harnery 0.24.0 → 0.26.0

package/dist/commands/harness.d.ts

@@ -1,8 +1,9 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
-import { type BenchResult, type HarnessBenchReport } from "../core/harnesses/index.js";
+import { type BenchResult, type HarnessAttestationReport, type HarnessBenchReport } from "../core/harnesses/index.js";
 import type { HarnessProfile } from "../core/harnesses/types.js";
 export declare function registerHarnessCommand(program: Command, emit: EmitContext): void;
+export declare function renderAttestationReport(report: HarnessAttestationReport): string;
 export declare function renderProfileTable(profiles: readonly HarnessProfile[]): string;
 export declare function renderProfile(profile: HarnessProfile): string;
 export declare function renderBenchReport(report: HarnessBenchReport): string;

package/dist/commands/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,kBAAkB,EAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAYjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6DhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAcpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAuJhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/commands/harness.js

@@ -1,4 +1,5 @@
-import { createBuiltinHarnessRegistry, runHarnessBench, } from "../core/harnesses/index.js";
+import { workflowSubscriptionOnly } from "../core/config.js";
+import { createBuiltinHarnessRegistry, listAttestations, runHarnessAttestation, runHarnessBench, } from "../core/harnesses/index.js";
 const registry = createBuiltinHarnessRegistry();
 export function registerHarnessCommand(program, emit) {
     const command = program
@@ -62,6 +63,103 @@ export function registerHarnessCommand(program, emit) {
             emit.setExitCode(1);
         }
     });
+    command
+        .command("attest [harnesses...]")
+        .description("Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.")
+        .option("--yes", "Confirm that this spends real vendor tokens")
+        .option("--subscription-only", "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)")
+        .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
+        .option("--json", "Machine-readable attestation report")
+        .action(async (harnesses, opts) => {
+        if (!opts.yes) {
+            emit.error({
+                code: "harness_attest_unconfirmed",
+                message: "harness attest runs one real model turn per harness and spends vendor tokens. Re-run with --yes.",
+            });
+            emit.setExitCode(1);
+            return;
+        }
+        const timeoutMs = opts.timeout ? Number(opts.timeout) : undefined;
+        if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+            emit.error({
+                code: "harness_attest_bad_timeout",
+                message: "--timeout must be a positive number",
+            });
+            emit.setExitCode(1);
+            return;
+        }
+        try {
+            const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly();
+            const report = await runHarnessAttestation(registry, {
+                harnesses,
+                timeoutMs,
+                subscriptionOnly,
+            });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(report);
+            }
+            else {
+                emit.text(renderAttestationReport(report));
+            }
+            // A sweep that recorded nothing at all is a failure; a partial sweep is
+            // reported honestly and still exits 0, because a host is not required
+            // to install every vendor CLI.
+            emit.setExitCode(report.recorded === 0 ? 1 : 0);
+        }
+        catch (error) {
+            emit.error({ code: "harness_attest_failed", message: error.message });
+            emit.setExitCode(1);
+        }
+    });
+    command
+        .command("attestations")
+        .description("Show the recorded live attestations without running any model turns.")
+        .option("--json", "Machine-readable attestation list")
+        .action((opts) => {
+        try {
+            const records = listAttestations();
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data({ attestations: records });
+                return;
+            }
+            if (records.length === 0) {
+                emit.text("No attestations recorded. Run `harness attest --yes` to create one.");
+                return;
+            }
+            emit.text(renderTable(["HARNESS", "VERSION", "BILLING", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
+                record.harness,
+                record.binary_version,
+                record.subscription_only ? "subscription" : "any",
+                record.observed_at,
+                Object.entries(record.observations)
+                    .map(([dimension, support]) => `${dimension}=${support}`)
+                    .join(" "),
+            ])));
+        }
+        catch (error) {
+            emit.error({ code: "harness_attestations_failed", message: error.message });
+            emit.setExitCode(1);
+        }
+    });
+}
+export function renderAttestationReport(report) {
+    const rows = report.results.map((result) => [
+        result.harness,
+        result.outcome,
+        result.binaryVersion ?? "",
+        result.observations
+            ? Object.entries(result.observations)
+                .map(([dimension, support]) => `${dimension}=${support}`)
+                .join(" ")
+            : result.note,
+    ]);
+    const table = renderTable(["HARNESS", "OUTCOME", "VERSION", "OBSERVED"], rows);
+    const tail = report.incomplete
+        ? "Some harnesses were not attested; their bench rows keep an adapter basis."
+        : "Every selected harness was attested.";
+    return `${table}\n\nrecorded: ${report.recorded}/${report.results.length}\n${tail}`;
 }
 export function renderProfileTable(profiles) {
     const rows = profiles.map((profile) => [
@@ -100,13 +198,25 @@ export function renderBenchReport(report) {
         result.declared,
         result.observed,
         result.verdict,
+        result.basis,
     ]);
-    const table = renderTable(["HARNESS", "DIMENSION", "DECLARED", "OBSERVED", "VERDICT"], rows);
+    const table = renderTable(["HARNESS", "DIMENSION", "DECLARED", "OBSERVED", "VERDICT", "BASIS"], rows);
     const summary = Object.entries(report.summary)
         .filter(([, count]) => count > 0)
         .map(([verdict, count]) => `${verdict}=${count}`)
         .join(", ");
-    return `${table}\n\nmode: ${report.mode} (no model calls)\n${summary}`;
+    const basis = Object.entries(report.basisSummary)
+        .filter(([, count]) => count > 0)
+        .map(([name, count]) => `${name}=${count}`)
+        .join(", ");
+    return [
+        table,
+        "",
+        `mode: ${report.mode} (no model calls)`,
+        summary,
+        `basis: ${basis}`,
+        "adapter = checked against Harnery's planner/normalizer/fixture, not the installed CLI",
+    ].join("\n");
 }
 function renderTable(headers, rows) {
     const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0)));

package/dist/commands/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAsEnD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAgGnF"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA0EnD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAgGnF"}

package/dist/commands/supervisor.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { approveSupervisorPlan, configureSupervisorService, createSupervisor, listSupervisors, readSupervisor, readSupervisorPlan, readSupervisorServiceConfig, readSupervisorServiceStatus, rejectSupervisorPlan, requestSupervisorServiceStop, retrySupervisorPlan, runSupervisor, runSupervisorServiceDaemon, spawnSupervisorService, supervisorServiceLogPath, } from "../core/supervisor/index.js";
@@ -332,12 +332,7 @@ function serviceEngine(config, registry) {
         cwd: config.engine.cwd,
         subscriptionOnly: config.engine.subscription_only,
         allowApiBilling: config.engine.allow_api_billing,
-        harnessEvidence: Object.fromEntries(registry
-            .list()
-            .map((adapter) => [
-            adapter.profile.id,
-            { toolEvidence: adapter.profile.capabilities.toolEvidence },
-        ])),
+        ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
         policy: config.engine.policy,
         approvalMode: "park",
         approvalAddressee: config.engine.approval_addressee,
@@ -413,12 +408,7 @@ function registerRunCommand(supervisor, mode, registry, emit) {
                     cwd: opts.cwd,
                     subscriptionOnly: opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
                     allowApiBilling: opts.allowApiBilling,
-                    harnessEvidence: Object.fromEntries(registry
-                        .list()
-                        .map((adapter) => [
-                        adapter.profile.id,
-                        { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                    ])),
+                    ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                     policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                     approvalMode: "park",
                     approvalAddressee: opts.approvalTo,

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmDnD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAuDnD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E"}

package/dist/commands/work.js

@@ -1,5 +1,5 @@
 import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { acceptWorkItem, cancelWorkItem, createWorkItem, listWorkItems, readWorkItem, reconcileAllWorkItems, reconcileWorkItem, reopenWorkItem, runWorkItem, } from "../core/work/index.js";
@@ -132,12 +132,7 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
                         cwd: opts.cwd,
                         subscriptionOnly: opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
                         allowApiBilling: opts.allowApiBilling,
-                        harnessEvidence: Object.fromEntries(registry
-                            .list()
-                            .map((adapter) => [
-                            adapter.profile.id,
-                            { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                        ])),
+                        ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                         policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                         approvalMode: "park",
                         approvalAddressee: opts.approvalTo,

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqqBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6pBjF"}

package/dist/commands/workflow.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { resolveBinName, workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { WorkflowParkedError } from "../core/workflow/engine.js";
@@ -88,12 +88,7 @@ export function registerWorkflowCommand(program, emit) {
                 maxAgents: opts.maxAgents ? Number.parseInt(opts.maxAgents, 10) : undefined,
                 concurrency: opts.concurrency ? Number.parseInt(opts.concurrency, 10) : undefined,
                 cwd: opts.cwd,
-                harnessEvidence: Object.fromEntries(registry
-                    .list()
-                    .map((adapter) => [
-                    adapter.profile.id,
-                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                ])),
+                ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                 policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                 approvalMode: "park",
                 approvalAddressee: opts.approvalTo,
@@ -179,12 +174,7 @@ export function registerWorkflowCommand(program, emit) {
                         writableRoots: [binding.writable_root.configured],
                     }
                     : undefined,
-                harnessEvidence: Object.fromEntries(registry
-                    .list()
-                    .map((adapter) => [
-                    adapter.profile.id,
-                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                ])),
+                ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
             });
             if (opts.json) {
                 emit.config({ format: "json" });

package/dist/core/harnesses/attest.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The opt-in live probe that produces an attestation (ADR 0038).
+ *
+ * One bounded turn per harness, through the same `spawn` the workflow engine
+ * uses, so what gets attested is the path production takes rather than a
+ * parallel test rig.
+ */
+import type { SpawnResult } from "../workflow/types.js";
+import type { AttestableDimension, HarnessAttestation } from "./attestation.js";
+import type { HarnessRegistry } from "./registry.js";
+import type { CapabilitySupport, HarnessId } from "./types.js";
+/** Fixed and content-free, so nothing user-supplied can reach the record and
+ * the turn stays as cheap as a turn can be. */
+export declare const ATTESTATION_PROMPT = "Reply with the single word: ok";
+export declare const DEFAULT_ATTESTATION_TIMEOUT_MS = 120000;
+export type AttestationOutcome = "recorded" | "skipped" | "unreachable" | "failed";
+export interface HarnessAttestationResult {
+    harness: HarnessId;
+    outcome: AttestationOutcome;
+    binaryVersion?: string;
+    observations?: Partial<Record<AttestableDimension, CapabilitySupport>>;
+    durationMs?: number;
+    note: string;
+}
+export interface HarnessAttestationReport {
+    generatedAt: string;
+    harnesses: HarnessId[];
+    results: HarnessAttestationResult[];
+    recorded: number;
+    /** True when at least one selected harness could not be attested, so a
+     * caller can tell a partial sweep from a complete one. */
+    incomplete: boolean;
+}
+export interface RunHarnessAttestationOptions {
+    harnesses?: readonly string[];
+    timeoutMs?: number;
+    cwd?: string;
+    coordRoot?: string;
+    /** Scrub API-key vars from the child so it can only use its stored login,
+     * matching `workflow run --subscription-only`. The observation is recorded
+     * against this mode, because a child that may fall back to an API key can
+     * behave differently from one that may not. */
+    subscriptionOnly?: boolean;
+    /** Test seam and alternate host probe. A null version means unavailable. */
+    versionProbe?: (binary: string) => string | null;
+    /** Test seam. Defaults to the adapter's production spawner. */
+    spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
+    /** Test seam. Defaults to writing under the coord root. */
+    persist?: (record: HarnessAttestation) => void;
+    now?: () => Date;
+}
+export declare function runHarnessAttestation(registry: HarnessRegistry, opts?: RunHarnessAttestationOptions): Promise<HarnessAttestationReport>;
+//# sourceMappingURL=attest.d.ts.map

package/dist/core/harnesses/attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAqBtD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA4FnC"}

package/dist/core/harnesses/attest.js

@@ -0,0 +1,120 @@
+/**
+ * The opt-in live probe that produces an attestation (ADR 0038).
+ *
+ * One bounded turn per harness, through the same `spawn` the workflow engine
+ * uses, so what gets attested is the path production takes rather than a
+ * parallel test rig.
+ */
+import { ATTESTATION_SCHEMA_VERSION, profileDigest, sealAttestation, writeAttestation, } from "./attestation.js";
+import { probeBinaryVersion } from "./bench.js";
+/** Fixed and content-free, so nothing user-supplied can reach the record and
+ * the turn stays as cheap as a turn can be. */
+export const ATTESTATION_PROMPT = "Reply with the single word: ok";
+export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
+/** Vendor failures arrive as whole console transcripts, banner and prompt echo
+ * included. Reports are bounded evidence, so the reason is collapsed to one
+ * short line and the echoed prompt is removed. */
+const MAX_NOTE_REASON_CHARS = 200;
+/** Keep the TAIL, not the head. A CLI prints its banner, config, and startup
+ * warnings first and the reason it actually failed last, so truncating from the
+ * front reliably preserves the noise and discards the answer. Learned the hard
+ * way: a head-truncated note once surfaced a cosmetic startup warning while
+ * hiding the real "out of credits" failure on the final line. */
+function boundedReason(reason) {
+    if (!reason)
+        return "no error reported";
+    const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+    if (!collapsed)
+        return "no error reported";
+    return collapsed.length > MAX_NOTE_REASON_CHARS
+        ? `…${collapsed.slice(-MAX_NOTE_REASON_CHARS)}`
+        : collapsed;
+}
+export async function runHarnessAttestation(registry, opts = {}) {
+    const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
+    const cwd = opts.cwd ?? process.cwd();
+    const subscriptionOnly = opts.subscriptionOnly === true;
+    const versionProbe = opts.versionProbe ?? probeBinaryVersion;
+    const now = opts.now ?? (() => new Date());
+    const results = [];
+    for (const id of ids) {
+        const adapter = registry.require(id);
+        const binaryVersion = versionProbe(adapter.profile.binary);
+        if (!binaryVersion) {
+            results.push({
+                harness: id,
+                outcome: "skipped",
+                note: `${adapter.profile.binary} not found on PATH`,
+            });
+            continue;
+        }
+        let result;
+        try {
+            result = opts.spawn
+                ? await opts.spawn(id, ATTESTATION_PROMPT, timeoutMs)
+                : await adapter.spawn({
+                    prompt: ATTESTATION_PROMPT,
+                    timeoutMs,
+                    maxTurns: 1,
+                    cwd,
+                    subscriptionOnly,
+                });
+        }
+        catch (error) {
+            results.push({
+                harness: id,
+                outcome: "failed",
+                binaryVersion,
+                note: `probe threw: ${boundedReason(error.message)}`,
+            });
+            continue;
+        }
+        // Prerequisite rule: an unreachable subject cannot evidence anything, so a
+        // failed turn records nothing at all rather than a page of `unsupported`.
+        if (!result.ok) {
+            results.push({
+                harness: id,
+                outcome: "unreachable",
+                binaryVersion,
+                durationMs: result.durationMs,
+                note: `the probe turn did not complete (${boundedReason(result.error)}); nothing recorded`,
+            });
+            continue;
+        }
+        const observations = {
+            invocation: "supported",
+            finalResult: result.text.trim().length > 0 ? "supported" : "unsupported",
+            sessionId: result.sessionId ? "supported" : "unsupported",
+            cost: result.costUsd !== undefined ? "supported" : "unsupported",
+        };
+        const record = sealAttestation({
+            schema_version: ATTESTATION_SCHEMA_VERSION,
+            harness: id,
+            binary_version: binaryVersion,
+            profile_digest: profileDigest(adapter.profile),
+            subscription_only: subscriptionOnly,
+            observed_at: now().toISOString(),
+            observations,
+        });
+        if (opts.persist)
+            opts.persist(record);
+        else
+            writeAttestation(record, { coordRoot: opts.coordRoot });
+        results.push({
+            harness: id,
+            outcome: "recorded",
+            binaryVersion,
+            observations,
+            durationMs: result.durationMs,
+            note: `observed on ${binaryVersion}`,
+        });
+    }
+    return {
+        generatedAt: now().toISOString(),
+        harnesses: ids,
+        results,
+        recorded: results.filter((row) => row.outcome === "recorded").length,
+        incomplete: results.some((row) => row.outcome !== "recorded"),
+    };
+}

package/dist/core/harnesses/attestation.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Durable record of what an installed vendor CLI was actually observed doing
+ * (ADR 0038).
+ *
+ * The conformance bench proves Harnery's own planner and normalizer against a
+ * committed fixture. That is an adapter check, not a vendor check
+ * (ADR 0037). An attestation is the other half: one bounded live turn, its
+ * observations, and the vendor version they were observed on.
+ *
+ * A record stores structural facts only. No prompt text, no completion text,
+ * no host paths. It lives under the host's coordination directory and is never
+ * published.
+ */
+import type { CapabilitySupport, HarnessId, HarnessProfile } from "./types.js";
+export declare const ATTESTATION_SCHEMA_VERSION = 2;
+/** Dimensions one minimal live turn can honestly establish. Everything else
+ * needs a purpose-built scenario and stays outside the record rather than
+ * being guessed at. */
+export declare const ATTESTABLE_DIMENSIONS: readonly ["invocation", "finalResult", "sessionId", "cost"];
+export type AttestableDimension = (typeof ATTESTABLE_DIMENSIONS)[number];
+export interface HarnessAttestation {
+    schema_version: number;
+    harness: HarnessId;
+    /** What the vendor binary reported when this was recorded. Staleness is
+     * keyed on this, so a vendor upgrade invalidates the record automatically. */
+    binary_version: string;
+    /** Digest of the capability declaration at record time, so an edited
+     * declaration also invalidates the record. */
+    profile_digest: string;
+    /** The billing policy the probe ran under. A child launched with API keys
+     * scrubbed can behave differently from one that can fall back to them, so an
+     * observation only speaks for the mode it was made in. */
+    subscription_only: boolean;
+    observed_at: string;
+    /** Only what the probe actually saw. A dimension absent from this map was
+     * not observed, which is not the same as unsupported. */
+    observations: Partial<Record<AttestableDimension, CapabilitySupport>>;
+    /** Over every field above. A hand-edited record fails to load. */
+    record_digest: string;
+}
+export interface AttestationStoreOptions {
+    /** Test seam and alternate host. Defaults to the resolved coord root. */
+    coordRoot?: string;
+}
+export declare function attestationsDir(opts?: AttestationStoreOptions): string;
+/** Stable identity of a declaration, so editing a claim invalidates the
+ * attestation that was recorded against the old one. */
+export declare function profileDigest(profile: HarnessProfile): string;
+export declare function sealAttestation(record: Omit<HarnessAttestation, "record_digest">): HarnessAttestation;
+/** Replace-in-place write. Unlike a workflow record an attestation is meant to
+ * be re-recorded, so this is a mutable atomic swap rather than an immutable
+ * create. */
+export declare function writeAttestation(record: HarnessAttestation, opts?: AttestationStoreOptions): string;
+/** Null for absent, unreadable, malformed, wrong-schema, or tampered records.
+ * A record that fails its own digest is discarded rather than trusted, because
+ * the whole point of the file is that it was not hand-written. */
+export declare function readAttestation(harness: HarnessId, opts?: AttestationStoreOptions): HarnessAttestation | null;
+export declare function validateAttestation(value: unknown, harness?: HarnessId): HarnessAttestation | null;
+/** An attestation speaks only for the vendor version and declaration it was
+ * recorded against. */
+export declare function isAttestationCurrent(record: HarnessAttestation | null, binaryVersion: string | null, profile: HarnessProfile, subscriptionOnly?: boolean): record is HarnessAttestation;
+export declare function listAttestations(opts?: AttestationStoreOptions): HarnessAttestation[];
+/** Both harness-derived proof inputs, read once, for a workflow run
+ * (ADR 0038). Callers inject the result so the engine performs no capability
+ * lookups of its own. A harness with no current attestation simply has no
+ * citation; that absence is not a proof unknown. */
+export declare function harnessProofInputs(profiles: readonly HarnessProfile[], opts: AttestationStoreOptions & {
+    versionProbe: (binary: string) => string | null;
+    /** Billing policy this run will use, so a record made under the other mode
+     * is not cited as if it applied. */
+    subscriptionOnly?: boolean;
+}): {
+    harnessEvidence: Record<string, {
+        toolEvidence: HarnessProfile["capabilities"]["toolEvidence"];
+    }>;
+    harnessAttestations: Record<string, {
+        binary_version: string;
+        observed_at: string;
+        record_digest: string;
+    }>;
+};
+//# sourceMappingURL=attestation.d.ts.map

package/dist/core/harnesses/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,6DAA8D,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,IAAI,kBAAkB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD;wCACoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CAoCA"}