enigma-memory 0.1.17 → 0.1.22

package/scripts/build-goal-completion-audit.mjs

@@ -5,7 +5,12 @@ import { pathToFileURL } from 'node:url';
 import { buildProductionHandoffPacket } from './build-production-handoff-packet.mjs';
 import { buildCloudflareTokenPolicy } from './build-cloudflare-token-policy.mjs';
 import { runBackendReadinessSmoke } from './run-backend-readiness-smoke.mjs';
-import { HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA, HOSTED_BACKEND_LIVE_RESULT_SCHEMA, REQUIRED_REF_KEYS } from './validate-hosted-backend-live.mjs';
+import {
+  HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA,
+  HOSTED_BACKEND_LIVE_RESULT_SCHEMA,
+  REQUIRED_REF_KEYS,
+  validateHostedBackendLiveEvidence,
+} from './validate-hosted-backend-live.mjs';
 import { validateProductionManifestFiles } from './validate-production-manifests.mjs';
 import { applyCloudflareSecretEnvFile } from './cloudflare-secret-env.mjs';
 
@@ -29,7 +34,7 @@ function assertNoUnsafeOutput(name, value, path = name) {
   }
 }
 
-const DEFAULT_OBJECTIVE = 'Build Enigma Memory into a production-grade project with backend infrastructure, tests, professional math/diagram whitepaper, secure public site, deployment/handoff plan, GPT-5.5 architecture/review ownership, and Kimi Code implementation support without unsupported claims.';
+const DEFAULT_OBJECTIVE = 'Build Enigma Memory into a production-grade project with backend infrastructure, tests, professional math/diagram whitepaper, secure public site, and a deployment/handoff plan, without unsupported claims.';
 
 class UsageError extends Error {
   constructor(message) {
@@ -67,6 +72,45 @@ function expandHostedBackendBlockers(infra) {
   }
   return blockers;
 }
+async function hostedBackendLiveSummary(input, generatedAt) {
+  const supplied = input && typeof input === 'object'
+    ? input
+    : await readJsonPath(input, 'hosted backend live evidence');
+  if (supplied === null) {
+    return {
+      ok: false,
+      status: 'missing',
+      blocker_paths: ['hosted_backend_live_evidence'],
+      checked: null,
+    };
+  }
+  const result = supplied.schema === HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA
+    ? validateHostedBackendLiveEvidence(supplied, { generated_at: generatedAt })
+    : supplied;
+  if (result.schema !== HOSTED_BACKEND_LIVE_RESULT_SCHEMA) {
+    throw new UsageError(`hosted backend live input must use schema ${HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA} or ${HOSTED_BACKEND_LIVE_RESULT_SCHEMA}`);
+  }
+  const blockerPaths = Array.isArray(result.blockers)
+    ? result.blockers.map((entry) => entry?.path).filter((path) => typeof path === 'string')
+    : ['blockers'];
+  if (result.checked?.refs_missing !== 0) blockerPaths.push('checked.refs_missing');
+  if (result.checked?.probes_covered !== 4) blockerPaths.push('checked.probes_covered');
+  if (result.checked?.runtime_services_covered !== 2) blockerPaths.push('checked.runtime_services_covered');
+  if (result.checked?.authenticated_data_plane_proofs_covered !== 2) blockerPaths.push('checked.authenticated_data_plane_proofs_covered');
+  if (result.ok !== true || result.status !== 'accepted') blockerPaths.push('status');
+  return {
+    ok: blockerPaths.length === 0,
+    status: result.status,
+    blocker_paths: [...new Set(blockerPaths)],
+    checked: {
+      refs_missing: result.checked?.refs_missing ?? null,
+      probes_covered: result.checked?.probes_covered ?? null,
+      runtime_services_covered: result.checked?.runtime_services_covered ?? null,
+      authenticated_data_plane_proofs_covered: result.checked?.authenticated_data_plane_proofs_covered ?? null,
+    },
+  };
+}
+
 
 function parseArgs(argv) {
   const out = {
@@ -82,6 +126,7 @@ function parseArgs(argv) {
     operatorAcceptancePacket: null,
     infrastructureReadiness: null,
     releaseAudit: null,
+    hostedBackendLive: null,
     workerInspect: null,
   };
   for (let index = 0; index < argv.length;) {
@@ -103,6 +148,7 @@ function parseArgs(argv) {
     else if (token === '--cloudflare-env-file') out.envFile = readValue(token);
     else if (token === '--operator-acceptance-packet' || token === '--operatorAcceptancePacket') out.operatorAcceptancePacket = readValue(token);
     else if (token === '--infrastructure-readiness' || token === '--infrastructureReadiness') out.infrastructureReadiness = readValue(token);
+    else if (token === '--hosted-backend-live' || token === '--hostedBackendLive') out.hostedBackendLive = readValue(token);
     else if (token === '--release-audit' || token === '--releaseAudit') out.releaseAudit = readValue(token);
     else if (token === '--worker-inspect' || token === '--workerInspect') out.workerInspect = readValue(token);
     else if (token === '--out') out.out = readValue(token);
@@ -112,7 +158,7 @@ function parseArgs(argv) {
 }
 
 function usage() {
-  return `Usage: node scripts/build-goal-completion-audit.mjs --site <dir> [options]\n\nOptions:\n  --project-name <name>             Cloudflare Pages project. Default: enigma-memory.\n  --domain <host>                   Public domain. Default: enigmamemory.com.\n  --live-url <url>                  Current public URL to observe. Default: https://enigmamemory.com/.\n  --expect-title <text>             Expected live title fragment. Default: Enigma.\n  --account-id <id>                 Cloudflare account id or placeholder for token-policy evidence.\n  --infrastructure-readiness <file> Completed infrastructure readiness JSON to summarize.\n  --operator-acceptance-packet <file> Completed operator packet JSON to validate and summarize.\n  --release-audit <file>            Current release audit JSON to summarize.\n  --worker-inspect <file>           Optional Worker inspection result; ready evidence suppresses the standalone probe action.\n  --cloudflare-env-file <file>      Load local Cloudflare env values without printing the path or values.\n  --objective <text>                Override objective text.\n  --out <file>                      Write audit JSON.\n  --help                            Show this help.\n`;
+  return `Usage: node scripts/build-goal-completion-audit.mjs --site <dir> [options]\n\nOptions:\n  --project-name <name>             Cloudflare Pages project. Default: enigma-memory.\n  --domain <host>                   Public domain. Default: enigmamemory.com.\n  --live-url <url>                  Current public URL to observe. Default: https://enigmamemory.com/.\n  --expect-title <text>             Expected live title fragment. Default: Enigma.\n  --account-id <id>                 Cloudflare account id or placeholder for token-policy evidence.\n  --infrastructure-readiness <file> Completed infrastructure readiness JSON to summarize.\n  --hosted-backend-live <file>      Strict hosted evidence/result with runtime and authenticated data-plane proofs.\n  --operator-acceptance-packet <file> Completed operator packet JSON to validate and summarize.\n  --release-audit <file>            Current release audit JSON to summarize.\n  --worker-inspect <file>           Optional Worker inspection result; ready evidence suppresses the standalone probe action.\n  --cloudflare-env-file <file>      Load local Cloudflare env values without printing the path or values.\n  --objective <text>                Override objective text.\n  --out <file>                      Write audit JSON.\n  --help                            Show this help.\n`;
 }
 
 async function readText(path) {
@@ -148,31 +194,23 @@ function blockerBreakdownLines(prefix, breakdown) {
 }
 
 async function inspectDocs() {
-  const masterPlan = await readText(resolve('docs/overnight-build-master-plan.md'));
   const whitepaper = await readText(resolve('docs/enigma-memory-technical-whitepaper.md'));
   const evidence = await readText(resolve('docs/release-evidence-2026-06-23.md'));
+  const claimBoundaries = await readText(resolve('docs/proof-network-claim-boundaries.md'));
   return {
-    masterPlan,
     whitepaper,
     evidence,
+    claimBoundaries,
   };
 }
 
-function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, productionManifests }) {
+function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, productionManifests, hostedBackendLive }) {
   const pages = handoff.pages ?? {};
   const infra = handoff.infrastructure ?? {};
   const operator = handoff.operator_acceptance ?? {};
   const releaseAudit = handoff.release_audit ?? {};
   const releaseGateNames = new Set(Array.isArray(releaseAudit.gate_names) ? releaseAudit.gate_names : []);
   const deliverables = [];
-  deliverables.push({
-    id: 'orchestration-master-plan',
-    requirement: 'Architecture/review owner and implementation-owner plan exists with claim boundaries and handoff cadence.',
-    ...boolEvidence(
-      /GPT-5\.5 owns architecture, design, and review/.test(docs.masterPlan) && /Kimi Code owns implementation/.test(docs.masterPlan),
-      ['docs/overnight-build-master-plan.md'],
-    ),
-  });
   deliverables.push({
     id: 'whitepaper-math-diagrams',
     requirement: 'Professional whitepaper contains math and diagrams for the memory layer and its evidence-bounded comparison framework.',
@@ -211,9 +249,9 @@ function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, pr
       backendSmoke.ok === true
         && backendSmoke.check_count === 4
         && backendSmoke.checks?.filter((check) => check.mode === 'production-fail-closed' && check.readyz_status === 503).length === 2
-        && backendSmoke.checks?.filter((check) => check.mode === 'production-referenced-fixture' && check.readyz_status === 200 && check.readyz_missing_evidence_ref_count === 0).length === 2,
+        && backendSmoke.checks?.filter((check) => check.mode === 'production-operational-fixture' && check.readyz_status === 200 && check.readyz_missing_evidence_ref_count === 0 && check.readyz_all_checks_ok === true).length === 2,
       ['npm run production:backend-smoke', `${backendSmoke.check_count} checks`],
-      ['backend readiness smoke did not prove fail-closed and fully referenced local runtime fixtures'],
+      ['backend readiness smoke did not prove fail-closed and explicit operational local runtime fixtures'],
     ),
   });
   deliverables.push({
@@ -231,7 +269,7 @@ function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, pr
   });
   deliverables.push({
     id: 'hosted-live-evidence-contract',
-    requirement: 'Hosted backend live evidence has a formal validator/schema requiring public HTTPS relay/gateway probes, all hosted refs, and operator acceptance go.',
+    requirement: 'Hosted backend live evidence has a formal validator/schema requiring public HTTPS health probes, explicit operational runtime capability, authenticated relay/gateway private data-plane proofs, all hosted refs, and operator acceptance go.',
     ...boolEvidence(
       HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA === 'enigma.hosted_backend_live_evidence.v1'
         && HOSTED_BACKEND_LIVE_RESULT_SCHEMA === 'enigma.hosted_backend_live_result.v1'
@@ -280,11 +318,17 @@ function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, pr
   });
   deliverables.push({
     id: 'hosted-backend-live',
-    requirement: 'Hosted relay/gateway/storage/KMS/SIEM/backup/operator infrastructure is live and directly verified.',
+    requirement: 'Hosted relay/gateway/storage/KMS/SIEM/backup/operator infrastructure is live with explicit operational runtime capability and authenticated private data-plane proofs.',
     ...boolEvidence(
-      infra.hosted_live_ready === true,
-      ['npm run infrastructure:readiness -- --manifest <completed> --live --cloudflare-live required'],
-      expandHostedBackendBlockers(infra),
+      infra.hosted_live_ready === true && hostedBackendLive.ok === true,
+      [
+        'npm run infrastructure:readiness -- --manifest <completed> --live --cloudflare-live required',
+        'npm run production:hosted-live -- --evidence <completed-hosted-evidence.json>',
+      ],
+      [
+        ...expandHostedBackendBlockers(infra),
+        ...hostedBackendLive.blocker_paths.map((path) => `hosted evidence blocker path: ${path}`),
+      ],
     ),
   });
   deliverables.push({
@@ -300,8 +344,9 @@ function deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, pr
     id: 'unsupported-claims-blocked',
     requirement: '$100B/best-in-world ambition is treated as ambition; collateral does not convert it into unsupported proof, ROI, compliance, or hosted-live claims.',
     ...boolEvidence(
-      /unsupported_market_superlative/.test(docs.evidence) || /unsupported superlatives/.test(docs.evidence) || /unsupported launch claim/i.test(docs.masterPlan),
-      ['docs/overnight-build-master-plan.md', 'docs/release-evidence-2026-06-23.md'],
+      /unsupported_market_superlative/.test(docs.evidence) || /unsupported superlatives/.test(docs.evidence)
+        || /market leadership/i.test(docs.claimBoundaries ?? '') || /unsupported superlatives/i.test(docs.claimBoundaries ?? ''),
+      ['docs/release-evidence-2026-06-23.md', 'docs/proof-network-claim-boundaries.md'],
       ['claim-boundary evidence missing unsupported-superlative controls'],
     ),
   });
@@ -318,6 +363,7 @@ export async function buildGoalCompletionAudit(input = {}, options = {}) {
   const expectTitle = optionalText(input.expectTitle, 'Enigma');
   const accountId = optionalText(input.accountId, '<cloudflare-account-id>');
   const workerInspect = await readJsonPath(input.workerInspect, 'worker inspection');
+  const hostedBackendLive = await hostedBackendLiveSummary(input.hostedBackendLive, generatedAt);
   const docs = await inspectDocs();
   const handoff = await buildProductionHandoffPacket({ site, projectName, domain, liveUrl, expectTitle, infrastructureReadiness: input.infrastructureReadiness, operatorAcceptancePacket: input.operatorAcceptancePacket, releaseAudit: input.releaseAudit }, {
     env,
@@ -335,7 +381,7 @@ export async function buildGoalCompletionAudit(input = {}, options = {}) {
     generated_at: generatedAt,
   });
   const productionManifests = await validateProductionManifestFiles({ generated_at: generatedAt });
-  const deliverables = deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, productionManifests });
+  const deliverables = deliverablesFromEvidence({ docs, handoff, tokenPolicy, backendSmoke, productionManifests, hostedBackendLive });
   const blockers = deliverables.flatMap((item) => item.ok ? [] : item.blockers.map((blocker) => `${item.id}: ${blocker}`));
   const deliverableById = new Map(deliverables.map((item) => [item.id, item]));
   const staticSiteLive = deliverableById.get('secure-static-site-artifact')?.ok === true
@@ -357,6 +403,7 @@ export async function buildGoalCompletionAudit(input = {}, options = {}) {
       check_count: backendSmoke.check_count,
       loopback_only: backendSmoke.loopback_only,
     },
+    hosted_backend_live_evidence: hostedBackendLive,
     production_manifest_validation: {
       ok: productionManifests.ok,
       status: productionManifests.status,
@@ -367,7 +414,7 @@ export async function buildGoalCompletionAudit(input = {}, options = {}) {
     next_actions: nextActionsForGoalAudit(handoff.next_actions, workerInspect),
     claim_boundary: [
       'This audit preserves the original objective and maps it to current direct evidence.',
-      'complete:false remains expected until hosted backend, operator acceptance, and provider evidence exist; static Cloudflare Pages deploy alone is not enough.',
+      'complete:false remains expected until hosted backend runtime capability, authenticated relay/gateway private data-plane proofs, operator acceptance, and provider evidence exist; health probes or static Cloudflare Pages deploy alone are not enough.',
       'Ambition language is not treated as proof of market value, ROI, compliance status, benchmark leadership, hosted-live readiness, provider deletion, or model forgetting.',
     ],
   };