/lifecycle-manifests/tsconfig.json",
+  ]);
+} else {
+  const configDirectory = join(root, ".local/qualification/observability-config");
+  await mkdir(configDirectory, { recursive: true });
+  const config = join(configDirectory, "vitest.config.mjs");
+  await writeFile(
+    config,
+    `import base from ${JSON.stringify(pathToFileURL(join(root, "vitest.config.ts")).href)};\nexport default {...base, resolve: {...base.resolve, alias: ${JSON.stringify(alias)}}};\n`,
+  );
+  await run([
+    join(root, "node_modules/vitest/vitest.mjs"),
+    "run",
+    "--config",
+    config,
+    "--maxWorkers=1",
+    "--testTimeout=60000",
+    "--hookTimeout=60000",
+    "packages/lifecycle-manifests/src/summary-metrics.test.ts",
+    "packages/cli/src/model-call-v3-integration.test.ts",
+    "packages/cli/src/run-finalization-barrier.test.ts",
+    "packages/cli/src/candidate-resolution.test.ts",
+    "packages/cli/src/run-lifecycle-closure.test.ts",
+    ".agents/dashboard/packages/local-runtime/start-dashboard.test.mjs",
+    ".agents/dashboard/packages/local-runtime/start-dashboard-launch-claims.test.mjs",
+    ".agents/dashboard/packages/local-runtime/start-dashboard-lifecycle.test.mjs",
+    ".agents/dashboard/packages/local-runtime/src/server-cross-layer-parity.test.ts",
+    ".agents/dashboard/packages/local-runtime/src/sqlite-read-model-marks-token-cost-telemetry-unavailable-when.test.ts",
+    ".agents/dashboard/apps/frontend/src/operations-detail-hydration.test.ts",
+    ".agents/dashboard/apps/frontend/src/dashboard-cost-facts.test.ts",
+    ".agents/dashboard/modules/operations/src/react/OperationsOverview.test.ts",
+    ".agents/dashboard/modules/cost-monitor/src/server/run-telemetry.test.ts",
+    "tests/e2e/traceability-contract.e2e.test.ts",
+  ]);
+}
+console.log(JSON.stringify({ mode, passed: true, platform: process.platform }));