oxe-cc 1.0.0 → 1.3.0

package/lib/runtime/verification/verification-compiler.js

@@ -6,9 +6,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.compile = compile;
 exports.runCheck = runCheck;
 exports.runSuite = runSuite;
+exports.executeSuite = executeSuite;
 exports.summarizeSuite = summarizeSuite;
+exports.verifyRun = verifyRun;
 const crypto_1 = __importDefault(require("crypto"));
 const child_process_1 = require("child_process");
+const verification_manifest_1 = require("./verification-manifest");
 function inferCheckType(howToVerify) {
     const v = howToVerify.toLowerCase();
     if (v.includes('npm test') || v.includes('jest') || v.includes('vitest') || v.includes('node --test'))
@@ -132,12 +135,125 @@ async function runSuite(suite, cwd, timeoutMs = 60000) {
     }
     return results;
 }
+async function executeSuite(suite, cwd, options) {
+    const results = [];
+    const verificationResults = [];
+    const evidenceRefs = new Map();
+    const timeoutMs = options.timeoutMs ?? 60000;
+    const attemptNumber = options.attemptNumber ?? 1;
+    for (const check of suite.checks) {
+        const provider = options.pluginRegistry?.verifierProviderFor(check.type);
+        let result;
+        let verificationResult;
+        if (provider) {
+            const providerResult = await provider.execute({
+                check_id: check.id,
+                check_type: check.type,
+                command: check.command,
+                work_item_id: options.workItemId,
+                workspace_root: cwd,
+                evidence_dir: '',
+            });
+            result = {
+                check_id: check.id,
+                acceptance_ref: check.acceptance_ref,
+                status: providerResult.status,
+                stdout: providerResult.summary ?? '',
+                stderr: '',
+                exit_code: providerResult.status === 'pass' ? 0 : 1,
+                duration_ms: 0,
+                error: providerResult.status === 'error' ? providerResult.summary ?? 'provider error' : null,
+                evidence_refs: providerResult.evidence_refs,
+            };
+            verificationResult = providerResult;
+        }
+        else {
+            result = await runCheck(check, cwd, timeoutMs);
+            const collectedEvidence = options.evidenceStore
+                ? await collectCheckEvidence(options.evidenceStore, check, result, {
+                    run_id: options.runId,
+                    work_item_id: options.workItemId,
+                    attempt_number: attemptNumber,
+                })
+                : [];
+            result.evidence_refs = collectedEvidence;
+            verificationResult = {
+                verification_id: `vr-${crypto_1.default.randomBytes(4).toString('hex')}`,
+                work_item_id: options.workItemId,
+                check_id: check.id,
+                status: result.status,
+                evidence_refs: collectedEvidence,
+                summary: result.error || result.stderr || result.stdout || null,
+            };
+        }
+        if (result.evidence_refs && result.evidence_refs.length > 0) {
+            evidenceRefs.set(check.id, result.evidence_refs);
+        }
+        results.push(result);
+        verificationResults.push(verificationResult);
+    }
+    const manifest = (0, verification_manifest_1.buildManifest)(options.runId, results, {
+        workItemId: options.workItemId,
+        granularity: 'work_item',
+        evidenceRefs,
+    });
+    const riskLedger = (0, verification_manifest_1.buildRiskLedger)(options.runId, manifest);
+    const evidenceCoverage = (0, verification_manifest_1.summarizeEvidenceCoverage)(manifest);
+    return {
+        results,
+        verification_results: verificationResults,
+        evidence_refs: evidenceRefs,
+        manifest,
+        risk_ledger: riskLedger,
+        evidence_coverage: evidenceCoverage,
+    };
+}
 function summarizeSuite(results) {
     const counts = { total: results.length, pass: 0, fail: 0, skip: 0, error: 0 };
     for (const r of results)
         counts[r.status]++;
     return { ...counts, allPassed: counts.fail === 0 && counts.error === 0 };
 }
+async function verifyRun(input) {
+    const gaps = [];
+    if (!input.suite || !Array.isArray(input.suite.checks) || input.suite.checks.length === 0) {
+        gaps.push('Nenhum check executável foi compilado a partir de SPEC/PLAN.');
+        return {
+            status: 'partial',
+            suite: input.suite,
+            executed: null,
+            gaps,
+            verification_results: [],
+            check_results: [],
+            manifest: null,
+            risk_ledger: null,
+            evidence_coverage: null,
+        };
+    }
+    const executed = await executeSuite(input.suite, input.cwd, {
+        timeoutMs: input.timeoutMs,
+        runId: input.runId,
+        workItemId: input.workItemId,
+        attemptNumber: input.attemptNumber,
+        evidenceStore: input.evidenceStore,
+        pluginRegistry: input.pluginRegistry,
+    });
+    (0, verification_manifest_1.saveManifest)(input.projectRoot, input.runId, executed.manifest);
+    (0, verification_manifest_1.saveRiskLedger)(input.projectRoot, input.runId, executed.risk_ledger);
+    (0, verification_manifest_1.saveEvidenceCoverage)(input.projectRoot, input.runId, executed.evidence_coverage);
+    const summary = summarizeSuite(executed.results);
+    return {
+        status: summary.total === 0 ? 'partial' : summary.allPassed ? 'passed' : 'failed',
+        suite: input.suite,
+        executed,
+        gaps,
+        verification_results: executed.verification_results,
+        check_results: executed.results,
+        manifest: executed.manifest,
+        risk_ledger: executed.risk_ledger,
+        evidence_coverage: executed.evidence_coverage,
+    };
+}
 function hashObject(obj) {
     return crypto_1.default
         .createHash('sha256')
@@ -145,3 +261,24 @@ function hashObject(obj) {
         .digest('hex')
         .slice(0, 12);
 }
+async function collectCheckEvidence(store, check, result, options) {
+    const refs = [];
+    if (result.stdout) {
+        const evidence = await store.collect('stdout', result.stdout, options);
+        refs.push(evidence.evidence_id);
+    }
+    if (result.stderr) {
+        const evidence = await store.collect('stderr', result.stderr, options);
+        refs.push(evidence.evidence_id);
+    }
+    const summaryEvidence = await store.collect(check.evidence_type_expected, JSON.stringify({
+        check_id: check.id,
+        type: check.type,
+        command: check.command,
+        status: result.status,
+        exit_code: result.exit_code,
+        duration_ms: result.duration_ms,
+    }, null, 2), options);
+    refs.push(summaryEvidence.evidence_id);
+    return refs;
+}

package/lib/runtime/verification/verification-manifest.d.ts

@@ -0,0 +1,67 @@
+import type { VerificationStatus } from '../models/verification-result';
+import type { CheckResult } from './verification-compiler';
+export type VerificationProfile = 'quick' | 'standard' | 'critical';
+export type FailureClass = 'deterministic' | 'flaky' | 'timeout' | 'env_setup' | 'policy_failure' | 'evidence_missing';
+export type VerificationGranularity = 'work_item' | 'wave' | 'run';
+export interface ManifestCheck {
+    check_id: string;
+    acceptance_ref: string | null;
+    status: VerificationStatus;
+    failure_class: FailureClass | null;
+    evidence_refs: string[];
+    duration_ms: number;
+}
+export interface VerificationManifest {
+    manifest_id: string;
+    run_id: string;
+    work_item_id: string | null;
+    wave: number | null;
+    granularity: VerificationGranularity;
+    profile: VerificationProfile;
+    compiled_at: string;
+    checks: ManifestCheck[];
+    summary: {
+        total: number;
+        pass: number;
+        fail: number;
+        skip: number;
+        error: number;
+        all_passed: boolean;
+    };
+}
+export interface ResidualRisk {
+    risk_id: string;
+    work_item_id: string | null;
+    check_id: string | null;
+    failure_class: FailureClass;
+    description: string;
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    mitigation: string | null;
+}
+export interface ResidualRiskLedger {
+    run_id: string;
+    generated_at: string;
+    risks: ResidualRisk[];
+}
+export interface EvidenceCoverageSummary {
+    total_checks: number;
+    checks_with_evidence: number;
+    total_evidence_refs: number;
+    coverage_percent: number;
+}
+export declare function classifyFailure(result: CheckResult): FailureClass | null;
+export declare function buildManifest(runId: string, results: CheckResult[], options?: {
+    workItemId?: string;
+    wave?: number;
+    granularity?: VerificationGranularity;
+    profile?: VerificationProfile;
+    evidenceRefs?: Map<string, string[]>;
+}): VerificationManifest;
+export declare function buildRiskLedger(runId: string, manifest: VerificationManifest): ResidualRiskLedger;
+export declare function summarizeEvidenceCoverage(manifest: VerificationManifest): EvidenceCoverageSummary;
+export declare function saveManifest(projectRoot: string, runId: string, manifest: VerificationManifest): void;
+export declare function loadManifest(projectRoot: string, runId: string): VerificationManifest | null;
+export declare function saveRiskLedger(projectRoot: string, runId: string, ledger: ResidualRiskLedger): void;
+export declare function loadRiskLedger(projectRoot: string, runId: string): ResidualRiskLedger | null;
+export declare function saveEvidenceCoverage(projectRoot: string, runId: string, coverage: EvidenceCoverageSummary): void;
+export declare function loadEvidenceCoverage(projectRoot: string, runId: string): EvidenceCoverageSummary | null;

package/lib/runtime/verification/verification-manifest.js

@@ -0,0 +1,179 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyFailure = classifyFailure;
+exports.buildManifest = buildManifest;
+exports.buildRiskLedger = buildRiskLedger;
+exports.summarizeEvidenceCoverage = summarizeEvidenceCoverage;
+exports.saveManifest = saveManifest;
+exports.loadManifest = loadManifest;
+exports.saveRiskLedger = saveRiskLedger;
+exports.loadRiskLedger = loadRiskLedger;
+exports.saveEvidenceCoverage = saveEvidenceCoverage;
+exports.loadEvidenceCoverage = loadEvidenceCoverage;
+const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+function runDir(projectRoot, runId) {
+    return path_1.default.join(projectRoot, '.oxe', 'runs', runId);
+}
+function manifestPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'verification-manifest.json');
+}
+function riskLedgerPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'residual-risk-ledger.json');
+}
+function legacyRiskLedgerPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'residual-risks.json');
+}
+function evidenceCoveragePath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'evidence-coverage.json');
+}
+const PROFILE_REQUIRED_CHECKS = {
+    quick: ['deterministic'],
+    standard: ['deterministic', 'policy_failure'],
+    critical: ['deterministic', 'policy_failure', 'evidence_missing', 'flaky'],
+};
+function classifyFailure(result) {
+    if (result.status === 'pass' || result.status === 'skip')
+        return null;
+    if (result.error && (result.error.toLowerCase().includes('timeout') || result.error.toLowerCase().includes('timed out')))
+        return 'timeout';
+    if (result.exit_code === null && result.error)
+        return 'env_setup';
+    if (result.stderr.toLowerCase().includes('policy') || result.stderr.toLowerCase().includes('denied')) {
+        return 'policy_failure';
+    }
+    if (result.exit_code !== 0 && result.stderr === '' && result.stdout === '')
+        return 'evidence_missing';
+    // Default: non-deterministic signals (no reliable exit code pattern)
+    return 'deterministic';
+}
+function buildManifest(runId, results, options = {}) {
+    const profile = options.profile ?? 'standard';
+    const granularity = options.granularity ?? 'run';
+    const evidenceRefs = options.evidenceRefs ?? new Map();
+    const checks = results.map((r) => ({
+        check_id: r.check_id,
+        acceptance_ref: r.acceptance_ref,
+        status: r.status,
+        failure_class: classifyFailure(r),
+        evidence_refs: evidenceRefs.get(r.check_id) ?? [],
+        duration_ms: r.duration_ms,
+    }));
+    const summary = {
+        total: checks.length,
+        pass: checks.filter((c) => c.status === 'pass').length,
+        fail: checks.filter((c) => c.status === 'fail').length,
+        skip: checks.filter((c) => c.status === 'skip').length,
+        error: checks.filter((c) => c.status === 'error').length,
+        all_passed: checks.every((c) => c.status === 'pass' || c.status === 'skip'),
+    };
+    return {
+        manifest_id: `vm-${crypto_1.default.randomBytes(4).toString('hex')}`,
+        run_id: runId,
+        work_item_id: options.workItemId ?? null,
+        wave: options.wave ?? null,
+        granularity,
+        profile,
+        compiled_at: new Date().toISOString(),
+        checks,
+        summary,
+    };
+}
+function buildRiskLedger(runId, manifest) {
+    const risks = [];
+    for (const check of manifest.checks) {
+        if (check.status === 'pass' || check.status === 'skip')
+            continue;
+        if (!check.failure_class)
+            continue;
+        const required = PROFILE_REQUIRED_CHECKS[manifest.profile];
+        if (!required.includes(check.failure_class))
+            continue;
+        risks.push({
+            risk_id: `risk-${crypto_1.default.randomBytes(3).toString('hex')}`,
+            work_item_id: manifest.work_item_id,
+            check_id: check.check_id,
+            failure_class: check.failure_class,
+            description: `Check ${check.check_id} ${check.status}: ${check.failure_class}`,
+            severity: check.failure_class === 'policy_failure' || check.failure_class === 'deterministic'
+                ? 'high'
+                : check.failure_class === 'evidence_missing'
+                    ? 'medium'
+                    : 'low',
+            mitigation: null,
+        });
+    }
+    return {
+        run_id: runId,
+        generated_at: new Date().toISOString(),
+        risks,
+    };
+}
+function summarizeEvidenceCoverage(manifest) {
+    const totalChecks = manifest.checks.length;
+    const checksWithEvidence = manifest.checks.filter((check) => check.evidence_refs.length > 0).length;
+    const totalEvidenceRefs = manifest.checks.reduce((sum, check) => sum + check.evidence_refs.length, 0);
+    const coveragePercent = totalChecks === 0 ? 100 : Math.round((checksWithEvidence / totalChecks) * 100);
+    return {
+        total_checks: totalChecks,
+        checks_with_evidence: checksWithEvidence,
+        total_evidence_refs: totalEvidenceRefs,
+        coverage_percent: coveragePercent,
+    };
+}
+function saveManifest(projectRoot, runId, manifest) {
+    const p = manifestPath(projectRoot, runId);
+    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+    fs_1.default.writeFileSync(p, JSON.stringify(manifest, null, 2), 'utf8');
+}
+function loadManifest(projectRoot, runId) {
+    const p = manifestPath(projectRoot, runId);
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveRiskLedger(projectRoot, runId, ledger) {
+    const canonical = riskLedgerPath(projectRoot, runId);
+    const legacy = legacyRiskLedgerPath(projectRoot, runId);
+    fs_1.default.mkdirSync(path_1.default.dirname(canonical), { recursive: true });
+    fs_1.default.writeFileSync(canonical, JSON.stringify(ledger, null, 2), 'utf8');
+    fs_1.default.writeFileSync(legacy, JSON.stringify(ledger, null, 2), 'utf8');
+}
+function loadRiskLedger(projectRoot, runId) {
+    const canonical = riskLedgerPath(projectRoot, runId);
+    const legacy = legacyRiskLedgerPath(projectRoot, runId);
+    const p = fs_1.default.existsSync(canonical) ? canonical : legacy;
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveEvidenceCoverage(projectRoot, runId, coverage) {
+    const p = evidenceCoveragePath(projectRoot, runId);
+    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+    fs_1.default.writeFileSync(p, JSON.stringify(coverage, null, 2), 'utf8');
+}
+function loadEvidenceCoverage(projectRoot, runId) {
+    const p = evidenceCoveragePath(projectRoot, runId);
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}

package/lib/runtime/workspace/strategies/ephemeral-container.d.ts

@@ -14,6 +14,7 @@ export declare class EphemeralContainerManager implements WorkspaceManager {
     private containerIds;
     private useFallback;
     constructor(projectRoot: string, opts?: ContainerOptions);
+    get isolation_level(): 'shared' | 'isolated';
     get usingFallback(): boolean;
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;

package/lib/runtime/workspace/strategies/ephemeral-container.js

@@ -30,6 +30,9 @@ class EphemeralContainerManager {
             }
         }
     }
+    get isolation_level() {
+        return this.useFallback ? this.fallbackManager.isolation_level : 'isolated';
+    }
     get usingFallback() { return this.useFallback; }
     async allocate(req) {
         if (this.useFallback)
@@ -56,6 +59,7 @@ class EphemeralContainerManager {
         return {
             workspace_id: wsId,
             strategy: 'ephemeral_container',
+            isolation_level: this.isolation_level,
             branch: null,
             base_commit: null,
             root_path: `docker:${containerId}:${this.opts.mountPath}`,

package/lib/runtime/workspace/strategies/git-worktree.d.ts

@@ -2,6 +2,7 @@ import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
 import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
 export declare class GitWorktreeManager implements WorkspaceManager {
     private readonly projectRoot;
+    readonly isolation_level: "isolated";
     private leases;
     constructor(projectRoot: string);
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;

package/lib/runtime/workspace/strategies/git-worktree.js

@@ -11,6 +11,7 @@ const crypto_1 = __importDefault(require("crypto"));
 class GitWorktreeManager {
     constructor(projectRoot) {
         this.projectRoot = projectRoot;
+        this.isolation_level = 'isolated';
         this.leases = new Map();
     }
     async allocate(req) {
@@ -24,6 +25,7 @@ class GitWorktreeManager {
         const lease = {
             workspace_id: wsId,
             strategy: 'git_worktree',
+            isolation_level: this.isolation_level,
             branch,
             base_commit: baseCommit,
             root_path: worktreePath,

package/lib/runtime/workspace/strategies/inplace.d.ts

@@ -2,6 +2,7 @@ import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
 import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
 export declare class InplaceWorkspaceManager implements WorkspaceManager {
     private readonly projectRoot;
+    readonly isolation_level: "shared";
     constructor(projectRoot: string);
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;

package/lib/runtime/workspace/strategies/inplace.js

@@ -8,11 +8,13 @@ const crypto_1 = __importDefault(require("crypto"));
 class InplaceWorkspaceManager {
     constructor(projectRoot) {
         this.projectRoot = projectRoot;
+        this.isolation_level = 'shared';
     }
     async allocate(req) {
         return {
             workspace_id: `ws-inplace-${req.work_item_id}-a${req.attempt_number}`,
             strategy: 'inplace',
+            isolation_level: this.isolation_level,
             branch: null,
             base_commit: null,
             root_path: this.projectRoot,

package/lib/runtime/workspace/workspace-manager.d.ts

@@ -1,4 +1,4 @@
-import type { WorkspaceLease, SnapshotRef, WorkspaceStrategy } from '../models/workspace';
+import type { WorkspaceLease, SnapshotRef, WorkspaceStrategy, WorkspaceIsolationLevel } from '../models/workspace';
 export interface WorkspaceRequest {
     work_item_id: string;
     attempt_number: number;
@@ -6,6 +6,7 @@ export interface WorkspaceRequest {
     mutation_scope: string[];
 }
 export interface WorkspaceManager {
+    readonly isolation_level: WorkspaceIsolationLevel;
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;
     reset(id: string, snapRef: SnapshotRef): Promise<void>;

package/lib/sdk/README.md

@@ -47,21 +47,21 @@ const { options, warnings: w } = oxe.install.resolveOptionsFromConfig(dir, {
 | **health** | `loadOxeConfigMerged`, `validateConfigShape`, `buildHealthReport`, `suggestNextStep`, `oxePaths`, constantes de config |
 | **workflows** | `resolveWorkflowsDir`, `listWorkflowMdFiles`, `diffWorkflows`, `validateWorkflowShapes` (avisos `WORKFLOW_SHAPE`) |
 | **install** | `resolveOptionsFromConfig` |
-| **manifest** | `loadFileManifest`, `writeFileManifest`, `sha256File`, `collectFilesRecursive` |
-| **agents** | `adjustWorkflowPathsForNestedLayout`, `parseCursorCommandFrontmatter` |
-| **azure** | `azurePaths`, `detectAzureCli`, `loadAzureProfile`, `syncAzureInventory`, `planAzureOperation`, `applyAzureOperation`, `azureDoctor` |
-| **doctor** | `runDoctorChecks` — resultado estruturado (erros + avisos + diff de workflows + `workflowShape` com lint leve dos `.md`) |
+| **manifest** | `loadFileManifest`, `writeFileManifest`, `sha256File`, `collectFilesRecursive` |
+| **agents** | `adjustWorkflowPathsForNestedLayout`, `parseCursorCommandFrontmatter` |
+| **azure** | `azurePaths`, `detectAzureCli`, `loadAzureProfile`, `syncAzureInventory`, `planAzureOperation`, `applyAzureOperation`, `azureDoctor` |
+| **doctor** | `runDoctorChecks` — resultado estruturado (erros + avisos + diff de workflows + `workflowShape` com lint leve dos `.md`) |
 
 TypeScript: ver `index.d.ts` junto deste ficheiro.
 
 ## `health.buildHealthReport` e `parseLastCompactDate`
 
 - **`parseLastCompactDate(stateText)`** — lê a data em **`.oxe/STATE.md`** na secção **Último compact** (mesma convenção que **Último scan**). Devolve `Date | null` se a linha for placeholder ou ilegível.
-- **`buildHealthReport(projectRoot)`** — agrega fase, datas, avisos de SPEC/PLAN/VERIFY e o próximo passo sugerido. Campos usados em CI e em `oxe-cc status --json`:
-  - **`scanDate`**, **`stale`** — último scan e idade face a `scan_max_age_days` (`stale: { stale, days }`).
-  - **`compactDate`**, **`staleCompact`** — último compact e idade face a `compact_max_age_days`.
-  - **`azureActive`**, **`azure`** — contexto Azure resolvido, inventário materializado, warnings e pendências do provider.
-  - **`next`** — `{ step, cursorCmd, reason, artifacts }` (espelha a lógica de `suggestNextStep`).
+- **`buildHealthReport(projectRoot)`** — agrega fase, datas, avisos de SPEC/PLAN/VERIFY e o próximo passo sugerido. Campos usados em CI e em `oxe-cc status --json`:
+  - **`scanDate`**, **`stale`** — último scan e idade face a `scan_max_age_days` (`stale: { stale, days }`).
+  - **`compactDate`**, **`staleCompact`** — último compact e idade face a `compact_max_age_days`.
+  - **`azureActive`**, **`azure`** — contexto Azure resolvido, inventário materializado, warnings e pendências do provider.
+  - **`next`** — `{ step, cursorCmd, reason, artifacts }` (espelha a lógica de `suggestNextStep`).
 
 ## `runDoctorChecks` e relatório de saúde
 

package/lib/sdk/index.cjs

@@ -648,22 +648,31 @@ module.exports = {
     operationalPaths: operational.operationalPaths,
     appendEvent: operational.appendEvent,
     readEvents: operational.readEvents,
-    summarizeEvents: operational.summarizeEvents,
-    writeRunState: operational.writeRunState,
-    readRunState: operational.readRunState,
-    buildOperationalGraph: operational.buildOperationalGraph,
-    serializeCanonicalState: operational.serializeCanonicalState,
-    hydrateCanonicalState: operational.hydrateCanonicalState,
-    reduceCanonicalRunState: operational.reduceCanonicalRunState,
-    compileExecutionGraphFromArtifacts: operational.compileExecutionGraphFromArtifacts,
-    compileVerificationSuiteFromArtifacts: operational.compileVerificationSuiteFromArtifacts,
-    projectRuntimeArtifacts: operational.projectRuntimeArtifacts,
-    runRuntimeCiChecks: operational.runRuntimeCiChecks,
-    applyRuntimeAction: operational.applyRuntimeAction,
-    parseCapabilityManifest: operational.parseCapabilityManifest,
-    readCapabilityCatalog: operational.readCapabilityCatalog,
+    summarizeEvents: operational.summarizeEvents,
+    writeRunState: operational.writeRunState,
+    readRunState: operational.readRunState,
+    buildOperationalGraph: operational.buildOperationalGraph,
+    serializeCanonicalState: operational.serializeCanonicalState,
+    hydrateCanonicalState: operational.hydrateCanonicalState,
+    reduceCanonicalRunState: operational.reduceCanonicalRunState,
+    compileExecutionGraphFromArtifacts: operational.compileExecutionGraphFromArtifacts,
+    compileVerificationSuiteFromArtifacts: operational.compileVerificationSuiteFromArtifacts,
+    projectRuntimeArtifacts: operational.projectRuntimeArtifacts,
+    runRuntimeCiChecks: operational.runRuntimeCiChecks,
+    buildRuntimePluginRegistry: operational.buildRuntimePluginRegistry,
+    readRuntimeGates: operational.readRuntimeGates,
+    resolveRuntimeGate: operational.resolveRuntimeGate,
+    runRuntimeVerify: operational.runRuntimeVerify,
+    runRuntimePromotion: operational.runRuntimePromotion,
+    recoverRuntimeState: operational.recoverRuntimeState,
+    applyRuntimeAction: operational.applyRuntimeAction,
+    parseCapabilityManifest: operational.parseCapabilityManifest,
+    readCapabilityCatalog: operational.readCapabilityCatalog,
     buildMemoryLayers: operational.buildMemoryLayers,
     replayEvents: operational.replayEvents,
+    replayRuntimeState: operational.replayRuntimeState,
+    readRuntimeMultiAgentStatus: operational.readRuntimeMultiAgentStatus,
+    multiAgentStatus: operational.readRuntimeMultiAgentStatus,
   },
 
   /** Context Engine V2: seleção, compressão e inspeção determinística de artefatos. */
@@ -742,13 +751,13 @@ module.exports = {
   /** Um único objeto com verificações tipo `doctor` + relatório de saúde. */
   runDoctorChecks,
 };
-
-
-// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
-// The compiled runtime lives at lib/runtime/ alongside this file.
-try {
-  const runtime = require('../runtime/index.js');
-  Object.assign(module.exports, runtime);
-} catch {
-  // Runtime not built yet — safe to skip during development
-}
+
+
+// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
+// The compiled runtime lives at lib/runtime/ alongside this file.
+try {
+  const runtime = require('../runtime/index.js');
+  Object.assign(module.exports, runtime);
+} catch {
+  // Runtime not built yet — safe to skip during development
+}