metheus-governance-mcp-cli 0.2.151 → 0.2.152

package/cli.mjs

@@ -130,10 +130,12 @@ import {
   printRunnerResult,
 } from "./lib/runner-helpers.mjs";
 import {
+  createProjectEvidence as createProjectEvidenceImpl,
   createProjectWorkItem as createProjectWorkItemImpl,
   createThreadComment as createThreadCommentImpl,
   createWorkItemThread as createWorkItemThreadImpl,
   discoverArchiveThreadForDestination as discoverArchiveThreadForDestinationImpl,
+  linkWorkItemEvidence as linkWorkItemEvidenceImpl,
   listProjectChatDestinations as listProjectChatDestinationsImpl,
   listThreadComments as listThreadCommentsImpl,
   listUserBotsForRunner as listUserBotsForRunnerImpl,
@@ -1362,7 +1364,6 @@ function loadBotRunnerWorkspaceRegistry(options = {}) {
 }
 
 function saveBotRunnerConfig(nextConfig, filePath = botRunnerConfigFilePath()) {
-  saveBotRunnerWorkspaceRegistry(safeObject(nextConfig).projectMappings);
   const payload = serializeBotRunnerConfig(nextConfig);
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   fs.writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
@@ -1523,6 +1524,9 @@ function loadBotRunnerConfig(options = {}) {
     normalized.projectMappings = mergedProjectMappings;
     normalized.workspaceRegistryFilePath = workspaceRegistry.filePath;
     if (persistIfNeeded && (normalized.migrated || !fs.existsSync(filePath) || registryChanged || legacyProjectMappingsPresent)) {
+      if (registryChanged || legacyProjectMappingsPresent) {
+        saveBotRunnerWorkspaceRegistry(mergedProjectMappings, workspaceRegistry.filePath);
+      }
       saveBotRunnerConfig(normalized, filePath);
       normalized.migrated = false;
     }
@@ -1626,24 +1630,22 @@ function rememberProjectWorkspaceMapping({ projectID, workspaceDir, source }) {
       reason: "existing workspace mapping preserved over unrelated automatic signal",
     };
   }
-  const nextConfig = {
-    ...config,
-    projectMappings: {
-      ...safeObject(config.projectMappings),
-      [projectID]: {
-        projectID,
-        workspaceDir: normalizedWorkspaceDir,
-        source: normalizedSource,
-        updatedAt: new Date().toISOString(),
-      },
+  const nextProjectMappings = {
+    ...safeObject(config.projectMappings),
+    [projectID]: {
+      projectID,
+      workspaceDir: normalizedWorkspaceDir,
+      source: normalizedSource,
+      updatedAt: new Date().toISOString(),
     },
   };
-  const filePath = saveBotRunnerConfig(nextConfig, config.filePath);
+  const workspaceRegistryFilePath = config.workspaceRegistryFilePath || botRunnerWorkspaceRegistryFilePath();
+  saveBotRunnerWorkspaceRegistry(nextProjectMappings, workspaceRegistryFilePath);
   return {
     ok: true,
     updated: true,
-    filePath,
-    workspaceRegistryFilePath: nextConfig.workspaceRegistryFilePath || botRunnerWorkspaceRegistryFilePath(),
+    filePath: config.filePath,
+    workspaceRegistryFilePath,
     projectID,
     workspaceDir: normalizedWorkspaceDir,
   };
@@ -3286,10 +3288,18 @@ async function createProjectWorkItem(params) {
   return createProjectWorkItemImpl(params, buildRunnerDataDeps());
 }
 
+async function createProjectEvidence(params) {
+  return createProjectEvidenceImpl(params, buildRunnerDataDeps());
+}
+
 async function createWorkItemThread(params) {
   return createWorkItemThreadImpl(params, buildRunnerDataDeps());
 }
 
+async function linkWorkItemEvidence(params) {
+  return linkWorkItemEvidenceImpl(params, buildRunnerDataDeps());
+}
+
 function buildRunnerDeliveryDeps() {
   return {
     listProjectChatDestinations,
@@ -3324,8 +3334,10 @@ function buildRunnerExecutionDeps() {
     resolveRunnerExecutionPlanForRole,
     validateWorkspaceArtifacts,
     tryJsonParse,
+    createProjectEvidence,
     createProjectWorkItem,
     createWorkItemThread,
+    linkWorkItemEvidence,
     replaceProjectCtxpackFiles,
   };
 }
@@ -7380,13 +7392,6 @@ function syncCtxpackToLocalCache({
     } catch {
       // Best-effort metadata refresh for workspace-root auto-detection.
     }
-    if (!isHomeFallback) {
-      rememberProjectWorkspaceMapping({
-        projectID,
-        workspaceDir: resolvedWorkspaceDir,
-        source: "ctxpack_sync_current",
-      });
-    }
     return {
       sync_status: isHomeFallback ? "home_fallback" : "current",
       sync_message: isHomeFallback
@@ -7410,14 +7415,6 @@ function syncCtxpackToLocalCache({
 
     fs.writeFileSync(metaPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
     fs.writeFileSync(workspaceMetaPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
-    if (!isHomeFallback) {
-      rememberProjectWorkspaceMapping({
-        projectID,
-        workspaceDir: resolvedWorkspaceDir,
-        source: "ctxpack_sync_write",
-      });
-    }
-
     return {
       sync_status: isHomeFallback ? "home_fallback" : (previousMeta ? "updated" : "downloaded"),
       sync_message: isHomeFallback
@@ -8505,14 +8502,14 @@ TELEGRAM_BOT_REVIEW_TOKEN=review-token
       safeObject(runnerConfigAfterProjectTool.projectMappings)?.[selftestProjectID]?.workspaceDir || "";
     const projectToolWorkspaceSignalOk =
       String(safeObject(response).error || "").trim() === ""
-      && normalizedPathForCompare(storedProjectToolWorkspace) === normalizedPathForCompare(projectToolWorkspaceDir);
+      && !String(storedProjectToolWorkspace || "").trim();
     push(
-      "project_summary_workspace_signal_updates_runner_mapping",
+      "project_summary_workspace_signal_does_not_update_runner_mapping",
       projectToolWorkspaceSignalOk,
       `workspace=${storedProjectToolWorkspace || "(none)"} source=${String(safeObject(runnerConfigAfterProjectTool.projectMappings)?.[selftestProjectID]?.source || "(none)")}`,
     );
   } catch (err) {
-    push("project_summary_workspace_signal_updates_runner_mapping", false, String(err?.message || err));
+    push("project_summary_workspace_signal_does_not_update_runner_mapping", false, String(err?.message || err));
   } finally {
     if (previousProjectToolUserProfile === undefined) delete process.env.USERPROFILE;
     else process.env.USERPROFILE = previousProjectToolUserProfile;
@@ -8582,12 +8579,12 @@ TELEGRAM_BOT_REVIEW_TOKEN=review-token
     const storedWorkspaceAfterDrift =
       safeObject(runnerConfigAfterProjectToolDrift.projectMappings)?.[selftestProjectID]?.workspaceDir || "";
     push(
-      "project_summary_workspace_signal_does_not_override_unrelated_existing_mapping",
+      "project_summary_workspace_signal_preserves_existing_manual_mapping",
       normalizedPathForCompare(storedWorkspaceAfterDrift) === normalizedPathForCompare(stableWorkspaceDir),
       `stored=${storedWorkspaceAfterDrift || "(none)"} stable=${stableWorkspaceDir}`,
     );
   } catch (err) {
-    push("project_summary_workspace_signal_does_not_override_unrelated_existing_mapping", false, String(err?.message || err));
+    push("project_summary_workspace_signal_preserves_existing_manual_mapping", false, String(err?.message || err));
   } finally {
     if (previousProjectToolDriftUserProfile === undefined) delete process.env.USERPROFILE;
     else process.env.USERPROFILE = previousProjectToolDriftUserProfile;

package/lib/local-project-dispatch.mjs

@@ -49,7 +49,6 @@ export async function handleLocalProjectToolDispatch(
   const normalizeMergeAction = requireDependency(deps, "normalizeMergeAction");
   const executeCtxpackMergeActionForTool = requireDependency(deps, "executeCtxpackMergeActionForTool");
   const buildCtxpackMergeExecuteText = requireDependency(deps, "buildCtxpackMergeExecuteText");
-  const rememberProjectWorkspaceMapping = requireDependency(deps, "rememberProjectWorkspaceMapping");
   const jsonRpcError = requireDependency(deps, "jsonRpcError");
   const jsonRpcResult = requireDependency(deps, "jsonRpcResult");
 
@@ -91,17 +90,6 @@ export async function handleLocalProjectToolDispatch(
         workspaceDir,
         workspaceSignalTrusted,
       });
-      if (workspaceSignalTrusted && String(workspaceDir || "").trim()) {
-        try {
-          rememberProjectWorkspaceMapping({
-            projectID,
-            workspaceDir,
-            source: "project_tool_workspace_signal",
-          });
-        } catch {
-          // Best-effort persistence only. The project summary response itself should still succeed.
-        }
-      }
       const text = buildProjectSummaryText(summary);
       return jsonRpcResult(requestObj, {
         content: [{ type: "text", text }],

package/lib/runner-data.mjs

@@ -281,6 +281,94 @@ export async function createWorkItemThread(
   return safeObject(parseJSONText(responseText));
 }
 
+export async function createProjectEvidence(
+  {
+    siteBaseURL,
+    token,
+    timeoutSeconds,
+    actorUserID,
+    projectID,
+    type,
+    uri = "",
+    source = "",
+    credibility = "",
+    sensitivity = "",
+    reproducibility = "",
+    version = "",
+    hash = "",
+    storage = "",
+    repoURL = "",
+    commitSHA = "",
+    repoPath = "",
+    blobSHA = "",
+    sha256 = "",
+    sizeBytes,
+    mimeType = "",
+  },
+  deps,
+) {
+  const postJSONWithAuthHeaders = requireDependency(deps, "postJSONWithAuthHeaders");
+  const parseJSONText = requireDependency(deps, "parseJSONText");
+  const payload = {
+    project_id: projectID,
+    type,
+    ...(uri ? { uri } : {}),
+    ...(source ? { source } : {}),
+    ...(credibility ? { credibility } : {}),
+    ...(sensitivity ? { sensitivity } : {}),
+    ...(reproducibility ? { reproducibility } : {}),
+    ...(version ? { version } : {}),
+    ...(hash ? { hash } : {}),
+    ...(storage ? { storage } : {}),
+    ...(repoURL ? { repo_url: repoURL } : {}),
+    ...(commitSHA ? { commit_sha: commitSHA } : {}),
+    ...(repoPath ? { repo_path: repoPath } : {}),
+    ...(blobSHA ? { blob_sha: blobSHA } : {}),
+    ...(sha256 ? { sha256 } : {}),
+    ...(Number.isFinite(Number(sizeBytes)) ? { size_bytes: Number(sizeBytes) } : {}),
+    ...(mimeType ? { mime_type: mimeType } : {}),
+  };
+  const responseText = await postJSONWithAuthHeaders(
+    `${siteBaseURL}/api/v1/evidence`,
+    timeoutSeconds,
+    token,
+    payload,
+    {
+      "X-Actor-User-Id": actorUserID,
+    },
+  );
+  return safeObject(parseJSONText(responseText));
+}
+
+export async function linkWorkItemEvidence(
+  {
+    siteBaseURL,
+    token,
+    timeoutSeconds,
+    actorUserID,
+    workItemID,
+    evidenceID,
+    relationNote = "",
+  },
+  deps,
+) {
+  const postJSONWithAuthHeaders = requireDependency(deps, "postJSONWithAuthHeaders");
+  const parseJSONText = requireDependency(deps, "parseJSONText");
+  const responseText = await postJSONWithAuthHeaders(
+    `${siteBaseURL}/api/v1/workitems/${encodeURIComponent(workItemID)}/evidence`,
+    timeoutSeconds,
+    token,
+    {
+      evidence_id: evidenceID,
+      relation_note: relationNote,
+    },
+    {
+      "X-Actor-User-Id": actorUserID,
+    },
+  );
+  return safeObject(parseJSONText(responseText));
+}
+
 export async function discoverArchiveThreadForDestination(
   {
     siteBaseURL,

package/lib/runner-orchestration.mjs

@@ -586,7 +586,14 @@ async function materializeExecutionWorkItems({
   const createWorkItemThread = typeof executionDeps.createWorkItemThread === "function"
     ? executionDeps.createWorkItemThread
     : null;
+  const createProjectEvidence = typeof executionDeps.createProjectEvidence === "function"
+    ? executionDeps.createProjectEvidence
+    : null;
+  const linkWorkItemEvidence = typeof executionDeps.linkWorkItemEvidence === "function"
+    ? executionDeps.linkWorkItemEvidence
+    : null;
   const createdWorkItems = [];
+  const createdEvidenceItems = [];
   const errors = [];
   for (const item of requestedWorkItems) {
     try {
@@ -634,8 +641,66 @@ async function materializeExecutionWorkItems({
       errors.push(`failed to create work item "${item.title}": ${String(err?.message || err)}`);
     }
   }
+  if (requiresEvidenceLinkForExecutionStep(step) && createdWorkItems.length > 0) {
+    if (!createProjectEvidence || !linkWorkItemEvidence) {
+      errors.push("runner execution deps missing evidence creation/link helpers");
+    } else if (ensureArray(validatedArtifacts).length === 0) {
+      errors.push(`could not link evidence for execution step "${String(safeObject(step).goal || "").trim() || "unnamed"}" because no validated project artifacts were produced`);
+    } else {
+      for (const artifactRaw of ensureArray(validatedArtifacts)) {
+        const artifact = safeObject(artifactRaw);
+        const artifactPath = String(artifact.relativePath || artifact.path || "").trim();
+        if (!artifactPath) {
+          continue;
+        }
+        try {
+          const createdEvidence = safeObject(await createProjectEvidence({
+            siteBaseURL: runtime.baseURL,
+            token: runtime.token,
+            timeoutSeconds: runtime.timeoutSeconds,
+            actorUserID: safeObject(runtime.actor).user_id,
+            projectID: String(normalizedRoute.projectID || normalizedRoute.project_id || "").trim(),
+            type: "file",
+            uri: artifactPath,
+            source: "runner_execution",
+          }));
+          const evidenceID = String(createdEvidence.id || createdEvidence.evidence_id || createdEvidence.evidenceID || "").trim();
+          if (!evidenceID) {
+            errors.push(`failed to create evidence for artifact "${artifactPath}"`);
+            continue;
+          }
+          createdEvidenceItems.push({
+            id: evidenceID,
+            path: artifactPath,
+          });
+          for (const workItem of createdWorkItems) {
+            const workItemID = String(safeObject(workItem).id || "").trim();
+            if (!workItemID) {
+              continue;
+            }
+            try {
+              await linkWorkItemEvidence({
+                siteBaseURL: runtime.baseURL,
+                token: runtime.token,
+                timeoutSeconds: runtime.timeoutSeconds,
+                actorUserID: safeObject(runtime.actor).user_id,
+                workItemID,
+                evidenceID,
+                relationNote: `Execution artifact: ${artifactPath}`,
+              });
+            } catch (err) {
+              errors.push(`failed to link evidence "${artifactPath}" to work item "${String(safeObject(workItem).title || workItemID).trim() || workItemID}": ${String(err?.message || err)}`);
+            }
+          }
+        } catch (err) {
+          errors.push(`failed to create evidence for artifact "${artifactPath}": ${String(err?.message || err)}`);
+        }
+      }
+    }
+  }
   return {
     workItems: createdWorkItems,
+    evidenceItems: createdEvidenceItems,
     errors,
   };
 }
@@ -1148,6 +1213,7 @@ async function maybeExecuteDynamicRolePlan({
   const mergedArtifactPaths = new Set();
   const mergedBoundaryViolations = [];
   const mergedWorkItems = [];
+  const mergedEvidenceItems = [];
   const mergedCtxpackChangedPaths = new Set();
   let finalCtxpackUpdate = null;
   const totalSteps = plannedSteps.length;
@@ -1318,6 +1384,7 @@ async function maybeExecuteDynamicRolePlan({
         selectedRecord,
       });
       createdWorkItems = ensureArray(workItemMaterialization.workItems);
+      const createdEvidenceItems = ensureArray(workItemMaterialization.evidenceItems);
       stepErrors.push(
         ...ensureArray(workItemMaterialization.errors)
           .map((item) => String(item || "").trim())
@@ -1326,6 +1393,17 @@ async function maybeExecuteDynamicRolePlan({
       if (requiresWorkItemsForExecutionStep(step) && createdWorkItems.length === 0) {
         stepErrors.push(`${String(step.role || "").trim()} step completed without creating any governance work items`);
       }
+      createdEvidenceItems.forEach((item) => {
+        const evidence = safeObject(item);
+        const evidenceID = String(evidence.id || "").trim();
+        if (!evidenceID) {
+          return;
+        }
+        if (mergedEvidenceItems.some((existing) => String(safeObject(existing).id || "").trim() === evidenceID)) {
+          return;
+        }
+        mergedEvidenceItems.push(evidence);
+      });
     }
     if (stepErrors.length > 0) {
       const reason = stepErrors.join("; ");
@@ -1387,6 +1465,7 @@ async function maybeExecuteDynamicRolePlan({
       artifactValidation: String(stepValidation.status || "").trim() || "none",
       ctxpack: ctxpackUpdate,
       workItems: createdWorkItems,
+      evidenceItems: mergedEvidenceItems,
     });
   }
   const finalStepResult = stepResults[stepResults.length - 1] || {};
@@ -1431,6 +1510,10 @@ async function maybeExecuteDynamicRolePlan({
         description: String(safeObject(item).description || "").trim(),
         thread_id: String(safeObject(item).thread_id || "").trim(),
       })),
+      evidenceItems: mergedEvidenceItems.map((item) => ({
+        id: String(safeObject(item).id || "").trim(),
+        path: String(safeObject(item).path || "").trim(),
+      })),
       ctxpackUpdate: finalCtxpackUpdate && Object.keys(finalCtxpackUpdate).length > 0
         ? {
             ctxpack_id: String(finalCtxpackUpdate.ctxpackID || "").trim(),
@@ -3050,6 +3133,8 @@ export async function processRunnerSelectedRecord({
         last_boundary_violations: [],
         last_work_item_ids: ensureArray(aiResult?.workItems).map((item) => String(safeObject(item).id || "").trim()).filter(Boolean),
         last_work_item_titles: ensureArray(aiResult?.workItems).map((item) => String(safeObject(item).title || "").trim()).filter(Boolean),
+        last_evidence_ids: ensureArray(aiResult?.evidenceItems).map((item) => String(safeObject(item).id || "").trim()).filter(Boolean),
+        last_evidence_paths: ensureArray(aiResult?.evidenceItems).map((item) => String(safeObject(item).path || "").trim()).filter(Boolean),
         last_ctxpack_version_id: String(safeObject(aiResult?.ctxpackUpdate).version_id || "").trim(),
         last_ctxpack_changed_paths: ensureArray(safeObject(aiResult?.ctxpackUpdate).changed_paths).map((item) => String(item || "").trim()).filter(Boolean),
         last_ctxpack_pushed_file_count: intFromRawAllowZero(safeObject(aiResult?.ctxpackUpdate).pushed_file_count, 0),
@@ -3099,6 +3184,8 @@ export async function processRunnerSelectedRecord({
       ctxpack_pushed_file_count: intFromRawAllowZero(safeObject(aiResult?.ctxpackUpdate).pushed_file_count, 0),
       work_item_ids: ensureArray(aiResult?.workItems).map((item) => String(safeObject(item).id || "").trim()).filter(Boolean),
       work_item_titles: ensureArray(aiResult?.workItems).map((item) => String(safeObject(item).title || "").trim()).filter(Boolean),
+      evidence_ids: ensureArray(aiResult?.evidenceItems).map((item) => String(safeObject(item).id || "").trim()).filter(Boolean),
+      evidence_paths: ensureArray(aiResult?.evidenceItems).map((item) => String(safeObject(item).path || "").trim()).filter(Boolean),
       reply_chars: String(sanitizedReplyText || "").length,
       execution_mode: executionPlan.mode,
       role_profile: executionPlan.roleProfileName,

package/lib/selftest-runner-scenarios.mjs

@@ -3887,6 +3887,8 @@ export async function runSelftestRunnerScenarios(push, deps) {
     let deliveredText = "";
     let createWorkItemCalls = 0;
     let createThreadCalls = 0;
+    let createEvidenceCalls = 0;
+    let linkEvidenceCalls = 0;
     let ctxpackPushCalls = 0;
     const workspaceDir = fs.mkdtempSync(path.join(os.tmpdir(), "metheus-runner-selftest-workitems-"));
     const processed = await processRunnerSelectedRecord({
@@ -4063,6 +4065,20 @@ export async function runSelftestRunnerScenarios(push, deps) {
               thread_id: `${workItemID}-thread`,
             };
           },
+          createProjectEvidence: async ({ uri }) => {
+            createEvidenceCalls += 1;
+            return {
+              id: `evidence-${createEvidenceCalls}`,
+              evidence_id: `evidence-${createEvidenceCalls}`,
+              uri,
+            };
+          },
+          linkWorkItemEvidence: async () => {
+            linkEvidenceCalls += 1;
+            return {
+              linked: true,
+            };
+          },
           replaceProjectCtxpackFiles: async ({ artifacts }) => {
             ctxpackPushCalls += 1;
             return {
@@ -4106,12 +4122,15 @@ export async function runSelftestRunnerScenarios(push, deps) {
         && deliveryCalls === 1
         && createWorkItemCalls === 2
         && createThreadCalls === 2
+        && createEvidenceCalls === 1
+        && linkEvidenceCalls === 2
         && ctxpackPushCalls === 1
         && ensureArray(processed.result?.work_item_ids).length === 2
+        && ensureArray(processed.result?.evidence_ids).length === 1
         && ensureArray(processed.result?.executed_role_plan?.created_work_items).length === 2
         && String(processed.result?.ctxpack_version_id || "") === "version-1"
         && /implementation plan/i.test(deliveredText),
-      `kind=${String(processed.kind || "(none)")} delivery_calls=${deliveryCalls} delivered=${deliveredText} created_work_items=${ensureArray(processed.result?.work_item_ids).join(",")} threads=${createThreadCalls} ctxpack_pushes=${ctxpackPushCalls}`,
+      `kind=${String(processed.kind || "(none)")} delivery_calls=${deliveryCalls} delivered=${deliveredText} created_work_items=${ensureArray(processed.result?.work_item_ids).join(",")} evidence_ids=${ensureArray(processed.result?.evidence_ids).join(",")} threads=${createThreadCalls} evidence_links=${linkEvidenceCalls} ctxpack_pushes=${ctxpackPushCalls}`,
     );
   } catch (err) {
     push("single_bot_execution_request_materializes_governance_work_items", false, String(err?.message || err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.151",
+  "version": "0.2.152",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [