forge-workflow 0.1.0-beta.5 → 0.1.0-beta.7

package/node_modules/@forge/memory/src/usage-evidence.js

@@ -0,0 +1,205 @@
+'use strict';
+
+const { types: { isProxy } } = require('node:util');
+
+// Public, storage-agnostic contract for bounded durable-memory usage evidence.
+const USE_KINDS = Object.freeze(['cli-recall', 'prompt-injection', 'read-attention', 'session-digest']);
+const MAX_IDENTIFIER_LENGTH = 255;
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/i;
+const SQLITE_CONTENTION_CODES = new Set(['SQLITE_BUSY', 'SQLITE_LOCKED']);
+
+const USAGE_EVIDENCE_MIGRATION = Object.freeze({
+  id: '011_memory_usage_evidence',
+  additive: true,
+  rollback_mode: 'disable-writes-preserve-evidence',
+  apply: Object.freeze([
+    `CREATE TABLE IF NOT EXISTS memory_usage_writer_state (
+  singleton INTEGER NOT NULL PRIMARY KEY CHECK (singleton = 1),
+  enabled INTEGER NOT NULL CHECK (enabled IN (0, 1))
+);`,
+    'INSERT OR IGNORE INTO memory_usage_writer_state (singleton, enabled) VALUES (1, 1);',
+    `CREATE TABLE IF NOT EXISTS memory_usage_events (
+  event_id TEXT NOT NULL PRIMARY KEY,
+  memory_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  use_kind TEXT NOT NULL,
+  consumer_id TEXT NOT NULL,
+  selection_digest TEXT NOT NULL,
+  observed_at TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL UNIQUE
+);`,
+    'CREATE INDEX IF NOT EXISTS idx_memory_usage_events_memory_observed ON memory_usage_events(memory_id, observed_at);',
+    `CREATE TABLE IF NOT EXISTS memory_usage_projection (
+  scope TEXT NOT NULL,
+  memory_id TEXT NOT NULL PRIMARY KEY,
+  last_used_at TEXT NOT NULL,
+  use_count INTEGER NOT NULL CHECK (typeof(use_count) = 'integer' AND use_count >= 0)
+);`,
+    'CREATE INDEX IF NOT EXISTS idx_memory_usage_projection_scope_last_used_memory ON memory_usage_projection(scope, last_used_at, memory_id);',
+  ]),
+  rollback: Object.freeze(['UPDATE memory_usage_writer_state SET enabled = 0 WHERE singleton = 1;']),
+});
+
+class UsageIdempotencyConflictError extends Error {
+  constructor(idempotencyKey) {
+    super(`usage evidence idempotency key conflicts: ${idempotencyKey}`);
+    this.name = 'UsageIdempotencyConflictError';
+  }
+}
+
+class UsageMemoryScopeConflictError extends Error {
+  constructor(memoryId) {
+    super(`usage evidence memory scope conflicts: ${memoryId}`);
+    this.name = 'UsageMemoryScopeConflictError';
+  }
+}
+
+function assertAdapter(store, method) {
+  return ownDataMethod(store, method, 'store');
+}
+
+function ownDataMethod(value, method, subject = 'adapter') {
+  if (!value || typeof value !== 'object' || isProxy(value)) {
+    throw new TypeError(`usage evidence ${subject} must be a plain record`);
+  }
+  let descriptor;
+  try { descriptor = Object.getOwnPropertyDescriptor(value, method); } catch { throw new TypeError(`usage evidence ${subject} ${method} must be an own data property`); }
+  if (!descriptor || !Object.hasOwn(descriptor, 'value') || typeof descriptor.value !== 'function') {
+    throw new TypeError(`usage evidence ${subject} ${method} must be an own data property`);
+  }
+  return descriptor.value;
+}
+
+function optionalOwnDataMethod(value, method, subject = 'store') {
+  if (!value || typeof value !== 'object' || isProxy(value)) {
+    throw new TypeError(`usage evidence ${subject} must be a plain record`);
+  }
+  let descriptor;
+  try { descriptor = Object.getOwnPropertyDescriptor(value, method); } catch { throw new TypeError(`usage evidence ${subject} ${method} must be an own data property`); }
+  if (!descriptor) return undefined;
+  if (!Object.hasOwn(descriptor, 'value') || typeof descriptor.value !== 'function') {
+    throw new TypeError(`usage evidence ${subject} ${method} must be an own data property`);
+  }
+  return descriptor.value;
+}
+
+function assertOpaqueIdentifier(value, fieldName) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_IDENTIFIER_LENGTH
+    || /[\\/]/.test(value) || [...value].some(character => character.charCodeAt(0) < 32)) {
+    throw new TypeError(`usage evidence ${fieldName} must be a bounded opaque identifier`);
+  }
+}
+
+function assertObservedAt(value) {
+  if (typeof value !== 'string' || Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value) {
+    throw new TypeError('usage evidence observed_at must be a canonical ISO timestamp');
+  }
+}
+
+function readOwnDataProperty(input, fieldName) {
+  let descriptor;
+  try { descriptor = Object.getOwnPropertyDescriptor(input, fieldName); } catch { throw new TypeError(`usage evidence ${fieldName} must be an own data property`); }
+  if (!descriptor || !Object.hasOwn(descriptor, 'value')) throw new TypeError(`usage evidence ${fieldName} must be an own data property`);
+  return descriptor.value;
+}
+
+function normalizeUsageEvidence(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new TypeError('usage evidence must be an object');
+  const event = Object.fromEntries(['event_id', 'memory_id', 'scope', 'use_kind', 'consumer_id', 'selection_digest', 'observed_at', 'idempotency_key']
+    .map(field => [field, readOwnDataProperty(input, field)]));
+  for (const fieldName of ['event_id', 'memory_id', 'scope', 'consumer_id', 'idempotency_key']) assertOpaqueIdentifier(event[fieldName], fieldName);
+  if (!USE_KINDS.includes(event.use_kind)) throw new TypeError(`usage evidence use_kind must be one of: ${USE_KINDS.join(', ')}`);
+  if (typeof event.selection_digest !== 'string' || !DIGEST_PATTERN.test(event.selection_digest)) throw new TypeError('usage evidence selection_digest must be a SHA-256 digest');
+  assertObservedAt(event.observed_at);
+  return event;
+}
+
+function installUsageEvidenceSchema(store) {
+  const exec = assertAdapter(store, 'exec');
+  for (const statement of USAGE_EVIDENCE_MIGRATION.apply) exec.call(store, statement);
+}
+
+function sameUsageEvidence(left, right) {
+  return ['event_id', 'memory_id', 'scope', 'use_kind', 'consumer_id', 'selection_digest', 'observed_at', 'idempotency_key']
+    .every(field => left[field] === right[field]);
+}
+
+function loadProjection(one, store, event) {
+  return one.call(store, 'SELECT last_used_at, use_count FROM memory_usage_projection WHERE memory_id = ?', [event.memory_id]);
+}
+
+function runTransactionWithSingleContentionRetry(transaction, store, callback) {
+  try { return transaction.call(store, callback); } catch (error) {
+    if (!SQLITE_CONTENTION_CODES.has(error?.code)) throw error;
+    return transaction.call(store, callback);
+  }
+}
+
+function assertWriterEnabled(writerGuard, store) {
+  if (writerGuard) writerGuard.call(store);
+}
+
+function appendUsageEvidence(store, input) {
+  const transaction = assertAdapter(store, 'transaction');
+  const one = assertAdapter(store, 'one');
+  const run = assertAdapter(store, 'run');
+  const writerGuard = optionalOwnDataMethod(store, 'assertUsageWriterEnabled');
+  const event = normalizeUsageEvidence(input);
+  return runTransactionWithSingleContentionRetry(transaction, store, () => {
+    assertWriterEnabled(writerGuard, store);
+    const existing = one.call(store, `SELECT event_id, memory_id, scope, use_kind, consumer_id, selection_digest, observed_at, idempotency_key
+      FROM memory_usage_events WHERE idempotency_key = ?`, [event.idempotency_key]);
+    if (existing) {
+      if (!sameUsageEvidence(existing, event)) throw new UsageIdempotencyConflictError(event.idempotency_key);
+      return { appended: false, ...loadProjection(one, store, event) };
+    }
+    const conflictingEvent = one.call(store, 'SELECT scope FROM memory_usage_events WHERE memory_id = ? AND scope <> ? LIMIT 1', [event.memory_id, event.scope]);
+    const existingProjection = one.call(store, 'SELECT scope FROM memory_usage_projection WHERE memory_id = ?', [event.memory_id]);
+    if (conflictingEvent || (existingProjection && existingProjection.scope !== event.scope)) throw new UsageMemoryScopeConflictError(event.memory_id);
+    run.call(store, `INSERT INTO memory_usage_events (event_id, memory_id, scope, use_kind, consumer_id, selection_digest, observed_at, idempotency_key)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [event.event_id, event.memory_id, event.scope, event.use_kind, event.consumer_id, event.selection_digest, event.observed_at, event.idempotency_key]);
+    run.call(store, `INSERT INTO memory_usage_projection (scope, memory_id, last_used_at, use_count) VALUES (?, ?, ?, 1)
+      ON CONFLICT(memory_id) DO UPDATE SET last_used_at = MAX(memory_usage_projection.last_used_at, excluded.last_used_at), use_count = memory_usage_projection.use_count + 1`,
+    [event.scope, event.memory_id, event.observed_at]);
+    return { appended: true, ...loadProjection(one, store, event) };
+  });
+}
+
+function rebuildUsageProjection(store) {
+  const transaction = assertAdapter(store, 'transaction');
+  const exec = assertAdapter(store, 'exec');
+  const one = assertAdapter(store, 'one');
+  const writerGuard = optionalOwnDataMethod(store, 'assertUsageWriterEnabled');
+  return runTransactionWithSingleContentionRetry(transaction, store, () => {
+    assertWriterEnabled(writerGuard, store);
+    const conflict = one.call(store, `SELECT memory_id FROM memory_usage_events GROUP BY memory_id HAVING COUNT(DISTINCT scope) > 1 LIMIT 1`);
+    if (conflict) throw new UsageMemoryScopeConflictError(conflict.memory_id);
+    exec.call(store, 'DELETE FROM memory_usage_projection');
+    exec.call(store, `INSERT INTO memory_usage_projection (scope, memory_id, last_used_at, use_count)
+      SELECT MIN(scope), memory_id, MAX(observed_at), COUNT(*) FROM memory_usage_events GROUP BY memory_id`);
+    return { projections: Number(one.call(store, 'SELECT COUNT(*) AS count FROM memory_usage_projection').count) };
+  });
+}
+
+function createUsageEvidenceStore(driver) {
+  const append = ownDataMethod(driver, 'appendUsageEvidence', 'adapter');
+  const rebuild = ownDataMethod(driver, 'rebuildUsageProjection', 'adapter');
+  const projection = ownDataMethod(driver, 'loadUsageProjection', 'adapter');
+  const projections = ownDataMethod(driver, 'loadUsageProjections', 'adapter');
+  return Object.freeze({
+    append: (event, config = {}) => append.call(driver, normalizeUsageEvidence(event), config),
+    rebuild: (config = {}) => rebuild.call(driver, config),
+    projection: (memoryId, config = {}) => {
+      assertOpaqueIdentifier(memoryId, 'memory_id');
+      return projection.call(driver, memoryId, config);
+    },
+    projections: (memoryIds, config = {}) => {
+      if (!Array.isArray(memoryIds) || memoryIds.length > 200) throw new TypeError('usage evidence memory ids must be a bounded array');
+      const unique = [...new Set(memoryIds)];
+      unique.forEach(memoryId => assertOpaqueIdentifier(memoryId, 'memory_id'));
+      return projections.call(driver, unique, config);
+    },
+  });
+}
+
+module.exports = { USE_KINDS, USAGE_EVIDENCE_MIGRATION, UsageIdempotencyConflictError, UsageMemoryScopeConflictError, appendUsageEvidence, createUsageEvidenceStore, installUsageEvidenceSchema, normalizeUsageEvidence, rebuildUsageProjection };

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "forge-workflow",
-  "version": "0.1.0-beta.5",
+  "version": "0.1.0-beta.7",
+  "packageManager": "bun@1.4.2",
   "description": "Local runtime control plane for AI-assisted engineering workflows, gates, evidence, and all AI agents",
   "bin": {
     "forge": "bin/forge.js",
@@ -34,7 +35,7 @@
     "test:benchmark:full": "node scripts/benchmark.js --output test-results/benchmark-full-results.json --profile-dir test-results/benchmark-full-profiles --group full-suite --group validate",
     "test:full:parallel": "node scripts/test-full-suite.js",
     "test:dashboard": "node scripts/test-dashboard.js",
-    "test:profile": "node scripts/test-profile.js --input-dir test-results --output test-results/test-profile.json --label local",
+    "test:profile": "node scripts/test-profile.js --input-dir test-results --output test-results/test-profile.profile.json --label local",
     "test:randomized": "bun test --timeout 15000 --randomize",
     "test:rerun": "bun test --timeout 15000 --rerun-each 2",
     "agentic:sync": "node scripts/sync-agentic-workflow.js"
@@ -57,7 +58,7 @@
     "eslint": "^10.0.2",
     "eslint-plugin-sonarjs": "^4.1.0",
     "globals": "^17.3.0",
-    "js-yaml": "^5.2.2",
+    "js-yaml": "^5.2.3",
     "lefthook": "^2.1.4",
     "typescript": "7.0.2"
   },
@@ -101,6 +102,7 @@
     ".forge/hooks/",
     ".forge/protected-paths.yaml",
     "CHANGELOG.md",
+    "CODING_STANDARDS.md",
     "QUICKSTART.md",
     "docs/*.md",
     "docs/architecture/**/*.md",
@@ -114,10 +116,19 @@
     ".mcp.json.example"
   ],
   "dependencies": {
+    "@forge/flow": "0.1.0-beta.6",
+    "@forge/memory": "0.1.0-beta.6",
+    "@forge/contracts": "0.1.0-beta.6",
     "@babel/parser": "^8.0.0",
+    "cross-spawn": "^7.0.6",
     "fastest-levenshtein": "^1.0.16",
     "yaml": "^2.8.3"
   },
+  "bundledDependencies": [
+    "@forge/flow",
+    "@forge/memory",
+    "@forge/contracts"
+  ],
   "overrides": {
     "eslint": "^10.0.2",
     "fast-uri": "^3.1.4",
@@ -125,7 +136,8 @@
     "minimatch": "10.2.4",
     "brace-expansion": "5.0.9",
     "linkify-it": "^5.0.2",
-    "lodash": "4.18.1"
+    "lodash": "4.18.1",
+    "qs": "6.16.0"
   },
   "c8": {
     "lines": 80,

package/packages/flow/node_modules/@forge/contracts/compatibility-matrix.v1.json

@@ -0,0 +1 @@
+{"matrix_version":1,"readers":{"0.1.0-beta.6":{"accepted":{"forge.memory.work-packet.v1":[1],"forge.memory.context-packet.v1":[1],"forge.memory.claim-request.v1":[1],"forge.memory.lease-receipt.v1":[1],"forge.memory.capability-manifest.v1":[1],"forge.memory.run-receipt.v1":[1],"forge.memory.feedback-report.v1":[1],"forge.memory.structured-error.v1":[1],"forge.memory.monitor-event.v1":[1],"forge.memory.delivery-receipt.v1":[1],"forge.memory.monitor-receipt.v1":[1]},"validation_surfaces":{"structural":"no_authority_or_freshness_claim","consequential":"requires_independent_live_expected"},"schema_annotations":{"generic_json_schema_enforces_x_forge":false,"conformance_helper":"validateContractStructure","requirement":"x-forge bounds and privacy annotations require the Forge runtime validator"},"run_receipt_non_authoritative_statuses":["NOT_EXECUTED"],"unknown_advisory":"preserve","unknown_consequential":"reject","unknown_schema_version":"reject"}}}

package/packages/flow/node_modules/@forge/contracts/contract-baseline.v1.json

@@ -0,0 +1,134 @@
+{
+  "baseline_version": 1,
+  "generator_version": "contracts-schema-gen/7",
+  "artifacts": [
+    {
+      "path": "compatibility-matrix.v1.json",
+      "sha256": "4ca93d10ae9bff80dd3785bb5ebfc77610cf19e928b9b9ae3f6a1ad9c2fea18e"
+    },
+    {
+      "path": "fixtures/v1/canonical-hash.json",
+      "sha256": "469c5b83ebe5e02601cd41b83f35f013f8fb4b118b8e213dc1790bb61301dc3c"
+    },
+    {
+      "path": "fixtures/v1/contract-inputs.v1.json",
+      "sha256": "40f28821f77ea153259a43e0ca8a5d6611f3e5e0ec4e4e47114d4cddeadac3fc"
+    },
+    {
+      "path": "fixtures/v1/feedback-secret-reject.json",
+      "sha256": "d2a8762a169617a6c98f5654e1d5265732485037e55af107018d139895b47869"
+    },
+    {
+      "path": "fixtures/v1/identity-conflict.json",
+      "sha256": "c703733d89f8adb079fb0e0ffe01ad35238d9a5f3ae725af54bca8b518fd6039"
+    },
+    {
+      "path": "fixtures/v1/malformed-envelope-inputs.v1.json",
+      "sha256": "17354a1178523332645f27d506eeabaa39eb6ea6bfa448807f7d0b8d4a1226f2"
+    },
+    {
+      "path": "fixtures/v1/malformed-missing-required.json",
+      "sha256": "e4031505309e8b172d274ef7c4ef617e71217742ff2b7285f37859db0eea42b9"
+    },
+    {
+      "path": "fixtures/v1/monitor-bounds-reject.json",
+      "sha256": "36594e37f3707572ec73c60134f24f5fb3ae17a41d804c409fc03a83e9716c26"
+    },
+    {
+      "path": "fixtures/v1/monitor-receipt-privacy-reject.json",
+      "sha256": "e2c53bc43d727d3583f9f2da6538c127a08997fe279f9e74d585c5b95983b4bf"
+    },
+    {
+      "path": "fixtures/v1/not-executed-receipt.json",
+      "sha256": "4582002c36cca422ac1ad9a5858558234d5ed162dbe72b36665fe09ab098099f"
+    },
+    {
+      "path": "fixtures/v1/privacy-redaction.json",
+      "sha256": "be4bae1d68db334875b3d198525dcd46f3efb46dbeea62de03399a915b716e20"
+    },
+    {
+      "path": "fixtures/v1/retry-identical.json",
+      "sha256": "41c944e15725d45a19bd97015c4bf7fb6ca1a4740426225426bc38799046bd8a"
+    },
+    {
+      "path": "fixtures/v1/stale-authority-reject.json",
+      "sha256": "700173546cff08486df201316472921d8304ea892c29770b5f199e63c92601b3"
+    },
+    {
+      "path": "fixtures/v1/structured-error-privacy-reject.json",
+      "sha256": "008186d22ed5048e4926c7b56c08a71802392886425944d0e1a22b10c7433d58"
+    },
+    {
+      "path": "fixtures/v1/structured-error-stripe-live-reject.json",
+      "sha256": "6e7e0d865ccab874fed66cefd15943bbaf51e4be37bfc99cd38f2e8cd6cafce6"
+    },
+    {
+      "path": "fixtures/v1/structured-error-stripe-test-reject.json",
+      "sha256": "ab9d748875e4688299a8678a551a2d3f13eb85c6f852ccbaaf102b870b3da82c"
+    },
+    {
+      "path": "fixtures/v1/unknown-advisory-roundtrip.json",
+      "sha256": "674e1dd9585d86ed7c8851a3d7e2b0ce81427a3dbc59c149409ee87375f9e879"
+    },
+    {
+      "path": "fixtures/v1/unknown-consequential-reject.json",
+      "sha256": "4228ce85d8f92d6eea61802fd34a410eab778314c70c8315cd1d9c9ba8ef2813"
+    },
+    {
+      "path": "fixtures/v1/valid-full.json",
+      "sha256": "2ba47dfcd5bc6dc4fae83160b05eeca480b51b065d251a0f531ca2c3effb0397"
+    },
+    {
+      "path": "fixtures/v1/valid-minimal.json",
+      "sha256": "e7d4e7d5cb11b4de809140d572c6f40a5ed4fc813f0044983930a6fbaab99444"
+    },
+    {
+      "path": "fixtures/v1/wrong-capability-digest.json",
+      "sha256": "8599acc3eebfba3883ec05e496cfc66e08e79877c8193c24db75540b4549062a"
+    },
+    {
+      "path": "schemas/v1/capability-manifest.schema.json",
+      "sha256": "8435c1ec9ebfd0f9b9b6d06f490dcfdac4696f002a83692899e1e172f17cd6dd"
+    },
+    {
+      "path": "schemas/v1/claim-request.schema.json",
+      "sha256": "eb9a6aa46c51550fa5505caeeff6e7773fce128e940fdb85a851cfd13cbf1375"
+    },
+    {
+      "path": "schemas/v1/context-packet.schema.json",
+      "sha256": "36f422011e03fafe07de5fb16a1e9c745015b4257f640e77f1ae1f4ba70971eb"
+    },
+    {
+      "path": "schemas/v1/delivery-receipt.schema.json",
+      "sha256": "1e505c9a790d2e5a3ccf1cd227b7a708924f9d92a61c2220964f7cb05a9d8f4c"
+    },
+    {
+      "path": "schemas/v1/feedback-report.schema.json",
+      "sha256": "6f9f272b831d30574ecf56601307a361544f022c7690fd8077aeae8ca5913e37"
+    },
+    {
+      "path": "schemas/v1/lease-receipt.schema.json",
+      "sha256": "e7b3c1f6857e4ebad930518236011b8346054b1fa7d38607def4a42c1ba9a739"
+    },
+    {
+      "path": "schemas/v1/monitor-event.schema.json",
+      "sha256": "df270f5b7e280c10293f2c964727d13baa0488c9e1cc87037ba1307bc76958dc"
+    },
+    {
+      "path": "schemas/v1/monitor-receipt.schema.json",
+      "sha256": "555dba3db355498a1813bfcf045fe2c3f10057789539918e3303c11191048b33"
+    },
+    {
+      "path": "schemas/v1/run-receipt.schema.json",
+      "sha256": "de55aca54248a208560fffade7bcfdc555e83daf330f37fe482bb8068495ece6"
+    },
+    {
+      "path": "schemas/v1/structured-error.schema.json",
+      "sha256": "ea8b6d40528634743efa91a550d27d8191adc8ce95e630356dadce98ba864d64"
+    },
+    {
+      "path": "schemas/v1/work-packet.schema.json",
+      "sha256": "82f149e5ceedf004a5c129f264d0cb94e6704a7eadae8f02dbd40a62b75a556c"
+    }
+  ]
+}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/canonical-hash.json

@@ -0,0 +1 @@
+{"fixture_id":"canonical-hash","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"operation":"canonical-hash","expected":{"stable_under_key_reordering":true,"content_hash_excluded":true}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/contract-inputs.v1.json

@@ -0,0 +1,71 @@
+{
+  "corpus_version": 1,
+  "inputs": [
+    {
+      "schema_id": "forge.memory.work-packet.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000001", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "fixture", "actor_class": "system", "actor_id": "fixture" }, "content_hash": "b5b6527735acceed41f41cb4b7ae778ad8e3d3fd517832c4936e8c632881c10c",
+      "payload": { "issue_id": "issue-1", "expected_issue_revision": 1, "packet_id": "packet-1", "packet_revision": 1, "repository_id": "github.com/example/forge", "target_head": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "objective": "fixture objective", "authority": { "kind": "kernel", "issue_revision": 1 }, "allowed_mutations": ["files"], "workflow_config_revision": "config-1", "capability_manifest_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.context-packet.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000002", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "fixture", "actor_class": "system", "actor_id": "fixture" }, "content_hash": "278663383d458667b71eb25f6bed8c5828445e070b5af2369a46bc2953b34999",
+      "payload": { "work_packet_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "context_selection_revision": 1, "privacy_scope_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "retention_class": "local_sensitive", "disclosure_class": "remote_redacted", "redaction_policy_revision": "redaction-1", "summaries": [{ "kind": "issue", "text": "redacted fixture" }] }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.claim-request.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000003", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "fixture", "actor_class": "agent", "actor_id": "agent-1" }, "content_hash": "aa1972081945dbfff1b9a800ce139968f6bc8581f19d5f243906181565a665aa",
+      "payload": { "issue_id": "issue-1", "expected_issue_revision": 1, "actor_id": "agent-1", "request_id": "request-1", "requested_scope": { "mutations": ["files"] }, "idempotency_key": "claim-1" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.lease-receipt.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000004", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "kernel", "actor_class": "authority", "actor_id": "kernel" }, "content_hash": "f3fdc336f2da33d69ed4e1e360e455d9903123add962464062d29f373cabe3d0",
+      "payload": { "claim_request_id": "request-1", "lease_id": "lease-1", "lease_epoch": 1, "issue_revision": 1, "actor_id": "agent-1", "scope": { "mutations": ["files"] }, "expires_at": "2026-08-09T13:00:00.000Z", "durable": true, "authority_signature": "fixture-signature" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.capability-manifest.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000005", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-flow", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "probe", "actor_class": "system", "actor_id": "probe" }, "content_hash": "296ff678e04103e339231fef672db2220f5bd23981fefdc96dcfcd6f338f355e",
+      "payload": { "provider_id": "codex", "manifest_revision": 1, "config_revision": "config-1", "executable_identity": { "path_hash": "fixture" }, "provider_version": "1.0.0", "probe_revision": "probe-1", "result_hash": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "capabilities": [{ "capability_id": "flow.execute", "available": true }], "evaluator_status": "approved", "probed_at": "2026-08-09T12:00:00.000Z", "expires_at": "2026-08-09T13:00:00.000Z" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.run-receipt.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000006", "created_at": "2026-08-09T12:30:00.000Z",
+      "producer": { "product_id": "forge-flow", "product_version": "0.1.0-beta.6", "instance_id": "run-1" }, "capabilities_used": [],
+      "provenance": { "source_kind": "execution", "actor_class": "agent", "actor_id": "agent-1" }, "content_hash": "4f919795d2c62ad6520b54fc526c215621ef046a59326f673aa6e41a1f6fc751",
+      "payload": { "packet_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "run_id": "run-1", "attempt_id": "attempt-1", "exact_head": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "packet_revision": 1, "manifest_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "workflow_config_revision": "config-1", "status": "PASS", "executor": { "product": "forge-flow" }, "started_at": "2026-08-09T12:00:00.000Z", "ended_at": "2026-08-09T12:30:00.000Z", "evidence_refs": [], "validation": { "status": "PASS" }, "cleanup": { "status": "PASS" } }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.feedback-report.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000007", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "feedback", "actor_class": "anonymous-user", "actor_id": "report-1" }, "content_hash": "3adb5b3f1b726b7b67032bf607ab89e54aee3f9eeefa6d4cdbd29340bee555c1",
+      "payload": { "report_id": "report-1", "product_version": "0.1.0-beta.6", "contract_version": 1, "stable_error_code": "FORGE_FIXTURE", "affected_capability": "flow.execute", "redacted_reproduction_steps": ["run fixture"], "expected_classification": "PASS", "actual_classification": "FAIL", "occurrence_count": 1, "content_fingerprint": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "consent_event_id": "consent-1", "redaction_policy_revision": "redaction-1" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.structured-error.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000008", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-memory", "product_version": "0.1.0-beta.6", "instance_id": "fixture" }, "capabilities_used": [],
+      "provenance": { "source_kind": "execution", "actor_class": "system", "actor_id": "forge" }, "content_hash": "50d181d71714a308539f5612fee7dfa854a4abe9591981842303de24db64982d",
+      "payload": { "parent_object_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "error_occurrence_id": "error-1", "code": "FORGE_FIXTURE", "terminal_classification": "FAIL", "safe_details": { "summary": "fixture failure" } }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.monitor-event.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000009", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-flow", "product_version": "0.1.0-beta.6", "instance_id": "monitor-1" }, "capabilities_used": [],
+      "provenance": { "source_kind": "monitor", "actor_class": "system", "actor_id": "monitor" }, "content_hash": "01b1e7086a5ba2ddf521ad8e8901db925d9f9e8fe2db75c43ca5eea941d68559",
+      "payload": { "monitor_id": "monitor-1", "event_id": "event-1", "sequence": 0, "subject_revision": "head-1", "type": "check.completed", "actionability": "advisory", "observed_at": "2026-08-09T12:00:00.000Z", "bounded_payload": { "status": "PASS" } }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.delivery-receipt.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000010", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-flow", "product_version": "0.1.0-beta.6", "instance_id": "delivery-1" }, "capabilities_used": [],
+      "provenance": { "source_kind": "delivery", "actor_class": "system", "actor_id": "adapter" }, "content_hash": "0bfe86d8a48be6ac271c92c1e767ec53ce0f7bfc2e228a47832522eefa44b40a",
+      "payload": { "event_id": "event-1", "target": "agent-1", "transport_tier": "T1", "attempt": 1, "delivered_at": "2026-08-09T12:00:00.000Z", "acknowledged": true, "outcome": "acknowledged" }, "extensions": {}
+    },
+    {
+      "schema_id": "forge.memory.monitor-receipt.v1", "schema_version": 1, "object_id": "00000000-0000-4000-8000-000000000011", "created_at": "2026-08-09T12:00:00.000Z",
+      "producer": { "product_id": "forge-flow", "product_version": "0.1.0-beta.6", "instance_id": "monitor-1" }, "capabilities_used": [],
+      "provenance": { "source_kind": "monitor", "actor_class": "system", "actor_id": "monitor" }, "content_hash": "01da8754bae5d5a17501a7e20bfc93959e274227add6a31e451424b2c1ac7251",
+      "payload": { "monitor_id": "monitor-1", "owner_run_id": "run-1", "terminal_state": "PASS", "terminal_reason": "predicate satisfied", "last_sequence": 0, "evidence_digest": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "cancellation_acknowledged": true, "process_cleanup": { "status": "PASS" }, "lease_cleanup": { "status": "PASS" } }, "extensions": {}
+    }
+  ]
+}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/feedback-secret-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"feedback-secret-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.feedback-report.v1"},"mutation":{"operation":"replace","path":"payload.redacted_reproduction_steps","value":["token=ghp_123456789012345678901234567890"],"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"PRIVACY_SECRET_PATTERN"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/identity-conflict.json

@@ -0,0 +1 @@
+{"fixture_id":"identity-conflict","accepted_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"candidate_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"candidate_mutation":{"operation":"replace","path":"payload.objective","value":"conflicting objective","rehash":true},"operation":"classify-semantic-attempt","expected":{"status":"identity-conflict"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/malformed-envelope-inputs.v1.json

@@ -0,0 +1,16 @@
+{
+  "corpus_version": 1,
+  "base_input": { "ref": "contract-inputs.v1.json", "schema_id": "forge.memory.work-packet.v1" },
+  "cases": [
+    { "missing_field": "schema_id", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "schema_version", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "object_id", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "created_at", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "producer", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "capabilities_used", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "provenance", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "content_hash", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "payload", "operation": "remove", "expected_code": "MISSING_REQUIRED" },
+    { "missing_field": "extensions", "operation": "remove", "expected_code": "MISSING_REQUIRED" }
+  ]
+}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/malformed-missing-required.json

@@ -0,0 +1 @@
+{"fixture_id":"malformed-missing-required","input_ref":{"file":"malformed-envelope-inputs.v1.json"},"operation":"materialize-cases","expected":{"case_count":10,"code":"MISSING_REQUIRED"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/monitor-bounds-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"monitor-bounds-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.monitor-event.v1"},"mutation":{"operation":"replace","path":"payload.bounded_payload","value":{"shape":"nine-level nested object; materializer repeats key child nine times"},"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"BOUNDED_VALUE_TOO_DEEP"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/monitor-receipt-privacy-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"monitor-receipt-privacy-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.monitor-receipt.v1"},"mutation":{"operation":"replace","path":"payload.process_cleanup","value":{"detail":"password=supersecretvalue"},"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"PRIVACY_SECRET_PATTERN"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/not-executed-receipt.json

@@ -0,0 +1 @@
+{"fixture_id":"not-executed-receipt","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.run-receipt.v1"},"mutation":{"operation":"replace","path":"payload.status","value":"NOT_EXECUTED","rehash":true},"operation":"validate-structure-then-authority","expected":{"structural_ok":true,"authority_ok":false,"authority_code":"NOT_EXECUTED_NO_TRANSITION"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/privacy-redaction.json

@@ -0,0 +1 @@
+{"fixture_id":"privacy-redaction","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.context-packet.v1"},"live_expected":{"workPacketHash":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","privacyScopeHash":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","redactionPolicyRevision":"redaction-1","allowedDisclosureClasses":["remote_redacted"]},"operation":"validate-expected","expected":{"code":"STALE_PRIVACY_SCOPE","raw_content_embedded":false}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/retry-identical.json

@@ -0,0 +1 @@
+{"fixture_id":"retry-identical","accepted_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"candidate_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"operation":"classify-semantic-attempt","expected":{"status":"retry-identical"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/stale-authority-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"stale-authority-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"live_expected":{"issueRevision":2,"workflowConfigRevision":"config-1","capabilityManifestDigest":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","exactHead":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"operation":"validate-expected","expected":{"code":"STALE_ISSUE_REVISION"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/structured-error-privacy-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"structured-error-privacy-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.structured-error.v1"},"mutation":{"operation":"replace","path":"payload.safe_details","value":{"detail":"token=ghp_123456789012345678901234567890"},"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"PRIVACY_SECRET_PATTERN"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/structured-error-stripe-live-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"structured-error-stripe-live-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.structured-error.v1"},"mutation":{"operation":"replace","path":"payload.safe_details","value":{"detail":"sk_live_1234567890ABCDEF"},"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"PRIVACY_SECRET_PATTERN"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/structured-error-stripe-test-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"structured-error-stripe-test-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.structured-error.v1"},"mutation":{"operation":"replace","path":"payload.safe_details","value":{"detail":"sk_test_ABCDEF1234567890"},"rehash":true},"operation":"validate-structure","expected":{"ok":false,"code":"PRIVACY_SECRET_PATTERN"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/unknown-advisory-roundtrip.json

@@ -0,0 +1 @@
+{"fixture_id":"unknown-advisory-roundtrip","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"mutation":{"operation":"add","path":"extensions.vendor.example/advisory","value":{"impact":"advisory","schema_version":1,"value":{"note":"preserve"}},"rehash":true},"operation":"roundtrip-extension","expected":{"preserved":true}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/unknown-consequential-reject.json

@@ -0,0 +1 @@
+{"fixture_id":"unknown-consequential-reject","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"mutation":{"operation":"add","path":"extensions.vendor.example/authority","value":{"impact":"consequential","schema_version":1,"value":{"permit":true}},"rehash":true},"operation":"validate-extension","expected":{"code":"UNKNOWN_CONSEQUENTIAL_EXTENSION"}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/valid-full.json

@@ -0,0 +1 @@
+{"fixture_id":"valid-full","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"mutations":[{"operation":"add","path":"payload.acceptance_criteria","value":["all gates pass"]},{"operation":"add","path":"payload.prohibited_actions","value":["merge"]}],"operation":"rehash-and-validate-structure","authority_claim":false,"expected":{"ok":true}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/valid-minimal.json

@@ -0,0 +1 @@
+{"fixture_id":"valid-minimal","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"operation":"validate-structure","authority_claim":false,"expected":{"ok":true}}

package/packages/flow/node_modules/@forge/contracts/fixtures/v1/wrong-capability-digest.json

@@ -0,0 +1 @@
+{"fixture_id":"wrong-capability-digest","input_ref":{"file":"contract-inputs.v1.json","schema_id":"forge.memory.work-packet.v1"},"live_expected":{"issueRevision":1,"workflowConfigRevision":"config-1","capabilityManifestDigest":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","exactHead":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"operation":"validate-expected","expected":{"code":"WRONG_CAPABILITY_DIGEST"}}

package/packages/flow/node_modules/@forge/contracts/index.js

@@ -0,0 +1,32 @@
+"use strict";
+
+const { canonicalize, computeContentHash } = require("./src/canonical.js");
+const { verifyContractBaseline } = require("./src/baseline.js");
+const { CONTRACTS } = require("./src/definitions.js");
+const { classifySemanticAttempt, semanticIdentity } = require("./src/identity.js");
+const { generateJsonSchema, supportedSchemaVersions } = require("./src/schema.js");
+const {
+  ContractValidationError,
+  ENVELOPE_FIELDS,
+  parseContract,
+  validateContract,
+  validateContractStructure,
+  validateEnvelope,
+} = require("./src/validate.js");
+
+module.exports = {
+  ENVELOPE_FIELDS,
+  CONTRACTS,
+  ContractValidationError,
+  canonicalize,
+  classifySemanticAttempt,
+  computeContentHash,
+  generateJsonSchema,
+  parseContract,
+  semanticIdentity,
+  supportedSchemaVersions,
+  validateContract,
+  validateContractStructure,
+  validateEnvelope,
+  verifyContractBaseline,
+};