avorelo 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (258) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +56 -0
  3. package/bin/avorelo +9 -0
  4. package/package.json +135 -0
  5. package/scripts/README.md +40 -0
  6. package/scripts/cco-dashboard.js +252 -0
  7. package/scripts/cco-status.js +430 -0
  8. package/scripts/lib/activation/account-state.js +37 -0
  9. package/scripts/lib/activation/activation-runner.js +546 -0
  10. package/scripts/lib/activation/activation-self-healing.js +480 -0
  11. package/scripts/lib/activation/activation-state.js +83 -0
  12. package/scripts/lib/activation/activation-summary.js +191 -0
  13. package/scripts/lib/activation/adapters/claude-code.js +77 -0
  14. package/scripts/lib/activation/adapters/codex-cli.js +52 -0
  15. package/scripts/lib/activation/adapters/cursor.js +37 -0
  16. package/scripts/lib/activation/adapters/github-agent.js +39 -0
  17. package/scripts/lib/activation/adapters/terminal.js +42 -0
  18. package/scripts/lib/activation/adapters/vscode.js +39 -0
  19. package/scripts/lib/activation/adapters/windsurf.js +37 -0
  20. package/scripts/lib/activation/ai-surface-detector.js +151 -0
  21. package/scripts/lib/activation/connect-account.js +145 -0
  22. package/scripts/lib/activation/detect-environment.js +75 -0
  23. package/scripts/lib/activation/detect-hosts.js +62 -0
  24. package/scripts/lib/activation/format-activation-output.js +109 -0
  25. package/scripts/lib/activation/next-action.js +43 -0
  26. package/scripts/lib/activation/repair-engine.js +219 -0
  27. package/scripts/lib/activation-distribution-readiness.js +507 -0
  28. package/scripts/lib/adapter-conformance.js +176 -0
  29. package/scripts/lib/adapter-readiness.js +417 -0
  30. package/scripts/lib/adapter-safety-boundaries.js +335 -0
  31. package/scripts/lib/adapter-technical-readiness-gate.js +205 -0
  32. package/scripts/lib/agent-access-governance.js +455 -0
  33. package/scripts/lib/agent-enforcement.js +765 -0
  34. package/scripts/lib/agent-policy-profile.js +210 -0
  35. package/scripts/lib/agent-security/action-evaluator.js +507 -0
  36. package/scripts/lib/agent-security/adapter-registry.js +98 -0
  37. package/scripts/lib/agent-security/auto-policy.js +139 -0
  38. package/scripts/lib/agent-security/bounded-scan.js +93 -0
  39. package/scripts/lib/agent-security/enforcement-adapter.js +174 -0
  40. package/scripts/lib/agent-security/enforcement-engine.js +1129 -0
  41. package/scripts/lib/agent-security/file-write-adapter.js +183 -0
  42. package/scripts/lib/agent-security/file-write-rules.js +178 -0
  43. package/scripts/lib/agent-security/index.js +3342 -0
  44. package/scripts/lib/agent-security/instruction-risk.js +181 -0
  45. package/scripts/lib/agent-security/mcp-action-adapter.js +185 -0
  46. package/scripts/lib/agent-security/mcp-action-rules.js +184 -0
  47. package/scripts/lib/agent-security/package-action-adapter.js +175 -0
  48. package/scripts/lib/agent-security/package-action-rules.js +233 -0
  49. package/scripts/lib/agent-security/performance.js +148 -0
  50. package/scripts/lib/agent-security/permission-minimizer.js +403 -0
  51. package/scripts/lib/agent-security/scan-cache.js +74 -0
  52. package/scripts/lib/agent-security/source-trust.js +146 -0
  53. package/scripts/lib/ai-install-prompt.js +288 -0
  54. package/scripts/lib/ai-workspace-hygiene.js +1499 -0
  55. package/scripts/lib/alpha-activation.js +520 -0
  56. package/scripts/lib/alpha-feedback.js +263 -0
  57. package/scripts/lib/alpha-readiness-gate.js +332 -0
  58. package/scripts/lib/anti-gaming.js +169 -0
  59. package/scripts/lib/artifact-health.js +431 -0
  60. package/scripts/lib/attribution.js +180 -0
  61. package/scripts/lib/audit.js +289 -0
  62. package/scripts/lib/avorelo-skill-registry.js +810 -0
  63. package/scripts/lib/batch-jobs.js +71 -0
  64. package/scripts/lib/brain-pack.js +578 -0
  65. package/scripts/lib/brand-boundary.js +424 -0
  66. package/scripts/lib/brand.js +74 -0
  67. package/scripts/lib/browser-capability.js +1048 -0
  68. package/scripts/lib/browser-proof-preflight.js +321 -0
  69. package/scripts/lib/cache-readiness.js +187 -0
  70. package/scripts/lib/canonical-reentry.js +162 -0
  71. package/scripts/lib/capability-packs.js +314 -0
  72. package/scripts/lib/capability-recommender.js +512 -0
  73. package/scripts/lib/capability-registry.js +1059 -0
  74. package/scripts/lib/carry-forward-surfacing.js +194 -0
  75. package/scripts/lib/ccusage-adapter.js +188 -0
  76. package/scripts/lib/company-loop.js +1149 -0
  77. package/scripts/lib/config.js +637 -0
  78. package/scripts/lib/context-acquisition-plan.js +287 -0
  79. package/scripts/lib/context-budget-guard.js +170 -0
  80. package/scripts/lib/context-budget-scanner.js +257 -0
  81. package/scripts/lib/context-optimizer.js +715 -0
  82. package/scripts/lib/context-reduction-plan.js +178 -0
  83. package/scripts/lib/context-safety.js +88 -0
  84. package/scripts/lib/context-savings-engine.js +158 -0
  85. package/scripts/lib/cost-evidence.js +254 -0
  86. package/scripts/lib/cross-host-install-plan.js +308 -0
  87. package/scripts/lib/cross-host-install-readiness.js +237 -0
  88. package/scripts/lib/cross-host-value-flow.js +268 -0
  89. package/scripts/lib/dashboard.js +900 -0
  90. package/scripts/lib/design-partner-feedback.js +346 -0
  91. package/scripts/lib/entitlements.js +100 -0
  92. package/scripts/lib/execution-packet.js +559 -0
  93. package/scripts/lib/experimentation-events.js +547 -0
  94. package/scripts/lib/external-capability-compliance.js +107 -0
  95. package/scripts/lib/external-user-simulation.js +166 -0
  96. package/scripts/lib/failure-recovery-readiness.js +81 -0
  97. package/scripts/lib/failure-recovery.js +419 -0
  98. package/scripts/lib/feedback-intelligence.js +537 -0
  99. package/scripts/lib/feedback-signals.js +205 -0
  100. package/scripts/lib/file-integrity.js +68 -0
  101. package/scripts/lib/fsx.js +127 -0
  102. package/scripts/lib/full-readiness-gate.js +451 -0
  103. package/scripts/lib/guidance-builder.js +174 -0
  104. package/scripts/lib/hook-apply.js +1019 -0
  105. package/scripts/lib/hook-baseline.js +310 -0
  106. package/scripts/lib/hook-config-preview.js +275 -0
  107. package/scripts/lib/hook-contracts.js +290 -0
  108. package/scripts/lib/hook-safety-boundary-readiness.js +80 -0
  109. package/scripts/lib/host-capability-matrix.js +351 -0
  110. package/scripts/lib/host-support-context.js +254 -0
  111. package/scripts/lib/http-hook-action.js +538 -0
  112. package/scripts/lib/install-ai-readiness.js +84 -0
  113. package/scripts/lib/install-intake-risk.js +1037 -0
  114. package/scripts/lib/install-journey-intelligence.js +329 -0
  115. package/scripts/lib/intervention-guidance.js +57 -0
  116. package/scripts/lib/known-limitations.js +115 -0
  117. package/scripts/lib/l8-path-truth.js +146 -0
  118. package/scripts/lib/launch-hardening-gate.js +436 -0
  119. package/scripts/lib/launch-readiness.js +628 -0
  120. package/scripts/lib/learning-memory.js +686 -0
  121. package/scripts/lib/lifecycle-hooks.js +802 -0
  122. package/scripts/lib/local-package-smoke.js +423 -0
  123. package/scripts/lib/local-pricing.js +299 -0
  124. package/scripts/lib/mcp-enforcement.js +311 -0
  125. package/scripts/lib/mcp-least-privilege-policy.js +303 -0
  126. package/scripts/lib/mcp-tool-inventory.js +388 -0
  127. package/scripts/lib/mcp-tool-risk.js +0 -0
  128. package/scripts/lib/memory.js +335 -0
  129. package/scripts/lib/metrics.js +699 -0
  130. package/scripts/lib/micro-proof.js +133 -0
  131. package/scripts/lib/next-run-context.js +436 -0
  132. package/scripts/lib/operating-value.js +1648 -0
  133. package/scripts/lib/optimization-v3.js +122 -0
  134. package/scripts/lib/orchestration/adapters/_shared.js +49 -0
  135. package/scripts/lib/orchestration/adapters/aider.js +18 -0
  136. package/scripts/lib/orchestration/adapters/claude-code.js +35 -0
  137. package/scripts/lib/orchestration/adapters/codex.js +35 -0
  138. package/scripts/lib/orchestration/adapters/gemini-cli.js +18 -0
  139. package/scripts/lib/orchestration/adapters/git.js +25 -0
  140. package/scripts/lib/orchestration/adapters/index.js +31 -0
  141. package/scripts/lib/orchestration/adapters/lm-studio.js +18 -0
  142. package/scripts/lib/orchestration/adapters/ollama.js +18 -0
  143. package/scripts/lib/orchestration/adapters/opencode.js +18 -0
  144. package/scripts/lib/orchestration/adapters/openrouter.js +18 -0
  145. package/scripts/lib/orchestration/adapters/test-runner.js +25 -0
  146. package/scripts/lib/orchestration/cli.js +438 -0
  147. package/scripts/lib/orchestration/execution-manager.js +279 -0
  148. package/scripts/lib/orchestration/handoff.js +314 -0
  149. package/scripts/lib/orchestration/index.js +456 -0
  150. package/scripts/lib/orchestration/inventory.js +47 -0
  151. package/scripts/lib/orchestration/model-discovery.js +498 -0
  152. package/scripts/lib/orchestration/model-profiler.js +170 -0
  153. package/scripts/lib/orchestration/model-profiles.js +252 -0
  154. package/scripts/lib/orchestration/model-refresh-policy.js +72 -0
  155. package/scripts/lib/orchestration/proof-writer.js +349 -0
  156. package/scripts/lib/orchestration/provider-discovery/aider.js +49 -0
  157. package/scripts/lib/orchestration/provider-discovery/claude-code.js +56 -0
  158. package/scripts/lib/orchestration/provider-discovery/codex.js +49 -0
  159. package/scripts/lib/orchestration/provider-discovery/common.js +186 -0
  160. package/scripts/lib/orchestration/provider-discovery/gemini.js +106 -0
  161. package/scripts/lib/orchestration/provider-discovery/lm-studio.js +118 -0
  162. package/scripts/lib/orchestration/provider-discovery/models-dev.js +12 -0
  163. package/scripts/lib/orchestration/provider-discovery/ollama.js +100 -0
  164. package/scripts/lib/orchestration/provider-discovery/opencode.js +47 -0
  165. package/scripts/lib/orchestration/provider-discovery/openrouter.js +44 -0
  166. package/scripts/lib/orchestration/risk-classifier.js +130 -0
  167. package/scripts/lib/orchestration/routing-policy.js +486 -0
  168. package/scripts/lib/orchestration/settings.js +112 -0
  169. package/scripts/lib/orchestration/state.js +165 -0
  170. package/scripts/lib/orchestration/verification-manager.js +138 -0
  171. package/scripts/lib/output-profiles.js +146 -0
  172. package/scripts/lib/package-content-audit.js +368 -0
  173. package/scripts/lib/package-runtime.js +278 -0
  174. package/scripts/lib/plan-surface.js +53 -0
  175. package/scripts/lib/plans.js +2318 -0
  176. package/scripts/lib/policy-provider.js +27 -0
  177. package/scripts/lib/prelaunch-activation-readiness.js +409 -0
  178. package/scripts/lib/prelaunch-evidence-store.js +816 -0
  179. package/scripts/lib/prelaunch-intelligence.js +869 -0
  180. package/scripts/lib/pricing-experiment.js +118 -0
  181. package/scripts/lib/pro-moment-events.js +77 -0
  182. package/scripts/lib/pro-moment-state.js +227 -0
  183. package/scripts/lib/pro-moments.js +1216 -0
  184. package/scripts/lib/product-learning-events.js +629 -0
  185. package/scripts/lib/project-profile.js +555 -0
  186. package/scripts/lib/prompt-compiler.js +280 -0
  187. package/scripts/lib/prompt-lint.js +32 -0
  188. package/scripts/lib/prompt-suggestions.js +52 -0
  189. package/scripts/lib/proof-canonical.js +398 -0
  190. package/scripts/lib/proof-drilldown.js +383 -0
  191. package/scripts/lib/proof-events.js +342 -0
  192. package/scripts/lib/proof-history.js +243 -0
  193. package/scripts/lib/proof-metrics.js +296 -0
  194. package/scripts/lib/proof-outcome-evidence.js +134 -0
  195. package/scripts/lib/proof-receipt.js +335 -0
  196. package/scripts/lib/proof-record.js +461 -0
  197. package/scripts/lib/public-activation-distribution-gate.js +258 -0
  198. package/scripts/lib/public-cli.js +3891 -0
  199. package/scripts/lib/public-distribution-truth.js +211 -0
  200. package/scripts/lib/public-install-claim-checker.js +294 -0
  201. package/scripts/lib/publish-provenance-readiness.js +283 -0
  202. package/scripts/lib/readiness-delta.js +218 -0
  203. package/scripts/lib/readiness-evidence-closure.js +196 -0
  204. package/scripts/lib/reentry-memory-capture.js +241 -0
  205. package/scripts/lib/reentry-memory-retrieval.js +302 -0
  206. package/scripts/lib/reentry-memory-status.js +146 -0
  207. package/scripts/lib/reentry-memory-store.js +178 -0
  208. package/scripts/lib/reentry-state.js +66 -0
  209. package/scripts/lib/release-candidate-bundle.js +166 -0
  210. package/scripts/lib/remediation.js +81 -0
  211. package/scripts/lib/repo-map.js +391 -0
  212. package/scripts/lib/run-improvements-lifecycle.js +330 -0
  213. package/scripts/lib/run-improvements.js +789 -0
  214. package/scripts/lib/runtime-decision-policy.js +387 -0
  215. package/scripts/lib/safe-path-engine.js +705 -0
  216. package/scripts/lib/safe-run-controller.js +887 -0
  217. package/scripts/lib/score.js +262 -0
  218. package/scripts/lib/seamless-enforcement.js +329 -0
  219. package/scripts/lib/seamless-outcome.js +689 -0
  220. package/scripts/lib/seamless-reality-gate.js +5043 -0
  221. package/scripts/lib/security-risk-classifier.js +511 -0
  222. package/scripts/lib/security-scan.js +384 -0
  223. package/scripts/lib/session-context-optimizer.js +1211 -0
  224. package/scripts/lib/session-timing.js +315 -0
  225. package/scripts/lib/skill-hygiene.js +805 -0
  226. package/scripts/lib/skill-packs.js +161 -0
  227. package/scripts/lib/skills-operating-layer.js +580 -0
  228. package/scripts/lib/smart-work-routing.js +768 -0
  229. package/scripts/lib/source-catalog.js +700 -0
  230. package/scripts/lib/status-value-summary.js +32 -0
  231. package/scripts/lib/support-bundle.js +578 -0
  232. package/scripts/lib/task-continuation.js +440 -0
  233. package/scripts/lib/test-helpers.js +15 -0
  234. package/scripts/lib/tier.js +38 -0
  235. package/scripts/lib/token-context-quality-gate.js +370 -0
  236. package/scripts/lib/token-cost-capture.js +187 -0
  237. package/scripts/lib/token-cost-intelligence.js +358 -0
  238. package/scripts/lib/token-efficiency-evidence.js +213 -0
  239. package/scripts/lib/token-evidence.js +699 -0
  240. package/scripts/lib/tokenish.js +17 -0
  241. package/scripts/lib/tool-output-sandbox.js +304 -0
  242. package/scripts/lib/trust-audit.js +136 -0
  243. package/scripts/lib/unified-events.js +396 -0
  244. package/scripts/lib/upgrade-interruption-recovery.js +407 -0
  245. package/scripts/lib/usage-ledger.js +201 -0
  246. package/scripts/lib/value-ledger.js +130 -0
  247. package/scripts/lib/value-proof-calibration.js +531 -0
  248. package/scripts/lib/visual-qa.js +231 -0
  249. package/scripts/lib/voice-alpha.js +29 -0
  250. package/scripts/lib/work-aware-orchestration.js +976 -0
  251. package/scripts/lib/work-control-receipts.js +577 -0
  252. package/scripts/lib/work-ledger.js +1123 -0
  253. package/scripts/lib/work-panel-preview.js +352 -0
  254. package/scripts/lib/workflow-discipline.js +280 -0
  255. package/scripts/lib/workflow-signals.js +419 -0
  256. package/scripts/lib/workspace-map.js +281 -0
  257. package/scripts/lib/workspace-registry.js +1367 -0
  258. package/scripts/lib/workspace-resolver.js +480 -0
@@ -0,0 +1,398 @@
1
+ "use strict";
2
+
3
+ const fs = require("fs");
4
+ const path = require("path");
5
+
6
+ const CANONICAL_PROOF_VERSION = 1;
7
+ const CANONICAL_PROOF_FAMILIES = [
8
+ "task_contract",
9
+ "control_decision",
10
+ "material_step",
11
+ "safe_stop",
12
+ "completion_truth",
13
+ ];
14
+
15
+ const BOUNDED_STATE_SUMMARY_REL = path.join(
16
+ "artifacts",
17
+ "ws-aif",
18
+ "l8",
19
+ "state-summary",
20
+ "bounded-state-summary.v1.json"
21
+ );
22
+ const REENTRY_CARRY_FORWARD_REL = path.join(
23
+ "artifacts",
24
+ "ws-aif",
25
+ "l8",
26
+ "state-summary",
27
+ "reentry-carry-forward.v1.json"
28
+ );
29
+ const CONTROLLED_EXPOSURE_READINESS_REL = path.join(
30
+ "artifacts",
31
+ "ws-aif",
32
+ "l8",
33
+ "controlled-exposure",
34
+ "controlled-exposure-readiness.v1.json"
35
+ );
36
+ const ARTIFACT_TRUTH_RATCHET_REL = path.join(
37
+ "artifacts",
38
+ "ws-aif",
39
+ "l8",
40
+ "artifact-truth",
41
+ "artifact-truth-ratchet.v1.json"
42
+ );
43
+
44
+ function hasNonEmptyString(value) {
45
+ return typeof value === "string" && value.trim().length > 0;
46
+ }
47
+
48
+ function normalizeStringList(values) {
49
+ if (!Array.isArray(values)) return [];
50
+ return values.map((value) => String(value || "").trim()).filter(Boolean);
51
+ }
52
+
53
+ function uniqueStrings(values) {
54
+ return [...new Set(normalizeStringList(values))];
55
+ }
56
+
57
+ function collectRefValues(objectValue) {
58
+ if (!objectValue || typeof objectValue !== "object" || Array.isArray(objectValue)) return [];
59
+ return Object.entries(objectValue)
60
+ .filter(([key, value]) => key.endsWith("_ref") && hasNonEmptyString(value))
61
+ .map(([, value]) => value.trim());
62
+ }
63
+
64
+ function cloneNextBoundedAction(value) {
65
+ if (hasNonEmptyString(value)) return value.trim();
66
+ if (!value || typeof value !== "object") return null;
67
+ const normalized = {};
68
+ if (hasNonEmptyString(value.action_id)) normalized.action_id = value.action_id.trim();
69
+ if (hasNonEmptyString(value.reason)) normalized.reason = value.reason.trim();
70
+ if (hasNonEmptyString(value.command)) normalized.command = value.command.trim();
71
+ if (hasNonEmptyString(value.rollback_baseline_id)) normalized.rollback_baseline_id = value.rollback_baseline_id.trim();
72
+ if (hasNonEmptyString(value.rollback_trigger)) normalized.rollback_trigger = value.rollback_trigger.trim();
73
+ return Object.keys(normalized).length > 0 ? normalized : null;
74
+ }
75
+
76
+ function readJsonOrNull(absPath) {
77
+ if (!absPath || !fs.existsSync(absPath)) return null;
78
+ try {
79
+ return JSON.parse(fs.readFileSync(absPath, "utf8"));
80
+ } catch {
81
+ return null;
82
+ }
83
+ }
84
+
85
+ function normalizeTaskContractSummary(contract) {
86
+ if (!contract || typeof contract !== "object" || Array.isArray(contract)) return null;
87
+
88
+ const normalized = {};
89
+ const scalarAliases = [
90
+ ["status", ["status"]],
91
+ ["tool", ["tool"]],
92
+ ["intent", ["intent"]],
93
+ ["objective", ["objective"]],
94
+ ];
95
+ const listAliases = [
96
+ ["allowed_paths", ["allowed_paths", "allowedPaths"]],
97
+ ["scope_out", ["scope_out", "scopeOut"]],
98
+ ["requested_outputs", ["requested_outputs", "requestedOutputs"]],
99
+ ["stop_conditions", ["stop_conditions", "stopConditions"]],
100
+ ["success_criteria", ["success_criteria", "successCriteria"]],
101
+ ["evidence_refs", ["evidence_refs", "evidenceRefs"]],
102
+ ["review_reasons", ["review_reasons", "reviewReasons"]],
103
+ ];
104
+
105
+ for (const [field, aliases] of scalarAliases) {
106
+ const value = aliases.map((alias) => contract[alias]).find(hasNonEmptyString);
107
+ if (hasNonEmptyString(value)) normalized[field] = value.trim();
108
+ }
109
+
110
+ for (const [field, aliases] of listAliases) {
111
+ const values = aliases
112
+ .map((alias) => contract[alias])
113
+ .find((candidate) => Array.isArray(candidate));
114
+ const normalizedValues = uniqueStrings(values || []);
115
+ if (normalizedValues.length > 0) normalized[field] = normalizedValues;
116
+ }
117
+
118
+ return Object.keys(normalized).length > 0 ? normalized : null;
119
+ }
120
+
121
+ function validateCanonicalProof(signal) {
122
+ if (!signal || typeof signal !== "object" || Array.isArray(signal)) {
123
+ return { valid: false, errors: ["canonical_proof must be an object"] };
124
+ }
125
+ const errors = [];
126
+ if (Number(signal.version || CANONICAL_PROOF_VERSION) !== CANONICAL_PROOF_VERSION) errors.push(`unsupported canonical_proof version: ${signal.version}`);
127
+ if (!CANONICAL_PROOF_FAMILIES.includes(signal.family)) errors.push(`unknown canonical_proof family: ${signal.family}`);
128
+ if (
129
+ signal.family === "task_contract" &&
130
+ !hasNonEmptyString(signal.objective) &&
131
+ (!Array.isArray(signal.allowed_paths) || signal.allowed_paths.length === 0) &&
132
+ (!Array.isArray(signal.stop_conditions) || signal.stop_conditions.length === 0)
133
+ ) {
134
+ errors.push("task_contract requires at least objective, allowed_paths, or stop_conditions");
135
+ }
136
+ if (signal.family === "control_decision" && !hasNonEmptyString(signal.decision)) errors.push("control_decision requires decision");
137
+ if (signal.family === "material_step" && !hasNonEmptyString(signal.step_type || signal.step_kind)) errors.push("material_step requires step_type");
138
+ if (signal.family === "completion_truth" && !hasNonEmptyString(signal.completion_status)) errors.push("completion_truth requires completion_status");
139
+ return { valid: errors.length === 0, errors };
140
+ }
141
+
142
+ function normalizeCanonicalProof(signal) {
143
+ if (!signal || typeof signal !== "object" || Array.isArray(signal)) return null;
144
+ const normalized = { version: CANONICAL_PROOF_VERSION, family: signal.family };
145
+ const rawStepType = signal.step_type || signal.step_kind;
146
+ const rawArtifactRef = signal.artifact_ref || signal.output_artifact_reference;
147
+ const rawProgressRef = signal.progress_ref || signal.progress_reference;
148
+ const rawUnresolvedItems = signal.unresolved_items || signal.unresolved_limitations;
149
+ const rawRiskLevel =
150
+ signal.risk_level
151
+ || (Number(signal.risk_score) >= 70 ? "high" : Number(signal.risk_score) >= 40 ? "medium" : Number.isFinite(Number(signal.risk_score)) ? "low" : null);
152
+
153
+ [
154
+ "decision",
155
+ "source",
156
+ "scope_status",
157
+ "policy_boundary",
158
+ "decision_basis",
159
+ "message",
160
+ "step_type",
161
+ "value_type",
162
+ "artifact_ref",
163
+ "notes",
164
+ "output_artifact_type",
165
+ "output_artifact_reference",
166
+ "completion_status",
167
+ "final_outcome_type",
168
+ "useful_result_state",
169
+ "completion_quality_state",
170
+ "partial_completion_reason",
171
+ "safe_stop_reason",
172
+ "reentry_status",
173
+ "claim_boundary",
174
+ "where_am_i_now",
175
+ "progress_ref",
176
+ "progress_reference",
177
+ "recommended_next_action",
178
+ "evidence_status",
179
+ "reason_summary",
180
+ "risk_level",
181
+ "status",
182
+ "tool",
183
+ "intent",
184
+ "objective",
185
+ ].forEach((field) => {
186
+ if (hasNonEmptyString(signal[field])) normalized[field] = signal[field].trim();
187
+ });
188
+
189
+ [
190
+ "approval_required",
191
+ "blocked",
192
+ "downgraded",
193
+ "recovery_triggered",
194
+ "rollback_available",
195
+ "progress_preserved",
196
+ "reentry_anchor_saved",
197
+ "evidence_backed_completion",
198
+ "has_related_evidence",
199
+ "user_visible_proof_supported",
200
+ ].forEach((field) => {
201
+ if (typeof signal[field] === "boolean") normalized[field] = signal[field];
202
+ });
203
+
204
+ if (Number.isFinite(Number(signal.risk_score))) normalized.risk_score = Number(signal.risk_score);
205
+ if (Number.isFinite(Number(signal.bytes))) normalized.bytes = Number(signal.bytes);
206
+ if (hasNonEmptyString(rawStepType)) normalized.step_type = rawStepType.trim();
207
+ if (hasNonEmptyString(rawArtifactRef)) normalized.artifact_ref = rawArtifactRef.trim();
208
+ if (hasNonEmptyString(rawProgressRef)) {
209
+ normalized.progress_ref = rawProgressRef.trim();
210
+ normalized.progress_reference = rawProgressRef.trim();
211
+ }
212
+ if (hasNonEmptyString(rawRiskLevel)) normalized.risk_level = rawRiskLevel.trim();
213
+
214
+ const reasonCodes = normalizeStringList(signal.reason_codes);
215
+ if (reasonCodes.length > 0) normalized.reason_codes = reasonCodes;
216
+ const evidenceRefs = normalizeStringList(signal.evidence_refs);
217
+ if (evidenceRefs.length > 0) normalized.evidence_refs = evidenceRefs;
218
+ if (Array.isArray(rawUnresolvedItems)) {
219
+ const unresolved = normalizeStringList(rawUnresolvedItems);
220
+ normalized.unresolved_items = unresolved;
221
+ normalized.unresolved_limitations = unresolved;
222
+ }
223
+ [
224
+ "allowed_paths",
225
+ "scope_out",
226
+ "requested_outputs",
227
+ "stop_conditions",
228
+ "success_criteria",
229
+ "review_reasons",
230
+ ].forEach((field) => {
231
+ const values = uniqueStrings(signal[field]);
232
+ if (values.length > 0) normalized[field] = values;
233
+ });
234
+
235
+ const nextBoundedAction = cloneNextBoundedAction(signal.next_bounded_action);
236
+ if (nextBoundedAction) normalized.next_bounded_action = nextBoundedAction;
237
+ const taskContract = normalizeTaskContractSummary(signal.task_contract);
238
+ if (taskContract) normalized.task_contract = taskContract;
239
+
240
+ return validateCanonicalProof(normalized).valid ? normalized : null;
241
+ }
242
+
243
+ function createCanonicalProof(family, payload = {}) {
244
+ return normalizeCanonicalProof({ version: CANONICAL_PROOF_VERSION, family, ...(payload || {}) });
245
+ }
246
+
247
+ function createTaskContractProof(taskContract) {
248
+ const normalizedTaskContract = normalizeTaskContractSummary(taskContract);
249
+ if (!normalizedTaskContract) return null;
250
+ return createCanonicalProof("task_contract", normalizedTaskContract);
251
+ }
252
+
253
+ function withCanonicalProof(meta, signal) {
254
+ const canonicalProof = normalizeCanonicalProof(signal);
255
+ if (!canonicalProof) return { ...(meta || {}) };
256
+ return { ...(meta || {}), canonical_proof: canonicalProof };
257
+ }
258
+
259
+ function getCanonicalProofFromEntry(entry) {
260
+ return normalizeCanonicalProof(entry?.meta?.canonical_proof || entry?.metadata?.canonical_proof);
261
+ }
262
+
263
+ function extractCanonicalProofEntries(entries) {
264
+ return (entries || []).map((entry) => {
265
+ const signal = getCanonicalProofFromEntry(entry);
266
+ if (!signal) return null;
267
+ return {
268
+ signal,
269
+ ts: entry?.ts || entry?.timestamp || null,
270
+ event: entry?.event || entry?.event_name || null,
271
+ action: entry?.action || null,
272
+ tool: entry?.tool || null,
273
+ };
274
+ }).filter(Boolean);
275
+ }
276
+
277
+ function latestCanonicalEntriesByFamily(entries) {
278
+ const latest = new Map();
279
+ extractCanonicalProofEntries(entries).forEach((entry) => latest.set(entry.signal.family, entry));
280
+ return latest;
281
+ }
282
+
283
+ function latestTerminalCanonicalSignal(entries) {
284
+ const extracted = extractCanonicalProofEntries(entries).filter((entry) => entry.signal.family === "safe_stop" || entry.signal.family === "completion_truth");
285
+ return extracted.length > 0 ? extracted[extracted.length - 1].signal : null;
286
+ }
287
+
288
+ function formatNextBoundedAction(action) {
289
+ if (!action) return null;
290
+ if (hasNonEmptyString(action)) return action.trim();
291
+ if (typeof action !== "object") return null;
292
+ const actionId = hasNonEmptyString(action.action_id) ? action.action_id.trim() : null;
293
+ const reason = hasNonEmptyString(action.reason) ? action.reason.trim() : null;
294
+ if (actionId && reason) return `${actionId}: ${reason}`;
295
+ return actionId || reason || null;
296
+ }
297
+
298
+ function buildBoundedStateContext(cwd) {
299
+ const summaryPayload = readJsonOrNull(path.join(cwd, BOUNDED_STATE_SUMMARY_REL));
300
+ const reentryCarryForward = readJsonOrNull(path.join(cwd, REENTRY_CARRY_FORWARD_REL));
301
+ const controlledExposure = readJsonOrNull(path.join(cwd, CONTROLLED_EXPOSURE_READINESS_REL));
302
+ const artifactTruth = readJsonOrNull(path.join(cwd, ARTIFACT_TRUTH_RATCHET_REL));
303
+
304
+ if (!summaryPayload && !reentryCarryForward && !controlledExposure && !artifactTruth) return null;
305
+
306
+ const evidenceRefs = uniqueStrings([
307
+ summaryPayload ? BOUNDED_STATE_SUMMARY_REL : null,
308
+ reentryCarryForward ? REENTRY_CARRY_FORWARD_REL : null,
309
+ controlledExposure ? CONTROLLED_EXPOSURE_READINESS_REL : null,
310
+ artifactTruth ? ARTIFACT_TRUTH_RATCHET_REL : null,
311
+ ...collectRefValues(summaryPayload?.evidence_refs),
312
+ ...collectRefValues(controlledExposure?.evidence_summary),
313
+ ...(reentryCarryForward?.minimum_reentry_refs || []).map((item) => item?.ref),
314
+ ].map((value) => (hasNonEmptyString(value) ? value.trim() : null)).filter(Boolean));
315
+
316
+ const artifactRefs = uniqueStrings([
317
+ summaryPayload ? BOUNDED_STATE_SUMMARY_REL : null,
318
+ reentryCarryForward ? REENTRY_CARRY_FORWARD_REL : null,
319
+ controlledExposure ? CONTROLLED_EXPOSURE_READINESS_REL : null,
320
+ artifactTruth ? ARTIFACT_TRUTH_RATCHET_REL : null,
321
+ ]);
322
+
323
+ const nextBoundedAction =
324
+ cloneNextBoundedAction(summaryPayload?.next_bounded_action) ||
325
+ cloneNextBoundedAction(reentryCarryForward?.next_bounded_action) ||
326
+ cloneNextBoundedAction(controlledExposure?.next_bounded_action);
327
+ const whereAmINow =
328
+ (hasNonEmptyString(summaryPayload?.where_am_i_now) ? summaryPayload.where_am_i_now.trim() : null) ||
329
+ (hasNonEmptyString(reentryCarryForward?.where_am_i_now) ? reentryCarryForward.where_am_i_now.trim() : null);
330
+ const claimBoundary = hasNonEmptyString(summaryPayload?.what_can_i_honestly_claim)
331
+ ? summaryPayload.what_can_i_honestly_claim.trim()
332
+ : null;
333
+ const reentryStatus =
334
+ (hasNonEmptyString(summaryPayload?.reentry_status) ? summaryPayload.reentry_status.trim() : null) ||
335
+ (hasNonEmptyString(reentryCarryForward?.reentry_status) ? reentryCarryForward.reentry_status.trim() : null) ||
336
+ null;
337
+
338
+ return {
339
+ artifact_path:
340
+ summaryPayload ? BOUNDED_STATE_SUMMARY_REL.split(path.sep).join("/")
341
+ : reentryCarryForward ? REENTRY_CARRY_FORWARD_REL.split(path.sep).join("/")
342
+ : controlledExposure ? CONTROLLED_EXPOSURE_READINESS_REL.split(path.sep).join("/")
343
+ : ARTIFACT_TRUTH_RATCHET_REL.split(path.sep).join("/"),
344
+ state_source:
345
+ summaryPayload ? BOUNDED_STATE_SUMMARY_REL.split(path.sep).join("/")
346
+ : reentryCarryForward ? REENTRY_CARRY_FORWARD_REL.split(path.sep).join("/")
347
+ : controlledExposure ? CONTROLLED_EXPOSURE_READINESS_REL.split(path.sep).join("/")
348
+ : ARTIFACT_TRUTH_RATCHET_REL.split(path.sep).join("/"),
349
+ artifact_refs: artifactRefs.map((value) => value.split(path.sep).join("/")),
350
+ claim_boundary: claimBoundary,
351
+ what_can_i_honestly_claim: claimBoundary,
352
+ where_am_i_now: whereAmINow,
353
+ reentry_status: reentryStatus,
354
+ next_bounded_action: nextBoundedAction,
355
+ latest_trustworthy_run_id:
356
+ hasNonEmptyString(reentryCarryForward?.latest_trustworthy_run_id)
357
+ ? reentryCarryForward.latest_trustworthy_run_id.trim()
358
+ : null,
359
+ latest_trustworthy_workset_id:
360
+ hasNonEmptyString(reentryCarryForward?.latest_trustworthy_workset_id)
361
+ ? reentryCarryForward.latest_trustworthy_workset_id.trim()
362
+ : null,
363
+ rollback_available:
364
+ whereAmINow === "rollback"
365
+ || controlledExposure?.readiness_status === "rollback"
366
+ || nextBoundedAction?.action_id === "rollback_to_safe_baseline",
367
+ rollback_trigger: hasNonEmptyString(controlledExposure?.rollback_trigger) ? controlledExposure.rollback_trigger.trim() : null,
368
+ readiness_status: hasNonEmptyString(controlledExposure?.readiness_status) ? controlledExposure.readiness_status.trim() : null,
369
+ exposure_scope: hasNonEmptyString(controlledExposure?.exposure_scope) ? controlledExposure.exposure_scope.trim() : null,
370
+ artifact_truth_status: hasNonEmptyString(artifactTruth?.artifact_truth_status) ? artifactTruth.artifact_truth_status.trim() : null,
371
+ counts_as_meaningful_output:
372
+ typeof artifactTruth?.counts_as_meaningful_output === "boolean"
373
+ ? artifactTruth.counts_as_meaningful_output
374
+ : null,
375
+ reentry_reason_summary:
376
+ hasNonEmptyString(reentryCarryForward?.reason_summary)
377
+ ? reentryCarryForward.reason_summary.trim()
378
+ : null,
379
+ evidence_refs: evidenceRefs.map((value) => value.split(path.sep).join("/")),
380
+ };
381
+ }
382
+
383
+ module.exports = {
384
+ CANONICAL_PROOF_FAMILIES,
385
+ CANONICAL_PROOF_VERSION,
386
+ buildBoundedStateContext,
387
+ createCanonicalProof,
388
+ createTaskContractProof,
389
+ extractCanonicalProofEntries,
390
+ formatNextBoundedAction,
391
+ getCanonicalProofFromEntry,
392
+ latestCanonicalEntriesByFamily,
393
+ latestTerminalCanonicalSignal,
394
+ normalizeTaskContractSummary,
395
+ normalizeCanonicalProof,
396
+ validateCanonicalProof,
397
+ withCanonicalProof,
398
+ };