elanous 0.2.40 → 0.2.42

package/src/ux-sim/mock-scenario-catalog.ts

@@ -0,0 +1,156 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export interface MockScenarioDevice {
+  id: string;
+  name: string;
+  implementation: string[];
+  tests: string[];
+  target: string;
+  inputs: string[];
+  observations: string[];
+}
+
+export interface MockScenarioEntry {
+  id: string;
+  name: string;
+  kind: string;
+  device: string;
+  implementation: string[];
+  tests: string[];
+  trigger: string;
+  observe: string[];
+  expected: string;
+}
+
+export interface MockScenarioCatalog {
+  version: 1;
+  runEvidence: {
+    scope: string;
+    runId: string;
+    event: { category: string; name: string };
+    persistence: string;
+    artifact: string;
+  };
+  devices: MockScenarioDevice[];
+  scenarios: MockScenarioEntry[];
+  discovery: { trackedRoot: string; candidateRoots: string[]; limits: string };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function requireString(value: unknown, path: string): string {
+  if (typeof value !== 'string' || value.trim() === '') throw new Error(`${path} must be a non-empty string`);
+  return value;
+}
+
+function requireStringArray(value: unknown, path: string, allowEmpty = false): string[] {
+  if (!Array.isArray(value) || (!allowEmpty && value.length === 0) || value.some((item) => typeof item !== 'string' || item.trim() === '')) {
+    throw new Error(`${path} must be ${allowEmpty ? 'an' : 'a non-empty'} array of non-empty strings`);
+  }
+  return value as string[];
+}
+
+function uniqueIds(rows: unknown[], path: string): Set<string> {
+  const ids = new Set<string>();
+  rows.forEach((row, index) => {
+    if (!isRecord(row)) throw new Error(`${path}[${index}] must be an object`);
+    const id = requireString(row.id, `${path}[${index}].id`);
+    if (ids.has(id)) throw new Error(`${path} contains duplicate id: ${id}`);
+    ids.add(id);
+  });
+  return ids;
+}
+
+/** Validate the checked-in index before CLI output or scenario metadata is consumed. */
+export function parseMockScenarioCatalog(value: unknown): MockScenarioCatalog {
+  if (!isRecord(value) || value.version !== 1) throw new Error('mock scenario catalog must declare version: 1');
+  if (!Array.isArray(value.devices) || !Array.isArray(value.scenarios)) throw new Error('mock scenario catalog requires devices and scenarios arrays');
+  const deviceIds = uniqueIds(value.devices, 'devices');
+  uniqueIds(value.scenarios, 'scenarios');
+
+  const devices = value.devices.map((row, index): MockScenarioDevice => {
+    if (!isRecord(row)) throw new Error(`devices[${index}] must be an object`);
+    return {
+      id: requireString(row.id, `devices[${index}].id`),
+      name: requireString(row.name, `devices[${index}].name`),
+      implementation: requireStringArray(row.implementation, `devices[${index}].implementation`),
+      tests: requireStringArray(row.tests, `devices[${index}].tests`),
+      target: requireString(row.target, `devices[${index}].target`),
+      inputs: requireStringArray(row.inputs, `devices[${index}].inputs`),
+      observations: requireStringArray(row.observations, `devices[${index}].observations`),
+    };
+  });
+  const scenarios = value.scenarios.map((row, index): MockScenarioEntry => {
+    if (!isRecord(row)) throw new Error(`scenarios[${index}] must be an object`);
+    const device = requireString(row.device, `scenarios[${index}].device`);
+    if (!deviceIds.has(device)) throw new Error(`scenarios[${index}] references unknown device: ${device}`);
+    return {
+      id: requireString(row.id, `scenarios[${index}].id`),
+      name: requireString(row.name, `scenarios[${index}].name`),
+      kind: requireString(row.kind, `scenarios[${index}].kind`),
+      device,
+      implementation: requireStringArray(row.implementation, `scenarios[${index}].implementation`),
+      tests: requireStringArray(row.tests, `scenarios[${index}].tests`),
+      trigger: requireString(row.trigger, `scenarios[${index}].trigger`),
+      observe: requireStringArray(row.observe, `scenarios[${index}].observe`),
+      expected: requireString(row.expected, `scenarios[${index}].expected`),
+    };
+  });
+  if (!isRecord(value.runEvidence) || !isRecord(value.runEvidence.event)) throw new Error('runEvidence and runEvidence.event are required');
+  if (!isRecord(value.discovery)) throw new Error('discovery is required');
+  const runEvidence = value.runEvidence;
+  const event = runEvidence.event;
+  const discovery = value.discovery;
+  return {
+    version: 1,
+    devices,
+    scenarios,
+    runEvidence: {
+      scope: requireString(runEvidence.scope, 'runEvidence.scope'),
+      runId: requireString(runEvidence.runId, 'runEvidence.runId'),
+      event: { category: requireString(event.category, 'runEvidence.event.category'), name: requireString(event.name, 'runEvidence.event.name') },
+      persistence: requireString(runEvidence.persistence, 'runEvidence.persistence'),
+      artifact: requireString(runEvidence.artifact, 'runEvidence.artifact'),
+    },
+    discovery: {
+      trackedRoot: requireString(discovery.trackedRoot, 'discovery.trackedRoot'),
+      candidateRoots: requireStringArray(discovery.candidateRoots, 'discovery.candidateRoots'),
+      limits: requireString(discovery.limits, 'discovery.limits'),
+    },
+  };
+}
+
+export function loadMockScenarioCatalog(): MockScenarioCatalog {
+  const path = fileURLToPath(new URL('./mock-scenario-catalog.json', import.meta.url));
+  return parseMockScenarioCatalog(JSON.parse(readFileSync(path, 'utf8')) as unknown);
+}
+
+export function renderMockScenarioList(catalog: MockScenarioCatalog): string[] {
+  return [
+    'Mock scenario catalog · reusable devices and scenario references',
+    ...catalog.scenarios.map((scenario) => `${scenario.id}\t${scenario.kind}\t${scenario.name}`),
+    `장치 ${catalog.devices.length} · 시나리오 ${catalog.scenarios.length} · 자세히: bun scripts/ux-sim.ts show <MS-id>`,
+  ];
+}
+
+export function renderMockScenarioDetails(catalog: MockScenarioCatalog, id: string): string[] {
+  const scenario = catalog.scenarios.find((entry) => entry.id === id);
+  if (!scenario) throw new Error(`unknown mock scenario id: ${id}`);
+  const device = catalog.devices.find((entry) => entry.id === scenario.device)!;
+  return [
+    `${scenario.id} · ${scenario.name}`,
+    `유형: ${scenario.kind}`,
+    `장치: ${device.name} (${device.id})`,
+    `대상: ${device.target}`,
+    `입력: ${device.inputs.join(' · ')}`,
+    `주입: ${scenario.trigger}`,
+    `관측: ${scenario.observe.join(' · ')}`,
+    `기대: ${scenario.expected}`,
+    `구현: ${scenario.implementation.join(' · ')}`,
+    `시험: ${scenario.tests.join(' · ')}`,
+    `ScenarioV0 실행 증거: ${catalog.runEvidence.scope} · runId → ${catalog.runEvidence.event.category}/${catalog.runEvidence.event.name} → test logs.db · ${catalog.runEvidence.artifact}`,
+  ];
+}

package/src/ux-sim/release-sim-rig.ts

@@ -0,0 +1,262 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { getTestStateRoot } from '../nexus/paths.js';
+import { listGraphRuns, runGraph, type GraphRunState } from '../graph-runner/runner.js';
+import { resolveScenarioFilePath } from './scenario.js';
+
+const REPOSITORY_ROOT = join(import.meta.dir, '../..');
+const RELEASE_GRAPH = join(REPOSITORY_ROOT, 'graphs/release/release-loop.yaml');
+const CUT_TIP = 'a'.repeat(40);
+
+export interface ReleaseSimRigCase {
+  id: string;
+  mode?: 'baseline' | 'cut-tip-moved-after-resume';
+  fault?: { node: string; outcome: 'fail' | 'error' | 'timeout'; evidence?: Record<string, unknown> };
+  expect: { status: 'done' | 'failed' | 'resume-refused'; mustVisit: string[]; mustNotVisit: string[] };
+}
+
+export interface ReleaseSimRigScenario {
+  version: 1;
+  kind: 'release-graph';
+  id: string;
+  isolation: 'test';
+  input: { version: string; previousVersion: string };
+  cases: ReleaseSimRigCase[];
+}
+
+export interface ReleaseSimRigCaseResult {
+  id: string;
+  pass: boolean;
+  status: string;
+  path: string[];
+  dispatchedNodes: string[];
+  unexpectedEdges: Array<{ from: string; to: string; outcome: string; expectedTo?: string }>;
+  checks: { status: boolean; mustVisit: boolean; mustNotVisit: boolean; ledgerEvents: boolean };
+  injectedEvidence: Record<string, unknown>;
+  ledgerEvents: Array<Record<string, unknown>>;
+  statePath: string;
+  refusal?: string;
+}
+
+function unexpectedEdges(path: string[], state: GraphRunState, edges: Map<string, Record<string, unknown>>): ReleaseSimRigCaseResult['unexpectedEdges'] {
+  const nodes = new Map(state.nodes.map((node) => [node.nodeId, node]));
+  const issues: ReleaseSimRigCaseResult['unexpectedEdges'] = [];
+  for (let index = 0; index + 1 < path.length; index++) {
+    const from = path[index]!;
+    const to = path[index + 1]!;
+    const edge = edges.get(from);
+    const output = nodes.get(from)?.output;
+    let parsed: Record<string, unknown> = {};
+    if (typeof output === 'string') {
+      try { parsed = record(JSON.parse(output.trim().split('\n').at(-1) ?? ''), `${from} output`); } catch { /* use runner fallback below */ }
+    } else if (output && typeof output === 'object' && !Array.isArray(output)) parsed = output as Record<string, unknown>;
+    const named = typeof parsed.outcome === 'string' ? parsed.outcome : nodes.get(from)?.ok ? 'ok' : 'fail';
+    const map = edge?.map && typeof edge.map === 'object' ? edge.map as Record<string, unknown> : {};
+    const expectedTo = typeof map[named] === 'string' ? map[named] as string : typeof map[named === 'ok' ? 'ok' : 'fail'] === 'string'
+      ? map[named === 'ok' ? 'ok' : 'fail'] as string : undefined;
+    if (expectedTo !== to) issues.push({ from, to, outcome: named, ...(expectedTo ? { expectedTo } : {}) });
+  }
+  return issues;
+}
+
+function recordObservedEdges(path: string[], events: Array<Record<string, unknown>>): void {
+  for (let index = 0; index + 1 < path.length; index++) {
+    events.push({ event: 'edge-observed', from: path[index], to: path[index + 1], source: 'release-run-path' });
+  }
+}
+
+export interface ReleaseSimRigResult {
+  id: string;
+  pass: boolean;
+  universe: string;
+  cases: ReleaseSimRigCaseResult[];
+  table: Array<{ scenario: string; path: string; status: string; unexpectedEdges: string }>;
+  artifactPath: string;
+}
+
+function record(value: unknown, where: string): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${where} must be an object`);
+  return value as Record<string, unknown>;
+}
+
+function exactKeys(value: Record<string, unknown>, allowed: readonly string[], where: string): void {
+  const extra = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (extra.length) throw new Error(`${where} has unsupported key(s): ${extra.join(', ')}`);
+}
+
+function stringList(value: unknown, where: string): string[] {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || item.trim() === '')) {
+    throw new Error(`${where} must be an array of non-empty strings`);
+  }
+  return value as string[];
+}
+
+function releaseGraphShape(): { nodeIds: Set<string>; edges: Map<string, Record<string, unknown>> } {
+  const graph = record(parseYaml(readFileSync(RELEASE_GRAPH, 'utf8')), 'release graph');
+  if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges)) throw new Error('release graph nodes or edges missing');
+  const nodeIds = new Set(graph.nodes.map((value) => record(value, 'release graph node').node_id)
+    .filter((id): id is string => typeof id === 'string'));
+  const edges = new Map<string, Record<string, unknown>>();
+  for (const raw of graph.edges) {
+    const edge = record(raw, 'release edge');
+    if (typeof edge.from !== 'string' || edge.on !== 'outcome' || !edge.map || typeof edge.map !== 'object') {
+      throw new Error('release simulation requires outcome edges with explicit maps');
+    }
+    if (edges.has(edge.from)) throw new Error(`release graph has multiple outcome edges from ${edge.from}`);
+    edges.set(edge.from, edge);
+  }
+  return { nodeIds, edges };
+}
+
+export function parseReleaseSimRigScenario(source: string): ReleaseSimRigScenario {
+  const root = record(parseYaml(source), 'release simulation scenario');
+  exactKeys(root, ['version', 'kind', 'id', 'isolation', 'input', 'cases'], 'release simulation scenario');
+  if (root.version !== 1 || root.kind !== 'release-graph' || root.isolation !== 'test') {
+    throw new Error('release simulation scenario requires version: 1, kind: release-graph, isolation: test');
+  }
+  if (typeof root.id !== 'string' || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(root.id)) throw new Error('scenario.id must be lowercase letters, digits, and hyphens');
+  const input = record(root.input, 'scenario.input');
+  exactKeys(input, ['version', 'previousVersion'], 'scenario.input');
+  if (typeof input.version !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.version)
+    || typeof input.previousVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.previousVersion)) {
+    throw new Error('scenario.input requires release version and previousVersion');
+  }
+  const rawCases = root.cases;
+  if (!Array.isArray(rawCases) || rawCases.length === 0 || rawCases.length > 32) throw new Error('scenario.cases must contain 1–32 cases');
+  const { nodeIds } = releaseGraphShape();
+  const ids = new Set<string>();
+  const cases = rawCases.map((raw, index): ReleaseSimRigCase => {
+    const row = record(raw, `scenario.cases[${index}]`);
+    exactKeys(row, ['id', 'mode', 'fault', 'expect'], `scenario.cases[${index}]`);
+    if (typeof row.id !== 'string' || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(row.id) || ids.has(row.id)) throw new Error(`scenario.cases[${index}].id must be unique lowercase text`);
+    ids.add(row.id);
+    let mode: ReleaseSimRigCase['mode'];
+    if (row.mode !== undefined) {
+      if (row.mode !== 'baseline' && row.mode !== 'cut-tip-moved-after-resume') throw new Error(`scenario.cases[${index}].mode is unregistered`);
+      mode = row.mode;
+    }
+    let fault: ReleaseSimRigCase['fault'];
+    if (row.fault !== undefined) {
+      const parsed = record(row.fault, `scenario.cases[${index}].fault`);
+      exactKeys(parsed, ['node', 'outcome', 'evidence'], `scenario.cases[${index}].fault`);
+      if (typeof parsed.node !== 'string' || !nodeIds.has(parsed.node)) throw new Error(`scenario.cases[${index}].fault.node is not in the release graph`);
+      if (parsed.outcome !== 'fail' && parsed.outcome !== 'error' && parsed.outcome !== 'timeout') throw new Error(`scenario.cases[${index}].fault.outcome is unregistered`);
+      fault = { node: parsed.node, outcome: parsed.outcome, ...(parsed.evidence === undefined ? {} : { evidence: record(parsed.evidence, `scenario.cases[${index}].fault.evidence`) }) };
+    }
+    if ((mode === undefined) === (fault === undefined)) throw new Error(`scenario.cases[${index}] requires exactly one of mode or fault`);
+    const expected = record(row.expect, `scenario.cases[${index}].expect`);
+    exactKeys(expected, ['status', 'mustVisit', 'mustNotVisit'], `scenario.cases[${index}].expect`);
+    if (expected.status !== 'done' && expected.status !== 'failed' && expected.status !== 'resume-refused') throw new Error(`scenario.cases[${index}].expect.status is invalid`);
+    const mustVisit = stringList(expected.mustVisit, `scenario.cases[${index}].expect.mustVisit`);
+    const mustNotVisit = stringList(expected.mustNotVisit, `scenario.cases[${index}].expect.mustNotVisit`);
+    for (const id of [...mustVisit, ...mustNotVisit]) if (!nodeIds.has(id)) throw new Error(`scenario.cases[${index}] names unknown release node ${id}`);
+    if (mustVisit.some((id) => mustNotVisit.includes(id))) throw new Error(`scenario.cases[${index}] visits and excludes the same node`);
+    return { id: row.id, ...(mode ? { mode } : {}), ...(fault ? { fault } : {}), expect: { status: expected.status, mustVisit, mustNotVisit } };
+  });
+  return { version: 1, kind: 'release-graph', id: root.id, isolation: 'test',
+    input: { version: input.version, previousVersion: input.previousVersion }, cases };
+}
+
+function parseContext(env: NodeJS.ProcessEnv): { nodeId: string } {
+  const location = env.ELANOUS_GRAPH_CONTEXT;
+  if (!location) throw new Error('ELANOUS_GRAPH_CONTEXT missing in release simulation');
+  const context = record(JSON.parse(readFileSync(location, 'utf8')), 'release graph context');
+  if (typeof context.nodeId !== 'string') throw new Error('release graph context nodeId missing');
+  return { nodeId: context.nodeId };
+}
+
+function resultForNode(nodeId: string, fault: ReleaseSimRigCase['fault'], version: string): { exitCode: number; stdout: string; stderr: string; evidence: Record<string, unknown> } {
+  const triggeredFault = fault?.node === nodeId ? fault : undefined;
+  const outcome = triggeredFault ? triggeredFault.outcome === 'timeout' ? 'error' : triggeredFault.outcome : 'ok';
+  const evidence = triggeredFault?.evidence ?? {};
+  const commit = nodeId === 'version-release' ? { commit: CUT_TIP, tag: `v${version}` } : {};
+  const payload = { outcome, verdict: outcome === 'ok' ? 'pass' : 'fail', summary: triggeredFault ? `simulated ${triggeredFault.outcome}` : `simulated ${nodeId} success`, ...commit,
+    simulation: { injected: triggeredFault !== undefined, node: nodeId, evidence } };
+  return { exitCode: !triggeredFault ? 0 : triggeredFault.outcome === 'fail' ? 1 : triggeredFault.outcome === 'timeout' ? 124 : 2,
+    stdout: `${JSON.stringify(payload)}\n`, stderr: triggeredFault ? `SIMULATED_${triggeredFault.outcome.toUpperCase()}` : '', evidence };
+}
+
+async function runCase(scenario: ReleaseSimRigScenario, item: ReleaseSimRigCase, root: string,
+  edges: Map<string, Record<string, unknown>>): Promise<ReleaseSimRigCaseResult> {
+  const runId = `release-sim-${scenario.id}-${item.id}`;
+  const ledgerEvents: Array<Record<string, unknown>> = [];
+  const dispatchedNodes: string[] = [];
+  const runBash = async (command: string, options: { env?: NodeJS.ProcessEnv }) => {
+    const { nodeId } = parseContext(options.env ?? {});
+    if (!command.trim()) throw new Error(`empty command at simulated node ${nodeId}`);
+    dispatchedNodes.push(nodeId);
+    const result = resultForNode(nodeId, item.fault, scenario.input.version);
+    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+  };
+  const capture = (event: string, data: Record<string, unknown>) => ledgerEvents.push({ event, ...data });
+
+  if (item.mode === 'cut-tip-moved-after-resume') {
+    let beforeNode = 0;
+    const simulatedStop = new Error('simulated runner stop after cut');
+    try {
+      await runGraph(RELEASE_GRAPH, { runId, input: scenario.input, pinChildUniverse: true, quiet: true,
+        deps: { root, runBash, log: capture, beforeNode: () => { if (++beforeNode === 2) throw simulatedStop; } } });
+    } catch (error) {
+      if (error !== simulatedStop) throw error;
+    }
+    let refusal = '';
+    try {
+      await runGraph(RELEASE_GRAPH, { resumeRunId: runId, pinChildUniverse: true, quiet: true,
+        releaseCommandSource: { root: REPOSITORY_ROOT, cutTip: 'b'.repeat(40), git: () => { throw new Error('git must not be consulted after the saved tip differs'); } },
+        deps: { root, runBash, log: capture } });
+    } catch (error) { refusal = error instanceof Error ? error.message : String(error); }
+    const interrupted = listGraphRuns(root).runs.find((run) => run.runId === runId);
+    const stateFile = interrupted?.statePath ?? '';
+    const path = interrupted?.path ?? [];
+    recordObservedEdges(path, ledgerEvents);
+    const edgeIssues = interrupted ? unexpectedEdges(path, interrupted, edges) : [];
+    const statusOk = item.expect.status === 'resume-refused' && refusal.includes('release command source differs from the saved cut tip');
+    const visitOk = item.expect.mustVisit.every((id) => path.includes(id));
+    const notVisitOk = item.expect.mustNotVisit.every((id) => !path.includes(id));
+    const ledgerOk = ledgerEvents.some((row) => row.event === 'node-end')
+      && ledgerEvents.filter((row) => row.event === 'edge-observed').length === Math.max(0, path.length - 1);
+    return { id: item.id, pass: statusOk && visitOk && notVisitOk && ledgerOk && edgeIssues.length === 0, status: statusOk ? 'resume-refused' : interrupted?.status ?? 'missing',
+      path, dispatchedNodes, unexpectedEdges: edgeIssues, checks: { status: statusOk, mustVisit: visitOk, mustNotVisit: notVisitOk, ledgerEvents: ledgerOk }, injectedEvidence: {}, ledgerEvents,
+      statePath: stateFile, ...(refusal ? { refusal } : {}) };
+  }
+
+  // Initial runs have no releaseCommandSource (the runner only accepts it on resume); all node shell work is intercepted here.
+  const state = await runGraph(RELEASE_GRAPH, { runId, input: scenario.input, pinChildUniverse: true, quiet: true,
+    deps: { root, runBash, log: capture } });
+  const path = state.path;
+  recordObservedEdges(path, ledgerEvents);
+  const edgeIssues = unexpectedEdges(path, state, edges);
+  const statusOk = state.status === item.expect.status;
+  const visitOk = item.expect.mustVisit.every((id) => path.includes(id));
+  const notVisitOk = item.expect.mustNotVisit.every((id) => !path.includes(id));
+  const ledgerOk = ledgerEvents.some((row) => row.event === 'node-start') && ledgerEvents.some((row) => row.event === 'node-end')
+    && ledgerEvents.filter((row) => row.event === 'edge-observed').length === Math.max(0, path.length - 1);
+  const injectedEvidence = item.fault ? item.fault.evidence ?? {} : {};
+  return { id: item.id, pass: statusOk && visitOk && notVisitOk && ledgerOk && edgeIssues.length === 0, status: state.status, path, dispatchedNodes, unexpectedEdges: edgeIssues,
+    checks: { status: statusOk, mustVisit: visitOk, mustNotVisit: notVisitOk, ledgerEvents: ledgerOk }, injectedEvidence,
+    ledgerEvents, statePath: state.statePath };
+}
+
+export async function runReleaseSimRigScenario(source: string): Promise<ReleaseSimRigResult> {
+  const scenario = parseReleaseSimRigScenario(source);
+  const root = getTestStateRoot();
+  if (!root) throw new Error('release simulation rig requires --test isolated mode');
+  const { edges } = releaseGraphShape();
+  const cases = [];
+  for (const item of scenario.cases) cases.push(await runCase(scenario, item, root, edges));
+  const result: ReleaseSimRigResult = { id: scenario.id, pass: cases.every((item) => item.pass), universe: root, cases,
+    table: cases.map((item) => ({ scenario: item.id, path: item.path.join(' → '), status: item.status,
+      unexpectedEdges: item.unexpectedEdges.length ? JSON.stringify(item.unexpectedEdges) : 'none' })),
+    artifactPath: join(root, 'ux-sim', 'evidence', `${scenario.id}.json`) };
+  mkdirSync(join(root, 'ux-sim', 'evidence'), { recursive: true });
+  writeFileSync(result.artifactPath, `${JSON.stringify(result, null, 2)}\n`, { mode: 0o600 });
+  return result;
+}
+
+export async function runReleaseSimRigIfFile(filePath: string): Promise<ReleaseSimRigResult | null> {
+  const source = readFileSync(resolveScenarioFilePath(filePath), 'utf8');
+  if (record(parseYaml(source), 'scenario').kind !== 'release-graph') return null;
+  if (!getTestStateRoot()) throw new Error('release simulation rig requires --test isolated mode');
+  return runReleaseSimRigScenario(source);
+}

package/src/ux-sim/scenario.ts

@@ -1,10 +1,10 @@
-import { closeSync, constants, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { closeSync, constants, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { extname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash, randomUUID } from 'node:crypto';
 import { parse as parseYaml } from 'yaml';
 import { debug } from '../debug/log.js';
+import type { LogSink } from '../mss/logging/sink.js';
 import { streamCodexResponsesEvents } from '../llm.js';
 import { LogStore, StoreSink, type LogStoreRow } from '../mss/logging/log-store.js';
 import { getTestStateRoot } from '../nexus/paths.js';
@@ -24,8 +24,10 @@ export interface ScenarioV0 {
 
 export interface ScenarioResult {
   id: string;
+  runId: string;
   seed: number;
   evidenceArtifact: string;
+  runEvidence: { category: string; event: string; persisted: boolean };
   pass: boolean;
   trigger: { id: string; type: string; status: number | null; expectedCount: number; fetchCount: number; error: string | null };
   screen: { pass: boolean; containsMissing: string[]; excludesFound: string[]; snapshot: string };
@@ -35,6 +37,7 @@ export interface ScenarioResult {
 
 let previousScenarioTurn: Promise<void> = Promise.resolve();
 const REPOSITORY_ROOT = fileURLToPath(new URL('../..', import.meta.url));
+const SENSITIVE_EXPECTATION_KEY = /(?:token|secret|password|prompt|authorization|credential|api.?key|request.?body)/i;
 
 function record(value: unknown, where: string): Record<string, unknown> {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${where} must be an object`);
@@ -46,6 +49,21 @@ function exactKeys(value: Record<string, unknown>, allowed: readonly string[], w
   if (extra.length) throw new Error(`${where} has unsupported key(s): ${extra.join(', ')}`);
 }
 
+function validateExpectationData(value: Record<string, unknown>, where = 'scenario.expect.logs[0].data'): void {
+  for (const [key, entry] of Object.entries(value)) {
+    if (SENSITIVE_EXPECTATION_KEY.test(key)) throw new Error(`${where} cannot include sensitive field: ${key}`);
+    if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+      validateExpectationData(entry as Record<string, unknown>, `${where}.${key}`);
+    } else if (Array.isArray(entry)) {
+      entry.forEach((item, index) => {
+        if (item && typeof item === 'object' && !Array.isArray(item)) {
+          validateExpectationData(item as Record<string, unknown>, `${where}.${key}[${index}]`);
+        }
+      });
+    }
+  }
+}
+
 function requiredString(value: unknown, where: string): string {
   if (typeof value !== 'string' || value.trim() === '') throw new Error(`${where} must be a non-empty string`);
   return value;
@@ -88,10 +106,19 @@ export function parseScenarioV0(source: string): ScenarioV0 {
   exactKeys(expectedLog, ['category', 'event', 'level', 'count', 'data'], 'scenario.expect.logs[0]');
   const category = requiredString(expectedLog.category, 'scenario.expect.logs[0].category');
   const event = requiredString(expectedLog.event, 'scenario.expect.logs[0].event');
+  if (category === 'ux.sim.scenario' && event === 'completed') {
+    throw new Error('scenario.expect.logs cannot use reserved event ux.sim.scenario/completed');
+  }
   const level = requiredString(expectedLog.level, 'scenario.expect.logs[0].level');
   if (expectedLog.count !== undefined && (!Number.isInteger(expectedLog.count) || (expectedLog.count as number) < 0)) throw new Error('scenario.expect.logs[0].count must be a non-negative integer');
   if (expectedLog.count === 0 && trigger.type !== 'codex.responses.fetch-network-error') throw new Error('zero expected log events are allowed only for codex.responses.fetch-network-error');
-  if (expectedLog.data !== undefined) record(expectedLog.data, 'scenario.expect.logs[0].data');
+  if (expectedLog.data !== undefined) {
+    const data = record(expectedLog.data, 'scenario.expect.logs[0].data');
+    validateExpectationData(data);
+    if (category === 'llm.codex' && event === 'request-rejected-shape' && 'status' in data && typeof data.status !== 'number') {
+      throw new Error('scenario.expect.logs[0].data.status must be numeric');
+    }
+  }
 
   return {
     version: 0,
@@ -191,9 +218,53 @@ export async function runScenarioV0(scenario: ScenarioV0): Promise<ScenarioResul
 }
 
 async function runScenarioV0Exclusive(scenario: ScenarioV0): Promise<ScenarioResult> {
-  const root = mkdtempSync(join(tmpdir(), `ux-sim-${scenario.id}-`));
-  const store = new LogStore(join(root, 'logs.db'), { instance: `ux-sim:${scenario.id}` });
-  const sink = new StoreSink(store, `ux-sim:${scenario.id}`, { installExitHandlers: false });
+  const stateRoot = getTestStateRoot()!;
+  assertNoSymlinkComponents(stateRoot);
+  mkdirSync(stateRoot, { recursive: true });
+  if (!lstatSync(stateRoot).isDirectory()) throw new Error('scenario test-state root must be a directory');
+  const logsDir = join(stateRoot, 'logs');
+  assertNoSymlinkComponents(logsDir);
+  mkdirSync(logsDir, { recursive: true });
+  assertNoSymlinkComponents(logsDir);
+  if (!lstatSync(logsDir).isDirectory()) throw new Error('scenario logs path must be a directory');
+  const logsPath = join(logsDir, 'logs.db');
+  assertNoSymlinkComponents(logsPath);
+  try {
+    const logsStat = lstatSync(logsPath);
+    if (!logsStat.isFile()) throw new Error('scenario logs path must be a regular file');
+    if (logsStat.nlink > 1) throw new Error('scenario logs path must not be a hardlink');
+  } catch (error) {
+    if (error instanceof Error && error.message === 'scenario logs path must be a regular file') throw error;
+    if (error instanceof Error && error.message === 'scenario logs path must not be a hardlink') throw error;
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  const runId = randomUUID();
+  const instance = `ux-sim:${scenario.id}:${runId}`;
+  const store = new LogStore(logsPath, { instance });
+  const storeSink = new StoreSink(store, instance, { installExitHandlers: false });
+  const expectedLog = scenario.expect.logs[0];
+  const sink: LogSink = {
+    name: storeSink.name,
+    emit(rec) {
+      if (rec.category === 'ux.sim.scenario' && rec.event === 'completed') {
+        const data = rec.data && typeof rec.data === 'object' ? rec.data as Record<string, unknown> : {};
+        storeSink.emit({
+          ts: rec.ts,
+          category: rec.category,
+          event: rec.event,
+          data: { runId, scenarioId: scenario.id, deviceVerdict: data.deviceVerdict },
+        });
+      } else if (rec.category === expectedLog?.category && rec.event === expectedLog.event) {
+        storeSink.emit({
+          ts: rec.ts,
+          category: rec.category,
+          event: rec.event,
+          level: rec.level,
+          ...(expectedLog.data ? { data: projectSubset(rec.data, expectedLog.data) } : {}),
+        });
+      }
+    },
+  };
   const off = debug.registerSink(sink);
   const originalFetch = globalThis.fetch;
   const trigger = scenario.triggers[0];
@@ -222,9 +293,9 @@ async function runScenarioV0Exclusive(scenario: ScenarioV0): Promise<ScenarioRes
     const containsMissing = scenario.expect.screen.snapshot.contains.filter((fragment) => !screenText.includes(fragment));
     const excludesFound = (scenario.expect.screen.snapshot.excludes ?? []).filter((fragment) => screenText.includes(fragment));
 
-    sink.flush();
+    storeSink.flush();
     const expected = scenario.expect.logs[0];
-    const rows = store.query({ exactCategories: [expected.category], events: [expected.event], limit: 1000 });
+    const rows = store.query({ exactCategories: [expected.category], events: [expected.event], instances: [instance], limit: 1000 });
     const expectedCount = expected.count ?? 1;
     const levelMismatch = rows.some((row) => row.level !== expected.level);
     const dataMismatch = expected.data ? rows.flatMap((row) => matchesSubset(rowData(row), expected.data!)) : [];
@@ -240,10 +311,25 @@ async function runScenarioV0Exclusive(scenario: ScenarioV0): Promise<ScenarioRes
     if (levelMismatch) failureReasons.push(`log-level-mismatch:expected-${expected.level}-observed-${rows[0]?.level ?? 'none'}`);
     if (dataMismatch.length) failureReasons.push('log-data-mismatch');
 
+    const devicePass = failureReasons.length === 0;
+    const runEvidence = { category: 'ux.sim.scenario', event: 'completed' } as const;
+    debug.log(runEvidence.category, runEvidence.event, {
+      runId,
+      scenarioId: scenario.id,
+      deviceVerdict: devicePass ? 'PASS' : 'FAIL',
+    });
+    storeSink.flush();
+    const persistedRunEvents = store.queryByDataKeys({ exactCategories: [runEvidence.category], runIds: [runId] })
+      .filter((row) => row.event === runEvidence.event);
+    const runEventPersisted = persistedRunEvents.length === 1;
+    if (!runEventPersisted) failureReasons.push('run-evidence-event-not-persisted');
+
     const result: ScenarioResult = {
       id: scenario.id,
+      runId,
       seed: scenario.seed,
       evidenceArtifact: '',
+      runEvidence: { ...runEvidence, persisted: runEventPersisted },
       pass: failureReasons.length === 0,
       trigger: { id: trigger.id, type: trigger.type, status: trigger.status ?? null, expectedCount: expectedTriggerCount, fetchCount, error: errorMessage },
       screen: { pass: screenPass, containsMissing, excludesFound, snapshot: screenText },
@@ -271,37 +357,44 @@ async function runScenarioV0Exclusive(scenario: ScenarioV0): Promise<ScenarioRes
     mkdirSync(evidenceDir, { recursive: true });
     assertNoSymlinkComponents(evidenceDir);
     if (!lstatSync(evidenceDir).isDirectory()) throw new Error('scenario evidence directory must stay inside test state');
-    const evidenceArtifact = join(evidenceDir, `${scenario.id}-seed-${scenario.seed}.json`);
+    const evidenceArtifact = join(evidenceDir, `${scenario.id}-seed-${scenario.seed}-run-${runId}.json`);
     result.evidenceArtifact = evidenceArtifact;
     const artifact = {
       version: 0,
       id: scenario.id,
+      runId,
       seed: scenario.seed,
       pass: result.pass,
       trigger: { type: result.trigger.type, ...(result.trigger.status !== null ? { status: result.trigger.status } : {}), expectedCount: result.trigger.expectedCount, fetchCount: result.trigger.fetchCount, errorObserved: result.trigger.error !== null },
       screen: { pass: result.screen.pass, snapshotSha256: createHash('sha256').update(result.screen.snapshot).digest('hex'), containsMissingCount: result.screen.containsMissing.length, excludesFoundCount: result.screen.excludesFound.length },
       logs: { pass: result.logs.pass, expectedCount: result.logs.expectedCount, observedCount: result.logs.observedCount, levelMismatch: result.logs.levelMismatch, dataMismatchCount: result.logs.dataMismatch.length },
+      runEvidence: { runId: result.runId, persisted: result.runEvidence.persisted },
       failureReasonCount: result.failureReasons.length,
     };
-    const tempArtifact = join(evidenceDir, `.${scenario.id}-${randomUUID()}.tmp`);
-    const fd = openSync(tempArtifact, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
-    try {
-      writeFileSync(fd, `${JSON.stringify(artifact, null, 2)}\n`);
-      closeSync(fd);
-      assertNoSymlinkComponents(evidenceDir);
-      renameSync(tempArtifact, evidenceArtifact);
-    } catch (error) {
-      try { closeSync(fd); } catch { /* already closed */ }
-      try { unlinkSync(tempArtifact); } catch { /* absent after successful rename */ }
-      throw error;
-    }
+    writeScenarioEvidenceArtifact(evidenceDir, evidenceArtifact, artifact);
     return result;
   } finally {
     globalThis.fetch = originalFetch;
     off();
-    sink.close();
+    storeSink.close();
     store.close();
-    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Write one already-validated evidence record atomically without following a target link. */
+export function writeScenarioEvidenceArtifact(evidenceDir: string, evidenceArtifact: string, artifact: unknown): void {
+  assertNoSymlinkComponents(evidenceDir);
+  const tempArtifact = join(evidenceDir, `.${randomUUID()}.tmp`);
+  const fd = openSync(tempArtifact, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+  try {
+    writeFileSync(fd, `${JSON.stringify(artifact, null, 2)}\n`);
+    closeSync(fd);
+    assertNoSymlinkComponents(evidenceDir);
+    renameSync(tempArtifact, evidenceArtifact);
+  } catch (error) {
+    try { closeSync(fd); } catch { /* already closed */ }
+    try { unlinkSync(tempArtifact); } catch { /* absent after successful rename */ }
+    throw error;
   }
 }