agent-control-plane-core 0.3.2 → 0.4.1

package/bin/hook-runtime.mjs

@@ -9,7 +9,7 @@
  * behavior; sharing pure plumbing across distinct entries is not that.
  */
 import { writeSync } from "node:fs";
-import { Decision } from "../src/control-plane.mjs";
+import { Decision, sanitizeVerdict } from "../src/control-plane.mjs";
 
 /** Read all of stdin to a string. */
 export function readStdin() {
@@ -51,12 +51,21 @@ export function demoJudge(event) {
  * helper's stderr, and gemini reads stderr as a reason only on exit 2 — none of
  * these fail-safe exits is a 2 for a stdout-carrying transport, and amp's ask
  * (exit 1) shows the diagnostic alongside the prompt, which is the point.
+ * `judge` is the seam a real deployment fills — {@link demoJudge} is a stand-in,
+ * so the guardrail is supplied here rather than by forking this file. Whatever
+ * it returns is treated as untrusted (see the clamp below).
  * @param {import("../src/control-plane.mjs").Adapter} adapter
  * @param {string} rawInput
  * @param {import("../src/control-plane.mjs").NativeResponse} onFailure
+ * @param {(event: import("../src/control-plane.mjs").ToolCallEvent) => import("../src/control-plane.mjs").Verdict} [judge]
  * @returns {import("../src/control-plane.mjs").NativeResponse}
  */
-export function renderHookResponse(adapter, rawInput, onFailure) {
+export function renderHookResponse(
+  adapter,
+  rawInput,
+  onFailure,
+  judge = demoJudge,
+) {
   try {
     const native = JSON.parse(rawInput);
     // A non-object top-level payload (null, array, number, string) is malformed:
@@ -69,7 +78,16 @@ export function renderHookResponse(adapter, rawInput, onFailure) {
         `hook payload must be a JSON object, got ${native === null ? "null" : Array.isArray(native) ? "array" : typeof native}`,
       );
     const event = adapter.parse(native);
-    return adapter.render(demoJudge(event), event);
+    // A judge's answer is clamped, not trusted. `normalizeVerdict` (inside
+    // every adapter's render) THROWS on a decision outside allow/deny/ask, and
+    // that throw lands in the catch below — which returns the host's fail-safe,
+    // exit 0 on claude/codex/gemini. So a judge that means DENY but spells it
+    // "denied" would let the tool run. Clamping to "ask" first keeps a
+    // malformed answer in front of a human. Prose is passed through: scrubbing
+    // monitor-authored text needs a scrubber this transport module has no
+    // business choosing, and the decision is the half that gates the call.
+    const verdict = sanitizeVerdict(judge(event), (text) => text);
+    return adapter.render(verdict, event);
   } catch (err) {
     const detail = err instanceof Error ? (err.stack ?? err.message) : `${err}`;
     process.stderr.write(`[acp] hook pipeline error: ${detail}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane-core",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "description": "Vendor-neutral control-plane contract for coding agents: a normalized ToolCallEvent/Verdict schema with per-agent adapters (Claude Code, Codex, Amp, Gemini CLI) and a conformance suite.",
   "type": "module",
   "repository": {

package/src/adapters/gemini.mjs

@@ -126,18 +126,35 @@ function geminiMeta(nativeEvent, raw) {
  * CLI removes the ambiguity at parse time: every MCP tool is unconditionally
  * registered — and surfaced in hook payloads — under its fully qualified
  * `mcp_{server}_{tool}` name (gemini-cli docs/tools/mcp-server.md), so a bare
- * builtin name in `tool_name` can only be the builtin. The builtin's native
- * input fields still pass through verbatim (e.g. read_file's `absolute_path`,
- * not Read's `file_path`) — `meta.native_tool` tells a consumer which field
- * dialect to expect. Targets are pinned to {@link MODELED_TOOLS} at import, and
- * every entry must be witnessed by a gemini conformance fixture
- * (`assertToolAliasesCovered`).
+ * builtin name in `tool_name` can only be the builtin. Renaming the tool also
+ * renames its INPUT to the schema that name advertises, via
+ * {@link GEMINI_INPUT_ALIASES} — a consumer told `event.tool` is `Read` reads
+ * `input.file_path` and finds it, rather than reading `undefined` off a
+ * forwarded `absolute_path` and allowing. Targets are pinned to
+ * {@link MODELED_TOOLS} at import, every entry must be witnessed by a gemini
+ * conformance fixture (`assertToolAliasesCovered`), and every aliased case must
+ * carry the canonical input key (`assertAliasedInputsCanonical`).
  * @type {Readonly<Record<string, string>>}
  */
+// `web_fetch` is deliberately ABSENT. Canonicalizing to `WebFetch` advertises
+// `input.url`, and Gemini's payload has no URL field at all — the target sits
+// inside a prose `prompt` ("summarize https://example.com"). Recovering it means
+// guessing which URL in free text is the target, and a guardrail that gates on a
+// guessed destination is worse than one that plainly does not recognize the
+// tool: under the alias a domain deny-lister read `input.url`, got `undefined`,
+// and allowed the fetch. Left native, `web_fetch` reaches a judge as a name it
+// must handle on purpose.
 export const GEMINI_TOOL_ALIASES = Object.freeze({
   read_file: "Read",
   write_file: "Write",
-  web_fetch: "WebFetch",
+});
+
+// Native input field → the canonical field the alias target advertises, per
+// tool. Only a pure RENAME belongs here: the value is carried across untouched,
+// so no consumer receives a field this adapter invented. A dialect that cannot
+// be expressed as a rename does not get an alias at all (see `web_fetch`).
+const GEMINI_INPUT_ALIASES = Object.freeze({
+  read_file: { absolute_path: "file_path" },
 });
 
 assertAliasTargetsModeled(GEMINI_TOOL_ALIASES);
@@ -161,14 +178,27 @@ function geminiCanonicalTool(nativeTool, callClass) {
 /**
  * @param {string} kind
  * @param {Record<string, unknown>} raw
+ * @param {string|null} nativeTool
+ * @param {string} callClass a {@link CallClass} value
  * @returns {Record<string, unknown>}
  */
-function geminiInput(kind, raw) {
+function geminiInput(kind, raw, nativeTool, callClass) {
   if (kind === EventKind.PROMPT_SUBMIT)
     return { prompt: asString(raw.prompt, "") };
-  if (kind === EventKind.PRE_TOOL || kind === EventKind.POST_TOOL)
-    return asObject(raw.tool_input);
-  return {};
+  if (kind !== EventKind.PRE_TOOL && kind !== EventKind.POST_TOOL) return {};
+  const input = asObject(raw.tool_input);
+  // Renamed only where the NAME was renamed: the aliases are builtin-scoped, so
+  // an MCP tool that happens to be called `read_file` keeps its own dialect.
+  if (callClass !== CallClass.BUILTIN || nativeTool === null) return input;
+  const renames = lookup(GEMINI_INPUT_ALIASES, nativeTool);
+  if (renames === undefined) return input;
+  const out = { ...input };
+  for (const [nativeKey, canonicalKey] of Object.entries(renames)) {
+    if (!Object.hasOwn(out, nativeKey)) continue;
+    out[canonicalKey] = out[nativeKey];
+    delete out[nativeKey];
+  }
+  return out;
 }
 
 /**
@@ -204,7 +234,7 @@ export function parse(native) {
   return makeEvent({
     event: kind,
     tool: geminiCanonicalTool(nativeTool, callClass),
-    input: geminiInput(kind, raw),
+    input: geminiInput(kind, raw, nativeTool, callClass),
     response,
     this_call_vetoable: coverageAllowsVeto(COVERAGE[callClass]),
     meta,

package/src/conformance.mjs

@@ -1,9 +1,11 @@
 import {
   CALL_CLASSES,
+  MODELED_TOOL_INPUT_KEYS,
   TOOL_ALIASES,
   canonicalTool,
   coverageAllowsVeto,
   isCoverageStatus,
+  lookup,
 } from "./control-plane.mjs";
 
 /**
@@ -102,6 +104,45 @@ export function assertToolAliasesCovered(
   }
 }
 
+/**
+ * Assert that every case whose tool name was ALIASED carries the canonical
+ * tool's input key.
+ *
+ * Renaming a native tool to a {@link MODELED_TOOLS} name tells every consumer
+ * "this is a Read, read it like one" — the README's whole "write your logic
+ * once against the normalized types" promise. An adapter that renames the name
+ * but forwards the native input dialect makes that promise false in the one
+ * direction nobody checks: the judge reads the canonical field, gets
+ * `undefined`, and allows. A native-NAMED tool promises nothing and is left
+ * alone; this fires only where the adapter itself claimed the schema.
+ *
+ * The remedy for a failure is a real choice, not a fixture edit: rename the
+ * input keys too when the mapping is a pure rename, or drop the alias when it
+ * is not (a URL buried in a prose `prompt` cannot be renamed into a `url`
+ * without inventing it, and an invented target is worse than a visible gap).
+ * @param {any[]} fixturesList the golden fixtures for every shipped adapter
+ * @param {any} assert node:assert/strict (injected)
+ */
+export function assertAliasedInputsCanonical(fixturesList, assert) {
+  for (const fixtures of fixturesList) {
+    for (const testCase of fixtures.cases) {
+      const nativeTool = testCase.event?.meta?.native_tool;
+      const canon = testCase.event?.tool;
+      if (typeof nativeTool !== "string" || nativeTool === canon) continue;
+      const key = lookup(
+        /** @type {Record<string, string>} */ (MODELED_TOOL_INPUT_KEYS),
+        canon,
+      );
+      if (key === undefined) continue;
+      assert.ok(
+        testCase.event.input !== undefined &&
+          Object.hasOwn(testCase.event.input, key),
+        `fixture '${testCase.name}' (${fixtures.agent}): ${JSON.stringify(nativeTool)} was canonicalized to ${JSON.stringify(canon)}, which advertises input.${key}, but the input carries ${JSON.stringify(Object.keys(testCase.event.input ?? {}))} — rename the input keys or drop the alias`,
+      );
+    }
+  }
+}
+
 /**
  * The control-plane conformance harness.
  *
@@ -123,9 +164,17 @@ export function assertToolAliasesCovered(
  *      MUST carry a real block signal — a non-zero `exit_code` — not just a JSON
  *      body the agent is free to ignore. At least one enforced deny must appear,
  *      so the honesty check is never vacuous.
- *   5. non-vetoable honesty: when the parsed event's `this_call_vetoable` is
- *      false, EVERY render for that case must be `enforced === false` — a
- *      guardrail that cannot veto this call must never render as if it did.
+ *   5. vetoability honesty, BOTH directions. When the parsed event's
+ *      `this_call_vetoable` is false, EVERY render for that case must be
+ *      `enforced === false` — a guardrail that cannot veto this call must never
+ *      render as if it did. And when it is true, a `deny` verdict MUST render
+ *      `enforced === true` with a non-zero `exit_code`: where the host can be
+ *      stopped, a deny has to stop it. Without the forward half the whole
+ *      deny-must-block property rests on each fixture's golden `deepEqual`, so
+ *      an adapter that renders a vetoable deny as exit 0 passes as long as its
+ *      own fixture was written to match — which is the one bug this harness
+ *      exists to make impossible. Item ④'s enforced-deny requirement keeps this
+ *      non-vacuous: a suite that never enforces anything fails there.
  *   6. allow = abstain: by default (no `soleGate` opt-in) every `allow` render
  *      is `enforced === false` AND `exit_code === 0` — an "I have no objection"
  *      verdict never renders as a block, on any adapter. At least one `allow`
@@ -141,7 +190,7 @@ export function assertToolAliasesCovered(
  * assert further on.
  *
  * @param {{ adapter: import("./control-plane.mjs").Adapter, fixtures: any, assert: any }} args
- * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, enforcedDenySeen: boolean, coverageClassesChecked: Set<string> }}
+ * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, enforcedDenySeen: boolean, vetoableDenySeen: boolean, coverageClassesChecked: Set<string> }}
  */
 export function runAdapterConformance({ adapter, fixtures, assert }) {
   assert.equal(
@@ -158,6 +207,7 @@ export function runAdapterConformance({ adapter, fixtures, assert }) {
   const coverageClassesChecked = new Set();
   let mutationSeen = false;
   let enforcedDenySeen = false;
+  let vetoableDenySeen = false;
   let renders = 0;
 
   for (const testCase of fixtures.cases) {
@@ -205,6 +255,26 @@ export function runAdapterConformance({ adapter, fixtures, assert }) {
           `non-vetoable call rendered as enforced: ${testCase.name} / ${scenario}`,
         );
       }
+      // The forward direction, and the one a guardrail's safety rests on: when
+      // the host CAN be stopped and the verdict says deny, the render must
+      // actually stop it. Without this the direction is left to each fixture's
+      // golden `deepEqual`, so an adapter that renders a vetoable deny as exit 0
+      // passes as long as its own fixture was written to match.
+      if (
+        spec.verdict.decision === "deny" &&
+        parsed.this_call_vetoable === true
+      ) {
+        assert.equal(
+          rendered.enforced,
+          true,
+          `vetoable deny did not enforce: ${testCase.name} / ${scenario}`,
+        );
+        assert.ok(
+          rendered.exit_code !== 0,
+          `vetoable deny carries no block signal: ${testCase.name} / ${scenario}`,
+        );
+        vetoableDenySeen = true;
+      }
       if (spec.verdict.decision === "allow") {
         assert.equal(
           rendered.enforced,
@@ -245,6 +315,7 @@ export function runAdapterConformance({ adapter, fixtures, assert }) {
     decisionsSeen,
     mutationSeen,
     enforcedDenySeen,
+    vetoableDenySeen,
     coverageClassesChecked,
   };
 }

package/src/control-plane.mjs

@@ -64,17 +64,40 @@ export const Decision = Object.freeze({
   ASK: "ask",
 });
 
+/**
+ * Every modeled tool, mapped to the input field a guardrail reads for it — the
+ * schema that renaming a native tool to this canonical name ADVERTISES.
+ *
+ * Canonicalizing the name while passing the native input dialect through is a
+ * silent bypass, and the worst kind: a judge written against `Read` reads
+ * `input.file_path`, an un-renamed Gemini payload supplies `absolute_path`, so
+ * the judge sees `undefined` and allows — having been told by `event.tool` that
+ * it was looking at a Read. Leaving the native name would at least fail
+ * visibly. `assertAliasedInputsCanonical` holds aliases to this map, so a new
+ * alias whose input dialect cannot be renamed faithfully fails conformance
+ * instead of shipping as a hole.
+ *
+ * This is also where {@link MODELED_TOOLS} comes from, rather than a second
+ * list beside it. A modeled tool missing its input key would make that guard
+ * skip it — re-opening the bypass one tool-add later — and deriving the names
+ * from the keys makes the two impossible to drift instead of asking a test to
+ * notice.
+ */
+export const MODELED_TOOL_INPUT_KEYS = Object.freeze({
+  Bash: "command",
+  Edit: "file_path",
+  Write: "file_path",
+  Read: "file_path",
+  WebFetch: "url",
+});
+
 /**
  * Tools whose input shape the core models. Every other tool passes through
  * unmodelled — its input object is preserved verbatim and no field is required.
  */
-export const MODELED_TOOLS = Object.freeze([
-  "Bash",
-  "Edit",
-  "Write",
-  "Read",
-  "WebFetch",
-]);
+export const MODELED_TOOLS = Object.freeze(
+  Object.keys(MODELED_TOOL_INPUT_KEYS),
+);
 
 /** @type {Set<string>} membership set for {@link MODELED_TOOLS}, used to constrain alias targets. */
 const MODELED_TOOL_SET = new Set(MODELED_TOOLS);

package/src/fixtures/gemini.json

@@ -291,7 +291,7 @@
         "event": "pre_tool",
         "tool": "Read",
         "input": {
-          "absolute_path": "/w/notes.txt"
+          "file_path": "/w/notes.txt"
         },
         "this_call_vetoable": true,
         "meta": {
@@ -359,7 +359,7 @@
       }
     },
     {
-      "name": "BeforeTool builtin web_fetch canonicalizes to WebFetch",
+      "name": "BeforeTool builtin web_fetch stays native (no url to canonicalize)",
       "call_class": "builtin",
       "native": {
         "hook_event_name": "BeforeTool",
@@ -371,7 +371,7 @@
       "event": {
         "schema_version": 1,
         "event": "pre_tool",
-        "tool": "WebFetch",
+        "tool": "web_fetch",
         "input": {
           "prompt": "summarize https://example.com"
         },

package/src/index.mjs

@@ -32,4 +32,5 @@ export {
   runAdapterConformance,
   assertCoverageWellFormed,
   assertToolAliasesCovered,
+  assertAliasedInputsCanonical,
 } from "./conformance.mjs";

package/types/adapters/gemini.d.mts

@@ -56,12 +56,14 @@ export const HookEvent: Readonly<{
  * CLI removes the ambiguity at parse time: every MCP tool is unconditionally
  * registered — and surfaced in hook payloads — under its fully qualified
  * `mcp_{server}_{tool}` name (gemini-cli docs/tools/mcp-server.md), so a bare
- * builtin name in `tool_name` can only be the builtin. The builtin's native
- * input fields still pass through verbatim (e.g. read_file's `absolute_path`,
- * not Read's `file_path`) — `meta.native_tool` tells a consumer which field
- * dialect to expect. Targets are pinned to {@link MODELED_TOOLS} at import, and
- * every entry must be witnessed by a gemini conformance fixture
- * (`assertToolAliasesCovered`).
+ * builtin name in `tool_name` can only be the builtin. Renaming the tool also
+ * renames its INPUT to the schema that name advertises, via
+ * {@link GEMINI_INPUT_ALIASES} — a consumer told `event.tool` is `Read` reads
+ * `input.file_path` and finds it, rather than reading `undefined` off a
+ * forwarded `absolute_path` and allowing. Targets are pinned to
+ * {@link MODELED_TOOLS} at import, every entry must be witnessed by a gemini
+ * conformance fixture (`assertToolAliasesCovered`), and every aliased case must
+ * carry the canonical input key (`assertAliasedInputsCanonical`).
  * @type {Readonly<Record<string, string>>}
  */
 export const GEMINI_TOOL_ALIASES: Readonly<Record<string, string>>;

package/types/conformance.d.mts

@@ -28,6 +28,26 @@ export function assertCoverageWellFormed(adapter: import("./control-plane.mjs").
  * @param {Record<string, Record<string, string>>} [adapterAliases] agent id → that adapter's scoped alias map (e.g. `{ gemini: GEMINI_TOOL_ALIASES }`)
  */
 export function assertToolAliasesCovered(fixturesList: any[], assert: any, adapterAliases?: Record<string, Record<string, string>>): void;
+/**
+ * Assert that every case whose tool name was ALIASED carries the canonical
+ * tool's input key.
+ *
+ * Renaming a native tool to a {@link MODELED_TOOLS} name tells every consumer
+ * "this is a Read, read it like one" — the README's whole "write your logic
+ * once against the normalized types" promise. An adapter that renames the name
+ * but forwards the native input dialect makes that promise false in the one
+ * direction nobody checks: the judge reads the canonical field, gets
+ * `undefined`, and allows. A native-NAMED tool promises nothing and is left
+ * alone; this fires only where the adapter itself claimed the schema.
+ *
+ * The remedy for a failure is a real choice, not a fixture edit: rename the
+ * input keys too when the mapping is a pure rename, or drop the alias when it
+ * is not (a URL buried in a prose `prompt` cannot be renamed into a `url`
+ * without inventing it, and an invented target is worse than a visible gap).
+ * @param {any[]} fixturesList the golden fixtures for every shipped adapter
+ * @param {any} assert node:assert/strict (injected)
+ */
+export function assertAliasedInputsCanonical(fixturesList: any[], assert: any): void;
 /**
  * The control-plane conformance harness.
  *
@@ -49,9 +69,17 @@ export function assertToolAliasesCovered(fixturesList: any[], assert: any, adapt
  *      MUST carry a real block signal — a non-zero `exit_code` — not just a JSON
  *      body the agent is free to ignore. At least one enforced deny must appear,
  *      so the honesty check is never vacuous.
- *   5. non-vetoable honesty: when the parsed event's `this_call_vetoable` is
- *      false, EVERY render for that case must be `enforced === false` — a
- *      guardrail that cannot veto this call must never render as if it did.
+ *   5. vetoability honesty, BOTH directions. When the parsed event's
+ *      `this_call_vetoable` is false, EVERY render for that case must be
+ *      `enforced === false` — a guardrail that cannot veto this call must never
+ *      render as if it did. And when it is true, a `deny` verdict MUST render
+ *      `enforced === true` with a non-zero `exit_code`: where the host can be
+ *      stopped, a deny has to stop it. Without the forward half the whole
+ *      deny-must-block property rests on each fixture's golden `deepEqual`, so
+ *      an adapter that renders a vetoable deny as exit 0 passes as long as its
+ *      own fixture was written to match — which is the one bug this harness
+ *      exists to make impossible. Item ④'s enforced-deny requirement keeps this
+ *      non-vacuous: a suite that never enforces anything fails there.
  *   6. allow = abstain: by default (no `soleGate` opt-in) every `allow` render
  *      is `enforced === false` AND `exit_code === 0` — an "I have no objection"
  *      verdict never renders as a block, on any adapter. At least one `allow`
@@ -67,7 +95,7 @@ export function assertToolAliasesCovered(fixturesList: any[], assert: any, adapt
  * assert further on.
  *
  * @param {{ adapter: import("./control-plane.mjs").Adapter, fixtures: any, assert: any }} args
- * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, enforcedDenySeen: boolean, coverageClassesChecked: Set<string> }}
+ * @returns {{ cases: number, renders: number, decisionsSeen: Set<string>, mutationSeen: boolean, enforcedDenySeen: boolean, vetoableDenySeen: boolean, coverageClassesChecked: Set<string> }}
  */
 export function runAdapterConformance({ adapter, fixtures, assert }: {
     adapter: import("./control-plane.mjs").Adapter;
@@ -79,5 +107,6 @@ export function runAdapterConformance({ adapter, fixtures, assert }: {
     decisionsSeen: Set<string>;
     mutationSeen: boolean;
     enforcedDenySeen: boolean;
+    vetoableDenySeen: boolean;
     coverageClassesChecked: Set<string>;
 };

package/types/control-plane.d.mts

@@ -272,6 +272,32 @@ export const Decision: Readonly<{
     DENY: "deny";
     ASK: "ask";
 }>;
+/**
+ * Every modeled tool, mapped to the input field a guardrail reads for it — the
+ * schema that renaming a native tool to this canonical name ADVERTISES.
+ *
+ * Canonicalizing the name while passing the native input dialect through is a
+ * silent bypass, and the worst kind: a judge written against `Read` reads
+ * `input.file_path`, an un-renamed Gemini payload supplies `absolute_path`, so
+ * the judge sees `undefined` and allows — having been told by `event.tool` that
+ * it was looking at a Read. Leaving the native name would at least fail
+ * visibly. `assertAliasedInputsCanonical` holds aliases to this map, so a new
+ * alias whose input dialect cannot be renamed faithfully fails conformance
+ * instead of shipping as a hole.
+ *
+ * This is also where {@link MODELED_TOOLS} comes from, rather than a second
+ * list beside it. A modeled tool missing its input key would make that guard
+ * skip it — re-opening the bypass one tool-add later — and deriving the names
+ * from the keys makes the two impossible to drift instead of asking a test to
+ * notice.
+ */
+export const MODELED_TOOL_INPUT_KEYS: Readonly<{
+    Bash: "command";
+    Edit: "file_path";
+    Write: "file_path";
+    Read: "file_path";
+    WebFetch: "url";
+}>;
 /**
  * Tools whose input shape the core models. Every other tool passes through
  * unmodelled — its input object is preserved verbatim and no field is required.

package/types/index.d.mts

@@ -4,4 +4,4 @@ export { ampAdapter } from "./adapters/amp.mjs";
 export { claudeAdapter, HookEvent } from "./adapters/claude.mjs";
 export { geminiAdapter, GEMINI_TOOL_ALIASES } from "./adapters/gemini.mjs";
 export { ADAPTERS, AGENT_IDS, adapterFor, assertRegistryConsistent } from "./registry.mjs";
-export { runAdapterConformance, assertCoverageWellFormed, assertToolAliasesCovered } from "./conformance.mjs";
+export { runAdapterConformance, assertCoverageWellFormed, assertToolAliasesCovered, assertAliasedInputsCanonical } from "./conformance.mjs";