enigma-memory 0.1.14 → 0.1.16

package/scripts/build-production-workplan.mjs

@@ -234,6 +234,8 @@ export function buildProductionWorkplan(inputs = {}, options = {}) {
   const endpointRefs = missingHostedEndpointRefs(hosted);
   const stateBlockers = hostedStateBlockers(hosted);
 
+  const finalDependencyCommand = 'npm run production:dependencies -- --goal-audit .enigma/goal-audit-current.json --release-audit .enigma/release-audit-current.json --worker-inspect .enigma/worker-inspect-result-current.json --whitepaper .enigma/whitepaper-claims-current.json --cloudflare-credentials .enigma/cloudflare-credentials-current.json --edge-deploy .enigma/edge-backend-deployment-current.json --edge-live .enigma/edge-backend-bootstrap-live-current.json --storage-bootstrap .enigma/cloudflare-storage-bootstrap-current.json';
+
   const phases = [
     makePhase({
       id: 'cloudflare_credentials',
@@ -309,7 +311,7 @@ export function buildProductionWorkplan(inputs = {}, options = {}) {
       owner: 'operator-or-reviewer',
       prerequisites: ['cloudflare_credentials', 'cloudflare_worker_permission', 'hosted_backend_refs', 'operator_acceptance', 'release_gates'],
       blockers: dependencyReport.launch_ready === true ? [] : ['launch_ready is false'],
-      commands: [release.next_command, staticSite.next_command, whitepaper.next_command, 'npm run production:goal-audit -- --site <public-site-dir> --domain enigmamemory.com --release-audit .enigma/release-audit-current.json', 'npm run production:dependencies -- --goal-audit .enigma/goal-audit-current.json --release-audit .enigma/release-audit-current.json --worker-inspect .enigma/worker-inspect-validation-current.json --whitepaper .enigma/whitepaper-claims-current.json --cloudflare-credentials .enigma/cloudflare-credentials-current.json --edge-deploy .enigma/edge-backend-deployment-current.json --edge-live .enigma/edge-backend-bootstrap-live-current.json --storage-bootstrap .enigma/cloudflare-storage-bootstrap-current.json'],
+      commands: [release.next_command, staticSite.next_command, whitepaper.next_command, 'npm run production:goal-audit -- --site <public-site-dir> --domain enigmamemory.com --release-audit .enigma/release-audit-current.json', finalDependencyCommand],
       evidence: [...release.evidence, ...staticSite.evidence, ...whitepaper.evidence],
       details: { goal_complete: dependencyReport.goal_complete === true, launch_ready: dependencyReport.launch_ready === true },
     }),

package/scripts/build-proof-network-packet.mjs

@@ -1,213 +1,213 @@
-#!/usr/bin/env node
-import { createHash } from 'node:crypto';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import {
-  assertNoPrivateProofPayload,
-  createBenchmarkAttestation,
-  createProofNetworkAnchorBatch,
-  createProofNetworkPacket,
-  sha256Json,
-  validateBenchmarkAttestation,
-  validateProofNetworkAnchorBatch,
-  validateProofNetworkPacket,
-} from '../packages/proof-network/src/index.js';
-
-export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.14';
-
-const HASH_RE = /^(?:sha256:)?[a-f0-9]{64}$/iu;
-const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw[\s_-]*memory|plaintext[\s_-]*prompts?|plain[\s_-]*text[\s_-]*prompts?|private[\s_-]*prompts?|provider[\s_-]*responses?|full[\s_-]*transcript|decrypted[\s_-]*memory|credentials?|secrets?|passwords?|private[\s_-]*keys?|api[\s_-]*key[\s_-]*(?:secret|material|value)|api[\s_-]*secrets?|access[\s_-]*tokens?|refresh[\s_-]*tokens?|token[\s_-]*values?|credential[\s_-]*material|tenant[\s_-]*names?)\b)/iu;
-const ABSOLUTE_LOCAL_PATH_RE = /^(?:[A-Za-z]:[\\/]|\\\\|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\b)/u;
-
-class UsageError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'UsageError';
-  }
-}
-
-function readRequiredValue(argv, index, flag) {
-  const value = argv[index + 1];
-  if (value === undefined || value.startsWith('--')) throw new UsageError(`${flag} requires a value`);
-  return value;
-}
-
-function assertPublicSafeString(value, label) {
-  if (typeof value !== 'string' || value.trim() === '') throw new UsageError(`${label} must be a non-empty public ref or hash`);
-  const normalized = value.trim();
-  if (SECRET_VALUE_RE.test(normalized)) throw new UsageError(`${label} contains private or secret material`);
-  return normalized;
-}
-
-function assertPublicHash(value, label) {
-  const normalized = assertPublicSafeString(value, label);
-  if (!HASH_RE.test(normalized)) throw new UsageError(`${label} must be a sha256 hash as 64 hex characters or sha256:<64 hex>`);
-  return normalized.toLowerCase().startsWith('sha256:') ? normalized.toLowerCase() : `sha256:${normalized.toLowerCase()}`;
-}
-
-function assertRelativeOutFile(value) {
-  const normalized = assertPublicSafeString(value, 'output file');
-  if (isAbsolute(normalized) || ABSOLUTE_LOCAL_PATH_RE.test(normalized)) throw new UsageError('output file must be a relative path');
-  return normalized;
-}
-
-export function parseArgs(argv = process.argv.slice(2)) {
-  const args = {
-    activeRoot: undefined,
-    receiptRoot: undefined,
-    benchmarkReport: undefined,
-    datasetHash: undefined,
-    runnerHash: undefined,
-    operatorRef: undefined,
-    out: undefined,
-    help: false,
-  };
-
-  for (let index = 0; index < argv.length; index += 1) {
-    const raw = argv[index];
-    const equalsIndex = raw.indexOf('=');
-    const flag = equalsIndex > 0 ? raw.slice(0, equalsIndex) : raw;
-    const inlineValue = equalsIndex > 0 ? raw.slice(equalsIndex + 1) : undefined;
-    const value = () => {
-      if (inlineValue !== undefined) return inlineValue;
-      const next = readRequiredValue(argv, index, flag);
-      index += 1;
-      return next;
-    };
-
-    if (flag === '--help' || flag === '-h') args.help = true;
-    else if (flag === '--active-root') args.activeRoot = assertPublicHash(value(), 'active root');
-    else if (flag === '--receipt-root') args.receiptRoot = assertPublicHash(value(), 'receipt root');
-    else if (flag === '--benchmark-report') args.benchmarkReport = value();
-    else if (flag === '--dataset-hash') args.datasetHash = assertPublicHash(value(), 'dataset hash');
-    else if (flag === '--runner-hash') args.runnerHash = assertPublicHash(value(), 'runner hash');
-    else if (flag === '--operator-ref') args.operatorRef = assertPublicSafeString(value(), 'operator ref');
-    else if (flag === '--out') args.out = assertRelativeOutFile(value());
-    else throw new UsageError(`unknown option ${raw}; use --help`);
-  }
-  return args;
-}
-
-export function usage() {
-  return `Usage: node scripts/build-proof-network-packet.mjs --active-root <sha256> --receipt-root <sha256> --benchmark-report <file> --dataset-hash <sha256> --runner-hash <sha256> --operator-ref <ref> [--out <file>]
-
-Builds a public-safe proof-network packet from local refs and hashes. The benchmark report file is hashed only; its body and path are never copied into the packet. This script does not call a network, deploy contracts, create accounts, sign transactions, or write raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, or provider responses.
-`;
-}
-
-function requireArgs(args) {
-  const required = [
-    ['--active-root', args.activeRoot],
-    ['--receipt-root', args.receiptRoot],
-    ['--benchmark-report', args.benchmarkReport],
-    ['--dataset-hash', args.datasetHash],
-    ['--runner-hash', args.runnerHash],
-    ['--operator-ref', args.operatorRef],
-  ];
-  const missing = required.filter(([, value]) => value === undefined).map(([name]) => name);
-  if (missing.length > 0) throw new UsageError(`missing required option(s): ${missing.join(', ')}`);
-}
-
-function sha256Buffer(buffer) {
-  return `sha256:${createHash('sha256').update(buffer).digest('hex')}`;
-}
-
-function withBoundaryFlags(packet) {
-  return {
-    transaction_submitted: false,
-    raw_memory_on_chain: false,
-    ...packet,
-    transaction_submitted: false,
-    raw_memory_on_chain: false,
-  };
-}
-
-function assertValidation(validation, label) {
-  if (validation?.ok !== true) throw new Error(`${label} validation failed: ${(validation?.errors ?? ['unknown error']).join('; ')}`);
-}
-
-export async function buildProofNetworkPacket(args, options = {}) {
-  requireArgs(args);
-  const generatedAt = options.generated_at ?? options.generatedAt ?? new Date().toISOString();
-  const reportBytes = await readFile(args.benchmarkReport);
-  const reportHash = sha256Buffer(reportBytes);
-  const packageRef = `npm:enigma-memory@${PROOF_NETWORK_PACKET_RELEASE_TARGET}`;
-
-  const publicInputs = {
-    active_root: args.activeRoot,
-    receipt_root: args.receiptRoot,
-    report_hash: reportHash,
-    dataset_ref: args.datasetHash,
-    runner_ref: args.runnerHash,
-    operator_ref: args.operatorRef,
-    package_ref: packageRef,
-    transaction_submitted: false,
-    raw_memory_on_chain: false,
-  };
-  assertNoPrivateProofPayload(publicInputs);
-
-  const operatorSignatureRef = `signature:${sha256Json(args.operatorRef).slice('sha256:'.length)}`;
-  const benchmarkAttestation = createBenchmarkAttestation({
-    report_hash: reportHash,
-    dataset_ref: args.datasetHash,
-    runner_ref: args.runnerHash,
-    package_ref: packageRef,
-    benchmark_ref: `benchmark-report:${reportHash}`,
-    signature_ref: operatorSignatureRef,
-    attested_at: generatedAt,
-  });
-  assertValidation(validateBenchmarkAttestation(benchmarkAttestation), 'benchmark attestation');
-
-  const anchorBatch = createProofNetworkAnchorBatch({
-    chain: 'solana',
-    generated_at: generatedAt,
-    anchor_ref: `anchor:${sha256Json([args.activeRoot, args.receiptRoot, reportHash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
-    commitments: [
-      { kind: 'active_root', root: args.activeRoot, ref: 'active-root' },
-      { kind: 'receipt_root', root: args.receiptRoot, ref: 'receipt-root' },
-      { kind: 'benchmark_report', root: reportHash, ref: 'benchmark-report' },
-      { kind: 'benchmark_attestation', root: benchmarkAttestation.benchmark_attestation_hash, ref: 'benchmark-attestation' },
-      { kind: 'operator_ref', root: sha256Json(args.operatorRef), ref: args.operatorRef },
-    ],
-  });
-  assertValidation(validateProofNetworkAnchorBatch(anchorBatch), 'anchor batch');
-
-  const packet = withBoundaryFlags(createProofNetworkPacket({
-    anchor_batches: [anchorBatch],
-    attestations: [benchmarkAttestation],
-    packet_ref: `proof-network-packet:${sha256Json([anchorBatch.anchor_batch_hash, benchmarkAttestation.benchmark_attestation_hash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
-    created_at: generatedAt,
-  }));
-  assertNoPrivateProofPayload(packet);
-  assertValidation(validateProofNetworkPacket(packet), 'proof-network packet');
-  return packet;
-}
-
-export async function main(argv = process.argv.slice(2)) {
-  const args = parseArgs(argv);
-  if (args.help) {
-    process.stdout.write(usage());
-    return 0;
-  }
-  const packet = await buildProofNetworkPacket(args);
-  const json = `${JSON.stringify(packet, null, 2)}\n`;
-  if (args.out) {
-    try {
-      await mkdir(dirname(args.out), { recursive: true });
-      await writeFile(args.out, json, 'utf8');
-    } catch {
-      throw new Error('failed to write proof-network packet output');
-    }
-  }
-  process.stdout.write(json);
-  return 0;
-}
-
-if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
-  main().catch((error) => {
-    process.stderr.write(`${error.name ?? 'Error'}: ${error.message ?? 'failed to build proof-network packet'}\n`);
-    process.exitCode = 1;
-  });
-}
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  assertNoPrivateProofPayload,
+  createBenchmarkAttestation,
+  createProofNetworkAnchorBatch,
+  createProofNetworkPacket,
+  sha256Json,
+  validateBenchmarkAttestation,
+  validateProofNetworkAnchorBatch,
+  validateProofNetworkPacket,
+} from '../packages/proof-network/src/index.js';
+
+export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.16';
+
+const HASH_RE = /^(?:sha256:)?[a-f0-9]{64}$/iu;
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw[\s_-]*memory|plaintext[\s_-]*prompts?|plain[\s_-]*text[\s_-]*prompts?|private[\s_-]*prompts?|provider[\s_-]*responses?|full[\s_-]*transcript|decrypted[\s_-]*memory|credentials?|secrets?|passwords?|private[\s_-]*keys?|api[\s_-]*key[\s_-]*(?:secret|material|value)|api[\s_-]*secrets?|access[\s_-]*tokens?|refresh[\s_-]*tokens?|token[\s_-]*values?|credential[\s_-]*material|tenant[\s_-]*names?)\b)/iu;
+const ABSOLUTE_LOCAL_PATH_RE = /^(?:[A-Za-z]:[\\/]|\\\\|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\b)/u;
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function readRequiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (value === undefined || value.startsWith('--')) throw new UsageError(`${flag} requires a value`);
+  return value;
+}
+
+function assertPublicSafeString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new UsageError(`${label} must be a non-empty public ref or hash`);
+  const normalized = value.trim();
+  if (SECRET_VALUE_RE.test(normalized)) throw new UsageError(`${label} contains private or secret material`);
+  return normalized;
+}
+
+function assertPublicHash(value, label) {
+  const normalized = assertPublicSafeString(value, label);
+  if (!HASH_RE.test(normalized)) throw new UsageError(`${label} must be a sha256 hash as 64 hex characters or sha256:<64 hex>`);
+  return normalized.toLowerCase().startsWith('sha256:') ? normalized.toLowerCase() : `sha256:${normalized.toLowerCase()}`;
+}
+
+function assertRelativeOutFile(value) {
+  const normalized = assertPublicSafeString(value, 'output file');
+  if (isAbsolute(normalized) || ABSOLUTE_LOCAL_PATH_RE.test(normalized)) throw new UsageError('output file must be a relative path');
+  return normalized;
+}
+
+export function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    activeRoot: undefined,
+    receiptRoot: undefined,
+    benchmarkReport: undefined,
+    datasetHash: undefined,
+    runnerHash: undefined,
+    operatorRef: undefined,
+    out: undefined,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const raw = argv[index];
+    const equalsIndex = raw.indexOf('=');
+    const flag = equalsIndex > 0 ? raw.slice(0, equalsIndex) : raw;
+    const inlineValue = equalsIndex > 0 ? raw.slice(equalsIndex + 1) : undefined;
+    const value = () => {
+      if (inlineValue !== undefined) return inlineValue;
+      const next = readRequiredValue(argv, index, flag);
+      index += 1;
+      return next;
+    };
+
+    if (flag === '--help' || flag === '-h') args.help = true;
+    else if (flag === '--active-root') args.activeRoot = assertPublicHash(value(), 'active root');
+    else if (flag === '--receipt-root') args.receiptRoot = assertPublicHash(value(), 'receipt root');
+    else if (flag === '--benchmark-report') args.benchmarkReport = value();
+    else if (flag === '--dataset-hash') args.datasetHash = assertPublicHash(value(), 'dataset hash');
+    else if (flag === '--runner-hash') args.runnerHash = assertPublicHash(value(), 'runner hash');
+    else if (flag === '--operator-ref') args.operatorRef = assertPublicSafeString(value(), 'operator ref');
+    else if (flag === '--out') args.out = assertRelativeOutFile(value());
+    else throw new UsageError(`unknown option ${raw}; use --help`);
+  }
+  return args;
+}
+
+export function usage() {
+  return `Usage: node scripts/build-proof-network-packet.mjs --active-root <sha256> --receipt-root <sha256> --benchmark-report <file> --dataset-hash <sha256> --runner-hash <sha256> --operator-ref <ref> [--out <file>]
+
+Builds a public-safe proof-network packet from local refs and hashes. The benchmark report file is hashed only; its body and path are never copied into the packet. This script does not call a network, deploy contracts, create accounts, sign transactions, or write raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, or provider responses.
+`;
+}
+
+function requireArgs(args) {
+  const required = [
+    ['--active-root', args.activeRoot],
+    ['--receipt-root', args.receiptRoot],
+    ['--benchmark-report', args.benchmarkReport],
+    ['--dataset-hash', args.datasetHash],
+    ['--runner-hash', args.runnerHash],
+    ['--operator-ref', args.operatorRef],
+  ];
+  const missing = required.filter(([, value]) => value === undefined).map(([name]) => name);
+  if (missing.length > 0) throw new UsageError(`missing required option(s): ${missing.join(', ')}`);
+}
+
+function sha256Buffer(buffer) {
+  return `sha256:${createHash('sha256').update(buffer).digest('hex')}`;
+}
+
+function withBoundaryFlags(packet) {
+  return {
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+    ...packet,
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+  };
+}
+
+function assertValidation(validation, label) {
+  if (validation?.ok !== true) throw new Error(`${label} validation failed: ${(validation?.errors ?? ['unknown error']).join('; ')}`);
+}
+
+export async function buildProofNetworkPacket(args, options = {}) {
+  requireArgs(args);
+  const generatedAt = options.generated_at ?? options.generatedAt ?? new Date().toISOString();
+  const reportBytes = await readFile(args.benchmarkReport);
+  const reportHash = sha256Buffer(reportBytes);
+  const packageRef = `npm:enigma-memory@${PROOF_NETWORK_PACKET_RELEASE_TARGET}`;
+
+  const publicInputs = {
+    active_root: args.activeRoot,
+    receipt_root: args.receiptRoot,
+    report_hash: reportHash,
+    dataset_ref: args.datasetHash,
+    runner_ref: args.runnerHash,
+    operator_ref: args.operatorRef,
+    package_ref: packageRef,
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+  };
+  assertNoPrivateProofPayload(publicInputs);
+
+  const operatorSignatureRef = `signature:${sha256Json(args.operatorRef).slice('sha256:'.length)}`;
+  const benchmarkAttestation = createBenchmarkAttestation({
+    report_hash: reportHash,
+    dataset_ref: args.datasetHash,
+    runner_ref: args.runnerHash,
+    package_ref: packageRef,
+    benchmark_ref: `benchmark-report:${reportHash}`,
+    signature_ref: operatorSignatureRef,
+    attested_at: generatedAt,
+  });
+  assertValidation(validateBenchmarkAttestation(benchmarkAttestation), 'benchmark attestation');
+
+  const anchorBatch = createProofNetworkAnchorBatch({
+    chain: 'solana',
+    generated_at: generatedAt,
+    anchor_ref: `anchor:${sha256Json([args.activeRoot, args.receiptRoot, reportHash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
+    commitments: [
+      { kind: 'active_root', root: args.activeRoot, ref: 'active-root' },
+      { kind: 'receipt_root', root: args.receiptRoot, ref: 'receipt-root' },
+      { kind: 'benchmark_report', root: reportHash, ref: 'benchmark-report' },
+      { kind: 'benchmark_attestation', root: benchmarkAttestation.benchmark_attestation_hash, ref: 'benchmark-attestation' },
+      { kind: 'operator_ref', root: sha256Json(args.operatorRef), ref: args.operatorRef },
+    ],
+  });
+  assertValidation(validateProofNetworkAnchorBatch(anchorBatch), 'anchor batch');
+
+  const packet = withBoundaryFlags(createProofNetworkPacket({
+    anchor_batches: [anchorBatch],
+    attestations: [benchmarkAttestation],
+    packet_ref: `proof-network-packet:${sha256Json([anchorBatch.anchor_batch_hash, benchmarkAttestation.benchmark_attestation_hash]).slice('sha256:'.length, 'sha256:'.length + 32)}`,
+    created_at: generatedAt,
+  }));
+  assertNoPrivateProofPayload(packet);
+  assertValidation(validateProofNetworkPacket(packet), 'proof-network packet');
+  return packet;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(usage());
+    return 0;
+  }
+  const packet = await buildProofNetworkPacket(args);
+  const json = `${JSON.stringify(packet, null, 2)}\n`;
+  if (args.out) {
+    try {
+      await mkdir(dirname(args.out), { recursive: true });
+      await writeFile(args.out, json, 'utf8');
+    } catch {
+      throw new Error('failed to write proof-network packet output');
+    }
+  }
+  process.stdout.write(json);
+  return 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message ?? 'failed to build proof-network packet'}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/check.mjs

@@ -3,7 +3,9 @@ import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const packageJsonPath = path.join(root, 'package.json');
+const packageJsonPath = process.env.ENIGMA_CHECK_PACKAGE_JSON_OVERRIDE
+  ? path.resolve(process.env.ENIGMA_CHECK_PACKAGE_JSON_OVERRIDE)
+  : path.join(root, 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
 const productionRoots = [
   'packages/adapters/src/',

package/scripts/cloudflare-ops.mjs

@@ -6,6 +6,7 @@ import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
 import { applyCloudflareSecretEnvFileFromArgv, CloudflareSecretEnvError } from './cloudflare-secret-env.mjs';
+import { PUBLIC_SITE_SECURITY_RESULT_SCHEMA, validatePublicSiteSecurity } from './validate-public-site-security.mjs';
 
 const execFile = promisify(execFileCallback);
 
@@ -46,6 +47,8 @@ Commands:
 
   pages deploy --site <dir> --project-name <name> [--execute]
       Without --execute, prints the exact Wrangler deploy plan only.
+      Dry-run output includes local public-site security validation.
+      --execute refuses artifacts with local security blockers before invoking Wrangler.
       With --execute, runs Wrangler through npm exec/npx without printing the token.
 
   pages verify --url <https-url> --project-name <name> [--domain <host>] \\
@@ -264,6 +267,35 @@ function redactPlanOutput(plan) {
   return redactOperationalPayload(plan);
 }
 
+function redactPublicSiteSecurityBlocker(entry) {
+  return {
+    message: redactOperationalText(entry?.message ?? ''),
+    ...(entry?.path === undefined ? {} : { path: redactOperationalText(String(entry.path)) }),
+  };
+}
+
+function publicSiteSecurityDeploySummary(result) {
+  return {
+    schema: PUBLIC_SITE_SECURITY_RESULT_SCHEMA,
+    ok: result?.ok === true,
+    status: result?.status ?? 'blocked',
+    blocker_count: Array.isArray(result?.blockers) ? result.blockers.length : 0,
+    blockers: Array.isArray(result?.blockers) ? result.blockers.map(redactPublicSiteSecurityBlocker) : [],
+    checked: redactOperationalPayload(result?.checked ?? {}),
+    claimBoundary: result?.claim_boundary ?? [],
+  };
+}
+
+function publicSiteSecurityErrorMessage(summary) {
+  const blockerText = summary.blockers
+    .slice(0, 5)
+    .map((entry) => (entry.path ? `${entry.path}: ${entry.message}` : entry.message))
+    .join('; ');
+  return blockerText.length > 0
+    ? `public site security validation blocked Pages deploy: ${blockerText}`
+    : 'public site security validation blocked Pages deploy';
+}
+
 function parsePositiveInteger(value, name) {
   const text = requireNonEmptyString(name, value);
   if (!/^\d+$/.test(text)) throw new UsageError(`${name} must be a positive integer`);
@@ -1518,6 +1550,7 @@ export async function runCloudflareOpsCommand(command, {
 
   if (command.kind === 'pages.deploy') {
     const plan = buildWranglerPagesDeployPlan(command);
+    const siteSecurity = publicSiteSecurityDeploySummary(await validatePublicSiteSecurity({ site: command.site }));
     if (!command.execute) {
       return {
         json: {
@@ -1526,10 +1559,12 @@ export async function runCloudflareOpsCommand(command, {
           dryRun: true,
           execute: false,
           plan: redactPlanOutput(plan),
+          siteSecurity,
           claimBoundary: 'Plan only; no Cloudflare Pages deployment was executed.',
         },
       };
     }
+    if (!siteSecurity.ok) throw new UsageError(publicSiteSecurityErrorMessage(siteSecurity));
     const result = await execFileImpl(plan.command, plan.args, { shell: plan.usesShell === true, windowsHide: true, maxBuffer: 10 * 1024 * 1024, env });
     return {
       json: {

package/scripts/collect-hosted-backend-live-evidence.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import https from 'node:https';
 import { createHash } from 'node:crypto';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -81,6 +82,42 @@ function redactProbeBody(value, path = 'probe.body') {
   return value;
 }
 
+export function localSimulationLoopbackFetch(url, init = {}) {
+  const parsed = new URL(url);
+  const host = parsed.hostname.toLowerCase();
+  if (parsed.protocol !== 'https:' || (host !== 'sim.enigmamemory.com' && !host.endsWith('.sim.enigmamemory.com'))) {
+    throw new Error('--local-simulation-loopback only supports https://*.sim.enigmamemory.com simulation probes');
+  }
+  const request = {
+    hostname: '127.0.0.1',
+    port: parsed.port || 443,
+    path: `${parsed.pathname}${parsed.search}`,
+    method: init.method || 'GET',
+    headers: init.headers,
+    rejectUnauthorized: false,
+    servername: parsed.hostname,
+  };
+  return new Promise((resolve, reject) => {
+    const req = https.request(request, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        resolve({
+          ok: res.statusCode >= 200 && res.statusCode < 300,
+          status: res.statusCode,
+          statusText: res.statusMessage || '',
+          url,
+          redirected: false,
+          text: async () => text,
+        });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
 async function fetchProbe(url, { fetchImpl = globalThis.fetch, observedAt }) {
   if (typeof fetchImpl !== 'function') throw new Error('global fetch is not available in this Node runtime');
   const response = await fetchImpl(url, {
@@ -189,6 +226,10 @@ function parseArgs(argv) {
     }
     if (!arg.startsWith('--')) throw new Error(`Unexpected argument: ${arg}`);
     const name = arg.slice(2);
+    if (name === 'local-simulation-loopback') {
+      flags.set(name, true);
+      continue;
+    }
     const value = argv[index + 1];
     if (!value || value.startsWith('--')) throw new Error(`${arg} requires a value`);
     flags.set(name, value);
@@ -198,7 +239,7 @@ function parseArgs(argv) {
 }
 
 function usage() {
-  return `Usage: node scripts/collect-hosted-backend-live-evidence.mjs --relay-url <https-base> --gateway-url <https-base> --refs-json <refs.json> --domain <domain> --environment-id <id> --cloud-provider <provider> --region <region> --owner <owner> --operator-decision go --operator-packet-ref <ref> --operator-approved-at <iso> --operator-approved-by <name> [--out <collection.json>] [--evidence-out <evidence.json>]\n\nCollects public HTTPS /livez and /readyz evidence for relay and gateway, then validates it with validate-hosted-backend-live. It never sends credentials and does not deploy infrastructure.\n`;
+  return `Usage: node scripts/collect-hosted-backend-live-evidence.mjs --relay-url <https-base> --gateway-url <https-base> --refs-json <refs.json> --domain <domain> --environment-id <id> --cloud-provider <provider> --region <region> --owner <owner> --operator-decision go --operator-packet-ref <ref> --operator-approved-at <iso> --operator-approved-by <name> [--out <collection.json>] [--evidence-out <evidence.json>] [--local-simulation-loopback]\n\nCollects public HTTPS /livez and /readyz evidence for relay and gateway, then validates it with validate-hosted-backend-live. It never sends credentials and does not deploy infrastructure. The --local-simulation-loopback flag is restricted to https://*.sim.enigmamemory.com local simulation probes with self-signed TLS and must not be used as production evidence.\n`;
 }
 
 async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fetch } = {}) {
@@ -212,6 +253,7 @@ async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fet
   const refs = await readJsonFile(refsPath);
   const environment = await maybeReadJsonFile(readFlag(flags, 'environment-json'));
   const operatorAcceptance = await maybeReadJsonFile(readFlag(flags, 'operator-acceptance-json'));
+  const selectedFetchImpl = flags.get('local-simulation-loopback') === true ? localSimulationLoopbackFetch : fetchImpl;
   const collection = await collectHostedBackendLiveEvidence({
     relayBaseUrl: readFlag(flags, 'relay-url'),
     gatewayBaseUrl: readFlag(flags, 'gateway-url'),
@@ -233,7 +275,7 @@ async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fet
     operatorApprovedAt: readFlag(flags, 'operator-approved-at'),
     operatorApprovedBy: readFlag(flags, 'operator-approved-by'),
     observed_at: readFlag(flags, 'observed-at') ?? new Date().toISOString(),
-    fetchImpl,
+    fetchImpl: selectedFetchImpl,
   });
   const collectionJson = `${JSON.stringify(collection, null, 2)}\n`;
   const evidenceJson = `${JSON.stringify(collection.evidence, null, 2)}\n`;

package/scripts/run-memory-benchmarks.mjs

@@ -832,6 +832,11 @@ export function runMemoryBenchmarkSuite(options = {}) {
       credentials_required: false,
       external_downloads_required: false,
       external_provider_calls: false,
+      llm_answer_accuracy_scored: false,
+      provider_api_calls_made: false,
+      api_spend_possible: false,
+      mem0_adapter_run: false,
+      external_competitor_adapters_run: false,
       raw_private_memory_plaintext_included: false,
       provider_deletion_claim: false,
       model_forgetting_claim: false,