carthagent 1.0.7 → 1.1.0-beta.1

package/tests/verify-owned-runtime-release.test.mjs

@@ -0,0 +1,371 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { createServer } from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { once } from 'node:events';
+import { gzipSync } from 'node:zlib';
+import { afterEach, test } from 'node:test';
+import {
+  REQUIRED_RUNTIME_TARGETS,
+  validateRuntimeReleaseManifest,
+  verifyOwnedRuntimeRelease,
+} from '../tools/verify-owned-runtime-release.mjs';
+import { createRuntimeGithubFetch } from '../lib/opencode/runtime-github-transport.mjs';
+
+const roots = [];
+afterEach(async () => Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true }))));
+
+test('validates required five-platform manifest then supplies every trusted digest to acquisition', async () => {
+  const { root, manifestPath, manifest } = await fixture();
+  const calls = [];
+  await verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion,
+    manifestPath,
+    assetsBaseUrl: 'https://github.example/releases/v9.8.7',
+    repoRoot: root,
+    acquireRuntime: async (options) => { calls.push(options); return `/verified/${options.platform}-${options.arch}`; },
+  });
+  assert.equal(root.length > 0, true);
+  assert.equal(calls.length, 5);
+  for (const [key, [platform, arch, name]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+    const call = calls.find((item) => `${item.platform}-${item.arch}` === key);
+    assert.ok(call, `acquired ${key}`);
+    assert.equal(call.baseUrl, 'https://github.example/releases/v9.8.7');
+    assert.equal(call.expectedArchiveSha256, manifest.assets[key].archiveSha256);
+    assert.equal(call.expectedExecutableSha256, manifest.assets[key].executableSha256);
+    assert.equal(call.expectedSourceRevision, manifest.sourceRevision);
+    assert.equal(call.expectedPatchSha256, manifest.patchSha256);
+    assert.equal(call.expectedLockSha256, manifest.lockSha256);
+    assert.equal(call.expectedCompatibilityVersion, manifest.compatibilityVersion);
+    assert.equal(call.expectedRuntimeVersion, manifest.runtimeVersion);
+    assert.equal(call.expectedChannel, `ctg.${manifest.compatibilityVersion}`);
+    assert.equal(manifest.assets[key].name, name);
+    assert.equal(call.platform, platform);
+    assert.equal(call.arch, arch);
+  }
+});
+
+test('verifier wires the opt-in credential transport to every production acquisition', async () => {
+  const { root, manifestPath, manifest } = await fixture();
+  const calls = [];
+  const fakeFetch = async (url, init) => {
+    calls.push({ url: String(url), init });
+    return new Response(JSON.stringify([]), { status: 200 });
+  };
+  await verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion, manifestPath,
+    assetsBaseUrl: `https://github.com/B-icy/Carthagent/releases/download/v${manifest.releaseVersion}`,
+    repoRoot: root, runtimeToken: 'fixture-token-never-real', fetchImpl: fakeFetch,
+    acquireRuntime: async (options) => {
+      assert.equal(typeof options.fetchImpl, 'function');
+      // Exercise the injected fetch adapter without initiating external I/O.
+      await assert.rejects(options.fetchImpl(`${options.baseUrl}/${manifest.assets['linux-x64'].name}`), /release was not found/);
+      return '/verified';
+    },
+  });
+  assert.equal(calls.length, 5);
+  assert.ok(calls.every(({ url, init }) => url.startsWith('https://api.github.com/repos/B-icy/Carthagent/releases?')));
+  assert.ok(calls.every(({ init }) => init.headers.authorization === 'Bearer fixture-token-never-real'));
+});
+
+test('rejects absent Linux arm64 and a release-version mismatch before acquiring anything', async () => {
+  const { root, manifestPath, manifest } = await fixture();
+  delete manifest.assets['linux-arm64'];
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  await assert.rejects(verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion,
+    manifestPath,
+    assetsBaseUrl: 'https://example.test/release',
+    repoRoot: root,
+    acquireRuntime: async () => assert.fail('invalid manifest must not acquire assets'),
+  }), /must contain exactly/);
+  await assert.rejects(verifyOwnedRuntimeRelease({
+    releaseVersion: '9.8.8', manifestPath, assetsBaseUrl: 'https://example.test/release', repoRoot: root,
+    acquireRuntime: async () => assert.fail('wrong release version must not acquire assets'),
+  }), /does not match/);
+});
+
+test('rejects malformed digests and noncanonical platform asset names', async () => {
+  const { manifest } = await fixture();
+  manifest.assets['windows-x64'].archiveSha256 = 'not-a-digest';
+  assert.throws(() => validateRuntimeReleaseManifest(manifest, manifest.releaseVersion), /archiveSha256/);
+  manifest.assets['windows-x64'].archiveSha256 = 'a'.repeat(64);
+  manifest.assets['windows-x64'].name = 'arbitrary.tar.gz';
+  assert.throws(() => validateRuntimeReleaseManifest(manifest, manifest.releaseVersion), /asset name/);
+});
+
+test('verifies all five USTAR assets through the production acquirer over loopback', async (t) => {
+  const { root, manifestPath, manifest } = await fixture();
+  const assets = new Map();
+  for (const [key, [platform, arch, name]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+    const executable = Buffer.from(`fixture executable for ${key}\n`);
+    const executablePath = `cli-${key}/bin/${key.startsWith('windows-') ? 'opencode.exe' : 'opencode'}`;
+    const runtime = {
+      owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+      sourceRevision: manifest.sourceRevision, patchSha256: manifest.patchSha256,
+      lockSha256: manifest.lockSha256, compatibilityVersion: manifest.compatibilityVersion,
+      runtimeVersion: manifest.runtimeVersion, channel: `ctg.${manifest.compatibilityVersion}`,
+      platform: `${platform}-${arch}`, webUI: false,
+    };
+    const archive = makeUstarArchive([
+      [executablePath, executable, 0o755],
+      ['SHA256SUMS', Buffer.from(`${sha(executable)}  ${executablePath}\n`), 0o644],
+      ['ctg-runtime.json', Buffer.from(JSON.stringify(runtime)), 0o644],
+      ['LICENSE', Buffer.from('fixture license\n'), 0o644],
+    ]);
+    manifest.assets[key].archiveSha256 = sha(archive);
+    manifest.assets[key].executableSha256 = sha(executable);
+    assets.set(`/releases/${manifest.releaseVersion}/${name}`, archive);
+  }
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  const server = createServer((request, response) => {
+    const body = assets.get(new URL(request.url, 'http://127.0.0.1').pathname);
+    if (!body) { response.writeHead(404).end(); return; }
+    response.writeHead(200, { 'content-length': body.length }).end(body);
+  });
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  const assetsBaseUrl = `http://127.0.0.1:${server.address().port}/releases/${manifest.releaseVersion}`;
+
+  await verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion,
+    manifestPath,
+    assetsBaseUrl,
+    repoRoot: root,
+    cacheRoot: path.join(root, 'acquirer-cache'),
+  });
+  assert.equal(assets.size, 5);
+});
+
+test('verifies five draft assets through API metadata and asset-id downloads with the production acquirer', async (t) => {
+  const { root, manifestPath, manifest } = await fixture();
+  const archiveByName = new Map();
+  const assetsById = new Map();
+  let nextId = 101;
+  for (const [key, [platform, arch, name]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+    const executable = Buffer.from(`draft fixture executable ${key}`);
+    const executablePath = `cli-${key}/bin/${key.startsWith('windows-') ? 'opencode.exe' : 'opencode'}`;
+    const runtime = {
+      owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+      sourceRevision: manifest.sourceRevision, patchSha256: manifest.patchSha256,
+      lockSha256: manifest.lockSha256, compatibilityVersion: manifest.compatibilityVersion,
+      runtimeVersion: manifest.runtimeVersion, channel: `ctg.${manifest.compatibilityVersion}`,
+      platform: `${platform}-${arch}`, webUI: false,
+    };
+    const archive = makeUstarArchive([
+      [executablePath, executable, 0o755],
+      ['SHA256SUMS', Buffer.from(`${sha(executable)}  ${executablePath}\n`), 0o644],
+      ['ctg-runtime.json', Buffer.from(JSON.stringify(runtime)), 0o644],
+      ['LICENSE', Buffer.from('fixture license\n'), 0o644],
+    ]);
+    manifest.assets[key].archiveSha256 = sha(archive);
+    manifest.assets[key].executableSha256 = sha(executable);
+    const id = nextId++;
+    archiveByName.set(name, archive);
+    assetsById.set(id, { name, archive });
+  }
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  const token = 'fixture-token-never-real';
+  const requests = [];
+  const fakeFetch = async (input, init = {}) => {
+    const url = new URL(input);
+    requests.push({ url, init });
+    if (url.origin !== 'https://api.github.com') throw new Error('Unexpected external fixture request');
+    if (url.pathname === '/repos/B-icy/Carthagent/releases') {
+      return Response.json([{ id: 88, tag_name: `v${manifest.releaseVersion}` }]);
+    }
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') {
+      return Response.json([...assetsById].map(([id, asset]) => ({
+        id, name: asset.name, state: 'uploaded', size: asset.archive.length,
+        url: `https://api.github.com/repos/B-icy/Carthagent/releases/assets/${id}`,
+      })));
+    }
+    const assetId = Number(url.pathname.match(/\/releases\/assets\/(\d+)$/)?.[1]);
+    if (assetId && assetsById.has(assetId)) return new Response(assetsById.get(assetId).archive);
+    throw new Error(`Unexpected fixture API path ${url.pathname}`);
+  };
+  await verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion,
+    manifestPath,
+    assetsBaseUrl: `https://github.com/B-icy/Carthagent/releases/download/v${manifest.releaseVersion}`,
+    repoRoot: root,
+    cacheRoot: path.join(root, 'draft-acquirer-cache'),
+    runtimeToken: token,
+    fetchImpl: fakeFetch,
+  });
+  assert.equal(requests.filter(({ url }) => url.pathname.includes('/releases/assets/')).length, 5);
+  assert.ok(requests.every(({ init }) => init.headers.authorization === `Bearer ${token}`));
+  assert.equal(archiveByName.size, 5);
+});
+
+test('draft archive bytes with a wrong trusted digest fail before extraction or executable acceptance', async () => {
+  const { root, manifestPath, manifest } = await fixture();
+  const key = 'linux-x64';
+  const [, , name] = REQUIRED_RUNTIME_TARGETS[key];
+  const executable = Buffer.from('must not be accepted');
+  const archive = makeUstarArchive([
+    [`cli-${key}/bin/opencode`, executable, 0o755],
+    ['SHA256SUMS', Buffer.from(`${sha(executable)}  cli-${key}/bin/opencode\n`), 0o644],
+    ['ctg-runtime.json', Buffer.from('{}'), 0o644],
+  ]);
+  manifest.assets[key].archiveSha256 = 'f'.repeat(64);
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  let assetRequested = false;
+  const token = 'fixture-token-never-real';
+  const fetchImpl = async (input) => {
+    const url = new URL(input);
+    if (url.pathname === '/repos/B-icy/Carthagent/releases') return Response.json([{ id: 88, tag_name: `v${manifest.releaseVersion}` }]);
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') return Response.json([{ id: 777, name, state: 'uploaded', size: archive.length, url: 'https://api.github.com/repos/B-icy/Carthagent/releases/assets/777' }]);
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/assets/777') { assetRequested = true; return new Response(archive); }
+    assert.fail(`Unexpected API URL ${url.href}`);
+  };
+  const acquire = await import('../lib/opencode/runtime-artifact.mjs');
+  await assert.rejects(acquire.acquireOwnedRuntime({
+    releaseVersion: manifest.releaseVersion, platform: 'linux', arch: 'x64', assetName: name,
+    baseUrl: `https://github.com/B-icy/Carthagent/releases/download/v${manifest.releaseVersion}`,
+    expectedArchiveSha256: manifest.assets[key].archiveSha256,
+    expectedExecutableSha256: sha(executable), expectedSourceRevision: manifest.sourceRevision,
+    expectedPatchSha256: manifest.patchSha256, expectedLockSha256: manifest.lockSha256,
+    expectedCompatibilityVersion: manifest.compatibilityVersion, expectedRuntimeVersion: manifest.runtimeVersion,
+    expectedChannel: `ctg.${manifest.compatibilityVersion}`, cacheRoot: path.join(root, 'bad-draft-cache'),
+    fetchImpl: createRuntimeGithubFetch({ token, fetchImpl }),
+  }), /archive SHA-256 mismatch/);
+  assert.equal(assetRequested, true);
+  await assert.rejects(import('node:fs/promises').then(({ access }) => access(path.join(root, 'bad-draft-cache', manifest.releaseVersion, key))));
+});
+
+test('production acquisition rejects an embedded channel mismatch against the pinned compatibility version', async (t) => {
+  const { root, manifestPath, manifest } = await fixture();
+  const [key, [platform, arch]] = Object.entries(REQUIRED_RUNTIME_TARGETS)[0];
+  const executable = Buffer.from('channel mismatch fixture executable');
+  const executablePath = `cli-${key}/bin/opencode`;
+  const runtime = {
+    owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+    sourceRevision: manifest.sourceRevision, patchSha256: manifest.patchSha256,
+    lockSha256: manifest.lockSha256, compatibilityVersion: manifest.compatibilityVersion,
+    runtimeVersion: manifest.runtimeVersion, channel: 'ctg.wrong-version',
+    platform: `${platform}-${arch}`, webUI: false,
+  };
+  const archive = makeUstarArchive([
+    [executablePath, executable, 0o755],
+    ['SHA256SUMS', Buffer.from(`${sha(executable)}  ${executablePath}\n`), 0o644],
+    ['ctg-runtime.json', Buffer.from(JSON.stringify(runtime)), 0o644],
+    ['LICENSE', Buffer.from('fixture license\n'), 0o644],
+  ]);
+  manifest.assets[key].archiveSha256 = sha(archive);
+  manifest.assets[key].executableSha256 = sha(executable);
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  const server = createServer((_request, response) => response.writeHead(200, { 'content-length': archive.length }).end(archive));
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+
+  await assert.rejects(verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion,
+    manifestPath,
+    assetsBaseUrl: `http://127.0.0.1:${server.address().port}/releases/${manifest.releaseVersion}`,
+    repoRoot: root,
+    cacheRoot: path.join(root, 'wrong-channel-cache'),
+  }), /channel mismatch/);
+});
+
+test('verifier pins the recipe-selected combined patch rather than the preserved base patch', async () => {
+  const { root, manifestPath, manifest } = await fixture();
+  const calls = [];
+  await verifyOwnedRuntimeRelease({
+    releaseVersion: manifest.releaseVersion, manifestPath,
+    assetsBaseUrl: 'https://example.test/release', repoRoot: root,
+    acquireRuntime: async (options) => { calls.push(options); return '/verified'; },
+  });
+  assert.equal(calls.length, 5);
+  assert.equal(calls[0].expectedPatchSha256, manifest.patchSha256);
+});
+
+test('verifier rejects missing or tampered recipe-selected patch before acquiring assets', async (t) => {
+  await t.test('missing selected patch does not fall back to preserved base', async () => {
+    const { root, manifestPath, manifest } = await fixture();
+    await rm(path.join(root, 'docs/patches/opencode-v2.0.32-session-ui-combined-v1.patch'));
+    let calls = 0;
+    await assert.rejects(verifyOwnedRuntimeRelease({
+      releaseVersion: manifest.releaseVersion, manifestPath,
+      assetsBaseUrl: 'https://example.test/release', repoRoot: root,
+      acquireRuntime: async () => { calls += 1; return '/verified'; },
+    }), /ENOENT/);
+    assert.equal(calls, 0);
+  });
+  await t.test('tampered selected patch fails its recipe digest', async () => {
+    const { root, manifestPath, manifest } = await fixture();
+    await writeFile(
+      path.join(root, 'docs/patches/opencode-v2.0.32-session-ui-combined-v1.patch'),
+      'tampered combined patch',
+    );
+    let calls = 0;
+    await assert.rejects(verifyOwnedRuntimeRelease({
+      releaseVersion: manifest.releaseVersion, manifestPath,
+      assetsBaseUrl: 'https://example.test/release', repoRoot: root,
+      acquireRuntime: async () => { calls += 1; return '/verified'; },
+    }), /Pinned patch bytes do not match the build recipe/);
+    assert.equal(calls, 0);
+  });
+});
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'ctg-runtime-release-manifest-'));
+  roots.push(root);
+  await mkdir(path.join(root, 'script/ctg'), { recursive: true });
+  await mkdir(path.join(root, 'docs/patches'), { recursive: true });
+  const patch = Buffer.from('fixture pinned patch');
+  const patchSha256 = createHash('sha256').update(patch).digest('hex');
+  const sourceRevision = '0123456789abcdef0123456789abcdef01234567';
+  const lockSha256 = 'b'.repeat(64);
+  await writeFile(path.join(root, 'script/ctg/build-owned-runtime.sh'), [
+    `EXPECTED_SOURCE="${sourceRevision}"`, `EXPECTED_PATCH="${patchSha256}"`, `EXPECTED_LOCK="${lockSha256}"`,
+    'patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v1.patch"',
+  ].join('\n'));
+  await writeFile(path.join(root, 'docs/patches/opencode-v2.0.32-session-ui-combined-v1.patch'), patch);
+  await writeFile(path.join(root, 'docs/patches/opencode-v2.0.32-session-ui.patch'), Buffer.from('preserved base patch with different bytes'));
+  const manifest = {
+    version: 1,
+    releaseVersion: '9.8.7',
+    compatibilityVersion: '2.0.32',
+    runtimeVersion: '0.0.0-ctg.2.0.32',
+    sourceRevision,
+    patchSha256,
+    lockSha256,
+    assets: Object.fromEntries(Object.entries(REQUIRED_RUNTIME_TARGETS).map(([key, [, , name]], index) => [key, {
+      name,
+      archiveSha256: (index + 1).toString(16).repeat(64),
+      executableSha256: (index + 6).toString(16).repeat(64),
+    }])),
+  };
+  const manifestPath = path.join(root, 'runtime-release.json');
+  await writeFile(manifestPath, JSON.stringify(manifest));
+  return { root, manifestPath, manifest };
+}
+
+function sha(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function octal(value, width) { return Buffer.from(`${value.toString(8).padStart(width - 1, '0')}\0`); }
+function tarEntry(name, data, mode) {
+  const header = Buffer.alloc(512);
+  header.write(name, 0, 100);
+  octal(mode, 8).copy(header, 100);
+  octal(0, 8).copy(header, 108);
+  octal(0, 8).copy(header, 116);
+  octal(data.length, 12).copy(header, 124);
+  octal(0, 12).copy(header, 136);
+  header.fill(32, 148, 156);
+  header[156] = '0'.charCodeAt(0);
+  header.write('ustar\0', 257, 6);
+  header.write('00', 263, 2);
+  let checksum = 0;
+  for (const byte of header) checksum += byte;
+  octal(checksum, 8).copy(header, 148);
+  return Buffer.concat([header, data, Buffer.alloc((512 - data.length % 512) % 512)]);
+}
+function makeUstarArchive(files) {
+  const entries = files.map(([name, data, mode]) => tarEntry(name, data, mode));
+  return gzipSync(Buffer.concat([...entries, Buffer.alloc(1024)]));
+}

package/tests/workspace-live.test.mjs

@@ -0,0 +1,127 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { createJiti } = require('jiti');
+const jiti = createJiti(import.meta.url);
+const { createLatestRequestGate, onWorkspaceUpdated, deliveryReadiness, renderDeliveryReadiness } = await jiti.import('../plugins/carthagent/src/ui/workspace-live.ts');
+
+function deferred() {
+  let resolve;
+  const promise = new Promise((done) => { resolve = done; });
+  return { promise, resolve };
+}
+
+test('overlapping async workspace refreshes cannot publish stale results', async () => {
+  const gate = createLatestRequestGate();
+  const older = deferred();
+  const newer = deferred();
+  let visible = 'initial';
+
+  const olderRequest = gate.begin();
+  const oldRefresh = older.promise.then((value) => {
+    if (olderRequest.isCurrent()) visible = value;
+  });
+  const newerRequest = gate.begin();
+  const newRefresh = newer.promise.then((value) => {
+    if (newerRequest.isCurrent()) visible = value;
+  });
+
+  newer.resolve('new result');
+  await newRefresh;
+  older.resolve('stale result');
+  await oldRefresh;
+  assert.equal(visible, 'new result');
+});
+
+test('a real workspace RPC event invalidates the active view and stale deferred refresh cannot overwrite it', async () => {
+  const gate = createLatestRequestGate();
+  const older = deferred();
+  const updated = deferred();
+  let visible = 'before event';
+  const publish = (promise) => {
+    const request = gate.begin();
+    return promise.then((value) => {
+      if (request.isCurrent()) visible = value;
+    });
+  };
+  const oldRefresh = publish(older.promise);
+  let listener;
+  const events = { on(name, handler) { assert.equal(name, 'updated'); listener = handler; return () => { listener = undefined; }; } };
+  let refreshes = 0;
+  const stop = onWorkspaceUpdated(events, () => '/workspace/project', () => {
+    gate.invalidate();
+    refreshes++;
+    void publish(updated.promise);
+  });
+
+  // This is the promise RPC event payload shape: location is on the envelope,
+  // while declared data is only { revision }.
+  listener({ type: 'rpc.carthagent.workspace.updated', location: { directory: '/workspace/project' }, data: { revision: '42' } });
+  listener({ type: 'rpc.carthagent.workspace.updated', location: { directory: '/other/project' }, data: { revision: '43' } });
+  assert.equal(refreshes, 1);
+  updated.resolve('event-refreshed view');
+  await Promise.resolve();
+  older.resolve('late stale response');
+  await oldRefresh;
+  assert.equal(visible, 'event-refreshed view');
+  stop();
+});
+
+test('bounded delivery DTO preserves stale incomplete status and authoritative locked gate with capped evidence', () => {
+  const checks = { returned: 100, total: 101 };
+  const delivery = {
+    status: 'stale', freshness: 'stale', completion: 'incomplete', gate: 'locked',
+    evidence: Array.from({ length: 100 }, (_, index) => ({ id: `check_${index}`, status: index === 99 ? 'stale' : 'fresh' })),
+    truncation: { checks, acceptance: { returned: 1, total: 1 }, steps: { returned: 1, total: 1 } },
+  };
+  const readiness = deliveryReadiness(delivery);
+  const rendered = renderDeliveryReadiness(delivery);
+  assert.equal(readiness.complete, false);
+  assert.match(readiness.status, /completion incomplete · gate locked · freshness stale/);
+  assert.match(readiness.status, /partial coverage: checks 100\/101/);
+  assert.equal(rendered.gate, 'locked');
+  assert.match(rendered.label, /Readiness: incomplete/);
+  assert.equal(rendered.coverage, 'partial');
+  assert.ok(rendered.sections.includes('checks: 100 of 101 returned'));
+  assert.match(rendered.receipts.at(-1), /check_99: stale/);
+});
+
+test('capped presentation coverage does not downgrade authoritative ready status or gate', () => {
+  const delivery = {
+    status: 'verified', freshness: 'current', completion: 'ready', gate: 'open',
+    truncation: { architecture: { returned: 100, total: 101 }, checks: { returned: 4, total: 4 } },
+  };
+  const readiness = deliveryReadiness(delivery);
+  const rendered = renderDeliveryReadiness(delivery);
+  assert.equal(readiness.complete, true);
+  assert.equal(readiness.coverage, 'partial');
+  assert.equal(rendered.gate, 'open');
+  assert.match(rendered.label, /Readiness: ready/);
+  assert.ok(rendered.sections.includes('architecture: 100 of 101 returned'));
+});
+
+test('stale check outside the returned cap remains blocked by the authoritative DTO gate', () => {
+  const delivery = {
+    status: 'stale', freshness: 'stale', completion: 'incomplete', gate: 'locked',
+    evidence: Array.from({ length: 100 }, (_, index) => ({ id: `check_${index}`, status: 'fresh' })),
+    truncation: { checks: { returned: 100, total: 101 } },
+  };
+  const rendered = renderDeliveryReadiness(delivery);
+  assert.equal(rendered.gate, 'locked');
+  assert.equal(rendered.coverage, 'partial');
+  assert.match(rendered.label, /Readiness: incomplete/);
+  assert.match(rendered.label, /freshness stale/);
+});
+
+test('missing coverage metadata and gate are unknown rather than fabricated incomplete or locked', () => {
+  const delivery = { completion: 'ready', freshness: 'current' };
+  const readiness = deliveryReadiness(delivery);
+  const rendered = renderDeliveryReadiness(delivery);
+  assert.equal(readiness.complete, true);
+  assert.equal(readiness.coverage, 'unknown');
+  assert.equal(rendered.gate, 'unknown');
+  assert.match(rendered.label, /gate unknown/);
+  assert.ok(rendered.sections.includes('Coverage metadata unavailable: completeness cannot be confirmed'));
+});

package/tools/benchmark/diagnose-request.mjs

@@ -1,40 +1,63 @@
-// Offline only: reconstruct the final request using the installed serializer.
-// No tool execution, model generation or candidate/session mutation.
-import { readFileSync, readdirSync, writeFileSync, mkdirSync } from 'node:fs';
+// Offline inspection of captured native OpenAI-compatible gateway requests.
+// Never creates a session, runs tools, reconstructs a Pi payload, or sends network traffic.
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { pathToFileURL, fileURLToPath } from 'node:url';
-import { ENGINE_ROOT, sha } from './runtime.mjs';
-export async function reconstruct(run) {
-  const { buildSystemPrompt } = await import(pathToFileURL(join(ENGINE_ROOT,'dist/core/system-prompt.js')));
-  const { createToolDefinition } = await import(pathToFileURL(join(ENGINE_ROOT,'dist/core/tools/index.js')));
-  const { stream } = await import(pathToFileURL(join(ENGINE_ROOT,'node_modules/@earendil-works/pi-ai/dist/api/openai-completions.js')));
-  const invocation=JSON.parse(readFileSync(join(run,'invocation.json'),'utf8'));
-  if(invocation.arm!=='plain')throw Error('Reconstruction currently supports plain arm only');
-  const workspace=join(run,'workspace'), toolNames=['read','bash','edit','write','grep','find','ls'];
-  const definitions=toolNames.map(name=>createToolDefinition(name,workspace));
-  const systemPrompt=buildSystemPrompt({cwd:workspace,selectedTools:toolNames,toolSnippets:Object.fromEntries(definitions.map(t=>[t.name,t.promptSnippet])),promptGuidelines:definitions.flatMap(t=>t.promptGuidelines || []),skills:[],contextFiles:[]});
-  const files=readdirSync(join(run,'sessions')).filter(f=>f.endsWith('.jsonl'));if(files.length!==1)throw Error('Expected one session');
-  const entries=readFileSync(join(run,'sessions',files[0]),'utf8').trim().split('\n').map(JSON.parse);
-  const messages=entries.filter(e=>e.type==='message').map(e=>e.message).filter(m=>!(m.role==='assistant'&&['error','aborted'].includes(m.stopReason)));
-  const config=JSON.parse(readFileSync(join(run,'config/models.json'),'utf8')).providers.benchmark;
-  const model={...config.models[0],provider:'benchmark',api:config.api,baseUrl:config.baseUrl};
-  let raw;
-  const s=stream(model,{systemPrompt,messages,tools:definitions},{apiKey:'offline-placeholder',onPayload:payload=>{raw=payload;throw Error('OFFLINE_CAPTURE_ONLY');},fetch:()=>{throw Error('NETWORK_FORBIDDEN');}});
-  await s.result();if(!raw)throw Error('Serializer did not produce payload');
-  const payload={model:raw.model,messages:raw.messages,tools:raw.tools,tool_choice:raw.tool_choice,stream:true,stream_options:{include_usage:true},max_tokens:16384,reasoning:{effort:'high'},provider:{max_price:{prompt:.30,completion:1.20},require_parameters:true}};
-  const receipts=readFileSync(join(run,'gateway.jsonl'),'utf8').trim().split('\n').map(JSON.parse),last=receipts.filter(r=>r.type==='request'&&r.kind==='generation').at(-1);
-  return {payload,report:{originalHash:last.requestHash,reconstructedHash:sha(JSON.stringify(payload)),hashMatches:sha(JSON.stringify(payload))===last.requestHash,originalBytes:last.bytes,reconstructedBytes:Buffer.byteLength(JSON.stringify(payload)),messages:payload.messages.length,...inspectRequest(payload)}};
+import { fileURLToPath } from 'node:url';
+import { sha } from './runtime.mjs';
+
+export function inspectRequest(payload) {
+  const issues = [], pending = new Set(), seen = new Set();
+  let toolCalls = 0, toolResults = 0;
+  for (const [index, message] of payload.messages.entries()) {
+    if (message.role === 'tool') {
+      toolResults++;
+      if (!pending.delete(message.tool_call_id)) issues.push(`message ${index}: unmatched tool result`);
+      continue;
+    }
+    if (pending.size) issues.push(`message ${index}: missing tool results before ${message.role}`);
+    for (const call of message.tool_calls || []) {
+      toolCalls++;
+      if (seen.has(call.id)) issues.push(`message ${index}: duplicate tool id`);
+      seen.add(call.id);
+      pending.add(call.id);
+      try { JSON.parse(call.function.arguments); } catch { issues.push(`message ${index}: invalid tool arguments`); }
+    }
+  }
+  if (pending.size) issues.push('Missing final tool results');
+  return {
+    toolCalls, toolResults, issues,
+    model: payload.model,
+    stream: payload.stream,
+    maxTokens: payload.max_tokens,
+    toolChoice: payload.tool_choice,
+    tools: payload.tools?.map(tool => tool.function?.name),
+  };
 }
-export function inspectRequest(payload){
- const issues=[],pending=new Set(),seen=new Set();let toolCalls=0,toolResults=0;
- for(const [i,m] of payload.messages.entries()){
-  if(m.role==='tool'){toolResults++;if(!pending.delete(m.tool_call_id))issues.push(`message ${i}: unmatched tool result`);}
-  else {if(pending.size)issues.push(`message ${i}: missing tool results before ${m.role}`);for(const t of m.tool_calls || []){toolCalls++;if(seen.has(t.id))issues.push(`message ${i}: duplicate tool id`);seen.add(t.id);pending.add(t.id);try{JSON.parse(t.function.arguments);}catch{issues.push(`message ${i}: invalid tool arguments`);}}}
- }
- if(pending.size)issues.push('Missing final tool results');
- return {toolCalls,toolResults,issues,reasoningMessages:payload.messages.filter(m=>m.reasoning_details).length,tools:payload.tools?.map(t=>t.function?.name)};
+
+export async function inspectCapturedRequest(capturePath) {
+  const source = readFileSync(capturePath, 'utf8');
+  const payload = JSON.parse(source);
+  if (!payload || typeof payload !== 'object' || typeof payload.model !== 'string' || !Array.isArray(payload.messages)) {
+    throw Error('Captured OpenAI-compatible request must include a model and messages array');
+  }
+  const report = {
+    runtime: 'opencode-2',
+    sourceHash: sha(source),
+    normalizedHash: sha(JSON.stringify(payload)),
+    sourceBytes: Buffer.byteLength(source),
+    normalizedBytes: Buffer.byteLength(JSON.stringify(payload)),
+    messages: payload.messages.length,
+    ...inspectRequest(payload),
+  };
+  return { payload, report };
 }
-if(process.argv[1]===fileURLToPath(import.meta.url)){
- const [run,out]=process.argv.slice(2);if(!run||!out)throw Error('Usage: diagnose-request.mjs RUN NEW_OUTPUT_DIRECTORY');
- const {payload,report}=await reconstruct(run);mkdirSync(out,{mode:0o700});writeFileSync(join(out,'payload.json'),JSON.stringify(payload),{mode:0o600});writeFileSync(join(out,'inspection.json'),JSON.stringify(report,null,2));console.log(JSON.stringify(report));
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const [capturePath, output] = process.argv.slice(2);
+  if (!capturePath || !output) throw Error('Usage: diagnose-request.mjs CAPTURED_REQUEST.json NEW_OUTPUT_DIRECTORY');
+  const { payload, report } = await inspectCapturedRequest(capturePath);
+  mkdirSync(output, { mode: 0o700 });
+  writeFileSync(join(output, 'payload.json'), JSON.stringify(payload), { mode: 0o600 });
+  writeFileSync(join(output, 'inspection.json'), JSON.stringify(report, null, 2), { mode: 0o600 });
+  console.log(JSON.stringify(report));
 }

package/tools/benchmark/eval-common.mjs

@@ -22,11 +22,11 @@ export async function serve(cmd,args,cwd,env,port,logPath){
 export async function json(url,path,body){const r=await fetch(url+path,{method:body===undefined?'GET':'POST',headers:{'Content-Type':'application/json'},body:body===undefined?undefined:JSON.stringify(body),signal:AbortSignal.timeout(5000)});return {status:r.status,body:await r.json()};}
 export async function browser(root){
  mkdirSync(root,{recursive:true});const port=await freePort();
- const driver=spawn('geckodriver',['--port',String(port),'--profile-root',root],{detached:true,stdio:['ignore','ignore','pipe'],env:safeEnv({MOZ_HEADLESS:'1'})});let log='';driver.stderr.on('data',c=>log=(log+c).slice(-1000000));let failure;driver.on('error',e=>failure=e);
+ const driver=spawn('geckodriver',['--host','127.0.0.1','--port',String(port),'--profile-root',root],{detached:true,stdio:['ignore','pipe','pipe'],env:safeEnv({MOZ_HEADLESS:'1'})});let log='';const append=c=>log=(log+c).slice(-1000000);driver.stdout.on('data',append);driver.stderr.on('data',append);let failure;driver.on('error',e=>failure=e);driver.on('exit',(code,signal)=>{if(code!==null&&code!==0)failure ||= Error(`geckodriver exited ${code}${signal?` (${signal})`:''}`);});
  const base=`http://127.0.0.1:${port}`;
- async function call(path,body,method=body===undefined?'GET':'POST'){const r=await fetch(base+path,{method,headers:{'Content-Type':'application/json'},body:body===undefined?undefined:JSON.stringify(body),signal:AbortSignal.timeout(45000)});const d=await r.json();if(!r.ok||d.value?.error)throw Error(JSON.stringify(d.value));return d.value;}
+ async function call(path,body,method=body===undefined?'GET':'POST',timeout=45000){const r=await fetch(base+path,{method,headers:{'Content-Type':'application/json'},body:body===undefined?undefined:JSON.stringify(body),signal:AbortSignal.timeout(timeout)});const d=await r.json();if(!r.ok||d.value?.error)throw Error(JSON.stringify(d.value));return d.value;}
  let session;
- try{for(let i=0;i<100;i++){if(failure)throw failure;try{await call('/status');break;}catch{}await wait(100);}session=(await call('/session',{capabilities:{alwaysMatch:{browserName:'firefox','moz:firefoxOptions':{args:['-headless']}}}})).sessionId;}catch(e){await stopGroup(driver);writeFileSync(root+'/driver.log',log);throw Error('Browser infrastructure: '+e.message);}
+  try{let ready=false;for(let i=0;i<60;i++){if(failure)throw failure;try{await call('/status',undefined,'GET',1000);ready=true;break;}catch{}await wait(250);}if(!ready)throw Error('geckodriver readiness timeout after 15 seconds');session=(await call('/session',{capabilities:{alwaysMatch:{browserName:'firefox','moz:firefoxOptions':{args:['-headless']}}}},'POST',30000)).sessionId;}catch(e){await stopGroup(driver);writeFileSync(root+'/driver.log',log);throw Error(`Browser infrastructure: ${e.message}${log?`\ngeckodriver log: ${log.slice(-4000)}`:''}`);}
  const prefix='/session/'+session;
  return {call:(p,b,m)=>call(prefix+p,b,m),exec:script=>call(prefix+'/execute/sync',{script:'return eval(arguments[0]);',args:[script]}),async shot(path){writeFileSync(path,Buffer.from(await call(prefix+'/screenshot'),'base64'));},async close(){try{await call(prefix,undefined,'DELETE');}finally{await stopGroup(driver);writeFileSync(root+'/driver.log',log);}}};
 }

package/tools/benchmark/evaluators.test.mjs

@@ -1,13 +1,13 @@
 import test from 'node:test';import assert from 'node:assert/strict';
-import{mkdtempSync,mkdirSync,existsSync,cpSync}from'node:fs';import{join,dirname}from'node:path';import{fileURLToPath}from'node:url';
+import{mkdtempSync,existsSync,cpSync}from'node:fs';import{join,dirname}from'node:path';import{fileURLToPath}from'node:url';import{homedir}from'node:os';
 import{evaluateShop}from'./eval-shop.mjs';import{evaluateVoxel}from'./eval-voxel.mjs';import{command}from'./eval-common.mjs';
 const fixtures=join(dirname(fileURLToPath(import.meta.url)),'fixtures/shop');
 test('full shop evaluator passes reference and rejects rounding/idempotency mutants over real HTTP/Firefox',async()=>{
- const base='/home/baissi/benchmarks/infrastructure-tests';mkdirSync(base,{recursive:true});const root=mkdtempSync(join(base,'shop-'));
+ const root=mkdtempSync(join(homedir(),'ctg-benchmark-shop-'));
  for(const mutant of ['', 'round','idempotency']){const score=await evaluateShop(fixtures,join(root,mutant||'reference'),{environment:{FIXTURE_MUTANT:mutant}});if(!mutant)assert.equal(score.passed,score.total,JSON.stringify(score));else assert.ok(score.results.some(r=>!r.passed&&r.name.includes(mutant==='round'?'exact-cent':'idempotent')),JSON.stringify(score));}
 });
 test('voxel evaluator regression on a copy of the retained v2 candidate, not an independent reference',async(t)=>{
- const original='/home/baissi/benchmarks/deepseek-jev-v2/voxel-plain/workspace';if(!existsSync(original)){t.skip('Historical candidate unavailable');return;}
- const base='/home/baissi/benchmarks/infrastructure-tests';mkdirSync(base,{recursive:true});const root=mkdtempSync(join(base,'voxel-')),workspace=join(root,'workspace');cpSync(original,workspace,{recursive:true,filter:path=>!['target','.git','.harness'].includes(path.split('/').at(-1))});const score=await evaluateVoxel(workspace,join(root,'evaluation'));assert.equal(score.passed,score.total,JSON.stringify(score));
+ const original=process.env.CTG_VOXEL_REGRESSION_WORKSPACE;if(!original||!existsSync(original)){t.skip('Set CTG_VOXEL_REGRESSION_WORKSPACE to the retained candidate workspace');return;}
+ const root=mkdtempSync(join(homedir(),'ctg-benchmark-voxel-')),workspace=join(root,'workspace');cpSync(original,workspace,{recursive:true,filter:path=>!['target','.git','.harness'].includes(path.split('/').at(-1))});const score=await evaluateVoxel(workspace,join(root,'evaluation'));assert.equal(score.passed,score.total,JSON.stringify(score));
 });
 test('evaluator children do not inherit supervisor credentials or NODE_OPTIONS',async()=>{process.env.BENCH_FAKE_SECRET='secret';const r=await command(process.execPath,['-e','console.log(process.env.BENCH_FAKE_SECRET || "clean")'],process.cwd());assert.equal(r.stdout.trim(),'clean');delete process.env.BENCH_FAKE_SECRET;});