open-multi-agent-kit 0.78.1 → 0.78.3

package/dist/evidence/proof-trust.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Proof Trust MVP — Algorithm 3
+ *
+ * Evaluates a proof bundle against a run directory, computing a trust score
+ * based on weighted field presence and validity.
+ */
+export interface ProofTrustMvpEngine {
+    evaluate(runDir: string, bundle: unknown): Promise<ProofTrustResult>;
+}
+export interface ProofTrustResult {
+    readonly trustScore: number;
+    readonly missingFields: readonly string[];
+}
+export declare function createProofTrustMvpEngine(schemas?: Readonly<Record<string, unknown>>): ProofTrustMvpEngine;

package/dist/evidence/proof-trust.js

@@ -0,0 +1,381 @@
+/**
+ * Proof Trust MVP — Algorithm 3
+ *
+ * Evaluates a proof bundle against a run directory, computing a trust score
+ * based on weighted field presence and validity.
+ */
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { isAbsolute, join, relative } from "node:path";
+// ─── Constants ─────────────────────────────────────────────────────────────
+const EXPECTED_SCHEMA_VERSION = "omk.proof-bundle.v1";
+const WEIGHTS = {
+    schema: 0.15,
+    commands: 0.15,
+    stdout: 0.10,
+    hashes: 0.15,
+    decisions: 0.15,
+    evidence: 0.15,
+    limitations: 0.05,
+    replay: 0.10,
+};
+const FIELD_TO_MISSING = {
+    schema: "schema",
+    commands: "commands",
+    stdout: "stdout",
+    hashes: "artifact-hashes",
+    decisions: "decision-trace",
+    evidence: "weak-evidence",
+    limitations: "limitations",
+    replay: "replay-or-inspect",
+};
+// ─── Factory ───────────────────────────────────────────────────────────────
+export function createProofTrustMvpEngine(schemas) {
+    return {
+        async evaluate(runDir, bundle) {
+            const missingFields = [];
+            const root = process.cwd();
+            // ── helpers ─────────────────────────────────────────────────
+            function isObject(value) {
+                return value !== null && typeof value === "object" && !Array.isArray(value);
+            }
+            function isNonEmptyString(value) {
+                return typeof value === "string" && value.length > 0;
+            }
+            function resolveRepoPath(path) {
+                if (!isNonEmptyString(path))
+                    return undefined;
+                if (isAbsolute(path))
+                    return undefined;
+                if (path.split(/[\\/]+/).includes(".."))
+                    return undefined;
+                const absolute = join(root, path);
+                const back = relative(root, absolute);
+                if (back.startsWith("..") || isAbsolute(back))
+                    return undefined;
+                return absolute;
+            }
+            async function digestFile(filePath) {
+                return createHash("sha256").update(await readFile(filePath)).digest("hex");
+            }
+            function markMissing(field) {
+                missingFields.push(FIELD_TO_MISSING[field]);
+            }
+            // ── schema check ────────────────────────────────────────────
+            {
+                let valid = true;
+                if (!isObject(bundle)) {
+                    valid = false;
+                }
+                else if (bundle.schemaVersion !== EXPECTED_SCHEMA_VERSION) {
+                    valid = false;
+                }
+                else {
+                    const required = [
+                        "proofId",
+                        "title",
+                        "omkVersion",
+                        "runtimeVersion",
+                        "commit",
+                        "runId",
+                        "providerPolicy",
+                        "scenario",
+                        "files",
+                        "verdict",
+                        "knownLimitations",
+                        "checksums",
+                    ];
+                    for (const field of required) {
+                        if (!(field in bundle)) {
+                            valid = false;
+                            break;
+                        }
+                    }
+                    if (valid && schemas && EXPECTED_SCHEMA_VERSION in schemas) {
+                        // Future: JSON Schema validation. MVP checks version only.
+                    }
+                }
+                if (!valid)
+                    markMissing("schema");
+            }
+            // ── commands check ──────────────────────────────────────────
+            {
+                let hasCommands = false;
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const commandsPath = bundle.files.commands;
+                    if (isNonEmptyString(commandsPath)) {
+                        const resolved = resolveRepoPath(commandsPath);
+                        if (resolved) {
+                            try {
+                                const content = await readFile(resolved, "utf8");
+                                if (content.trim().length > 0)
+                                    hasCommands = true;
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                if (!hasCommands) {
+                    const fallback = join(runDir, "commands.sh");
+                    if (existsSync(fallback)) {
+                        try {
+                            const content = await readFile(fallback, "utf8");
+                            if (content.trim().length > 0)
+                                hasCommands = true;
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                if (!hasCommands)
+                    markMissing("commands");
+            }
+            // ── stdout check ────────────────────────────────────────────
+            {
+                let hasStdout = false;
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const stdoutPath = bundle.files.stdout;
+                    if (isNonEmptyString(stdoutPath)) {
+                        const resolved = resolveRepoPath(stdoutPath);
+                        if (resolved) {
+                            try {
+                                const st = await stat(resolved);
+                                if (st.size > 0)
+                                    hasStdout = true;
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                if (!hasStdout) {
+                    try {
+                        const entries = await readdir(runDir);
+                        if (entries.some((e) => e.endsWith(".out")))
+                            hasStdout = true;
+                    }
+                    catch { /* ignore */ }
+                }
+                if (!hasStdout)
+                    markMissing("stdout");
+            }
+            // ── artifact-hashes check ───────────────────────────────────
+            {
+                let valid = true;
+                if (isObject(bundle) && isObject(bundle.checksums) && isObject(bundle.files)) {
+                    const checksums = bundle.checksums;
+                    const files = bundle.files;
+                    for (const [, path] of Object.entries(files)) {
+                        if (!isNonEmptyString(path))
+                            continue;
+                        const resolved = resolveRepoPath(path);
+                        if (!resolved || !existsSync(resolved)) {
+                            valid = false;
+                            break;
+                        }
+                        const expected = checksums[path];
+                        if (!isNonEmptyString(expected)) {
+                            valid = false;
+                            break;
+                        }
+                        try {
+                            const actual = await digestFile(resolved);
+                            if (actual !== expected) {
+                                valid = false;
+                                break;
+                            }
+                        }
+                        catch {
+                            valid = false;
+                            break;
+                        }
+                    }
+                    if (valid) {
+                        const fileValues = Object.values(files).filter((v) => isNonEmptyString(v));
+                        for (const checksumPath of Object.keys(checksums)) {
+                            if (!fileValues.includes(checksumPath)) {
+                                valid = false;
+                                break;
+                            }
+                        }
+                    }
+                }
+                else {
+                    valid = false;
+                }
+                if (!valid)
+                    markMissing("hashes");
+            }
+            // ── decision-trace check ────────────────────────────────────
+            {
+                let complete = false;
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const decisionsPath = bundle.files.decisionsJsonl;
+                    if (isNonEmptyString(decisionsPath)) {
+                        const resolved = resolveRepoPath(decisionsPath);
+                        if (resolved && existsSync(resolved)) {
+                            try {
+                                const content = await readFile(resolved, "utf8");
+                                const lines = content.split(/\r?\n/).filter((l) => l.trim().length > 0);
+                                if (lines.length > 0) {
+                                    complete = lines.every((line) => {
+                                        try {
+                                            const parsed = JSON.parse(line);
+                                            return isObject(parsed) && parsed.schemaVersion === "omk.decision.v1";
+                                        }
+                                        catch {
+                                            return false;
+                                        }
+                                    });
+                                }
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                if (!complete) {
+                    const fallback = join(runDir, "decisions.jsonl");
+                    if (existsSync(fallback)) {
+                        try {
+                            const content = await readFile(fallback, "utf8");
+                            const lines = content.split(/\r?\n/).filter((l) => l.trim().length > 0);
+                            if (lines.length > 0) {
+                                complete = lines.every((line) => {
+                                    try {
+                                        const parsed = JSON.parse(line);
+                                        return isObject(parsed) && parsed.schemaVersion === "omk.decision.v1";
+                                    }
+                                    catch {
+                                        return false;
+                                    }
+                                });
+                            }
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                if (!complete)
+                    markMissing("decisions");
+            }
+            // ── evidence check ──────────────────────────────────────────
+            {
+                const records = [];
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const evidencePath = bundle.files.evidenceJsonl;
+                    if (isNonEmptyString(evidencePath)) {
+                        const resolved = resolveRepoPath(evidencePath);
+                        if (resolved && existsSync(resolved)) {
+                            try {
+                                const content = await readFile(resolved, "utf8");
+                                const lines = content.split(/\r?\n/).filter((l) => l.trim().length > 0);
+                                for (const line of lines) {
+                                    try {
+                                        const parsed = JSON.parse(line);
+                                        if (isObject(parsed))
+                                            records.push(parsed);
+                                    }
+                                    catch { /* ignore */ }
+                                }
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                if (records.length === 0) {
+                    const fallback = join(runDir, "evidence.jsonl");
+                    if (existsSync(fallback)) {
+                        try {
+                            const content = await readFile(fallback, "utf8");
+                            const lines = content.split(/\r?\n/).filter((l) => l.trim().length > 0);
+                            for (const line of lines) {
+                                try {
+                                    const parsed = JSON.parse(line);
+                                    if (isObject(parsed))
+                                        records.push(parsed);
+                                }
+                                catch { /* ignore */ }
+                            }
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                let avg;
+                if (records.length === 0) {
+                    avg = 0;
+                }
+                else {
+                    const passCount = records.filter((r) => r.status === "passed").length;
+                    avg = passCount / records.length;
+                }
+                if (avg < 0.75)
+                    markMissing("evidence");
+            }
+            // ── limitations check ───────────────────────────────────────
+            {
+                let hasLimitations = false;
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const limitationsPath = bundle.files.limitations;
+                    if (isNonEmptyString(limitationsPath)) {
+                        const resolved = resolveRepoPath(limitationsPath);
+                        if (resolved) {
+                            try {
+                                const content = await readFile(resolved, "utf8");
+                                if (content.trim().length > 0)
+                                    hasLimitations = true;
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                if (!hasLimitations) {
+                    const fallback = join(runDir, "limitations.md");
+                    if (existsSync(fallback)) {
+                        try {
+                            const content = await readFile(fallback, "utf8");
+                            if (content.trim().length > 0)
+                                hasLimitations = true;
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                if (!hasLimitations)
+                    markMissing("limitations");
+            }
+            // ── replay-or-inspect check ─────────────────────────────────
+            {
+                let hasReplayOrInspect = false;
+                if (isObject(bundle) && isObject(bundle.files)) {
+                    const replayPath = bundle.files.replay;
+                    const inspectPath = bundle.files.inspectJson;
+                    for (const p of [replayPath, inspectPath]) {
+                        if (isNonEmptyString(p)) {
+                            const resolved = resolveRepoPath(p);
+                            if (resolved && existsSync(resolved)) {
+                                hasReplayOrInspect = true;
+                                break;
+                            }
+                        }
+                    }
+                }
+                if (!hasReplayOrInspect) {
+                    if (existsSync(join(runDir, "replay.json")) || existsSync(join(runDir, "inspect.json"))) {
+                        hasReplayOrInspect = true;
+                    }
+                }
+                if (!hasReplayOrInspect)
+                    markMissing("replay");
+            }
+            // ── compute trust score ─────────────────────────────────────
+            const missingSet = new Set(missingFields);
+            let trustScore = 0;
+            for (const [key, weight] of Object.entries(WEIGHTS)) {
+                if (!missingSet.has(FIELD_TO_MISSING[key])) {
+                    trustScore += weight;
+                }
+            }
+            return {
+                trustScore: Math.round(trustScore * 100) / 100,
+                missingFields: Object.freeze(missingFields),
+            };
+        },
+    };
+}

package/dist/evidence/regression-proof-matrix.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Regression Proof Matrix — Algorithm 9
+ *
+ * Verifies that Algorithms 1~8 are alive via tests, proof bundles,
+ * decision traces, and CLI surfaces.
+ */
+import type { ProofTrustResult } from "./proof-trust.js";
+/** Specification for a single algorithm in the regression matrix. */
+export interface AlgorithmSpec {
+    readonly name: string;
+    readonly tests: number;
+    readonly proofBundles: number;
+    readonly decisionTraces: number;
+    readonly cliSurface: "reachable" | "unreachable";
+}
+/** Release candidate global gate inputs. */
+export interface ReleaseCandidate {
+    readonly medianProofTrust: number;
+    readonly routerShadowSafety: number;
+    readonly providerAuthorityInvariant: number;
+    readonly minimalVerifiedDemo: number;
+}
+/** Result of evaluating the regression proof matrix. */
+export interface RegressionProofMatrixResult {
+    readonly verdict: "pass" | "fail";
+    readonly coverageByAlgorithm: Readonly<Record<string, number>>;
+    readonly reasons: readonly string[];
+}
+/** Engine interface. */
+export interface RegressionProofMatrixEngine {
+    evaluate(algorithmSet: readonly AlgorithmSpec[], testSuite: {
+        readonly testsByAlgorithm: Readonly<Record<string, number>>;
+    }, proofBundles: ReadonlyArray<Readonly<{
+        algorithm: string;
+    } & Partial<ProofTrustResult>>>, releaseCandidate: ReleaseCandidate): RegressionProofMatrixResult;
+}
+/** Optional configuration for the engine factory. */
+export interface RegressionProofMatrixOptions {
+    readonly coverageThreshold?: number;
+    readonly proofTrustThreshold?: number;
+}
+export declare function createRegressionProofMatrixEngine(options?: RegressionProofMatrixOptions): RegressionProofMatrixEngine;

package/dist/evidence/regression-proof-matrix.js

@@ -0,0 +1,72 @@
+/**
+ * Regression Proof Matrix — Algorithm 9
+ *
+ * Verifies that Algorithms 1~8 are alive via tests, proof bundles,
+ * decision traces, and CLI surfaces.
+ */
+import { TAU_EVIDENCE } from "../runtime/contracts/weakness-remediation.js";
+// ─── Constants ─────────────────────────────────────────────────────────────
+const DEFAULT_COVERAGE_THRESHOLD = TAU_EVIDENCE; // 0.75
+const DEFAULT_PROOF_TRUST_THRESHOLD = TAU_EVIDENCE; // 0.75
+// ─── Factory ───────────────────────────────────────────────────────────────
+export function createRegressionProofMatrixEngine(options) {
+    const coverageThreshold = options?.coverageThreshold ?? DEFAULT_COVERAGE_THRESHOLD;
+    const proofTrustThreshold = options?.proofTrustThreshold ?? DEFAULT_PROOF_TRUST_THRESHOLD;
+    return {
+        evaluate(algorithmSet, testSuite, proofBundles, releaseCandidate) {
+            const reasons = [];
+            const coverageByAlgorithm = {};
+            // Compute median proof trust from proof bundle scores when available
+            const proofTrustScores = [];
+            for (const pb of proofBundles) {
+                if (typeof pb.trustScore === "number") {
+                    proofTrustScores.push(pb.trustScore);
+                }
+            }
+            // Evaluate each algorithm using algorithmSet directly
+            for (const alg of algorithmSet) {
+                const coverage = 0.35 * (alg.tests > 0 ? 1 : 0) +
+                    0.30 * (alg.proofBundles > 0 ? 1 : 0) +
+                    0.20 * (alg.decisionTraces > 0 ? 1 : 0) +
+                    0.15 * (alg.cliSurface === "reachable" ? 1 : 0);
+                coverageByAlgorithm[alg.name] = Math.round(coverage * 100) / 100;
+                if (coverage < coverageThreshold) {
+                    reasons.push(`Algorithm "${alg.name}" coverage ${coverage.toFixed(2)} < threshold ${coverageThreshold}`);
+                }
+            }
+            // Global gates
+            const medianProofTrust = proofTrustScores.length > 0
+                ? computeMedian(proofTrustScores)
+                : releaseCandidate.medianProofTrust;
+            if (medianProofTrust < proofTrustThreshold) {
+                reasons.push(`medianProofTrust ${medianProofTrust.toFixed(2)} < threshold ${proofTrustThreshold}`);
+            }
+            if (releaseCandidate.routerShadowSafety !== 1) {
+                reasons.push(`routerShadowSafety ${releaseCandidate.routerShadowSafety} !== 1`);
+            }
+            if (releaseCandidate.providerAuthorityInvariant !== 1) {
+                reasons.push(`providerAuthorityInvariant ${releaseCandidate.providerAuthorityInvariant} !== 1`);
+            }
+            if (releaseCandidate.minimalVerifiedDemo !== 1) {
+                reasons.push(`minimalVerifiedDemo ${releaseCandidate.minimalVerifiedDemo} !== 1`);
+            }
+            const verdict = reasons.length === 0 ? "pass" : "fail";
+            return {
+                verdict,
+                coverageByAlgorithm: Object.freeze(coverageByAlgorithm),
+                reasons: Object.freeze(reasons),
+            };
+        },
+    };
+}
+// ─── Helpers ───────────────────────────────────────────────────────────────
+function computeMedian(values) {
+    if (values.length === 0)
+        return 0;
+    const sorted = [...values].sort((a, b) => a - b);
+    const mid = Math.floor(sorted.length / 2);
+    if (sorted.length % 2 === 0) {
+        return (sorted[mid - 1] + sorted[mid]) / 2;
+    }
+    return sorted[mid];
+}

package/dist/goal/intent-frame.d.ts

@@ -57,3 +57,9 @@ export declare function evaluatePromptNovelty(input: {
     action: NextAction;
     targetAtomId?: string;
 }): PromptNoveltyReport;
+/**
+ * Redact high-confidence secrets from free text while preserving layout
+ * (no normalization). Use before persisting or echoing prompts/answers so
+ * tokens never land in interview artifacts, GoalSpec fields, or --json output.
+ */
+export declare function redactSecretText(text: string): string;

package/dist/goal/intent-frame.js

@@ -176,20 +176,32 @@ export function evaluatePromptNovelty(input) {
         targetAtomId,
     };
 }
+const SECRET_REDACTION_PATTERNS = [
+    { name: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "Bearer [REDACTED_TOKEN]" },
+    { name: "openai-key", pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[REDACTED_API_KEY]" },
+    { name: "github-token", pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{16,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
+    { name: "aws-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
+    { name: "env-secret", pattern: /\b[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)\s*=\s*[^\s`'"]{6,}/g, replacement: "[REDACTED_ENV_SECRET]" },
+    { name: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
+];
+/**
+ * Redact high-confidence secrets from free text while preserving layout
+ * (no normalization). Use before persisting or echoing prompts/answers so
+ * tokens never land in interview artifacts, GoalSpec fields, or --json output.
+ */
+export function redactSecretText(text) {
+    let redacted = text;
+    for (const item of SECRET_REDACTION_PATTERNS) {
+        redacted = redacted.replace(item.pattern, item.replacement);
+    }
+    return redacted;
+}
 function sanitizePrompt(rawPrompt) {
     const normalized = normalizeText(rawPrompt);
-    const patterns = [
-        { name: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "Bearer [REDACTED_TOKEN]" },
-        { name: "openai-key", pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[REDACTED_API_KEY]" },
-        { name: "github-token", pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{16,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
-        { name: "aws-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
-        { name: "env-secret", pattern: /\b[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)\s*=\s*[^\s`'"]{6,}/g, replacement: "[REDACTED_ENV_SECRET]" },
-        { name: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
-    ];
     let redacted = normalized;
     let redactionCount = 0;
     const diagnostics = [];
-    for (const item of patterns) {
+    for (const item of SECRET_REDACTION_PATTERNS) {
         let count = 0;
         redacted = redacted.replace(item.pattern, () => {
             count += 1;

package/dist/goal/interview-assimilation.d.ts

@@ -0,0 +1,13 @@
+import type { GoalSpec } from "../contracts/goal.js";
+import type { InterviewAnswer, InterviewApplyResult, InterviewFinding, InterviewQuestion, InterviewSeed, InterviewSpecDelta } from "../contracts/interview.js";
+export declare function assimilateAnswers(input: {
+    seed: InterviewSeed;
+    questions: InterviewQuestion[];
+    answers: InterviewAnswer[];
+    goal?: GoalSpec;
+}): {
+    findings: InterviewFinding[];
+    specDelta: InterviewSpecDelta;
+    contradictions: string[];
+};
+export declare function applyInterviewDelta(goal: GoalSpec, delta: InterviewSpecDelta): InterviewApplyResult;