instar 1.3.587 → 1.3.589

package/dist/core/LiveTestArtifactStore.d.ts

@@ -0,0 +1,129 @@
+/**
+ * LiveTestArtifactStore — the durable, signed, hash-chained record a user-role
+ * live-test run produces, and the object the completion gate reads (spec
+ * docs/specs/live-user-channel-proof-standard.md §4.4). It is the shared contract
+ * between the harness (which WRITES it) and the gate (which VERIFIES it).
+ *
+ * Anti-hallucination (the load-bearing property): the artifact is machine-written
+ * and SIGNED, so an agent cannot hand-type a "I tested it" record into its
+ * transcript to buy the "done" exit. Concretely:
+ *   - the artifact is canonically serialized (sorted keys) and content-hashed;
+ *   - the hash is Ed25519-signed by the harness runner identity;
+ *   - each machine appends ONLY to its OWN ledger segment
+ *     (state/live-test-ledger.<machineId>.jsonl), hash-chained WITHIN the segment,
+ *     so cross-machine replication can never fork a shared chain or raise a false
+ *     broken-chain veto (§4.4, codex r4);
+ *   - the gate re-reads the artifact from disk, recomputes the hash, and checks it
+ *     against the ledger entry — the transcript is NEVER the evidence.
+ *
+ * Threat model (honest, like UnjustifiedStopGate): drift-correction, NOT a security
+ * boundary against a deliberately compromised runner. The git-commit anchor (the
+ * artifact + ledger are committed as part of the run) is the out-of-band check.
+ */
+export type RiskCategory = 'happy-path' | 'channel-parity' | 'lifecycle' | 'permission-volatile' | 'failure-rollback' | 'concurrency' | 'idempotency' | 'regression';
+export declare const REQUIRED_RISK_CATEGORIES: RiskCategory[];
+/** A channel feature requires {telegram, slack}; a dashboard feature, dashboard. */
+export type Surface = 'telegram' | 'slack' | 'dashboard';
+export type ScenarioVerdict = 'PASS' | 'FAIL' | 'BLOCKED';
+export type BlockedKind = 'platform-error' | 'platform-outage' | 'operator-waiver' | 'timeout' | 'credential-unavailable';
+/** Deterministic protocol evidence captured from the real platform (§4.4). */
+export interface ScenarioEvidence {
+    messageIds?: string[];
+    channelId?: string;
+    senderId?: string;
+    responderMachineId?: string;
+    ownershipSnapshot?: Record<string, unknown>;
+    [k: string]: unknown;
+}
+export interface ScenarioRow {
+    id: string;
+    description: string;
+    surface: Surface;
+    riskCategory: RiskCategory;
+    verdict: ScenarioVerdict;
+    evidence?: ScenarioEvidence;
+    /** Required when verdict === 'BLOCKED' — only a machine-verifiable external
+     *  blocker is honored (§4.6); a bare BLOCKED counts as FAIL at the gate. */
+    blockedKind?: BlockedKind;
+    blockedReason?: string;
+}
+export interface LiveTestArtifact {
+    featureId: string;
+    runId: string;
+    surfaces: Surface[];
+    riskCategories: RiskCategory[];
+    scenarios: ScenarioRow[];
+    createdAt: string;
+    runnerFingerprint: string;
+}
+export interface LedgerEntry {
+    featureId: string;
+    runId: string;
+    contentHash: string;
+    signature: string;
+    signerFingerprint: string;
+    surfaces: Surface[];
+    riskCategories: RiskCategory[];
+    createdAt: string;
+    /** Hash of the PRIOR entry in THIS machine's segment (null for the first). */
+    prevEntryHash: string | null;
+}
+/** Stable, sorted-key JSON serialization so the content hash is deterministic. */
+export declare function canonicalize(value: unknown): string;
+export interface LiveTestArtifactStoreDeps {
+    stateDir: string;
+    /** This machine's id — names its ledger segment (no cross-machine concurrent append). */
+    machineId: string;
+    /** The harness runner identity recorded in the ledger entry. */
+    signerFingerprint: string;
+    /** Ed25519 sign over a string → base64 signature (e.g. MachineIdentity.sign bound to the key). */
+    sign: (data: string) => string;
+    /** Verify a base64 signature over a string against the runner's trusted key. */
+    verify: (data: string, sig: string) => boolean;
+    now?: () => number;
+    logger?: (m: string) => void;
+}
+export interface VerifyResult {
+    ok: boolean;
+    reason?: 'no-entry' | 'artifact-missing' | 'hash-mismatch' | 'bad-signature';
+    entry?: LedgerEntry;
+    artifact?: LiveTestArtifact;
+}
+export declare class LiveTestArtifactStore {
+    private readonly d;
+    constructor(deps: LiveTestArtifactStoreDeps);
+    private now;
+    private log;
+    private artifactsDir;
+    private artifactPath;
+    private ownSegmentPath;
+    private writeFileAtomic;
+    /** Read this machine's ledger segment (own appends only). */
+    private readOwnSegment;
+    private readSegmentFile;
+    /**
+     * Write a signed artifact + append its hash-chained ledger entry to THIS
+     * machine's segment. Returns the ledger entry. The content hash is computed at
+     * write-time over the canonical artifact; the signature is over that hash.
+     */
+    write(artifact: LiveTestArtifact): LedgerEntry;
+    /** Read the on-disk artifact for an entry (or null). */
+    readArtifact(featureId: string, runId: string): LiveTestArtifact | null;
+    /** Every ledger entry across ALL machine segments (the derived union, §10). */
+    allEntries(): LedgerEntry[];
+    /**
+     * Verify a specific {featureId, runId}: the entry exists, the artifact is on
+     * disk, its recomputed content hash matches the entry (tamper check), and the
+     * signature verifies. This is what the gate calls — the transcript is never the
+     * evidence.
+     */
+    verifyEntry(featureId: string, runId: string): VerifyResult;
+    /** Verify THIS machine's segment hash-chain (a break = tamper signal, §4.4). */
+    verifyOwnChain(): {
+        ok: boolean;
+        brokenAtIndex?: number;
+    };
+    /** The freshest VERIFIED entry for a feature across all segments (or null). */
+    latestVerified(featureId: string): VerifyResult | null;
+}
+//# sourceMappingURL=LiveTestArtifactStore.d.ts.map

package/dist/core/LiveTestArtifactStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LiveTestArtifactStore.d.ts","sourceRoot":"","sources":["../../src/core/LiveTestArtifactStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,qBAAqB,GACrB,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,YAAY,CAAC;AAEjB,eAAO,MAAM,wBAAwB,EAAE,YAAY,EAGlD,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC1D,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,SAAS,GAAG,wBAAwB,CAAC;AAE1H,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;gFAC4E;IAC5E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAanD;AAMD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,gFAAgF;IAChF,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,eAAe,CAAC;IAC7E,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA4B;gBAElC,IAAI,EAAE,yBAAyB;IAI3C,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,GAAG;IAEX,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,eAAe;IAQvB,6DAA6D;IAC7D,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,eAAe;IASvB;;;;OAIG;IACH,KAAK,CAAC,QAAQ,EAAE,gBAAgB,GAAG,WAAW;IAwB9C,wDAAwD;IACxD,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAUvE,+EAA+E;IAC/E,UAAU,IAAI,WAAW,EAAE;IAU3B;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY;IAW3D,gFAAgF;IAChF,cAAc,IAAI;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IASzD,+EAA+E;IAC/E,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;CAUvD"}

package/dist/core/LiveTestArtifactStore.js

@@ -0,0 +1,184 @@
+/**
+ * LiveTestArtifactStore — the durable, signed, hash-chained record a user-role
+ * live-test run produces, and the object the completion gate reads (spec
+ * docs/specs/live-user-channel-proof-standard.md §4.4). It is the shared contract
+ * between the harness (which WRITES it) and the gate (which VERIFIES it).
+ *
+ * Anti-hallucination (the load-bearing property): the artifact is machine-written
+ * and SIGNED, so an agent cannot hand-type a "I tested it" record into its
+ * transcript to buy the "done" exit. Concretely:
+ *   - the artifact is canonically serialized (sorted keys) and content-hashed;
+ *   - the hash is Ed25519-signed by the harness runner identity;
+ *   - each machine appends ONLY to its OWN ledger segment
+ *     (state/live-test-ledger.<machineId>.jsonl), hash-chained WITHIN the segment,
+ *     so cross-machine replication can never fork a shared chain or raise a false
+ *     broken-chain veto (§4.4, codex r4);
+ *   - the gate re-reads the artifact from disk, recomputes the hash, and checks it
+ *     against the ledger entry — the transcript is NEVER the evidence.
+ *
+ * Threat model (honest, like UnjustifiedStopGate): drift-correction, NOT a security
+ * boundary against a deliberately compromised runner. The git-commit anchor (the
+ * artifact + ledger are committed as part of the run) is the out-of-band check.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const REQUIRED_RISK_CATEGORIES = [
+    'happy-path', 'channel-parity', 'lifecycle', 'permission-volatile',
+    'failure-rollback', 'concurrency', 'idempotency', 'regression',
+];
+/** Stable, sorted-key JSON serialization so the content hash is deterministic. */
+export function canonicalize(value) {
+    const seen = new WeakSet();
+    const norm = (v) => {
+        if (v === null || typeof v !== 'object')
+            return v;
+        if (seen.has(v))
+            throw new Error('canonicalize: cyclic value');
+        seen.add(v);
+        if (Array.isArray(v))
+            return v.map(norm);
+        const o = v;
+        const out = {};
+        for (const k of Object.keys(o).sort())
+            out[k] = norm(o[k]);
+        return out;
+    };
+    return JSON.stringify(norm(value));
+}
+function sha256(s) {
+    return crypto.createHash('sha256').update(s).digest('hex');
+}
+export class LiveTestArtifactStore {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    now() { return (this.d.now ?? Date.now)(); }
+    log(m) { this.d.logger?.(`[live-test-artifact] ${m}`); }
+    artifactsDir() { return path.join(this.d.stateDir, 'live-test-artifacts'); }
+    artifactPath(featureId, runId) {
+        const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, '_');
+        return path.join(this.artifactsDir(), safe(featureId), `${safe(runId)}.json`);
+    }
+    ownSegmentPath() {
+        const safe = this.d.machineId.replace(/[^A-Za-z0-9._-]/g, '_');
+        return path.join(this.d.stateDir, `live-test-ledger.${safe}.jsonl`);
+    }
+    writeFileAtomic(fp, data) {
+        const dir = path.dirname(fp);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        const tmp = `${fp}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, data);
+        fs.renameSync(tmp, fp);
+    }
+    /** Read this machine's ledger segment (own appends only). */
+    readOwnSegment() {
+        return this.readSegmentFile(this.ownSegmentPath());
+    }
+    readSegmentFile(fp) {
+        try {
+            if (!fs.existsSync(fp))
+                return [];
+            return fs.readFileSync(fp, 'utf-8').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+        }
+        catch {
+            return []; // @silent-fallback-ok — an unreadable/corrupt segment yields no entries (not-proven), never a throw
+        }
+    }
+    /**
+     * Write a signed artifact + append its hash-chained ledger entry to THIS
+     * machine's segment. Returns the ledger entry. The content hash is computed at
+     * write-time over the canonical artifact; the signature is over that hash.
+     */
+    write(artifact) {
+        const canonical = canonicalize(artifact);
+        const contentHash = sha256(canonical);
+        const signature = this.d.sign(contentHash);
+        this.writeFileAtomic(this.artifactPath(artifact.featureId, artifact.runId), canonical);
+        const own = this.readOwnSegment();
+        const prevEntryHash = own.length ? sha256(canonicalize(own[own.length - 1])) : null;
+        const entry = {
+            featureId: artifact.featureId,
+            runId: artifact.runId,
+            contentHash,
+            signature,
+            signerFingerprint: this.d.signerFingerprint,
+            surfaces: artifact.surfaces,
+            riskCategories: artifact.riskCategories,
+            createdAt: artifact.createdAt,
+            prevEntryHash,
+        };
+        fs.appendFileSync(this.ownSegmentPath(), `${JSON.stringify(entry)}\n`);
+        this.log(`wrote artifact ${artifact.featureId}/${artifact.runId} (hash ${contentHash.slice(0, 12)}…, ${artifact.scenarios.length} scenarios)`);
+        return entry;
+    }
+    /** Read the on-disk artifact for an entry (or null). */
+    readArtifact(featureId, runId) {
+        try {
+            const fp = this.artifactPath(featureId, runId);
+            if (!fs.existsSync(fp))
+                return null;
+            return JSON.parse(fs.readFileSync(fp, 'utf-8'));
+        }
+        catch {
+            return null; // @silent-fallback-ok — missing/corrupt artifact → null (gate treats as not-proven)
+        }
+    }
+    /** Every ledger entry across ALL machine segments (the derived union, §10). */
+    allEntries() {
+        const out = [];
+        try {
+            for (const f of fs.readdirSync(this.d.stateDir)) {
+                if (/^live-test-ledger\..+\.jsonl$/.test(f))
+                    out.push(...this.readSegmentFile(path.join(this.d.stateDir, f)));
+            }
+        }
+        catch { /* @silent-fallback-ok — no state dir → no entries */ }
+        return out;
+    }
+    /**
+     * Verify a specific {featureId, runId}: the entry exists, the artifact is on
+     * disk, its recomputed content hash matches the entry (tamper check), and the
+     * signature verifies. This is what the gate calls — the transcript is never the
+     * evidence.
+     */
+    verifyEntry(featureId, runId) {
+        const entry = this.allEntries().find((e) => e.featureId === featureId && e.runId === runId);
+        if (!entry)
+            return { ok: false, reason: 'no-entry' };
+        const artifact = this.readArtifact(featureId, runId);
+        if (!artifact)
+            return { ok: false, reason: 'artifact-missing', entry };
+        const recomputed = sha256(canonicalize(artifact));
+        if (recomputed !== entry.contentHash)
+            return { ok: false, reason: 'hash-mismatch', entry, artifact };
+        if (!this.d.verify(entry.contentHash, entry.signature))
+            return { ok: false, reason: 'bad-signature', entry, artifact };
+        return { ok: true, entry, artifact };
+    }
+    /** Verify THIS machine's segment hash-chain (a break = tamper signal, §4.4). */
+    verifyOwnChain() {
+        const seg = this.readOwnSegment();
+        for (let i = 1; i < seg.length; i++) {
+            const expectedPrev = sha256(canonicalize(seg[i - 1]));
+            if (seg[i].prevEntryHash !== expectedPrev)
+                return { ok: false, brokenAtIndex: i };
+        }
+        return { ok: true };
+    }
+    /** The freshest VERIFIED entry for a feature across all segments (or null). */
+    latestVerified(featureId) {
+        const entries = this.allEntries()
+            .filter((e) => e.featureId === featureId)
+            .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+        for (const e of entries) {
+            const v = this.verifyEntry(e.featureId, e.runId);
+            if (v.ok)
+                return v;
+        }
+        return entries.length ? this.verifyEntry(entries[0].featureId, entries[0].runId) : null;
+    }
+}
+//# sourceMappingURL=LiveTestArtifactStore.js.map

package/dist/core/LiveTestArtifactStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LiveTestArtifactStore.js","sourceRoot":"","sources":["../../src/core/LiveTestArtifactStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB;IAClE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;CAC/D,CAAC;AAqDF,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAuBD,MAAM,OAAO,qBAAqB;IACf,CAAC,CAA4B;IAE9C,YAAY,IAA+B;QACzC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,KAAa,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,CAAS,IAAU,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtE,YAAY,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpF,YAAY,CAAC,SAAiB,EAAE,KAAa;QACnD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC;IACO,cAAc;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,oBAAoB,IAAI,QAAQ,CAAC,CAAC;IACtE,CAAC;IAEO,eAAe,CAAC,EAAU,EAAE,IAAY;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,6DAA6D;IACrD,cAAc;QACpB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACrD,CAAC;IAEO,eAAe,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAgB,CAAC,CAAC;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,oGAAoG;QACjH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAA0B;QAC9B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QAEvF,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,KAAK,GAAgB;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW;YACX,SAAS;YACT,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB;YAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,aAAa;SACd,CAAC;QACF,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,aAAa,CAAC,CAAC;QAC/I,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,SAAiB,EAAE,KAAa;QAC3C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAqB,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,oFAAoF;QACnG,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,UAAU;QACR,MAAM,GAAG,GAAkB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,SAAiB,EAAE,KAAa;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,gFAAgF;IAChF,cAAc;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,YAAY;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,SAAiB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE;aAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,CAAC;CACF"}

package/dist/core/LiveTestGate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * LiveTestGate — the deterministic completion-gate veto (spec
+ * docs/specs/live-user-channel-proof-standard.md §4). It refuses a "done"/"shipped"
+ * verdict for a USER-FACING feature unless a verified live-test artifact (§4.4)
+ * proves it ran through its real surface (Telegram AND Slack for a channel feature)
+ * across the required risk categories.
+ *
+ * Signal vs. Authority (§4.2 — the load-bearing placement): the keyword classifier
+ * holds NO standalone blocking authority. The HARD veto rests only on OBJECTIVE
+ * facts — an author-DECLARED `userFacing:true` AND the absence of a verified
+ * artifact. An undeclared-but-user-facing-looking goal gets a SOFT 'nudge'
+ * (return-to-work signal), never a hard block on a brittle guess. Both outcomes
+ * keep an autonomous run working (they prevent a premature "done"); only the
+ * REPORTED authority differs, so the structure is honest about which is objective.
+ *
+ * Rollout (§4.8): `mode` is dry-run → warn → veto. In dry-run/warn the decision is
+ * computed + logged but `blocks` is false (it never actually stops the run); only
+ * `veto` mode blocks. The SAFE direction on an unverifiable artifact is not-proven
+ * (return to work), never a false "done".
+ */
+import type { LiveTestArtifactStore, Surface, LiveTestArtifact } from './LiveTestArtifactStore.js';
+export type LiveTestGateMode = 'dry-run' | 'warn' | 'veto';
+export declare function looksUserFacing(goalText: string): boolean;
+export interface LiveTestGateInput {
+    featureId: string;
+    /** Author declaration; undefined → classifier signal (never a hard block). */
+    userFacing?: boolean;
+    goalText: string;
+    /** The surfaces this feature has (channel/dashboard). Default ['telegram','slack']. */
+    requiredSurfaces?: Surface[];
+    mode: LiveTestGateMode;
+}
+export type GateOutcome = 'allow' | 'veto' | 'nudge';
+export interface LiveTestGateResult {
+    outcome: GateOutcome;
+    /** Whether this actually stops the run (only outcome!=allow AND mode==='veto'). */
+    blocks: boolean;
+    mode: LiveTestGateMode;
+    reason: string;
+    /** True when the gate WOULD veto/nudge but mode held it (dry-run/warn telemetry). */
+    wouldBlock: boolean;
+}
+/**
+ * Evaluate the live-test artifact for a feature against the §4.5 surface +
+ * §4.6 risk-category requirements. Returns null when the artifact fully satisfies
+ * the bar, or a human reason string when it does not.
+ */
+export declare function evaluateArtifact(artifact: LiveTestArtifact, requiredSurfaces: Surface[]): string | null;
+export declare class LiveTestGate {
+    private readonly store;
+    constructor(store: LiveTestArtifactStore);
+    evaluate(input: LiveTestGateInput): LiveTestGateResult;
+}
+//# sourceMappingURL=LiveTestGate.d.ts.map

package/dist/core/LiveTestGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LiveTestGate.d.ts","sourceRoot":"","sources":["../../src/core/LiveTestGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAgB,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAGjH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAQ3D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,mFAAmF;IACnF,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,EAAE,OAAO,CAAC;CACrB;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAsCvG;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,qBAAqB;IAEzD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB;CAmCvD"}

package/dist/core/LiveTestGate.js

@@ -0,0 +1,124 @@
+/**
+ * LiveTestGate — the deterministic completion-gate veto (spec
+ * docs/specs/live-user-channel-proof-standard.md §4). It refuses a "done"/"shipped"
+ * verdict for a USER-FACING feature unless a verified live-test artifact (§4.4)
+ * proves it ran through its real surface (Telegram AND Slack for a channel feature)
+ * across the required risk categories.
+ *
+ * Signal vs. Authority (§4.2 — the load-bearing placement): the keyword classifier
+ * holds NO standalone blocking authority. The HARD veto rests only on OBJECTIVE
+ * facts — an author-DECLARED `userFacing:true` AND the absence of a verified
+ * artifact. An undeclared-but-user-facing-looking goal gets a SOFT 'nudge'
+ * (return-to-work signal), never a hard block on a brittle guess. Both outcomes
+ * keep an autonomous run working (they prevent a premature "done"); only the
+ * REPORTED authority differs, so the structure is honest about which is objective.
+ *
+ * Rollout (§4.8): `mode` is dry-run → warn → veto. In dry-run/warn the decision is
+ * computed + logged but `blocks` is false (it never actually stops the run); only
+ * `veto` mode blocks. The SAFE direction on an unverifiable artifact is not-proven
+ * (return to work), never a false "done".
+ */
+import { REQUIRED_RISK_CATEGORIES } from './LiveTestArtifactStore.js';
+/** Keyword signal that a goal looks user-facing (NOT authority — §4.2/§4.3). */
+const USER_FACING_KEYWORDS = [
+    'channel', 'dashboard', 'message', 'transfer', 'slack', 'telegram', 'ux',
+    'reply', 'notification', 'notify', 'conversation', 'topic', 'session',
+];
+export function looksUserFacing(goalText) {
+    const t = ` ${goalText.toLowerCase()} `;
+    return USER_FACING_KEYWORDS.some((k) => new RegExp(`\\b${k}\\b`).test(t));
+}
+function uniq(xs) { return [...new Set(xs)]; }
+/**
+ * Evaluate the live-test artifact for a feature against the §4.5 surface +
+ * §4.6 risk-category requirements. Returns null when the artifact fully satisfies
+ * the bar, or a human reason string when it does not.
+ */
+export function evaluateArtifact(artifact, requiredSurfaces) {
+    // §4.5 surfaces: every required surface must be exercised (or carry an audited
+    // exemption — modeled as the surface simply being present in surfaces[]).
+    const present = new Set(artifact.surfaces);
+    const missingSurface = requiredSurfaces.find((s) => !present.has(s));
+    if (missingSurface)
+        return `missing required surface "${missingSurface}" (have: ${[...present].join(', ') || 'none'})`;
+    // §4.4 poison rule + §4.6 BLOCKED taxonomy, per risk category.
+    const byCategory = new Map();
+    for (const row of artifact.scenarios) {
+        const c = byCategory.get(row.riskCategory) ?? { pass: 0, fail: 0, blockedReal: 0 };
+        if (row.verdict === 'PASS')
+            c.pass++;
+        else if (row.verdict === 'FAIL')
+            c.fail++;
+        else if (row.verdict === 'BLOCKED') {
+            // BLOCKED is honored only with a machine-verifiable external blocker (§4.6);
+            // a bare BLOCKED counts as FAIL.
+            const real = row.blockedKind === 'platform-error' || row.blockedKind === 'platform-outage' || row.blockedKind === 'operator-waiver';
+            if (real)
+                c.blockedReal++;
+            else
+                c.fail++;
+        }
+        byCategory.set(row.riskCategory, c);
+    }
+    // The load-bearing categories must have a PASS (BLOCKED never satisfies them, §4.6).
+    const loadBearing = ['happy-path', 'channel-parity'];
+    for (const cat of loadBearing) {
+        const c = byCategory.get(cat);
+        if (!c || c.pass < 1)
+            return `load-bearing category "${cat}" has no PASS scenario`;
+        if (c.fail > 0)
+            return `category "${cat}" has ${c.fail} FAIL/poisoned scenario(s)`;
+    }
+    // Every applicable required category present with at least one PASS (§4.6).
+    const declared = uniq(artifact.riskCategories);
+    for (const cat of declared) {
+        if (!REQUIRED_RISK_CATEGORIES.includes(cat))
+            continue;
+        const c = byCategory.get(cat);
+        if (!c || c.pass < 1)
+            return `risk category "${cat}" is declared but has no PASS scenario`;
+        if (c.fail > 0)
+            return `risk category "${cat}" has ${c.fail} FAIL/poisoned scenario(s)`;
+    }
+    return null;
+}
+export class LiveTestGate {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    evaluate(input) {
+        const requiredSurfaces = input.requiredSurfaces ?? ['telegram', 'slack'];
+        const mk = (outcome, reason) => {
+            const wouldBlock = outcome !== 'allow';
+            return { outcome, reason, mode: input.mode, wouldBlock, blocks: wouldBlock && input.mode === 'veto' };
+        };
+        // §4.2/§4.3: determine user-facing. Explicit declaration is authoritative;
+        // otherwise the classifier is a SIGNAL only.
+        const declaredUserFacing = input.userFacing;
+        const classifierSaysUserFacing = looksUserFacing(input.goalText);
+        if (declaredUserFacing === false) {
+            // Declared internal. (A surfaced contradiction is the harness/sentinel's job,
+            // signal-only — the gate honors the declaration here.)
+            return mk('allow', 'declared userFacing:false — gate not applicable');
+        }
+        const isUserFacing = declaredUserFacing === true || classifierSaysUserFacing;
+        if (!isUserFacing)
+            return mk('allow', 'not a user-facing feature (no declaration, classifier negative)');
+        // User-facing → require a verified artifact.
+        const verified = this.store.latestVerified(input.featureId);
+        if (!verified || !verified.ok) {
+            const reason = `no verified live-test artifact for "${input.featureId}" (${verified?.reason ?? 'none found'}) — run the user-role harness through ${requiredSurfaces.join(' AND ')} first`;
+            // HARD veto only when DECLARED user-facing (objective). Undeclared-but-classified
+            // → soft nudge (Signal vs. Authority §4.2).
+            return mk(declaredUserFacing === true ? 'veto' : 'nudge', reason);
+        }
+        const shortfall = evaluateArtifact(verified.artifact, requiredSurfaces);
+        if (shortfall) {
+            return mk(declaredUserFacing === true ? 'veto' : 'nudge', `live-test artifact present but incomplete: ${shortfall}`);
+        }
+        return mk('allow', `verified live-test artifact proves "${input.featureId}" across ${requiredSurfaces.join(' AND ')}`);
+    }
+}
+// (CMT-1568 live-user-channel-proof — decision-audit record trigger)
+//# sourceMappingURL=LiveTestGate.js.map

package/dist/core/LiveTestGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LiveTestGate.js","sourceRoot":"","sources":["../../src/core/LiveTestGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAItE,gFAAgF;AAChF,MAAM,oBAAoB,GAAG;IAC3B,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI;IACxE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS;CACtE,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAwBD,SAAS,IAAI,CAAI,EAAO,IAAS,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,gBAA2B;IACtF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,6BAA6B,cAAc,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC;IAEvH,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqE,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACnF,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;YAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAChC,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;YAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aACrC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,6EAA6E;YAC7E,iCAAiC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,KAAK,gBAAgB,IAAI,GAAG,CAAC,WAAW,KAAK,iBAAiB,IAAI,GAAG,CAAC,WAAW,KAAK,iBAAiB,CAAC;YACpI,IAAI,IAAI;gBAAE,CAAC,CAAC,WAAW,EAAE,CAAC;;gBAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,qFAAqF;IACrF,MAAM,WAAW,GAAmB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,0BAA0B,GAAG,wBAAwB,CAAC;QACnF,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,aAAa,GAAG,SAAS,CAAC,CAAC,IAAI,4BAA4B,CAAC;IACrF,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACtD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,kBAAkB,GAAG,wCAAwC,CAAC;QAC3F,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,kBAAkB,GAAG,SAAS,CAAC,CAAC,IAAI,4BAA4B,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,KAA4B;QAA5B,UAAK,GAAL,KAAK,CAAuB;IAAG,CAAC;IAE7D,QAAQ,CAAC,KAAwB;QAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAK,CAAC,UAAU,EAAE,OAAO,CAAe,CAAC;QACxF,MAAM,EAAE,GAAG,CAAC,OAAoB,EAAE,MAAc,EAAsB,EAAE;YACtE,MAAM,UAAU,GAAG,OAAO,KAAK,OAAO,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxG,CAAC,CAAC;QAEF,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC5C,MAAM,wBAAwB,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEjE,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACjC,8EAA8E;YAC9E,uDAAuD;YACvD,OAAO,EAAE,CAAC,OAAO,EAAE,iDAAiD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,YAAY,GAAG,kBAAkB,KAAK,IAAI,IAAI,wBAAwB,CAAC;QAC7E,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC,OAAO,EAAE,iEAAiE,CAAC,CAAC;QAEzG,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,uCAAuC,KAAK,CAAC,SAAS,MAAM,QAAQ,EAAE,MAAM,IAAI,YAAY,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC3L,kFAAkF;YAClF,4CAA4C;YAC5C,OAAO,EAAE,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAS,EAAE,gBAAgB,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,8CAA8C,SAAS,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,EAAE,uCAAuC,KAAK,CAAC,SAAS,YAAY,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;CACF;AAED,qEAAqE"}

package/dist/core/LiveTestHarness.d.ts

@@ -0,0 +1,99 @@
+/**
+ * LiveTestHarness — the user-role live-test runner (spec
+ * docs/specs/live-user-channel-proof-standard.md §5). It drives a feature
+ * end-to-end AS THE USER through the real surface (Telegram AND Slack for a channel
+ * feature), recording a signed PASS/FAIL scenario matrix as the artifact the
+ * completion gate reads.
+ *
+ * This module is the harness CORE: it runs a scenario matrix over an INJECTED
+ * `ChannelDriver` (send / awaitReply / isDemoChannel), so it is unit-testable with a
+ * fake driver. The REAL Telegram + Slack drivers (real-account drive, §5.4, demo
+ * channels) and the Playwright dashboard driver wire into this same interface.
+ *
+ * Structural safety (§5.3): a volatile/permission scenario is REFUSED before any
+ * send unless its target channel is a demo channel — a structural throw, not a
+ * convention, so a destructive scenario can never touch the live operator channel.
+ *
+ * Determinism (§5.6/§4.4): the PASS/FAIL verdict rests on DETERMINISTIC protocol
+ * evidence (the reply text + the responder machine id captured from the real
+ * platform), not a fuzzy judgment. (An optional Tier-1 semantic supervisor for
+ * natural-language expectations is a follow-on; the core encodes exact checks.)
+ */
+import type { LiveTestArtifact, LiveTestArtifactStore, RiskCategory, Surface } from './LiveTestArtifactStore.js';
+export interface SendResult {
+    messageId: string;
+}
+export interface ReplyResult {
+    text: string;
+    messageId: string;
+    responderMachineId?: string;
+}
+/** The injected channel transport — a real adapter (Telegram/Slack) OR a fake. */
+export interface ChannelDriver {
+    /** Whether (surface, channelId) is a registered demo channel (§5.3 isolation). */
+    isDemoChannel(surface: Surface, channelId: string): boolean;
+    /** Send a user message on the real surface. */
+    send(surface: Surface, channelId: string, text: string): Promise<SendResult>;
+    /** Await the agent's reply (resolves null on timeout). */
+    awaitReply(surface: Surface, channelId: string, opts: {
+        timeoutMs: number;
+        afterMessageId?: string;
+    }): Promise<ReplyResult | null>;
+}
+export type Volatility = 'safe' | 'volatile' | 'permission';
+export interface HarnessScenario {
+    id: string;
+    description: string;
+    surface: Surface;
+    riskCategory: RiskCategory;
+    volatility: Volatility;
+    channelId: string;
+    /** The user message to send. */
+    input: string;
+    /** Deterministic expectations checked against the captured reply. */
+    expect: {
+        replyContains?: string;
+        replyNotEmpty?: boolean;
+        responderMachine?: string;
+    };
+    timeoutMs?: number;
+}
+export interface HarnessMatrix {
+    featureId: string;
+    surfaces: Surface[];
+    riskCategories: RiskCategory[];
+    scenarios: HarnessScenario[];
+}
+export interface LiveTestHarnessDeps {
+    store: LiveTestArtifactStore;
+    driver: ChannelDriver;
+    runnerFingerprint: string;
+    /** Bounded retries on a reply timeout before recording FAIL (§5.5 flake mgmt). */
+    maxReplyRetries?: number;
+    defaultTimeoutMs?: number;
+    now?: () => number;
+    logger?: (m: string) => void;
+}
+export declare class HarnessVolatileChannelError extends Error {
+    constructor(scenarioId: string, surface: Surface, channelId: string);
+}
+export declare class LiveTestHarness {
+    private readonly d;
+    constructor(deps: LiveTestHarnessDeps);
+    private now;
+    private log;
+    /**
+     * Run the scenario matrix and write the signed artifact. `runId` lets the caller
+     * pin a stable id (defaults to a now-stamped id). THROWS HarnessVolatileChannelError
+     * if any volatile/permission scenario targets a non-demo channel (fail-fast, before
+     * any send) — the §5.3 structural guard.
+     */
+    run(matrix: HarnessMatrix, opts?: {
+        runId?: string;
+    }): Promise<{
+        artifact: LiveTestArtifact;
+        entry: ReturnType<LiveTestArtifactStore['write']>;
+    }>;
+    private runScenario;
+}
+//# sourceMappingURL=LiveTestHarness.d.ts.map

package/dist/core/LiveTestHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LiveTestHarness.d.ts","sourceRoot":"","sources":["../../src/core/LiveTestHarness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAe,OAAO,EAC5E,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,UAAU;IAAG,SAAS,EAAE,MAAM,CAAA;CAAE;AACjD,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE;AAE7F,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5D,+CAA+C;IAC/C,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7E,0DAA0D;IAC1D,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpI;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM;CAIpE;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAsB;gBAE5B,IAAI,EAAE,mBAAmB;IAIrC,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,GAAG;IAEX;;;;;OAKG;IACG,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;YA4B7I,WAAW;CA+B1B"}