human-to-code 0.0.1 → 0.1.1

package/dist/analyzer.js

@@ -0,0 +1,103 @@
+/**
+ * Deterministic, static project analysis.
+ *
+ * This module never imports application modules, evaluates config files, or
+ * invokes project commands. It only inventories regular files and delegates
+ * bounded text inspection to static ecosystem adapters.
+ */
+import { PROJECT_PROFILE_SCHEMA_VERSION } from "./analyzer-types.js";
+import { compareDiagnostics, createAnalyzerContext, fingerprint, scanProject, } from "./analyzer-utils.js";
+import { nodeEcosystemAdapter } from "./adapters/node.js";
+import { fastApiEcosystemAdapter } from "./adapters/python.js";
+import { rustEcosystemAdapter } from "./adapters/rust.js";
+export const DEFAULT_ECOSYSTEM_ADAPTERS = [
+    nodeEcosystemAdapter,
+    fastApiEcosystemAdapter,
+    rustEcosystemAdapter,
+];
+function diagnosticKey(diagnostic) {
+    return `${diagnostic.severity}\u0000${diagnostic.code}\u0000${diagnostic.message}\u0000${diagnostic.paths.join("\u0000")}`;
+}
+function uniqueDiagnostics(diagnostics) {
+    const result = new Map();
+    for (const diagnostic of diagnostics) {
+        const normalized = { ...diagnostic, paths: [...diagnostic.paths].sort() };
+        result.set(diagnosticKey(normalized), normalized);
+    }
+    return [...result.values()].sort(compareDiagnostics);
+}
+function analysisStatus(workspaces, diagnostics) {
+    const all = [...diagnostics, ...workspaces.flatMap((workspace) => workspace.diagnostics)];
+    if (all.some((diagnostic) => diagnostic.severity === "partial-scan"))
+        return "PARTIAL_SCAN";
+    if (all.some((diagnostic) => diagnostic.severity === "needs-input"))
+        return "NEEDS_INPUT";
+    if (workspaces.length === 0 ||
+        all.some((diagnostic) => diagnostic.severity === "unsupported") ||
+        workspaces.some((workspace) => workspace.support.tier === "unsupported")) {
+        return "UNSUPPORTED";
+    }
+    return "SUPPORTED";
+}
+/**
+ * Analyze a project root using the built-in React/NestJS, FastAPI, and Cargo
+ * adapters. Custom adapters are useful for downstream/private ecosystems, but
+ * are held to the same read-only context boundary.
+ */
+export async function analyzeProject(root, options = {}, adapters = DEFAULT_ECOSYSTEM_ADAPTERS) {
+    const scanned = await scanProject(root, options);
+    const analyzerDiagnostics = [...scanned.diagnostics];
+    const context = createAnalyzerContext(scanned.inventory, analyzerDiagnostics, options);
+    const adapterResults = await Promise.all(adapters.map(async (adapter) => {
+        try {
+            return await adapter.analyze(context);
+        }
+        catch (error) {
+            context.addDiagnostic({
+                code: "ADAPTER_ANALYSIS_FAILED",
+                message: `The ${adapter.ecosystem} static adapter failed safely: ${String(error)}`,
+                severity: "partial-scan",
+                paths: ["."],
+            });
+            return [];
+        }
+    }));
+    const workspaces = adapterResults
+        .flat()
+        .sort((left, right) => left.id.localeCompare(right.id));
+    const diagnostics = uniqueDiagnostics([
+        ...analyzerDiagnostics,
+        ...workspaces.flatMap((workspace) => workspace.diagnostics),
+    ]);
+    if (workspaces.length === 0 && !diagnostics.some((item) => item.severity === "partial-scan")) {
+        diagnostics.push({
+            code: "NO_SUPPORTED_WORKSPACE",
+            message: "No statically recognizable React, NestJS, FastAPI, or Cargo workspace was found.",
+            severity: "unsupported",
+            paths: ["."],
+        });
+    }
+    const finalDiagnostics = uniqueDiagnostics(diagnostics);
+    const status = analysisStatus(workspaces, finalDiagnostics);
+    const fingerprintInput = {
+        schemaVersion: PROJECT_PROFILE_SCHEMA_VERSION,
+        status,
+        workspaces: workspaces.map((workspace) => ({ id: workspace.id, fingerprint: workspace.fingerprint })),
+        diagnostics: finalDiagnostics,
+        scan: scanned.inventory.scan,
+    };
+    return {
+        schemaVersion: PROJECT_PROFILE_SCHEMA_VERSION,
+        root: scanned.inventory.root,
+        status,
+        workspaces,
+        diagnostics: finalDiagnostics,
+        scan: scanned.inventory.scan,
+        fingerprint: fingerprint(fingerprintInput),
+    };
+}
+export { SUPPORT_MATRIX, SUPPORT_MATRIX_VERSION, supportFor } from "./support-matrix.js";
+export { NodeEcosystemAdapter, nodeEcosystemAdapter } from "./adapters/node.js";
+export { FastApiEcosystemAdapter, fastApiEcosystemAdapter } from "./adapters/python.js";
+export { RustEcosystemAdapter, rustEcosystemAdapter } from "./adapters/rust.js";
+//# sourceMappingURL=analyzer.js.map

package/dist/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAgC;IACrE,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;CACZ,CAAC;AAEX,SAAS,aAAa,CAAC,UAA8B;IACnD,OAAO,GAAG,UAAU,CAAC,QAAQ,SAAS,UAAU,CAAC,IAAI,SAAS,UAAU,CAAC,OAAO,SAAS,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7H,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAiC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CACrB,UAAgC,EAChC,WAAiC;IAEjC,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IAC5F,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAC1F,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC;QAC/D,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,EACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,UAA2B,EAAE,EAC7B,WAAwC,0BAA0B;IAElE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAiC,EAAE;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,CAAC;gBACpB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO,OAAO,CAAC,SAAS,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE;gBAClF,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,CAAC,GAAG,CAAC;aACb,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,GAAG,cAAc;SAC9B,IAAI,EAAE;SACN,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACpC,GAAG,mBAAmB;QACtB,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7F,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,kFAAkF;YAC3F,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,CAAC,GAAG,CAAC;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG;QACvB,aAAa,EAAE,8BAA8B;QAC7C,MAAM;QACN,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;KAC7B,CAAC;IACF,OAAO;QACL,aAAa,EAAE,8BAA8B;QAC7C,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;QAC5B,MAAM;QACN,UAAU;QACV,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;QAC5B,WAAW,EAAE,WAAW,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAyBD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/certification.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Certification harness: the WRITE gate that decides whether a
+ * (provider-profile, support-matrix-entry) pair may reach VERIFIED.
+ *
+ * The reliability contract forbids turning model confidence into certification.
+ * Certification therefore comes exclusively from stored, host-owned benchmark
+ * evidence that this module re-scores deterministically. Evidence is shipped as
+ * frozen package data — never read from the analyzed repository, which is
+ * untrusted — and the shipped registry is intentionally EMPTY until a real
+ * benchmark corpus has actually run. With no evidence, nothing is certified and
+ * VERIFIED stays unreachable, exactly as the preview requires.
+ */
+import type { Ecosystem } from "./analyzer-types.ts";
+/**
+ * Fail-closed thresholds from the reliability contract: a large per-ecosystem
+ * corpus, repeated runs, and a high pass rate. These are policy constants and
+ * are never relaxed by a caller, model, or repository.
+ */
+export declare const CERTIFICATION_POLICY: Readonly<{
+    minTasksPerEcosystem: 25;
+    runsPerTask: 3;
+    minPassRate: 0.95;
+}>;
+/**
+ * A benchmark run "passes" only when the generated candidate reached a
+ * validated strong sandbox for that task's own oracle. It is deliberately NOT
+ * the production VERIFIED status, which requires certification and would make
+ * this gate circular.
+ */
+export type BenchmarkRunOutcome = "validated" | "failed" | "inconclusive";
+export interface CertificationTaskResultV1 {
+    /** Stable identifier of the benchmark task within the corpus. */
+    taskId: string;
+    /** Exactly `runsPerTask` independent outcomes for this task. */
+    runs: readonly BenchmarkRunOutcome[];
+}
+export interface CertificationEvidenceV1 {
+    schemaVersion: 1;
+    /** Evidence is invalidated when the support matrix it was produced against changes. */
+    supportMatrixVersion: string;
+    ecosystem: Ecosystem;
+    /** Exact support-matrix entry key this evidence certifies. */
+    matrixKey: string;
+    /** Exact provider/model profile that produced the runs (see providerProfileId). */
+    providerProfileId: string;
+    /** sha256 of the benchmark corpus used; recorded for provenance. */
+    corpusHash: string;
+    producedAt: string;
+    tasks: readonly CertificationTaskResultV1[];
+}
+export interface CertificationScore {
+    certified: boolean;
+    passRate: number;
+    taskCount: number;
+    runCount: number;
+    reasons: string[];
+}
+/**
+ * Deterministic profile identity for a provider/model combination. Moving
+ * aliases and tags are not immutable digests, so this proves which label ran,
+ * not a reproducible snapshot. Evidence and live runs must match exactly.
+ */
+export declare function providerProfileId(name: string, resolvedModel: string): string;
+/**
+ * Strictly validate one evidence document. Throws on any deviation so a corrupt
+ * or over-broad evidence file can never contribute silent trust.
+ */
+export declare function validateCertificationEvidenceV1(value: unknown): CertificationEvidenceV1;
+/**
+ * Re-score already-validated evidence against the fail-closed policy. Every
+ * failing condition is collected so the diagnostics explain exactly why a
+ * profile is not certified. `certified` is true only when nothing failed.
+ */
+export declare function scoreCertificationEvidence(evidence: CertificationEvidenceV1): CertificationScore;
+export interface CertificationEvaluation {
+    matrixKey: string;
+    certified: boolean;
+    passRate: number;
+    reasons: string[];
+}
+export interface ProviderCertificationResult {
+    providerProfileId: string;
+    /** Support-matrix keys with passing evidence for this exact provider profile. */
+    certifiedMatrixKeys: string[];
+    /** One evaluation per evidence document matching this provider profile. */
+    evaluations: CertificationEvaluation[];
+}
+/**
+ * Resolve every support-matrix key a provider profile has passing evidence for.
+ * Only evidence whose `providerProfileId` matches exactly is considered, and
+ * each document must independently clear the fail-closed score.
+ */
+export declare function evaluateProviderCertification(profileId: string, evidence?: readonly CertificationEvidenceV1[]): ProviderCertificationResult;
+/**
+ * Shipped, host-owned certification evidence. Deliberately EMPTY: no
+ * 25-task-per-ecosystem, three-run, 95% benchmark has been executed and
+ * archived for this preview, so no provider/model/profile is certified and
+ * VERIFIED remains unreachable. Adding a real, scored corpus here — and nowhere
+ * else — is the only way to make a profile certifiable.
+ */
+export declare const CERTIFIED_EVIDENCE: readonly CertificationEvidenceV1[];
+//# sourceMappingURL=certification.d.ts.map

package/dist/certification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certification.d.ts","sourceRoot":"","sources":["../src/certification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;EAI/B,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC;AAQ1E,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,CAAC,CAAC;IACjB,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAkEvF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,kBAAkB,CA6BhG;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,SAAS,uBAAuB,EAAuB,GAChE,2BAA2B,CAmB7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,uBAAuB,EAAsB,CAAC"}

package/dist/certification.js

@@ -0,0 +1,193 @@
+/**
+ * Certification harness: the WRITE gate that decides whether a
+ * (provider-profile, support-matrix-entry) pair may reach VERIFIED.
+ *
+ * The reliability contract forbids turning model confidence into certification.
+ * Certification therefore comes exclusively from stored, host-owned benchmark
+ * evidence that this module re-scores deterministically. Evidence is shipped as
+ * frozen package data — never read from the analyzed repository, which is
+ * untrusted — and the shipped registry is intentionally EMPTY until a real
+ * benchmark corpus has actually run. With no evidence, nothing is certified and
+ * VERIFIED stays unreachable, exactly as the preview requires.
+ */
+import { SUPPORT_MATRIX, SUPPORT_MATRIX_VERSION } from "./support-matrix.js";
+/**
+ * Fail-closed thresholds from the reliability contract: a large per-ecosystem
+ * corpus, repeated runs, and a high pass rate. These are policy constants and
+ * are never relaxed by a caller, model, or repository.
+ */
+export const CERTIFICATION_POLICY = Object.freeze({
+    minTasksPerEcosystem: 25,
+    runsPerTask: 3,
+    minPassRate: 0.95,
+});
+const BENCHMARK_OUTCOMES = new Set([
+    "validated",
+    "failed",
+    "inconclusive",
+]);
+/**
+ * Deterministic profile identity for a provider/model combination. Moving
+ * aliases and tags are not immutable digests, so this proves which label ran,
+ * not a reproducible snapshot. Evidence and live runs must match exactly.
+ */
+export function providerProfileId(name, resolvedModel) {
+    const clean = (value) => value.trim().toLowerCase();
+    return `${clean(name)}::${clean(resolvedModel)}`;
+}
+const HEX64 = /^[0-9a-f]{64}$/u;
+function isEvidenceShape(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Strictly validate one evidence document. Throws on any deviation so a corrupt
+ * or over-broad evidence file can never contribute silent trust.
+ */
+export function validateCertificationEvidenceV1(value) {
+    if (!isEvidenceShape(value))
+        throw new Error("Certification evidence must be an object.");
+    const allowed = new Set([
+        "schemaVersion",
+        "supportMatrixVersion",
+        "ecosystem",
+        "matrixKey",
+        "providerProfileId",
+        "corpusHash",
+        "producedAt",
+        "tasks",
+    ]);
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key))
+            throw new Error(`Certification evidence has an unexpected field: ${key}.`);
+    }
+    const record = value;
+    if (record.schemaVersion !== 1)
+        throw new Error("Certification evidence schemaVersion must be 1.");
+    if (typeof record.supportMatrixVersion !== "string" || record.supportMatrixVersion.length === 0) {
+        throw new Error("Certification evidence supportMatrixVersion must be a non-empty string.");
+    }
+    if (record.ecosystem !== "react" && record.ecosystem !== "nestjs"
+        && record.ecosystem !== "fastapi" && record.ecosystem !== "rust") {
+        throw new Error("Certification evidence ecosystem is not a recognized ecosystem.");
+    }
+    if (typeof record.matrixKey !== "string" || record.matrixKey.length === 0) {
+        throw new Error("Certification evidence matrixKey must be a non-empty string.");
+    }
+    if (typeof record.providerProfileId !== "string" || record.providerProfileId.length === 0) {
+        throw new Error("Certification evidence providerProfileId must be a non-empty string.");
+    }
+    if (typeof record.corpusHash !== "string" || !HEX64.test(record.corpusHash)) {
+        throw new Error("Certification evidence corpusHash must be a sha256 hex digest.");
+    }
+    if (typeof record.producedAt !== "string" || !Number.isFinite(Date.parse(record.producedAt))) {
+        throw new Error("Certification evidence producedAt must be an ISO timestamp.");
+    }
+    if (!Array.isArray(record.tasks))
+        throw new Error("Certification evidence tasks must be an array.");
+    const taskIds = new Set();
+    const tasks = record.tasks.map((raw, index) => {
+        if (!isEvidenceShape(raw))
+            throw new Error(`Certification task ${index} must be an object.`);
+        for (const key of Object.keys(raw)) {
+            if (key !== "taskId" && key !== "runs")
+                throw new Error(`Certification task ${index} has an unexpected field: ${key}.`);
+        }
+        const taskId = raw.taskId;
+        if (typeof taskId !== "string" || taskId.length === 0)
+            throw new Error(`Certification task ${index} taskId must be a non-empty string.`);
+        if (taskIds.has(taskId))
+            throw new Error(`Certification task ${index} repeats taskId ${taskId}.`);
+        taskIds.add(taskId);
+        if (!Array.isArray(raw.runs))
+            throw new Error(`Certification task ${taskId} runs must be an array.`);
+        const runs = raw.runs.map((outcome) => {
+            if (typeof outcome !== "string" || !BENCHMARK_OUTCOMES.has(outcome)) {
+                throw new Error(`Certification task ${taskId} has an invalid run outcome.`);
+            }
+            return outcome;
+        });
+        return { taskId, runs };
+    });
+    return {
+        schemaVersion: 1,
+        supportMatrixVersion: record.supportMatrixVersion,
+        ecosystem: record.ecosystem,
+        matrixKey: record.matrixKey,
+        providerProfileId: record.providerProfileId,
+        corpusHash: record.corpusHash,
+        producedAt: record.producedAt,
+        tasks,
+    };
+}
+/**
+ * Re-score already-validated evidence against the fail-closed policy. Every
+ * failing condition is collected so the diagnostics explain exactly why a
+ * profile is not certified. `certified` is true only when nothing failed.
+ */
+export function scoreCertificationEvidence(evidence) {
+    const reasons = [];
+    if (evidence.supportMatrixVersion !== SUPPORT_MATRIX_VERSION) {
+        reasons.push(`Evidence was produced against support matrix ${evidence.supportMatrixVersion}, not ${SUPPORT_MATRIX_VERSION}.`);
+    }
+    const entry = SUPPORT_MATRIX.find((candidate) => candidate.key === evidence.matrixKey);
+    if (!entry) {
+        reasons.push(`Evidence references unknown support-matrix key ${evidence.matrixKey}.`);
+    }
+    else if (entry.ecosystem !== evidence.ecosystem) {
+        reasons.push(`Evidence ecosystem ${evidence.ecosystem} does not match matrix key ${evidence.matrixKey}.`);
+    }
+    const taskCount = evidence.tasks.length;
+    if (taskCount < CERTIFICATION_POLICY.minTasksPerEcosystem) {
+        reasons.push(`Corpus has ${taskCount} tasks; certification requires at least ${CERTIFICATION_POLICY.minTasksPerEcosystem}.`);
+    }
+    let runCount = 0;
+    let passing = 0;
+    for (const task of evidence.tasks) {
+        if (task.runs.length !== CERTIFICATION_POLICY.runsPerTask) {
+            reasons.push(`Task ${task.taskId} has ${task.runs.length} runs; certification requires exactly ${CERTIFICATION_POLICY.runsPerTask}.`);
+        }
+        runCount += task.runs.length;
+        passing += task.runs.filter((outcome) => outcome === "validated").length;
+    }
+    const passRate = runCount === 0 ? 0 : passing / runCount;
+    if (passRate < CERTIFICATION_POLICY.minPassRate) {
+        reasons.push(`Corpus pass rate ${(passRate * 100).toFixed(1)}% is below the required ${(CERTIFICATION_POLICY.minPassRate * 100).toFixed(0)}%.`);
+    }
+    return { certified: reasons.length === 0, passRate, taskCount, runCount, reasons };
+}
+/**
+ * Resolve every support-matrix key a provider profile has passing evidence for.
+ * Only evidence whose `providerProfileId` matches exactly is considered, and
+ * each document must independently clear the fail-closed score.
+ */
+export function evaluateProviderCertification(profileId, evidence = CERTIFIED_EVIDENCE) {
+    const certifiedMatrixKeys = new Set();
+    const evaluations = [];
+    for (const document of evidence) {
+        if (document.providerProfileId !== profileId)
+            continue;
+        const score = scoreCertificationEvidence(document);
+        evaluations.push({
+            matrixKey: document.matrixKey,
+            certified: score.certified,
+            passRate: score.passRate,
+            reasons: score.reasons,
+        });
+        if (score.certified)
+            certifiedMatrixKeys.add(document.matrixKey);
+    }
+    return {
+        providerProfileId: profileId,
+        certifiedMatrixKeys: [...certifiedMatrixKeys],
+        evaluations,
+    };
+}
+/**
+ * Shipped, host-owned certification evidence. Deliberately EMPTY: no
+ * 25-task-per-ecosystem, three-run, 95% benchmark has been executed and
+ * archived for this preview, so no provider/model/profile is certified and
+ * VERIFIED remains unreachable. Adding a real, scored corpus here — and nowhere
+ * else — is the only way to make a profile certifiable.
+ */
+export const CERTIFIED_EVIDENCE = Object.freeze([]);
+//# sourceMappingURL=certification.js.map

package/dist/certification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certification.js","sourceRoot":"","sources":["../src/certification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC;AAUH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAsB;IAC3E,WAAW;IACX,QAAQ;IACR,cAAc;CACf,CAAC,CAAC;AAgCH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,aAAqB;IACnE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,eAAe;QACf,sBAAsB;QACtB,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,YAAY;QACZ,YAAY;QACZ,OAAO;KACR,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACnG,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC5D,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAgC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACzE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,qBAAqB,CAAC,CAAC;QAC7F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,6BAA6B,GAAG,GAAG,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,qCAAqC,CAAC,CAAC;QACzI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,mBAAmB,MAAM,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,yBAAyB,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,8BAA8B,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAA8B,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAsB;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAiC;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,CAAC,oBAAoB,KAAK,sBAAsB,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,gDAAgD,QAAQ,CAAC,oBAAoB,SAAS,sBAAsB,GAAG,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,kDAAkD,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,SAAS,8BAA8B,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,IAAI,SAAS,GAAG,oBAAoB,CAAC,oBAAoB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,cAAc,SAAS,2CAA2C,oBAAoB,CAAC,oBAAoB,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,yCAAyC,oBAAoB,CAAC,WAAW,GAAG,CAAC,CAAC;QACxI,CAAC;QACD,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC;IACzD,IAAI,QAAQ,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAiB,EACjB,WAA+C,kBAAkB;IAEjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,MAAM,WAAW,GAA8B,EAAE,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS;YAAE,SAAS;QACvD,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,SAAS;YAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,SAAS;QAC5B,mBAAmB,EAAE,CAAC,GAAG,mBAAmB,CAAC;QAC7C,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+/** Production CLI: analyze -> reviewed contract -> grounded patch -> validation -> explicit apply. */
+export declare function run(argv: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,sGAAsG;AAiftG,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+EzD"}