enigma-memory 0.1.0

package/scripts/build-production-readiness-manifest.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  HOSTED_READINESS_REQUIRED_DEPENDENCIES,
+  normalizeDependencyEvidence,
+  readinessEvidenceRefs,
+} from '../packages/adapters/src/index.js';
+import { INFRASTRUCTURE_READINESS_MANIFEST_SCHEMA, validateInfrastructureReadinessManifest } from './infrastructure-readiness.mjs';
+
+const GATEWAY_REQUIRED_DEPENDENCIES = Object.freeze([
+  'backend_host',
+  'dns_tls',
+  'durable_storage',
+  'kms_or_secret_custody',
+  'backup_restore',
+  'monitoring',
+  'siem_or_log_sink',
+  'operator_acceptance',
+  'runtime_auth',
+  'admin_auth',
+  'data_plane_auth',
+  'network_access_policy',
+  'kms_custody',
+  'tenant_policy_approval',
+  'usage_metering',
+  'service_settlement',
+  'monitoring_alerting',
+  'public_site_security',
+  'security_threat_model',
+  'legal_compliance_approval',
+  'support_sla',
+  'incident_drill',
+  'backup_restore_drill',
+]);
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const flags = new Map();
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith('--')) continue;
+    const eq = arg.indexOf('=');
+    if (eq !== -1) {
+      const key = arg.slice(2, eq);
+      const value = arg.slice(eq + 1);
+      if (flags.has(key)) flags.set(key, [...[].concat(flags.get(key)), value]);
+      else flags.set(key, value);
+    } else if (!argv[index + 1] || argv[index + 1].startsWith('--')) {
+      flags.set(arg.slice(2), true);
+    } else {
+      const key = arg.slice(2);
+      const value = argv[index + 1];
+      if (flags.has(key)) flags.set(key, [...[].concat(flags.get(key)), value]);
+      else flags.set(key, value);
+      index += 1;
+    }
+  }
+  return flags;
+}
+
+function getFlag(flags, names, fallback = undefined) {
+  for (const name of names) if (flags.has(name)) return flags.get(name);
+  return fallback;
+}
+
+function firstEnv(env, names) {
+  for (const name of names) {
+    const value = env?.[name];
+    if (typeof value === 'string' && value.trim().length > 0) return value.trim();
+  }
+  return undefined;
+}
+
+function firstConfig(flags, env, flagNames, envNames, fallback = undefined) {
+  const flagValue = getFlag(flags, flagNames);
+  if (typeof flagValue === 'string' && flagValue.trim().length > 0) return flagValue.trim();
+  return firstEnv(env, envNames) ?? fallback;
+}
+
+function maybeEndpoint(url, ref = undefined) {
+  if (url === undefined && ref === undefined) return undefined;
+  const endpoint = {};
+  if (url !== undefined) endpoint.url = url;
+  if (ref !== undefined) endpoint.ref = ref;
+  return endpoint;
+}
+
+function refEvidence(ref, provider = 'operator') {
+  if (ref === undefined) return undefined;
+  return { status: 'verified', provider, ref, observed_at: new Date(0).toISOString() };
+}
+
+function collectDependencyEvidence(flags, env) {
+  const evidence = {};
+  const put = (key, value, provider = 'operator') => {
+    const ref = typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+    if (ref !== undefined) evidence[key] = refEvidence(ref, provider);
+  };
+  put('backend_host', firstConfig(flags, env, ['backend-host-ref', 'backendHostRef'], ['ENIGMA_BACKEND_HOST_REF', 'ENIGMA_RELAY_BACKEND_HOST_REF', 'ENIGMA_GATEWAY_BACKEND_HOST_REF', 'ENIGMA_RELAY_DEPLOYMENT_REF', 'ENIGMA_GATEWAY_DEPLOYMENT_REF']));
+  put('dns_tls', firstConfig(flags, env, ['dns-tls-ref', 'dnsTlsRef'], ['ENIGMA_DNS_TLS_REF', 'ENIGMA_RELAY_DNS_TLS_REF', 'ENIGMA_GATEWAY_DNS_TLS_REF', 'ENIGMA_TLS_REF']));
+  put('durable_storage', firstConfig(flags, env, ['durable-storage-ref', 'durableStorageRef'], ['ENIGMA_DURABLE_STORAGE_REF', 'ENIGMA_EXTERNAL_STORAGE_REF', 'ENIGMA_EXTERNAL_STORAGE_DSN_FILE', 'ENIGMA_RELAY_STORAGE_REF', 'ENIGMA_GATEWAY_STORAGE_REF']));
+  put('kms_or_secret_custody', firstConfig(flags, env, ['kms-ref', 'kmsRef', 'kms-or-secret-custody-ref'], ['ENIGMA_KMS_KEY_REF', 'ENIGMA_KMS_KEY_REF_FILE', 'ENIGMA_KMS_REF', 'ENIGMA_KMS_REF_FILE', 'ENIGMA_EXTERNAL_KMS_REF', 'ENIGMA_EXTERNAL_KMS_REF_FILE', 'ENIGMA_SECRETS_MANAGER_REF', 'ENIGMA_SECRETS_MANAGER_REF_FILE', 'ENIGMA_GATEWAY_SIGNER_REF', 'ENIGMA_GATEWAY_SIGNER_REF_FILE']));
+  put('backup_restore', firstConfig(flags, env, ['backup-ref', 'backupRestoreRef'], ['ENIGMA_BACKUP_TARGET_REF', 'ENIGMA_BACKUP_TARGET_URI_FILE', 'ENIGMA_RESTORE_TARGET_REF']));
+  put('monitoring', firstConfig(flags, env, ['monitoring-ref', 'monitoringRef'], ['ENIGMA_MONITORING_REF', 'ENIGMA_RELAY_MONITORING_REF', 'ENIGMA_GATEWAY_MONITORING_REF', 'ENIGMA_ALERTING_REF']));
+  put('siem_or_log_sink', firstConfig(flags, env, ['siem-ref', 'siemRef', 'log-sink-ref'], ['ENIGMA_SIEM_REF', 'ENIGMA_AUDIT_SINK_REF', 'ENIGMA_LOG_SINK_REF', 'ENIGMA_SIEM_EXPORT_ENDPOINT_FILE']));
+  put('runtime_auth', firstConfig(flags, env, ['runtime-auth-ref', 'runtimeAuthRef'], ['ENIGMA_RUNTIME_AUTH_REF', 'ENIGMA_RELAY_RUNTIME_AUTH_REF', 'ENIGMA_PAIRED_CLIENT_AUTH_REF']));
+  put('admin_auth', firstConfig(flags, env, ['admin-auth-ref', 'adminAuthRef'], ['ENIGMA_ADMIN_AUTH_REF', 'ENIGMA_GATEWAY_ADMIN_AUTH_REF']));
+  put('data_plane_auth', firstConfig(flags, env, ['data-plane-auth-ref', 'dataPlaneAuthRef'], ['ENIGMA_DATA_PLANE_AUTH_REF', 'ENIGMA_GATEWAY_DATA_PLANE_AUTH_REF']));
+  put('operator_acceptance', firstConfig(flags, env, ['operator-acceptance-ref', 'operatorAcceptanceRef'], ['ENIGMA_OPERATOR_ACCEPTANCE_REF', 'ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI', 'ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE']));
+  put('network_access_policy', firstConfig(flags, env, ['network-access-policy-ref', 'networkAccessPolicyRef'], ['ENIGMA_NETWORK_ACCESS_POLICY_REF', 'ENIGMA_NETWORK_POLICY_REF']));
+  put('kms_custody', firstConfig(flags, env, ['kms-custody-ref', 'kmsCustodyRef'], ['ENIGMA_KMS_CUSTODY_REF', 'ENIGMA_KEY_CUSTODY_REF']));
+  put('tenant_policy_approval', firstConfig(flags, env, ['tenant-policy-approval-ref', 'tenantPolicyApprovalRef'], ['ENIGMA_TENANT_POLICY_APPROVAL_REF', 'ENIGMA_TENANT_POLICY_REF']));
+  put('usage_metering', firstConfig(flags, env, ['usage-metering-ref', 'usageMeteringRef'], ['ENIGMA_USAGE_METERING_REF', 'ENIGMA_METERING_REF']));
+  put('service_settlement', firstConfig(flags, env, ['service-settlement-ref', 'serviceSettlementRef'], ['ENIGMA_SERVICE_SETTLEMENT_REF', 'ENIGMA_SETTLEMENT_REF']));
+  put('monitoring_alerting', firstConfig(flags, env, ['monitoring-alerting-ref', 'monitoringAlertingRef'], ['ENIGMA_MONITORING_ALERTING_REF', 'ENIGMA_ALERTING_EVIDENCE_REF']));
+  put('public_site_security', firstConfig(flags, env, ['public-site-security-ref', 'publicSiteSecurityRef'], ['ENIGMA_PUBLIC_SITE_SECURITY_REF', 'ENIGMA_SITE_SECURITY_REF']));
+  put('security_threat_model', firstConfig(flags, env, ['security-threat-model-ref', 'securityThreatModelRef'], ['ENIGMA_SECURITY_THREAT_MODEL_REF', 'ENIGMA_THREAT_MODEL_REF']));
+  put('legal_compliance_approval', firstConfig(flags, env, ['legal-compliance-ref', 'legalComplianceRef', 'legal-compliance-approval-ref', 'legalComplianceApprovalRef'], ['ENIGMA_LEGAL_COMPLIANCE_REF', 'ENIGMA_LEGAL_APPROVAL_REF', 'ENIGMA_LEGAL_COMPLIANCE_APPROVAL_REF']));
+  put('support_sla', firstConfig(flags, env, ['support-sla-ref', 'supportSlaRef'], ['ENIGMA_SUPPORT_SLA_REF']));
+  put('incident_drill', firstConfig(flags, env, ['incident-drill-ref', 'incidentDrillRef'], ['ENIGMA_INCIDENT_DRILL_REF']));
+  put('backup_restore_drill', firstConfig(flags, env, ['backup-restore-drill-ref', 'backupRestoreDrillRef'], ['ENIGMA_BACKUP_RESTORE_DRILL_REF']));
+  return evidence;
+}
+
+function asArray(value) {
+  if (value === undefined || value === true) return [];
+  return Array.isArray(value) ? value.map(String) : [String(value)];
+}
+
+export async function buildProductionReadinessManifest(options = {}) {
+  const flags = options.flags instanceof Map ? options.flags : parseArgs(options.argv ?? []);
+  const env = options.env ?? process.env;
+  const dependencyEvidence = collectDependencyEvidence(flags, env);
+  const normalizedEvidence = normalizeDependencyEvidence(dependencyEvidence, {
+    generated_at: options.generated_at ?? options.generatedAt ?? new Date(0).toISOString(),
+    required_keys: GATEWAY_REQUIRED_DEPENDENCIES,
+  });
+  const refs = {
+    ...readinessEvidenceRefs(normalizedEvidence.evidence),
+  };
+  const relayRef = firstConfig(flags, env, ['relay-ref', 'relayRef'], ['ENIGMA_RELAY_REF', 'ENIGMA_RELAY_DEPLOYMENT_REF']);
+  const gatewayRef = firstConfig(flags, env, ['gateway-ref', 'gatewayRef'], ['ENIGMA_GATEWAY_REF', 'ENIGMA_GATEWAY_DEPLOYMENT_REF']);
+  if (relayRef !== undefined) refs.relay = relayRef;
+  if (gatewayRef !== undefined) refs.gateway = gatewayRef;
+  const operatorDecision = firstConfig(flags, env, ['operator-decision', 'operatorDecision'], ['ENIGMA_OPERATOR_DECISION', 'ENIGMA_OPERATOR_ACCEPTANCE_DECISION'], 'pending');
+  const operatorRef = refs.operator_acceptance ?? firstConfig(flags, env, ['operator-acceptance-ref', 'operatorAcceptanceRef'], ['ENIGMA_OPERATOR_ACCEPTANCE_REF', 'ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI', 'ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE']);
+  const externalBlockers = asArray(getFlag(flags, ['external-blocker', 'externalBlocker']));
+  for (const missing of normalizedEvidence.missing_keys) externalBlockers.push(`missing refs.${missing}`);
+  if (operatorDecision !== 'go') externalBlockers.push(`operator acceptance decision is ${operatorDecision}`);
+  const publicSiteUrl = firstConfig(flags, env, ['public-site-url', 'publicSiteUrl'], ['ENIGMA_PUBLIC_SITE_URL'], 'https://enigmamemory.com/');
+  const cloudflareProjectName = firstConfig(flags, env, ['cloudflare-project-name', 'cloudflareProjectName'], ['CLOUDFLARE_PAGES_PROJECT_NAME', 'ENIGMA_CLOUDFLARE_PAGES_PROJECT_NAME'], 'enigma-memory');
+  const cloudflarePagesUrl = firstConfig(flags, env, ['cloudflare-pages-url', 'cloudflarePagesUrl'], ['ENIGMA_CLOUDFLARE_PAGES_URL'], 'https://enigma-memory.pages.dev/');
+  const cloudflareAccountId = firstConfig(flags, env, ['cloudflare-account-id', 'cloudflareAccountId'], ['CLOUDFLARE_ACCOUNT_ID']);
+  const manifest = {
+    schema: INFRASTRUCTURE_READINESS_MANIFEST_SCHEMA,
+    name: firstConfig(flags, env, ['name'], ['ENIGMA_READINESS_MANIFEST_NAME'], 'Enigma production readiness manifest'),
+    mode: firstConfig(flags, env, ['mode'], ['ENIGMA_READINESS_MODE'], 'hosted-live'),
+    public_site: maybeEndpoint(publicSiteUrl),
+    cloudflare_pages: {
+      project_name: cloudflareProjectName,
+      project_url: cloudflarePagesUrl,
+      ...(cloudflareAccountId === undefined ? {} : { account_id: cloudflareAccountId }),
+    },
+    relay: maybeEndpoint(
+      firstConfig(flags, env, ['relay-url', 'relayUrl'], ['ENIGMA_RELAY_READY_URL', 'ENIGMA_RELAY_PUBLIC_READY_URL'], 'https://relay.enigmamemory.com/readyz'),
+      relayRef
+    ),
+    gateway: maybeEndpoint(
+      firstConfig(flags, env, ['gateway-url', 'gatewayUrl'], ['ENIGMA_GATEWAY_READY_URL', 'ENIGMA_GATEWAY_PUBLIC_READY_URL'], 'https://gateway.enigmamemory.com/readyz'),
+      gatewayRef
+    ),
+    refs,
+    operator_acceptance: {
+      decision: operatorDecision,
+      ...(operatorRef === undefined ? {} : { ref: operatorRef }),
+    },
+    external_blockers: [...new Set(externalBlockers)],
+    claim_boundary: [
+      'Generated readiness manifests contain public-safe refs only and never secret values.',
+      'This manifest is not hosted backend readiness until live /readyz checks, Cloudflare/project observation, operator acceptance, and external blockers are all clear.',
+      'Missing refs remain explicit blockers rather than silent defaults.',
+    ],
+  };
+  return validateInfrastructureReadinessManifest(manifest);
+}
+
+async function main() {
+  const flags = parseArgs();
+  const manifest = await buildProductionReadinessManifest({ flags });
+  const out = getFlag(flags, ['out']);
+  const text = `${JSON.stringify(manifest, null, 2)}\n`;
+  if (out && out !== true) {
+    const path = resolve(String(out));
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, text, 'utf8');
+    process.stdout.write(`${JSON.stringify({ ok: true, out: path, schema: manifest.schema, external_blockers: manifest.external_blockers }, null, 2)}\n`);
+    return;
+  }
+  process.stdout.write(text);
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : '';
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/build-production-status-board.mjs

@@ -0,0 +1,297 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const PRODUCTION_STATUS_BOARD_SCHEMA = 'enigma.production_status_board.v1';
+
+const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9_-]{16,}|https?:\/\/[^\s/@]+:[^\s/@]+@|AKIA[0-9A-Z]{16})/iu;
+const LOCAL_PATH_RE = /(?<![A-Za-z])(?:[A-Za-z]:[\\/]|\\\\[^\\/]+[\\/][^\\/]+|\/(?:Users|home)\/[^\s"']+)/u;
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const out = {
+    goalAudit: null,
+    dependencies: null,
+    workplan: null,
+    out: null,
+    help: false,
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    const readValue = () => {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value.length === 0 || value.startsWith('--')) throw new Error(`${token} requires a value`);
+      index += 1;
+      return value;
+    };
+    if (token === '--goal-audit' || token === '--goalAudit') out.goalAudit = readValue();
+    else if (token === '--dependencies') out.dependencies = readValue();
+    else if (token === '--workplan') out.workplan = readValue();
+    else if (token === '--out') out.out = readValue();
+    else if (token === '--help' || token === '-h') out.help = true;
+    else throw new Error(`Unknown production status board option: ${token}`);
+  }
+  return out;
+}
+
+function usage() {
+  return 'Usage: node scripts/build-production-status-board.mjs --goal-audit <goal.json> --dependencies <dependencies.json> --workplan <workplan.json> [--out <file>]\n\nBuilds a public-safe launch status board from current goal, dependency, and workplan evidence.\n';
+}
+
+async function readJson(path, label) {
+  try {
+    return JSON.parse(await readFile(path, 'utf8'));
+  } catch {
+    throw new Error(`Unable to read ${label}`);
+  }
+}
+
+function assertPublicSafe(value, label = 'production status board') {
+  const text = JSON.stringify(value);
+  if (SECRET_RE.test(text)) throw new Error(`${label} contains secret-looking material`);
+  if (LOCAL_PATH_RE.test(text)) throw new Error(`${label} contains a local path`);
+}
+
+function requireObject(value, label) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  assertPublicSafe(value, label);
+  return value;
+}
+
+function limitedList(values, limit) {
+  return Array.isArray(values) ? values.slice(0, limit) : [];
+}
+
+function uniqueLimitedList(values, limit) {
+  const out = [];
+  const seen = new Set();
+  for (const value of Array.isArray(values) ? values : []) {
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+    if (out.length >= limit) break;
+  }
+  return out;
+}
+
+function omittedCount(values, limit) {
+  return Math.max(0, (Array.isArray(values) ? values.length : 0) - limit);
+}
+
+function summarizePhaseDetails(details) {
+  if (details === null || typeof details !== 'object' || Array.isArray(details)) return null;
+  const summary = {};
+  for (const key of ['missing_ref_count', 'listed_missing_ref_count', 'blocker_listed_missing_ref_count', 'unlisted_missing_ref_count']) {
+    if (Number.isFinite(details[key])) summary[key] = details[key];
+  }
+  if (Array.isArray(details.missing_refs)) summary.missing_refs = limitedList(details.missing_refs, 30);
+  if (details.missing_ref_groups && typeof details.missing_ref_groups === 'object' && !Array.isArray(details.missing_ref_groups)) {
+    summary.missing_ref_groups = Object.fromEntries(Object.entries(details.missing_ref_groups)
+      .filter(([, refs]) => Array.isArray(refs))
+      .map(([group, refs]) => [group, limitedList(refs, 30)]));
+  }
+  if (Array.isArray(details.missing_endpoint_refs)) summary.missing_endpoint_refs = limitedList(details.missing_endpoint_refs, 10);
+  if (Array.isArray(details.hosted_state_blockers)) summary.hosted_state_blockers = limitedList(details.hosted_state_blockers, 10);
+  return Object.keys(summary).length > 0 ? summary : null;
+}
+
+function summarizeGroup(group) {
+  return {
+    name: group.name,
+    ready: group.ready === true,
+    blocker_count: Number.isFinite(group.blocker_count) ? group.blocker_count : (Array.isArray(group.blockers) ? group.blockers.length : 0),
+    blockers: limitedList(group.blockers, 8),
+    omitted_blocker_count: omittedCount(group.blockers, 8),
+    next_command: typeof group.next_command === 'string' ? group.next_command : null,
+  };
+}
+
+function summarizePhase(phase) {
+  const details = summarizePhaseDetails(phase.details);
+  return {
+    id: phase.id,
+    title: phase.title,
+    ready: phase.ready === true,
+    owner: phase.owner,
+    prerequisites: Array.isArray(phase.prerequisites) ? phase.prerequisites : [],
+    blocker_count: Number.isFinite(phase.blocker_count) ? phase.blocker_count : (Array.isArray(phase.blockers) ? phase.blockers.length : 0),
+    blockers: limitedList(phase.blockers, 8),
+    omitted_blocker_count: omittedCount(phase.blockers, 8),
+    commands: limitedList(phase.commands, 5),
+    ...(details ? { details } : {}),
+  };
+}
+
+function summarizeDeliverable(deliverable) {
+  return {
+    id: deliverable.id,
+    ok: deliverable.ok === true,
+    requirement: deliverable.requirement,
+    blocker_count: Array.isArray(deliverable.blockers) ? deliverable.blockers.length : 0,
+    blockers: limitedList(deliverable.blockers, 8),
+    omitted_blocker_count: omittedCount(deliverable.blockers, 8),
+  };
+}
+
+function groupMap(dependencies) {
+  return new Map((Array.isArray(dependencies.groups) ? dependencies.groups : []).map((group) => [group.name, group]));
+}
+
+function phaseMap(workplan) {
+  return new Map((Array.isArray(workplan.phases) ? workplan.phases : []).map((phase) => [phase.id, phase]));
+}
+
+function checkExecutionOrder(workplan) {
+  const phases = Array.isArray(workplan.phases) ? workplan.phases : [];
+  const ids = new Set(phases.map((phase) => phase.id));
+  const order = Array.isArray(workplan.execution_order) ? workplan.execution_order : [];
+  return {
+    present: order.length > 0,
+    covers_all_phases: order.length === ids.size && order.every((id) => ids.has(id)),
+    next_phase_order_index: workplan.next_phase_id === null ? null : order.indexOf(workplan.next_phase_id),
+  };
+}
+
+function inputFreshness(inputs, options = {}) {
+  const staleAfterSeconds = Number.isFinite(options.staleAfterSeconds) ? options.staleAfterSeconds : 900;
+  const asOfMs = typeof options.asOf === 'string' ? Date.parse(options.asOf) : NaN;
+  const entries = [
+    ['goal_audit', inputs.goalAudit?.generated_at],
+    ['dependencies', inputs.dependencies?.generated_at],
+    ['workplan', inputs.workplan?.generated_at],
+    ['workplan.dependencies', inputs.workplan?.evidence_inputs?.dependency_generated_at],
+    ['workplan.operator_acceptance', inputs.workplan?.evidence_inputs?.operator_acceptance_generated_at],
+    ['workplan.hosted_ref_catalog', inputs.workplan?.evidence_inputs?.hosted_ref_catalog_generated_at],
+  ].map(([name, generatedAt]) => {
+    const time = typeof generatedAt === 'string' ? Date.parse(generatedAt) : NaN;
+    return {
+      name,
+      generated_at: typeof generatedAt === 'string' ? generatedAt : null,
+      valid: Number.isFinite(time),
+      epoch_ms: Number.isFinite(time) ? time : null,
+    };
+  });
+  const validTimes = entries.filter((entry) => entry.valid).map((entry) => entry.epoch_ms);
+  const latest = validTimes.length > 0 ? Math.max(...validTimes) : null;
+  const oldest = validTimes.length > 0 ? Math.min(...validTimes) : null;
+  const maxSkewSeconds = latest === null || oldest === null ? null : Math.round((latest - oldest) / 1000);
+  const latestAgeSeconds = latest === null || !Number.isFinite(asOfMs) ? null : Math.round((asOfMs - latest) / 1000);
+  return {
+    stale_after_seconds: staleAfterSeconds,
+    as_of: Number.isFinite(asOfMs) ? new Date(asOfMs).toISOString() : null,
+    valid_input_count: validTimes.length,
+    missing_or_invalid_inputs: entries.filter((entry) => !entry.valid).map((entry) => entry.name),
+    latest_generated_at: latest === null ? null : new Date(latest).toISOString(),
+    oldest_generated_at: oldest === null ? null : new Date(oldest).toISOString(),
+    max_skew_seconds: maxSkewSeconds,
+    latest_age_seconds: latestAgeSeconds,
+    stale: validTimes.length !== entries.length
+      || !Number.isFinite(asOfMs)
+      || (maxSkewSeconds !== null && maxSkewSeconds > staleAfterSeconds)
+      || (latestAgeSeconds !== null && latestAgeSeconds > staleAfterSeconds),
+  };
+}
+
+function blockedExternalGroups(groups) {
+  return ['cloudflare_credentials', 'cloudflare_worker_permission', 'hosted_backend_live', 'operator_acceptance']
+    .map((name) => groups.get(name))
+    .filter(Boolean)
+    .map(summarizeGroup)
+    .filter((group) => group.ready !== true);
+}
+
+export function buildProductionStatusBoard(inputs = {}, options = {}) {
+  const goalAudit = requireObject(inputs.goalAudit, 'goal audit');
+  const dependencies = requireObject(inputs.dependencies, 'dependency report');
+  const workplan = requireObject(inputs.workplan, 'production workplan');
+  if (goalAudit.schema !== 'enigma.goal_completion_audit.v1') throw new Error('goal audit schema mismatch');
+  if (dependencies.schema !== 'enigma.production_dependency_report.v1') throw new Error('dependency report schema mismatch');
+  if (workplan.schema !== 'enigma.production_workplan.v1') throw new Error('production workplan schema mismatch');
+
+  const groups = groupMap(dependencies);
+  const phases = phaseMap(workplan);
+  const blockedGroups = (Array.isArray(dependencies.groups) ? dependencies.groups : []).filter((group) => group.ready !== true).map(summarizeGroup);
+  const blockedPhases = (Array.isArray(workplan.phases) ? workplan.phases : []).filter((phase) => phase.ready !== true).map(summarizePhase);
+  const blockedDeliverables = (Array.isArray(goalAudit.deliverables) ? goalAudit.deliverables : []).filter((deliverable) => deliverable.ok !== true).map(summarizeDeliverable);
+  const nextPhase = workplan.next_phase_id ? phases.get(workplan.next_phase_id) : null;
+  const firstBlockedGroup = blockedGroups[0] ?? null;
+  const executionOrder = Array.isArray(workplan.execution_order) ? workplan.execution_order : [];
+  const localReady = ['static_site', 'release_gates', 'whitepaper_claims'].every((name) => groups.get(name)?.ready === true);
+  const generatedAt = options.generated_at ?? new Date().toISOString();
+  const freshness = inputFreshness({ goalAudit, dependencies, workplan }, { asOf: generatedAt });
+  const completeWithFreshEvidence = goalAudit.complete === true && dependencies.launch_ready === true && workplan.launch_ready === true && freshness.stale === false;
+  const launchReadyWithFreshEvidence = goalAudit.go_live_ready === true && dependencies.launch_ready === true && workplan.launch_ready === true && freshness.stale === false;
+  const report = {
+    schema: PRODUCTION_STATUS_BOARD_SCHEMA,
+    generated_at: generatedAt,
+    status: completeWithFreshEvidence ? 'ready' : 'blocked',
+    launch_ready: launchReadyWithFreshEvidence,
+    goal_complete: goalAudit.complete === true,
+    local_package_ready: localReady,
+    fresh_input_evidence: freshness.stale === false,
+    release_posture: goalAudit.release_posture ?? dependencies.release_posture ?? null,
+    ready_group_count: (Array.isArray(dependencies.groups) ? dependencies.groups : []).filter((group) => group.ready === true).length,
+    blocked_group_count: blockedGroups.length,
+    ready_phase_count: (Array.isArray(workplan.phases) ? workplan.phases : []).filter((phase) => phase.ready === true).length,
+    blocked_phase_count: blockedPhases.length,
+    blocked_deliverable_count: blockedDeliverables.length,
+    next_phase: nextPhase ? summarizePhase(nextPhase) : null,
+    next_phase_id: nextPhase?.id ?? null,
+    first_blocked_group: firstBlockedGroup,
+    execution_order: executionOrder,
+    execution_order_check: checkExecutionOrder(workplan),
+    input_freshness: freshness,
+    blocked_groups: blockedGroups,
+    blocked_phases: blockedPhases,
+    blocked_deliverables: blockedDeliverables,
+    external_blockers: blockedExternalGroups(groups),
+    immediate_operator_queue: uniqueLimitedList([
+      ...(nextPhase?.commands ?? []),
+      ...(firstBlockedGroup?.next_command ? [firstBlockedGroup.next_command] : []),
+    ], 6),
+    evidence_inputs: {
+      goal_audit_generated_at: goalAudit.generated_at ?? null,
+      dependency_generated_at: dependencies.generated_at ?? null,
+      workplan_generated_at: workplan.generated_at ?? null,
+      workplan_dependency_generated_at: workplan.evidence_inputs?.dependency_generated_at ?? null,
+      workplan_operator_acceptance_generated_at: workplan.evidence_inputs?.operator_acceptance_generated_at ?? null,
+      workplan_hosted_ref_catalog_generated_at: workplan.evidence_inputs?.hosted_ref_catalog_generated_at ?? null,
+    },
+    claim_boundary: [
+      'This status board summarizes already-generated evidence; it does not create credentials, deploy infrastructure, approve operators, or certify launch readiness.',
+      'launch_ready:true requires the goal audit, dependency report, and workplan to all be ready with direct current evidence.',
+      'Cloudflare token values, account ids, credential-bearing URLs, raw memory, prompts, transcripts, provider responses, and private keys must never appear in this artifact.',
+    ],
+  };
+  assertPublicSafe(report);
+  return report;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) return { text: usage(), status: 0 };
+  if (!args.goalAudit) throw new Error('--goal-audit is required');
+  if (!args.dependencies) throw new Error('--dependencies is required');
+  if (!args.workplan) throw new Error('--workplan is required');
+  const report = buildProductionStatusBoard({
+    goalAudit: await readJson(args.goalAudit, 'goal audit'),
+    dependencies: await readJson(args.dependencies, 'dependency report'),
+    workplan: await readJson(args.workplan, 'production workplan'),
+  });
+  const json = `${JSON.stringify(report, null, 2)}\n`;
+  if (args.out) {
+    await mkdir(dirname(args.out), { recursive: true });
+    await writeFile(args.out, json, 'utf8');
+  }
+  return { text: json, status: report.launch_ready ? 0 : 1 };
+}
+
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().then(({ text, status }) => {
+    process.stdout.write(text);
+    process.exitCode = status;
+  }).catch((error) => {
+    process.stdout.write(`${JSON.stringify({ schema: PRODUCTION_STATUS_BOARD_SCHEMA, status: 'blocked', launch_ready: false, blockers: [error.message] }, null, 2)}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/build-production-storage-migration.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  assertProductionStorageSqlSafe,
+  buildPostgresMigration,
+  productionStorageContract,
+} from '../packages/storage/src/index.js';
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const flags = new Map();
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith('--')) continue;
+    const eq = arg.indexOf('=');
+    if (eq !== -1) {
+      flags.set(arg.slice(2, eq), arg.slice(eq + 1));
+    } else if (!argv[index + 1] || argv[index + 1].startsWith('--')) {
+      flags.set(arg.slice(2), true);
+    } else {
+      flags.set(arg.slice(2), argv[index + 1]);
+      index += 1;
+    }
+  }
+  return flags;
+}
+
+function getFlag(flags, names, fallback = undefined) {
+  for (const name of names) if (flags.has(name)) return flags.get(name);
+  return fallback;
+}
+
+function outputFormat(flags) {
+  const format = String(getFlag(flags, ['format'], 'json')).toLowerCase();
+  if (!['json', 'sql'].includes(format)) throw new Error('--format must be json or sql');
+  return format;
+}
+
+export function buildProductionStorageMigrationArtifact(options = {}) {
+  const flags = options.flags instanceof Map ? options.flags : parseArgs(options.argv ?? []);
+  const schema = getFlag(flags, ['schema'], options.schema ?? 'enigma');
+  const migrationId = getFlag(flags, ['migration-id', 'migrationId'], options.migration_id ?? options.migrationId ?? '001_enigma_production_storage');
+  const migration = buildPostgresMigration({ schema, migration_id: migrationId });
+  assertProductionStorageSqlSafe(migration.sql);
+  const contract = productionStorageContract({ schema, migration_id: migrationId });
+  return {
+    ok: true,
+    schema: 'enigma.production_storage_migration_artifact.v1',
+    generated_at: options.generated_at ?? options.generatedAt ?? new Date(0).toISOString(),
+    format: outputFormat(flags),
+    contract,
+    migration,
+    claim_boundary: [
+      'This artifact is local SQL/migration material only; it does not connect to or mutate a database.',
+      'Operators must run it in controlled database change management and verify backups/restore before hosted_live_ready can be true.',
+      'The SQL schema stores hashes, opaque encrypted payload references, minimized decisions, SIEM events, and public-safe refs rather than raw memory or secrets.',
+    ],
+  };
+}
+
+async function main() {
+  const flags = parseArgs();
+  const artifact = buildProductionStorageMigrationArtifact({ flags });
+  const format = artifact.format;
+  const out = getFlag(flags, ['out']);
+  const content = format === 'sql'
+    ? `${artifact.migration.sql}\n`
+    : `${JSON.stringify(artifact, null, 2)}\n`;
+  if (out && out !== true) {
+    const path = resolve(String(out));
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, content, 'utf8');
+    process.stdout.write(`${JSON.stringify({ ok: true, out: path, schema: artifact.schema, format, table_count: artifact.contract.tables.length }, null, 2)}\n`);
+    return;
+  }
+  process.stdout.write(content);
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : '';
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+}