cool-workflow 0.1.97 → 0.2.0

package/dist/{telemetry-demo.js → shell/telemetry-demo.js}

@@ -1,42 +1,64 @@
 "use strict";
-// Tamper-evidence demo (the one-command proof) — make CW's central claim VISIBLE:
-// an audit record proves its own integrity, and ANYONE can re-verify it offline
-// with only the public key. No competitor's pipeline telemetry can do this.
+// shell/telemetry-demo.ts — `cw demo tamper|bundle`: the hermetic,
+// offline trust proofs. Impure (fs, ephemeral keypair generation,
+// tmpdir), so this lives in shell/ not core/.
 //
-// Fully hermetic + deterministic: generates an EPHEMERAL ed25519 keypair, builds
-// a REAL telemetry ledger through the production append API (appendTelemetryAttestation
-// + signTelemetry — byte-identical to what a live attested run writes), then
-// demonstrates all THREE tamper-evidence layers catching a forgery:
-//   A) LEDGER layer — flip a recorded verdict on disk (unattested -> attested, the
-//      canonical "forge a green record" attack) -> verifyTelemetryLedger recomputes
-//      every hash independently, so the edited record's hash mismatches AND every
-//      record after it breaks the chain (cascade).
-//   B) SIGNATURE layer — inflate the reported tokens but keep the original ed25519
-//      signature -> verifyTelemetryAttestation rejects it ("signature does not match").
-//   C) RESULT layer — edit the agent's SIGNED FINDING after signing. The executor
-//      binds sha256(result.md) into the ed25519 payload; CW re-derives the digest
-//      from the result file at verify time, so an edited finding no longer joins the
-//      signature. This is the threat a usage-only signature never covered.
+// MILESTONE 8. Byte-exact port of the old build's src/telemetry-demo.ts.
+// Fully hermetic + deterministic: an EPHEMERAL ed25519 keypair, fixed
+// hops/usages, a pinned `now`, no network, no model. Only the keypair
+// itself varies per run and never leaves this module.
 //
-// No model, no network, no API key, no second repo — runs in a private tmpdir.
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+// Evidence: SPEC/ledger-trust.md "`cw demo tamper`", "`cw demo bundle`";
+// plugins/cool-workflow/src/telemetry-demo.ts:1-424 (byte-exact source).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatTelemetryVerify = formatTelemetryVerify;
 exports.formatTamperDemo = formatTamperDemo;
 exports.runTamperDemo = runTamperDemo;
 exports.runBundleDemo = runBundleDemo;
 exports.formatBundleDemo = formatBundleDemo;
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-const telemetry_ledger_1 = require("./telemetry-ledger");
-const telemetry_attestation_1 = require("./telemetry-attestation");
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const hash_1 = require("../core/hash");
+const telemetry_attestation_1 = require("../core/trust/telemetry-attestation");
+const telemetry_ledger_io_1 = require("./telemetry-ledger-io");
+const run_paths_1 = require("../core/state/run-paths");
+const run_store_1 = require("./run-store");
 const run_export_1 = require("./run-export");
-const state_1 = require("./state");
-const execution_backend_1 = require("./execution-backend");
 /** Human-facing render of `telemetry verify <run>`. */
 function formatTelemetryVerify(r) {
     const keyUnreadable = r.failedChecks.some((c) => c.code === "telemetry-pubkey-unreadable");
@@ -58,7 +80,7 @@ function formatTelemetryVerify(r) {
     const fails = r.failedChecks.length ? "\n" + r.failedChecks.map((c) => `   ✗ ${c.name}  ${c.code || ""}`).join("\n") : "";
     return `telemetry verify ${r.runId}\n${head}\n${tally}${sig}${fails}`;
 }
-/** Human-facing render of `demo tamper` — the visible tamper-evidence proof. */
+/** Human-facing render of `demo tamper`. */
 function formatTamperDemo(r) {
     const lines = [];
     lines.push(`cw demo tamper — tamper-evidence proof (hermetic, ${r.trustKey} key)`);
@@ -78,214 +100,222 @@ function formatTamperDemo(r) {
         : "VERDICT: PROOF FAILED ✗ — a tamper went undetected. This is a regression in the integrity guarantee.");
     return lines.join("\n");
 }
-// Three hops with a deliberate mix: two signed/attested, one unattested — so the
-// ledger-layer tamper can forge the unattested verdict into "attested" (the exact
-// threat the ledger exists to catch).
+// Three hops with a deliberate mix: two signed/attested, one unattested —
+// so the ledger-layer tamper can forge the unattested verdict into
+// "attested" (the exact threat the ledger exists to catch).
 const HOPS = [
-    { workerId: "w-map", taskId: "map:server-api", promptDigest: (0, execution_backend_1.sha256)("map:server-api"), usage: { input_tokens: 2117, output_tokens: 1911 }, attestation: "attested" },
-    { workerId: "w-assess", taskId: "assess:security", promptDigest: (0, execution_backend_1.sha256)("assess:security"), usage: { input_tokens: 1840, output_tokens: 1502 }, attestation: "unattested" },
-    { workerId: "w-verdict", taskId: "verdict:synthesis", promptDigest: (0, execution_backend_1.sha256)("verdict:synthesis"), usage: { input_tokens: 980, output_tokens: 770 }, attestation: "attested" }
+    { workerId: "w-map", taskId: "map:server-api", promptDigest: (0, hash_1.sha256)("map:server-api"), usage: { input_tokens: 2117, output_tokens: 1911 }, attestation: "attested" },
+    { workerId: "w-assess", taskId: "assess:security", promptDigest: (0, hash_1.sha256)("assess:security"), usage: { input_tokens: 1840, output_tokens: 1502 }, attestation: "unattested" },
+    { workerId: "w-verdict", taskId: "verdict:synthesis", promptDigest: (0, hash_1.sha256)("verdict:synthesis"), usage: { input_tokens: 980, output_tokens: 770 }, attestation: "attested" },
 ];
 const DEMO_NOW = "2026-01-01T00:00:00.000Z";
 function failingChecks(checks) {
     return checks.filter((c) => !c.pass).map((c) => `${c.name}: ${c.code}`);
 }
-/** Run the full tamper-evidence demonstration in a private tmpdir (cleaned up
- *  unless `keepDir` is set). Pure of clock/network; the only nondeterminism is
- *  the ephemeral keypair, which never leaves this function. */
+/** Run the full tamper-evidence demonstration in a private tmpdir
+ *  (cleaned up unless `keepDir` is set). Deterministic except for the
+ *  ephemeral keypair, which never leaves this function. */
 function runTamperDemo(options = {}) {
-    const runDir = options.dir || node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-tamper-demo-"));
-    node_fs_1.default.mkdirSync(runDir, { recursive: true });
+    const runDir = options.dir || fs.mkdtempSync(path.join(os.tmpdir(), "cw-tamper-demo-"));
+    fs.mkdirSync(runDir, { recursive: true });
     const runId = "demo-tamper-run";
     // Minimal run shape: the ledger API uses only id + paths.runDir.
     const run = { id: runId, paths: { runDir } };
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519");
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
     const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
     const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-    // 1. Build a REAL ledger through the production append API, signing each
-    //    attested hop's usage with the ephemeral key.
+    // 1. Build a REAL ledger through the production append API, signing
+    //    each attested hop's usage with the ephemeral key.
     const signed = [];
     for (const hop of HOPS) {
         const ctx = { runId, taskId: hop.taskId, promptDigest: hop.promptDigest };
         const signature = hop.attestation === "attested" ? (0, telemetry_attestation_1.signTelemetry)(hop.usage, privateKeyPem, ctx) : undefined;
-        (0, telemetry_ledger_1.appendTelemetryAttestation)(run, {
+        (0, telemetry_ledger_io_1.appendTelemetryAttestation)(run, {
             workerId: hop.workerId,
             taskId: hop.taskId,
             promptDigest: hop.promptDigest,
             reportedUsage: hop.usage,
             usageSignature: signature,
             attestation: hop.attestation,
-            now: DEMO_NOW
+            now: DEMO_NOW,
         });
         signed.push({ hop, signature });
     }
-    // 2. Baseline: the clean ledger verifies, and every signed hop's signature is valid.
-    const clean = (0, telemetry_ledger_1.verifyTelemetryLedger)(run);
-    const signaturesValid = signed.filter((s) => s.signature && (0, telemetry_attestation_1.verifyTelemetryAttestation)(s.hop.usage, s.signature, publicKeyPem, { runId, taskId: s.hop.taskId, promptDigest: s.hop.promptDigest }).status === "attested").length;
+    // 2. Baseline: the clean ledger verifies, and every signed hop's
+    //    signature is valid.
+    const clean = (0, telemetry_ledger_io_1.verifyTelemetryLedger)(run);
+    const signaturesValid = signed.filter((s) => s.signature &&
+        (0, telemetry_attestation_1.verifyTelemetryAttestation)(s.hop.usage, s.signature, publicKeyPem, { runId, taskId: s.hop.taskId, promptDigest: s.hop.promptDigest }).status === "attested").length;
     const baseline = { ledgerVerified: clean.verified, signaturesValid, records: clean.records.length };
     const layers = [];
-    // 3a. LEDGER layer — the SOPHISTICATED forgery: flip record[1]'s verdict
-    //     "unattested" -> "attested" AND recompute its recordHash to cover the edit,
-    //     so the per-record digest check passes. The chain still catches it: record[2]
-    //     was linked to the ORIGINAL record[1] hash, so chain-link[2] now breaks. This
-    //     is the point of the chain over a flat per-record hash — fixing one record's
-    //     hash cannot be hidden without rewriting every record after it too.
-    const ledgerFile = (0, telemetry_ledger_1.telemetryLedgerPath)(run);
-    const ledgerJson = JSON.parse(node_fs_1.default.readFileSync(ledgerFile, "utf8"));
+    // 3a. LEDGER layer — flip record[1]'s verdict "unattested" -> "attested"
+    //     AND recompute its recordHash to cover the edit, so the per-record
+    //     digest check passes. The chain still catches it: record[2] was
+    //     linked to the ORIGINAL record[1] hash, so chain-link[2] breaks.
+    const ledgerFile = (0, telemetry_ledger_io_1.telemetryLedgerPath)(run);
+    const ledgerJson = JSON.parse(fs.readFileSync(ledgerFile, "utf8"));
     ledgerJson.records[1].attestation = "attested";
     const { recordHash: _stale, ...rest1 } = ledgerJson.records[1];
-    ledgerJson.records[1].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest1); // attacker re-seals the local hash
-    node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(ledgerJson, null, 2));
-    const afterLedger = (0, telemetry_ledger_1.verifyTelemetryLedger)(run);
+    ledgerJson.records[1].recordHash = (0, telemetry_ledger_io_1.computeRecordHash)(rest1); // attacker re-seals the local hash
+    fs.writeFileSync(ledgerFile, JSON.stringify(ledgerJson, null, 2));
+    const afterLedger = (0, telemetry_ledger_io_1.verifyTelemetryLedger)(run);
     layers.push({
         layer: "ledger",
         tamper: `forged record[1] verdict "unattested" -> "attested" AND recomputed its recordHash to cover the edit`,
         before: { verified: clean.verified, detail: `${clean.records.length} records: chain intact, all hashes recompute` },
         after: { verified: afterLedger.verified, detail: `the hash chain caught it: ${failingChecks(afterLedger.checks).join(", ")}` },
-        failures: failingChecks(afterLedger.checks)
+        failures: failingChecks(afterLedger.checks),
     });
-    // 3b. SIGNATURE layer — inflate hop-0's reported output tokens, keep the original
-    //     signature. The ed25519 verify binds the exact usage bytes, so it rejects.
+    // 3b. SIGNATURE layer — inflate hop-0's reported output tokens, keep
+    //     the original signature.
     const target = signed[0];
     const inflated = { ...target.hop.usage, output_tokens: target.hop.usage.output_tokens * 10 };
     const sigCheck = (0, telemetry_attestation_1.verifyTelemetryAttestation)(inflated, target.signature, publicKeyPem, {
         runId,
         taskId: target.hop.taskId,
-        promptDigest: target.hop.promptDigest
+        promptDigest: target.hop.promptDigest,
     });
     const sigCleanCheck = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, target.signature, publicKeyPem, {
         runId,
         taskId: target.hop.taskId,
-        promptDigest: target.hop.promptDigest
+        promptDigest: target.hop.promptDigest,
     });
     layers.push({
         layer: "signature",
         tamper: `inflated record[0] reported output_tokens ${target.hop.usage.output_tokens} -> ${inflated.output_tokens}, reused the original ed25519 signature`,
         before: { verified: sigCleanCheck.status === "attested", detail: `signature verifies against the reported usage (${sigCleanCheck.algorithm || "ed25519"})` },
         after: { verified: sigCheck.status === "attested", detail: sigCheck.reason || sigCheck.status },
-        failures: sigCheck.status === "attested" ? [] : [`signature: ${sigCheck.reason}`]
+        failures: sigCheck.status === "attested" ? [] : [`signature: ${sigCheck.reason}`],
     });
-    // 3c. RESULT layer — the REAL threat the result-bound signature closes: the agent's
-    //     signed FINDING is edited after signing. The executor binds sha256(result.md)
-    //     into the ed25519 payload (a 5-field, result-COVERING signature); CW re-derives
-    //     the digest from the result file at verify time. An edited finding hashes to a
-    //     different digest, so the signature joins neither the 5-field nor the 4-field
-    //     payload and the verify rejects it. A usage-only signature never covered this.
+    // 3c. RESULT layer — the agent's signed FINDING is edited after
+    //     signing. CW re-derives the digest from the result text at verify
+    //     time, so the edited finding no longer joins the signature.
     const findingSigned = "Finding: auth bypass in login() — severity HIGH";
     const findingEdited = findingSigned.replace("HIGH", "LOW");
     const resultCtx = { runId, taskId: target.hop.taskId, promptDigest: target.hop.promptDigest };
-    const resultSignature = (0, telemetry_attestation_1.signTelemetry)(target.hop.usage, privateKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingSigned) });
-    // Baseline: the signed finding verifies, and the signature actually COVERED the result.
-    const resultClean = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingSigned) });
-    // Tamper: CW re-derives the digest from the EDITED finding -> no longer the signed digest.
-    const resultCheck = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingEdited) });
+    const resultSignature = (0, telemetry_attestation_1.signTelemetry)(target.hop.usage, privateKeyPem, { ...resultCtx, resultDigest: (0, hash_1.sha256)(findingSigned) });
+    const resultClean = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, hash_1.sha256)(findingSigned) });
+    const resultCheck = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, hash_1.sha256)(findingEdited) });
     layers.push({
         layer: "result",
         tamper: `edited the agent's signed finding "severity HIGH" -> "severity LOW" after it was signed`,
         before: {
             verified: resultClean.status === "attested" && resultClean.coversResult === true,
-            detail: `the signed finding verifies — ed25519 binds usage + sha256(result), result-covering`
+            detail: `the signed finding verifies — ed25519 binds usage + sha256(result), result-covering`,
         },
         after: { verified: resultCheck.status === "attested", detail: resultCheck.reason || resultCheck.status },
-        failures: resultCheck.status === "attested" ? [] : [`result: ${resultCheck.reason}`]
+        failures: resultCheck.status === "attested" ? [] : [`result: ${resultCheck.reason}`],
     });
     if (!options.keepDir && !options.dir)
-        node_fs_1.default.rmSync(runDir, { recursive: true, force: true });
+        fs.rmSync(runDir, { recursive: true, force: true });
     const proven = baseline.ledgerVerified &&
         baseline.signaturesValid === signed.filter((s) => s.signature).length &&
         layers.every((l) => l.before.verified && !l.after.verified && l.failures.length > 0);
     return { schemaVersion: 1, runId, workers: HOPS.length, trustKey: "ephemeral-ed25519", baseline, layers, proven };
 }
 function runBundleDemo(options = {}) {
-    const workdir = options.dir || node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-bundle-demo-"));
-    node_fs_1.default.mkdirSync(workdir, { recursive: true });
+    const workdir = options.dir || fs.mkdtempSync(path.join(os.tmpdir(), "cw-bundle-demo-"));
+    fs.mkdirSync(workdir, { recursive: true });
     const runId = "demo-bundle-run";
-    const runDir = node_path_1.default.join(workdir, ".cw", "runs", runId);
-    const paths = (0, state_1.createRunPaths)(runDir);
-    (0, state_1.ensureRunDirs)(paths);
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519");
+    const runDir = path.join(workdir, ".cw", "runs", runId);
+    const paths = (0, run_paths_1.createRunPaths)(runDir);
+    (0, run_paths_1.ensureRunDirs)(paths);
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
     const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
     const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-    // Build a real signed ledger + a cited report, the way an attested run would.
+    // Build a real signed ledger + a cited report, the way an attested run
+    // would.
     const ledgerRun = { id: runId, paths };
     for (const hop of HOPS) {
         const ctx = { runId, taskId: hop.taskId, promptDigest: hop.promptDigest };
-        (0, telemetry_ledger_1.appendTelemetryAttestation)(ledgerRun, {
+        (0, telemetry_ledger_io_1.appendTelemetryAttestation)(ledgerRun, {
             workerId: hop.workerId,
             taskId: hop.taskId,
             promptDigest: hop.promptDigest,
             reportedUsage: hop.usage,
             usageSignature: hop.attestation === "attested" ? (0, telemetry_attestation_1.signTelemetry)(hop.usage, privateKeyPem, ctx) : undefined,
             attestation: hop.attestation,
-            now: DEMO_NOW
+            now: DEMO_NOW,
         });
     }
-    node_fs_1.default.writeFileSync(node_path_1.default.join(runDir, "report.md"), "# Architecture review\n\nRisk: src/server.js:18 — unauthenticated route.\n", "utf8");
+    fs.writeFileSync(path.join(runDir, "report.md"), "# Architecture review\n\nRisk: src/server.js:18 — unauthenticated route.\n", "utf8");
     const attestedCount = HOPS.filter((h) => h.attestation === "attested").length;
     const fullRun = {
-        schemaVersion: 1, id: runId, createdAt: DEMO_NOW, updatedAt: DEMO_NOW, cwd: workdir,
+        schemaVersion: 1,
+        id: runId,
+        createdAt: DEMO_NOW,
+        updatedAt: DEMO_NOW,
+        cwd: workdir,
         workflow: { id: "demo", title: "Demo", summary: "", limits: { maxAgents: 1, maxConcurrentAgents: 1 } },
-        inputs: { question: "what are the risks?" }, loopStage: "interpret",
-        phases: [], tasks: [], dispatches: [], commits: [], paths, nodes: [], contracts: []
+        inputs: { question: "what are the risks?" },
+        loopStage: "interpret",
+        phases: [],
+        tasks: [],
+        dispatches: [],
+        commits: [],
+        paths,
+        nodes: [],
+        contracts: [],
+    };
+    (0, run_store_1.saveCheckpoint)(fullRun);
+    const ledgerFile = (0, telemetry_ledger_io_1.telemetryLedgerPath)(ledgerRun);
+    const cleanLedger = fs.readFileSync(ledgerFile, "utf8");
+    const exportSealed = (out) => {
+        (0, run_export_1.exportRun)(fullRun, out, { trustPublicKey: publicKeyPem });
     };
-    (0, state_1.saveCheckpoint)(fullRun);
-    const ledgerFile = (0, telemetry_ledger_1.telemetryLedgerPath)(ledgerRun);
-    const cleanLedger = node_fs_1.default.readFileSync(ledgerFile, "utf8");
-    const exportSealed = (out) => { (0, run_export_1.exportRun)(fullRun, out, { trustPublicKey: publicKeyPem }); };
-    // Baseline: a clean sealed bundle verifies offline; the embedded key reverifies
-    // every signed hop.
-    const cleanBundle = node_path_1.default.join(workdir, "clean.cwrun.json");
+    // Baseline: a clean sealed bundle verifies offline; the embedded key
+    // reverifies every signed hop.
+    const cleanBundle = path.join(workdir, "clean.cwrun.json");
     exportSealed(cleanBundle);
     const clean = (0, run_export_1.verifyReportBundle)(cleanBundle);
     const baseline = { ok: clean.ok, telemetryVerified: clean.telemetryVerified, signaturesReverified: clean.signaturesReverified };
     const layers = [];
-    // CHAIN forgery: flip record[1]'s verdict and reseal its recordHash; record[2]'s
-    // prevHash still points at the original hash, so the chain breaks — even though
-    // every archive file digest (computed at export over the tampered bytes) is valid.
-    // This is exactly what inspect-archive alone cannot catch.
+    // CHAIN forgery: flip record[1]'s verdict and reseal its recordHash;
+    // record[2]'s prevHash still points at the original hash, so the chain
+    // breaks — even though every archive file digest is valid.
     {
         const j = JSON.parse(cleanLedger);
         j.records[1].attestation = "attested";
         const { recordHash: _drop, ...rest } = j.records[1];
-        j.records[1].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
-        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
-        const forged = node_path_1.default.join(workdir, "forged-chain.cwrun.json");
+        j.records[1].recordHash = (0, telemetry_ledger_io_1.computeRecordHash)(rest);
+        fs.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = path.join(workdir, "forged-chain.cwrun.json");
         exportSealed(forged);
         const after = (0, run_export_1.verifyReportBundle)(forged);
-        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        fs.writeFileSync(ledgerFile, cleanLedger);
         layers.push({
             layer: "chain",
             tamper: `forged record[1] verdict "unattested" -> "attested" and resealed its recordHash; the archive's own file digests stay valid`,
             before: { ok: clean.ok, detail: `${clean.signaturesReverified} signed hop(s) reverify; chain intact` },
             after: { ok: after.ok, detail: after.telemetryVerified ? "telemetry chain still verified (UNDETECTED!)" : "the embedded hash chain broke at the next record" },
-            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`),
         });
     }
-    // SIGNATURE forgery: inflate the last attested hop's reported tokens and reseal its
-    // usage digest + recordHash so the chain AND archive digests still verify; only the
-    // ed25519 signature (over the original usage) no longer matches the inflated number.
+    // SIGNATURE forgery: inflate the last attested hop's reported tokens
+    // and reseal its usage digest + recordHash so the chain AND archive
+    // digests still verify; only the ed25519 signature no longer matches.
     {
         const j = JSON.parse(cleanLedger);
         const idx = j.records.length - 1;
         j.records[idx].reportedUsage = { ...j.records[idx].reportedUsage, output_tokens: j.records[idx].reportedUsage.output_tokens * 10 };
-        j.records[idx].reportedUsageDigest = (0, telemetry_ledger_1.reportedUsageDigest)(j.records[idx].reportedUsage);
+        j.records[idx].reportedUsageDigest = (0, telemetry_ledger_io_1.reportedUsageDigest)(j.records[idx].reportedUsage);
         const { recordHash: _drop, ...rest } = j.records[idx];
-        j.records[idx].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
-        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
-        const forged = node_path_1.default.join(workdir, "forged-sig.cwrun.json");
+        j.records[idx].recordHash = (0, telemetry_ledger_io_1.computeRecordHash)(rest);
+        fs.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = path.join(workdir, "forged-sig.cwrun.json");
         exportSealed(forged);
         const after = (0, run_export_1.verifyReportBundle)(forged);
-        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        fs.writeFileSync(ledgerFile, cleanLedger);
         layers.push({
             layer: "signature",
             tamper: `inflated the last attested hop's output_tokens 10x and resealed its digest + recordHash; the chain stays valid`,
             before: { ok: clean.ok, detail: `the embedded public key reverifies the original signature` },
             after: { ok: after.ok, detail: after.signaturesFailed > 0 ? `${after.signaturesFailed} signature(s) failed ed25519 reverify` : "signature still verified (UNDETECTED!)" },
-            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`),
         });
     }
     if (!options.keepDir && !options.dir)
-        node_fs_1.default.rmSync(workdir, { recursive: true, force: true });
+        fs.rmSync(workdir, { recursive: true, force: true });
     const proven = baseline.ok &&
         baseline.telemetryVerified &&
         baseline.signaturesReverified === attestedCount &&

package/dist/shell/telemetry-ledger-io.js

@@ -0,0 +1,132 @@
+"use strict";
+// shell/telemetry-ledger-io.ts — telemetry ledger disk IO: path
+// resolution, absent-vs-corrupt load, durable append. The pure verify
+// math lives in core/trust/telemetry-ledger.ts.
+//
+// MILESTONE 8. Byte-exact port of the old build's src/telemetry-ledger.ts
+// IO-touching half. CRITICAL invariant (v2/PLAN.md byte-compat item 12):
+// an ABSENT telemetry.json is an empty, clean-verifying chain
+// (`present:false`); a PRESENT but unparseable one is CORRUPT — reads
+// report `telemetry-ledger-corrupt`, and append THROWS
+// `TelemetryLedgerCorruptError`. It must never re-genesis over a
+// poisoned file.
+//
+// Evidence: SPEC/ledger-trust.md "Absent vs corrupt telemetry ledger",
+// invariant 3; plugins/cool-workflow/src/telemetry-ledger.ts:25-72,133-161.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportedUsageDigest = exports.computeRecordHash = exports.TELEMETRY_LEDGER_SCHEMA_VERSION = exports.TelemetryLedgerCorruptError = void 0;
+exports.telemetryLedgerPath = telemetryLedgerPath;
+exports.loadTelemetryLedger = loadTelemetryLedger;
+exports.appendTelemetryAttestation = appendTelemetryAttestation;
+exports.verifyTelemetryLedger = verifyTelemetryLedger;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fs_atomic_1 = require("./fs-atomic");
+const telemetry_ledger_1 = require("../core/trust/telemetry-ledger");
+Object.defineProperty(exports, "computeRecordHash", { enumerable: true, get: function () { return telemetry_ledger_1.computeRecordHash; } });
+Object.defineProperty(exports, "reportedUsageDigest", { enumerable: true, get: function () { return telemetry_ledger_1.reportedUsageDigest; } });
+Object.defineProperty(exports, "TelemetryLedgerCorruptError", { enumerable: true, get: function () { return telemetry_ledger_1.TelemetryLedgerCorruptError; } });
+Object.defineProperty(exports, "TELEMETRY_LEDGER_SCHEMA_VERSION", { enumerable: true, get: function () { return telemetry_ledger_1.TELEMETRY_LEDGER_SCHEMA_VERSION; } });
+function telemetryLedgerPath(run) {
+    return path.join(run.paths.runDir, "telemetry.json");
+}
+/** Read the ledger, DISTINGUISHING absent (never written -> empty chain,
+ *  fine) from corrupt (exists but unparseable/wrong shape -> fail
+ *  closed). */
+function readTelemetryLedgerState(run) {
+    const file = telemetryLedgerPath(run);
+    if (!fs.existsSync(file))
+        return { status: "absent", ledger: { schemaVersion: 1, runId: run.id, records: [] } };
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return { status: "corrupt", file };
+    }
+    if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.records)) {
+        return { status: "corrupt", file };
+    }
+    return { status: "ok", ledger: { schemaVersion: 1, runId: run.id, records: parsed.records } };
+}
+/** Load the ledger for read/append. Absent -> empty chain. Corrupt ->
+ *  THROWS, so an append can never silently re-genesis on a poisoned/
+ *  edited file. */
+function loadTelemetryLedger(run) {
+    const state = readTelemetryLedgerState(run);
+    if (state.status === "corrupt")
+        throw new telemetry_ledger_1.TelemetryLedgerCorruptError(state.file);
+    return state.ledger;
+}
+/** Append one attestation record DURABLY to the append-only chain,
+ *  linking it to the prior record (or genesis). Returns the committed
+ *  record. Throws `TelemetryLedgerCorruptError` if the file on disk is
+ *  present but unparseable — never silently re-genesis. */
+function appendTelemetryAttestation(run, input) {
+    const ledger = loadTelemetryLedger(run);
+    const now = input.now || new Date().toISOString();
+    const prevHash = ledger.records.length ? ledger.records[ledger.records.length - 1].recordHash : (0, telemetry_ledger_1.genesisPrevHash)(run.id);
+    const base = {
+        schemaVersion: 1,
+        runId: run.id,
+        recordId: (0, telemetry_ledger_1.recordId)(ledger.records.length + 1),
+        recordedAt: now,
+        workerId: input.workerId,
+        taskId: input.taskId,
+        promptDigest: input.promptDigest,
+        reportedUsageDigest: (0, telemetry_ledger_1.reportedUsageDigest)(input.reportedUsage),
+        ...(input.reportedUsage ? { reportedUsage: input.reportedUsage } : {}),
+        usageSignature: input.usageSignature,
+        ...(input.resultDigest ? { resultDigest: input.resultDigest } : {}),
+        attestation: input.attestation,
+        attestationReason: input.attestationReason,
+        prevHash,
+    };
+    const record = { ...base, recordHash: (0, telemetry_ledger_1.computeRecordHash)(base) };
+    ledger.records.push(record);
+    (0, fs_atomic_1.writeJson)(telemetryLedgerPath(run), ledger, { durable: true });
+    return record;
+}
+/** Re-prove the whole telemetry chain for a run, reading from disk.
+ *  Absent -> present:false/verified:true (nothing to prove). Corrupt ->
+ *  present:true/verified:false with the `telemetry-ledger-corrupt`
+ *  check, never thrown. */
+function verifyTelemetryLedger(run) {
+    const state = readTelemetryLedgerState(run);
+    if (state.status === "corrupt")
+        return (0, telemetry_ledger_1.corruptTelemetryLedgerVerification)();
+    return (0, telemetry_ledger_1.verifyTelemetryLedgerRecords)(run.id, state.ledger.records);
+}