assertledger 1.4.0 → 1.5.0

package/docs/migration-verification-v4.md

@@ -0,0 +1,94 @@
+# Verification v4: designated Bun tests, closure-scoped links and declared isolation
+
+Verification request and evidence manifest v4 add three things a v3 campaign cannot express. V1 to
+v3 schema bytes, parsers, adapters and historical manifests are unchanged and replayable; every
+refusal they apply still applies to them.
+
+## Existing Bun tests, run by name
+
+The `bun-test-designated` adapter verifies an existing `bun:test` test instead of a new candidate
+file. A candidate names the test and, optionally, the first line of the failure it must produce:
+
+```json
+{
+  "id": "gate-routing",
+  "test": { "file": "tools/gates.test.ts", "path": ["gate routing", "keeps docs"] },
+  "expectedFailure": "error: expect(received).toContain(expected)"
+}
+```
+
+`path` is the describe path ending with the test name. The adapter is declared as
+`{ "kind": "bun-test-designated", "executable": "bun", "testTimeoutMs": null }`; `testTimeoutMs`
+sets Bun's per-test timeout (`bun test --timeout`) and must be shorter than
+`timeoutMsPerExecution`. `null` keeps Bun's default of 5 seconds.
+
+Each run executes only that test, selected by an anchored, escaped `--test-name-pattern`. The
+taxonomy is the one every adapter applies:
+
+- red is only an assertion failure attributed to the designated test: a failure thrown inside it by
+  a `bun:test` built-in matcher, in Bun's matcher message form, or by `assertSame`; with an expected
+  line, its first message line must be equal to it;
+- a timeout is never red, including a test that Bun timed out and whose callback threw a matcher
+  failure afterwards; nor is a crash, a hook failure, a collection or compile error, a custom matcher,
+  a matcher usage error, a forged message, or a test that is not found (`NO_TEST_DISCOVERED`);
+- repeated runs that diverge make the candidate `UNSTABLE`.
+
+Controls load every designated file without running a test. They show that each world evaluates the
+file and its imports and still registers the designated test exactly once. The designated test file
+must not be rewritten by any world (`DESIGNATED_TEST_OVERLAID`).
+
+Every campaign first runs the designated preflight: fixed probes, including a synchronous test that
+overruns its timeout and then fails a matcher, must each produce their expected outcome, or the
+campaign stops.
+
+## Repository links judged against the executed tests
+
+A v4 campaign collects the repository's links instead of refusing the first one. A link that leaves
+the repository root (`REPOSITORY_LINK_ESCAPES_ROOT`) or lies on the module closure of a test the
+adapter executes (`REPOSITORY_LINK_IN_TEST_CLOSURE`) refuses the campaign, and the error names its
+path. When a test's imports are computed or absolute, the closure is unbounded and any link refuses
+the campaign (`TEST_CLOSURE_UNBOUNDED`). The others are left out of the snapshot and listed, sorted,
+in `evidenceContext.repository.omittedLinks`, which the decision digest covers.
+
+The closure follows literal `import`, `export … from`, `import()`, `require()` and `mock.module()`
+specifiers, `tsconfig`/`jsconfig` paths, workspace packages, including their installed
+`node_modules` entry, declared dependencies of installed packages, and `bunfig.toml` test preloads.
+It does not cover files a test reads at run time; that limitation is recorded in the manifest.
+
+`doctor` applies the same rule to the tests the framework would discover, and reports the closure
+as non-blocking when it is unbounded. A link through which a runner could discover a test, named as
+a test itself or a directory holding one, is in the closure. `analyze`, `audit` and v1 to v3
+campaigns still refuse any link.
+
+## Snapshot options
+
+`repository.includeDependencies` keeps `node_modules` in the snapshot and its digest as found;
+AssertLedger neither installs nor verifies it. `repository.git` is `excluded`, the snapshot without
+Git metadata, or `synthesized`: the snapshot is committed once into a fresh repository with a fixed
+identity and date and no hooks, template or global configuration, honoring its own `.gitignore`.
+The tree identity and Git version are recorded in `evidenceContext.repository.git`. The source
+repository's own `.git` and history never enter the snapshot.
+
+## Declared isolation
+
+`isolation` is one of:
+
+- `container`: a fresh container per execution from a digest-pinned local image, through the
+  operator's runtime argv, for example the native WSL2 engine
+  `["wsl.exe","-d","Ubuntu","--exec","docker"]`. The designated adapter runs there; `bun-test`
+  with candidate files is still refused in a container (`BUN_TEST_CONTAINER_UNSUPPORTED`).
+- `trusted-local`: unsandboxed, level `UNSANDBOXED`.
+- `windows-native`: unsandboxed on a Windows host for tests that only run natively there, level
+  `WINDOWS_NATIVE_UNSANDBOXED`. It is never implied: the request declares the kind, the operator
+  acknowledges it (`--allow-windows-native-execution`), and it is refused on any other host
+  (`WINDOWS_NATIVE_HOST_REQUIRED`).
+
+The level is in `isolation.level` of every manifest and in every witness summary, and the decision
+digest binds it.
+
+## Compatibility
+
+`verify` and the SDK's `verifyV4` accept v4 requests; `replay` accepts v1 to v4 manifests. The v4
+request, v4 manifest and witness import request schemas are added to the post-conformance schema
+lock; the frozen v1 bundle and its root digest are unchanged. To replay a recorded red/green
+witness, see [witness import](witness-import.md).

package/docs/orchestration-qualification.md

@@ -0,0 +1,167 @@
+# Orchestration qualification v1
+
+## Delivery contract
+
+Deliver a named, version-pinned qualification profile with a sealed obligation inventory, executable
+reference/fault/neutral worlds, independent observations, deterministic receipts and domain-aware
+replay. A test-only receipt cannot satisfy a cache, wrapper, selection or CI obligation.
+
+The public reproduction is authored from scratch. Private consumer sources and resources are not
+distributed. Approval gates, brokers, shared skills and merge authorization are outside this change.
+
+## Work and acceptance
+
+1. Inventory the published CLI/SDK/MCP and consumer version/test forms; preserve concurrent work.
+2. Add versioned contracts/core and qualify native Bun assertions without changing frozen v1-v4.
+3. Execute real pinned Turbo cold/warm/invalidation, selection and failure propagation campaigns.
+4. Expose CLI/SDK/MCP, retain receipts/replay and the obligation matrix; run `pnpm check`.
+5. Freeze the aggregate candidate and obtain independent proof-integrity review before publishing PR.
+
+Contracts/core and Bun collection are authored in separate worktrees. The lead integrates, owns the
+campaign, verifies the complete candidate and publishes. Operational errors never earn detection.
+
+## Qualification boundary
+
+Local configuration analysis, local command execution and hosted CI observation are separate
+obligations. No local fixture establishes Bitbucket execution. Unknown/omitted consumer suites stay
+open. A qualified public reproduction does not establish whole-consumer readiness.
+
+`trusted-local` is explicitly unsandboxed. Digests establish replay integrity and domain binding;
+they do not authenticate the producer or cause test reexecution.
+
+## Existing capabilities and the consumer
+
+The existing `verify` CLI, SDK `verify`/`verifyV2`/`verifyV3`/`verifyV4`, MCP verification tools and versioned
+manifest replay remain available. Node uses its owned reporter and shallow `ERR_ASSERTION`
+attribution. The frozen Bun v3 profile admits only errors issued by `assertledger/bun` helpers.
+The integrated v4 baseline also supports designated Bun tests with native expectations and imported
+witness execution. Its controls load/register a selected test without executing it; this qualification
+profile executes its declared complete suites in the reference and neutral worlds.
+Those paths prove their declared test campaign; they do not supply Turbo, wrapper or hosted-CI
+qualification. The native qualification collector retains a separate event/JUnit protocol and
+passive matcher boundary, and reuses the v4 parser's per-test timeout refusal rule.
+The existing structured-command v1 protocol requires exit zero for `PASS`; it cannot represent a
+successful propagation check whose tested command intentionally exits seven. This extension reuses
+the bounded process runner, canonical hashing, Node reporter and existing versioned contracts.
+
+Source inspection of the incident consumer found Bun **1.4.2**, pnpm **12.9.1** and Turbo **2.11.7**;
+the Vitest compatibility dependency is **5.0.3**. Thirty workspace manifests declare tests, nine
+declare E2E, and ten delivery suites use `node:test` under Bun. Actual forms include callback
+contexts, generated registrations, TypeScript/TSX, helper imports, native assertions, preloads,
+isolation, filters and a development-condition test route. These pins and counts are an inventory,
+not qualification of those private suites. The published reproduction contains independently
+authored generic sources only.
+
+The new Bun profile pins the full runtime revision and qualifies five passive native matchers and
+three Node assertions. Its [capability boundary](../integrations/bun-native/README.md) names every
+qualified form. Unsupported assertions, active operands, custom matchers, absent files, skips,
+hooks, compilation/collection failures and no tests stay operational. They cannot earn detection.
+
+## Actions, observations and decisions
+
+An operator seals the inventory, worlds, actions and exact expected checks before execution. Only
+candidate file overlays on explicitly allowed paths are accepted afterward. The sealed plan digest
+must be anchored outside candidate control; this API does not create an authority or security boundary.
+
+Adapters collect facts. The pure core compares them with the operator checks, requires stable
+reference and neutral runs and the specifically declared target mismatches in every attempt.
+Missing reports, duplicates, contradictions, unobserved suite files and undeclared mismatches are
+not admission. Receipts list `coveredGuaranteeIds`, `openGuaranteeIds`, reasons and check IDs.
+
+| Guarantee | Action and observations | Oracle | Executable discriminant |
+|---|---|---|---|
+| Extracted command tests | Owned Node reporter, actual started files and TAP completion | Positive discovery, assertion attribution, exit consistency | Changed command shape |
+| Native Bun tests | Pinned runtime, signed event pipe, JUnit concordance, actual files | Matcher-issued error belongs to the same test | Changed native assertion value; getter/crash refusals |
+| Selection | Real Turbo summary, selected IDs and dependency closure | Exact required task IDs | Required dependency removed; actual empty filter |
+| Cache | Cold/warm/invalidation; fresh external execution traces; deleted/restored output bytes | Required executions and hashes equal expected values | Forgotten input; incomplete restoration; wrongly cached disabled task |
+| Propagation and wrappers | Actual leaf → Turbo → wrappers → terminal exit, fresh semantic completion report and required-stage traces | Exact expected nonzero exit, matching attestation and mandatory trace | Absorbed exit, omitted stage, empty filter, later success, stale success; ordinary throws/compile/spawn errors stay operational |
+| CI configuration | Bun YAML parser outside the mutated candidate route; anchors resolved; step/stage/parallel ancestry, conditions and triggers retained | Required route/step/command/execution-policy relationships | Pull-request gate disconnected, conditional gate, manual gate |
+| Hosted CI | Independently signed external observation | Pinned observer, exact commit/base/plan/input, executed steps and terminal success | Bad signature, wrong domain, missing/skipped step, failed terminal |
+| Receipt/replay | Strict parsing, recomputed bindings, decisions, digests and external domain | Complete evidence matches its actual validity domain | Tamper, resealed summary forgery, duplicate/missing/rebound report, changed mechanism |
+
+The public campaign executes fifteen fault worlds, reference and neutral twice. Cache directories
+are distinct for each world/attempt and reused only between that attempt's ordered phases. Task
+traces use a fresh nonce and a file outside the cache on every action. A cached log is never an
+execution observation. Configurations, tool binaries, environments and source inputs are sealed;
+the loaded proof mechanism has a separate digest. Root dependency directories are excluded from
+this snapshot profile; repositories needing them require an explicit admitted dependency snapshot.
+
+## CLI, SDK and MCP
+
+```text
+assertledger qualification-plan plan.json
+assertledger qualify request.json --allow-unsafe-execution
+assertledger qualification-replay receipt.json --domain current-domain.json
+assertledger qualification-ci receipt.json --observation signed-pipeline.json
+```
+
+`qualify` exits 0 for `QUALIFIED`, 3 for `OPEN`, 2 for `REJECTED`; unauthorized execution and invalid
+replay exit 4. SDK methods are `sealQualificationPlan`, `qualifyOrchestration`, `replayQualification`
+and `admitQualificationCi`. MCP exposes plan, replay and CI import in read-only mode; execution is
+available only when the server operator enabled unsafe execution, within its allowed repository roots.
+
+Structured command observations can additionally use `observe.report`: the adapter writes canonical
+JSON plus a newline to `ASSERTLEDGER_QUALIFICATION_RESULT_FILE`, with exactly `protocolVersion`,
+`nonce` and `facts`. The nonce is `ASSERTLEDGER_QUALIFICATION_NONCE`. These facts remain in the
+`report` namespace and never override engine-measured process facts. Missing, incomplete, stale or
+noncanonical reports become collection failures. Such reports are adapter-reported observations.
+
+For the `command` adapter, a normal zero exit supplies `commandOutcome: PASS`. A numeric nonzero
+exit is operational unless the fresh canonical report additionally attests
+`facts.commandOutcome: EXPECTED_FAILURE` and `facts.exitCode` equal to the engine-measured exit.
+The collector exposes that admitted semantic outcome separately from `report`; report fields never
+replace the measured exit. The public fixture writes the report only after normal leaf/wrapper
+completion, checks each child report before forwarding a nonzero exit, and emits no completion
+on spawn errors, signals, null statuses, ordinary exceptions or compilation failures. Completion
+reports are trusted-local adapter statements, not authenticated evidence: a malicious unsandboxed
+candidate can forge them. They cannot select operator checks or establish hosted CI admission.
+The Turbo summary collector has no qualified nonzero completion protocol; a numeric Turbo
+failure remains a collection error even when its summary is present. The propagation fixture
+qualifies its terminal command separately through the leaf/wrapper completion chain.
+
+The CI configuration collector retains the complete route/step/stage/parallel ancestry, positions,
+conditions, manual/automatic triggers and parallel fail-fast settings. Commands alone do not
+establish an unconditional gate. This narrow local profile supports only the documented execution
+fields; other step/group fields and pipeline kinds are refused as collection failures rather than
+silently projected away. Preserved conditions are configuration facts, not a claim that a hosted
+runner evaluated or executed them.
+
+## Independent hosted CI admission
+
+`ciTrust` is part of the operator-sealed plan, including a pinned Ed25519 public key, observer,
+repository URI identity (`workspace/repository`) and required step command digests. No local
+campaign generates this trust root or a hosted-pipeline observation. The external observer signs
+canonical JSON `{domain: "ASSERTLEDGER_CI_OBSERVATION_V1", statement: unsignedStatement}`.
+The statement names the pipeline URL/identity, repository, exact commit/base, plan/input/candidate
+digests, actual executed steps and terminal result. The key's owner must observe those facts through
+an independently trusted CI channel. A signature alone cannot establish that its signer is honest.
+
+CI import accepts only an intact existing receipt with that unchanged trust root. Unit signing
+fixtures test the verifier; they are never observations of Bitbucket. No real consumer pipeline
+observation is delivered by this local public campaign, so the consumer's hosted CI obligation stays open.
+
+## Replay and reuse
+
+Replay recalculates schema, integrity, completeness, deterministic decisions and the optional
+external validity domain. `reexecuted` and `producerAuthenticated` are always false. It does not
+rerun tests, authenticate local observations or independently confirm a pipeline. The CI verifier
+checks a supplied observation signature against the trust policy; it does not authenticate the
+receipt maker or infer a hosted observation from local execution.
+
+For reuse, supply the current externally trusted plan/candidate/input/commit/base and loaded
+`mechanismDigest`. An old saved domain file establishes its original domain only. Changed tools,
+inputs, environment, scope, adapters or proof policy invalidate the dependent qualification. Every
+change to the proof mechanism or policy requires fresh independent validation. Receipt replay never
+grants approval or merge authority.
+
+## Compatibility and delivery
+
+The four qualification v1 schemas are additive. Existing verification/manifest v1–v4, conformance
+v1 projections, schema bytes and the old extension lock remain unchanged. The new schema lock is
+separate. [Migration notes](migration-orchestration-qualification-v1.md) describe opt-in adoption.
+
+The complete candidate is verified with `pnpm check`, package smoke, the pinned public campaign,
+negative gate witnesses and a fresh independent aggregate proof review. Local verification, hosted
+GitHub CI, review and PR publication are separate delivery facts. Consumer readiness is conditional
+on the [required obligation inventory](../examples/orchestration/consumer-obligations.json), never
+on the public profile's success alone.

package/docs/reference.md

@@ -22,6 +22,8 @@ assertledger analyze . --json
 assertledger schema verification-request --json
 assertledger verify assertledger.request.json --allow-unsafe-execution --json
 assertledger verify assertledger.container-request.json --container-runtime '["docker"]' --json
+assertledger verify assertledger.windows-request.json --allow-windows-native-execution --json
+assertledger import-witness witness.json --out evidence --allow-unsafe-execution --json
 assertledger replay assertledger.manifest.json --json
 assertledger provider --json
 assertledger export assertledger.export-request.json --json
@@ -69,6 +71,11 @@ results go to stdout. Diagnostics go to stderr. `assertledger mcp` reserves stdo
 trusted-local campaign and sets the request's local acknowledgement before validation. The flag does
 not create a sandbox.
 
+`--allow-windows-native-execution` authorizes a v4 request with `windows-native` isolation on a Windows
+host, recorded as `WINDOWS_NATIVE_UNSANDBOXED`; it cannot be combined with the other backend flags.
+`import-witness` replays a recorded red/green witness under exactly one operator-chosen backend; see
+[witness import](witness-import.md) and the [v4 migration guide](migration-verification-v4.md).
+
 A v2 request with `container` isolation runs without that flag: each execution uses a fresh
 container from a digest-pinned local image through the operator's `--container-runtime` JSON argv,
 which defaults to `["docker"]`. `check` selects the same backend with `--container-image`. Combining

package/docs/witness-import.md

@@ -0,0 +1,67 @@
+# Witness import
+
+`assertledger import-witness` replays a recorded red/green witness as a v4 campaign and verifies it.
+The witness states what was observed; AssertLedger observes it again under its own taxonomy.
+
+## Request
+
+A `witness-import-request.v1.json` document names:
+
+- `repository`: the root, exclusions, `includeDependencies` and the `git` mode, as in a
+  [v4 request](migration-verification-v4.md);
+- `adapter`: `bun-test-designated`, with its executable and per-test timeout;
+- `test` and `expectedFailure`: the existing designated test and the first line of its failure;
+- `targets`: each mutated file with its `beforeDigest`, the SHA-256 of the bytes it replaces, and
+  its mutated `content`;
+- `neutral`: an operator-supplied neutral control and its reason, or `null`;
+- `requiredAttempts` and `timeoutMsPerExecution`.
+
+Each target must still hold its base bytes (`WITNESS_TARGET_BASE_MISMATCH`) and its content must
+differ from them (`WITNESS_TARGET_UNCHANGED`).
+
+## Campaign
+
+The repository is the reference world, the targets form the one target world, and the neutral
+control is the operator's, or an identity control whose limit the manifest states. The policy is
+fixed: every attempt in the target world must be an assertion failure attributed to the designated
+test with the expected line, and every reference and neutral attempt must pass.
+
+## Backend
+
+The witness never selects its backend. The operator passes exactly one of:
+
+```sh
+assertledger import-witness witness.json --out evidence --container-image oven/bun@sha256:DIGEST \
+  --container-runtime '["wsl.exe","-d","Ubuntu","--exec","docker"]'
+assertledger import-witness witness.json --out evidence --allow-unsafe-execution
+assertledger import-witness witness.json --out evidence --allow-windows-native-execution
+```
+
+`--env NAME` replaces the default host environment allowlist of a local backend. Without a backend
+the command refuses with exit code 4 and writes nothing.
+
+## Output
+
+`--out` must be a new directory outside the repository. It receives `executed-request.json`,
+`summary.md` and, written last, `manifest.json`. The summary states the verdict, every observation,
+the isolation level and the limitations; `--json` prints the manifest instead. The exit code follows
+the verdict. Accept the witness only on `VERIFIED` plus `assertledger replay <manifest> --json`
+with `valid: true`.
+
+## A repository with installed dependencies
+
+A Bun workspace installed with the isolated linker holds links in `node_modules`. Replay such a
+witness from an archive of the exact revision with a hoisted install, and keep the dependencies in
+the snapshot:
+
+```sh
+git -C <repository> archive --format=tar --output=archive.tar <revision>
+tar -xf archive.tar -C witness-repository
+cd witness-repository
+bun install --frozen-lockfile --linker hoisted --ignore-scripts
+```
+
+Set `includeDependencies: true`. Workspace packages stay linked in `node_modules`; a link outside
+the designated test's closure is left out and recorded, and one inside it refuses the import. A
+test that asks Git for its tracked files needs `git: "synthesized"`. When a snapshot copy is slow
+to read the first time, for example under on-access scanning, declare a per-test timeout that fits.

package/examples/orchestration/README.md

@@ -0,0 +1,68 @@
+# Public orchestration qualification
+
+This independently authored workspace reproduces the evidence gap behind incident #911:
+two extractible `node:test` assertions check command shapes and keep passing while actual
+cache, failure propagation and pipeline routing faults are present. It contains no private
+consumer source, URLs, credentials or hosted infrastructure.
+
+The named profile `public-turbo-orchestration-2.11.7-bun-1.4.2` requires Turbo 2.11.7,
+Bun 1.4.2, pnpm 12.9.1 and the exact executable identities recorded in its manifest.
+Run the builder under Node with `tsx`, providing absolute paths to those executables:
+
+```text
+node node_modules/tsx/dist/cli.mjs scripts/qualify-orchestration-profile.ts --turbo=/absolute/turbo --bun=/absolute/bun --pnpm=/absolute/pnpm --output=/absolute/evidence --commit=reviewed-commit --base=reviewed-base
+```
+
+On Windows `--pnpm` names the installed native `pnpm.exe`, rather than a PowerShell
+shim, Corepack entry point or shell string. The selected tool directories precede the
+operator's PATH. PATH and essential Windows environment values are sealed in the plan.
+No tool installation is performed by the campaign builder.
+
+Provision qualification tools in a separate disposable directory, preserving its generated
+lockfile, rather than adding dependencies to AssertLedger or a consumer repository:
+
+```text
+pnpm --dir /absolute/qualification-tools add --ignore-scripts --save-exact turbo@2.11.7 pnpm@12.9.1
+```
+
+Use the platform-specific native Turbo and pnpm executables inside that directory's
+`node_modules/.pnpm` distributions. Install Bun 1.4.2 separately using the documented
+platform installation method and pass its real executable. The builder probes versions
+and hashes executable bytes. It deliberately refuses a different version. Provisioning
+needs registry access; fixture setup runs offline with lifecycle scripts disabled.
+Workspace links and normalized lockfiles are prepared before cold cache actions.
+
+The operator's manifest declares seven obligations before execution. Reference and
+documentation-only neutral worlds must pass. Fifteen declared fault worlds must mismatch
+their named discriminants in two independent attempts. The leaf, Turbo and both wrapper
+layers must return 7, as observed on this pinned profile. The expected nonzero reference result is not classified as a regression
+assertion or a successful target kill.
+Each layer validates the fresh nonce-bound semantic completion of its failed child, then emits
+its own report with the observed exit. Ordinary errors, compilation failures and missing child
+executables cannot supply that report. The trusted-local fixture reports are not authenticated.
+
+Turbo build actions select the application and its leaf dependency. Each attempt has an
+independent local cache, reused only across cold, warm and input-invalidation actions.
+Warm actions delete generated outputs. Observations collect the real Turbo JSON summary,
+selected task IDs, input task hashes, cache states, hashes of both required outputs, and
+fresh action-specific nonce traces written by executing tasks. Cached console output does
+not establish execution. The `check` task has caching disabled and must execute twice.
+
+The cache worlds omit the verdict input, omit a restored output, or wrongly cache the
+uncached task. Propagation worlds absorb an exit code, omit a mandatory stage, select no
+work, overwrite failure with a later successful command, or reuse a seeded success.
+The selected-task world removes the required dependency from the task graph. The CI worlds
+disconnect the pull-request gate, add an unfulfilled changeset condition or make the gate manual
+while preserving its command. The parser retains execution policy and full stage/parallel/step
+ancestry, and refuses unsupported execution fields. It is an engine-owned asset outside the route
+it observes. Configuration observation does not establish hosted execution.
+
+Outputs are `manifest.json`, `receipt.json`, `replay.json`, `matrix.json` and
+`incident-reproduction.json`. The builder exits nonzero if the profile is not QUALIFIED,
+replay fails, or command-shape extraction detects an orchestration fault unexpectedly.
+
+This public profile qualifies only its named local obligations. It never declares the
+private consumer ready. Private suites, preloads, wrappers, browser/E2E/coverage behavior
+and hosted Bitbucket execution require their own profile and evidence. Static CI routing
+and local commands cannot discharge a hosted-pipeline obligation. Replay checks integrity
+and deterministic semantics; it does not run commands again or authenticate their producer.

package/examples/orchestration/consumer-obligations.json

@@ -0,0 +1,101 @@
+{
+  "profileId": "modelo-suite-911-consumer-v1",
+  "consumerReady": false,
+  "qualificationStatus": "OPEN",
+  "inventoryAuthority": "operator inventory from consumer source inspection; independent from candidate selection",
+  "sourcePins": {
+    "bun": "1.4.2",
+    "pnpm": "12.9.1",
+    "turbo": "2.11.7",
+    "vitestCompatibility": "5.0.3"
+  },
+  "suiteGroups": [
+    {
+      "id": "workspace-tests",
+      "declaringManifests": 30,
+      "extraction": "UNAVAILABLE",
+      "status": "OPEN"
+    },
+    {
+      "id": "workspace-e2e",
+      "declaringManifests": 9,
+      "extraction": "UNAVAILABLE",
+      "status": "OPEN"
+    },
+    { "id": "bun-node-delivery", "suiteFiles": 10, "extraction": "UNAVAILABLE", "status": "OPEN" },
+    {
+      "id": "repository-shell",
+      "suiteFiles": null,
+      "extraction": "UNAVAILABLE",
+      "status": "OPEN",
+      "reason": "exact executed shell suite inventory requires consumer campaign"
+    }
+  ],
+  "requiredObligations": [
+    {
+      "id": "complete-consumer-test-suites",
+      "kind": "tests",
+      "status": "OPEN",
+      "required": true,
+      "reason": "private complete suites have not been executed in this public campaign"
+    },
+    {
+      "id": "consumer-preloads-and-test-forms",
+      "kind": "tests",
+      "status": "OPEN",
+      "required": true,
+      "reason": "Vitest compatibility, mocks, DOM, isolation, development conditions and filter forms need exact-consumer witnesses"
+    },
+    {
+      "id": "consumer-task-selection",
+      "kind": "selection",
+      "status": "OPEN",
+      "required": true,
+      "reason": "public dependency-selection witnesses qualify the public fixture, not the consumer graph"
+    },
+    {
+      "id": "consumer-turbo-cache",
+      "kind": "cache",
+      "status": "OPEN",
+      "required": true,
+      "reason": "actual consumer configuration, persisted cache and dependencies need cold/warm/invalidation evidence"
+    },
+    {
+      "id": "consumer-error-propagation",
+      "kind": "propagation",
+      "status": "OPEN",
+      "required": true,
+      "reason": "actual consumer command route requires its own leaf-to-terminal witness"
+    },
+    {
+      "id": "consumer-wrappers",
+      "kind": "wrapper",
+      "status": "OPEN",
+      "required": true,
+      "reason": "shell/container/preflight wrapper closure requires actual route evidence"
+    },
+    {
+      "id": "consumer-ci-configuration",
+      "kind": "ci-config",
+      "status": "OPEN",
+      "required": true,
+      "reason": "public YAML qualification is separate from the consumer configuration"
+    },
+    {
+      "id": "consumer-ci-local-commands",
+      "kind": "ci-local",
+      "status": "OPEN",
+      "required": true,
+      "reason": "actual local CI commands and coverage gate must execute with controlled inputs"
+    },
+    {
+      "id": "consumer-bitbucket-pipeline",
+      "kind": "ci-live",
+      "status": "OPEN",
+      "required": true,
+      "reason": "no independent exact-commit/base executed-step and terminal pipeline observation supplied"
+    }
+  ],
+  "reusableQualification": "public-turbo-orchestration-2.11.7-bun-1.4.2 only under its exact receipt validity conditions",
+  "mergeAuthority": false
+}

package/examples/orchestration/workspace/bitbucket-pipelines.yml

@@ -0,0 +1,10 @@
+definitions:
+  steps:
+    - step: &gate
+        name: Public qualification gate
+        script:
+          - bun wrapper.mjs
+pipelines:
+  pull-requests:
+    '**':
+      - step: *gate

package/examples/orchestration/workspace/command-shape.test.mjs

@@ -0,0 +1,25 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { failCommandArgs, wrapperCommandArgs } from "./commands.mjs";
+
+test("structured Turbo failure selection", () => {
+  assert.deepEqual(failCommandArgs({ cacheDirectory: "mock-cache" }), [
+    "run",
+    "fail",
+    "--filter=@public/app...",
+    "--cache=local:rw",
+    "--cache-dir=mock-cache",
+    "--summarize",
+  ]);
+  assert.deepEqual(failCommandArgs({ emptySelection: true, cacheDirectory: "mock-cache" }), [
+    "run",
+    "fail",
+    "--filter=!@public/*",
+    "--cache=local:rw",
+    "--cache-dir=mock-cache",
+    "--summarize",
+  ]);
+});
+test("structured wrapper command", () => {
+  assert.deepEqual(wrapperCommandArgs("wrapper.mjs"), ["wrapper.mjs", "orchestrator"]);
+});

package/examples/orchestration/workspace/commands.mjs

@@ -0,0 +1,14 @@
+export function failCommandArgs({ emptySelection = false, cacheDirectory }) {
+  return [
+    "run",
+    "fail",
+    emptySelection ? "--filter=!@public/*" : "--filter=@public/app...",
+    "--cache=local:rw",
+    `--cache-dir=${cacheDirectory}`,
+    "--summarize",
+  ];
+}
+
+export function wrapperCommandArgs(wrapperPath) {
+  return [wrapperPath, "orchestrator"];
+}

package/examples/orchestration/workspace/completion.mjs

@@ -0,0 +1,39 @@
+import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+export function complete(exitCode) {
+  writeFileSync(
+    process.env.ASSERTLEDGER_QUALIFICATION_RESULT_FILE,
+    `${JSON.stringify({
+      facts: { commandOutcome: exitCode === 0 ? "PASS" : "EXPECTED_FAILURE", exitCode },
+      nonce: process.env.ASSERTLEDGER_QUALIFICATION_NONCE,
+      protocolVersion: "1.0.0",
+    })}\n`,
+  );
+}
+
+export function execute(executable, args, suffix) {
+  const report = `${process.env.ASSERTLEDGER_QUALIFICATION_RESULT_FILE}.${suffix}`;
+  rmSync(report, { force: true });
+  const result = spawnSync(executable, args, {
+    stdio: "inherit",
+    env: { ...process.env, ASSERTLEDGER_QUALIFICATION_RESULT_FILE: report },
+  });
+  if (result.error || result.signal || result.status === null) {
+    throw new Error("PUBLIC_CHILD_OPERATIONAL_FAILURE", { cause: result.error });
+  }
+  if (result.status !== 0) {
+    // A normal failed leaf must attest completion through each wrapper. Numeric
+    // exits, compiler diagnostics and thrown errors are not semantic attestations.
+    const document = JSON.parse(readFileSync(report, "utf8"));
+    if (
+      document.protocolVersion !== "1.0.0" ||
+      document.nonce !== process.env.ASSERTLEDGER_QUALIFICATION_NONCE ||
+      document.facts.commandOutcome !== "EXPECTED_FAILURE" ||
+      document.facts.exitCode !== result.status
+    ) {
+      throw new Error("PUBLIC_CHILD_COMPLETION_MISSING");
+    }
+  }
+  return result.status;
+}

package/examples/orchestration/workspace/faults.json

@@ -0,0 +1 @@
+{}

package/examples/orchestration/workspace/native.test.ts

@@ -0,0 +1,4 @@
+import { test, expect } from "bun:test";
+test("native Bun assertion", () => {
+  expect(2 + 2).toBe(4);
+});

package/examples/orchestration/workspace/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "public-orchestration-fixture",
+  "private": true,
+  "version": "1.0.0",
+  "packageManager": "pnpm@12.9.1"
+}

package/examples/orchestration/workspace/packages/app/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@public/app",
+  "version": "1.0.0",
+  "dependencies": {
+    "@public/leaf": "workspace:*"
+  },
+  "scripts": {
+    "build": "bun ../../task.mjs build",
+    "check": "bun ../../task.mjs check",
+    "fail": "bun ../../task.mjs fail"
+  }
+}

package/examples/orchestration/workspace/packages/app/verdict.txt

@@ -0,0 +1 @@
+initial