oxe-cc 1.2.1 → 1.3.0

package/lib/runtime/scheduler/scheduler.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Scheduler = void 0;
 const bus_1 = require("../events/bus");
+const policy_engine_1 = require("../policy/policy-engine");
+const audit_trail_1 = require("../audit/audit-trail");
 const run_journal_1 = require("./run-journal");
 class Scheduler {
     constructor() {
@@ -23,6 +25,10 @@ class Scheduler {
         this.journal = (0, run_journal_1.createJournal)(ctx.runId);
         (0, run_journal_1.saveJournal)(ctx.projectRoot, ctx.runId, this.journal);
         this.emit(ctx, { type: 'RunStarted', payload: { run_id: ctx.runId } });
+        ctx.auditTrail?.record('run_started', ctx.policyActor ?? 'runtime', {
+            runId: ctx.runId,
+            detail: { session_id: ctx.sessionId ?? null },
+        });
         for (const wave of graph.waves) {
             if (this.cancelled)
                 break;
@@ -35,7 +41,11 @@ class Scheduler {
                 this.journal.blocked_work_items = blocked.slice();
                 this.journal.partial_result = { run_id: ctx.runId, completed, failed, blocked };
                 (0, run_journal_1.saveJournal)(ctx.projectRoot, ctx.runId, this.journal);
-                return { run_id: ctx.runId, status: 'paused', completed, failed, blocked };
+                ctx.auditTrail?.record('run_paused', ctx.policyActor ?? 'runtime', {
+                    runId: ctx.runId,
+                    detail: { completed, failed, blocked },
+                });
+                return { run_id: ctx.runId, status: 'paused', completed, failed, blocked, pending_gates: this.journal.pending_gates.slice() };
             }
             const waveFailed = await this.runWave(wave.node_ids, graph, ctx, status, completed, failed, blocked);
             // Sync journal after each wave
@@ -62,17 +72,36 @@ class Scheduler {
             ? 'cancelled'
             : failed.length > 0
                 ? 'failed'
-                : 'completed';
+                : blocked.length > 0
+                    ? 'blocked'
+                    : 'completed';
         this.emit(ctx, {
             type: 'RunCompleted',
             payload: { run_id: ctx.runId, status: finalStatus },
         });
-        this.journal.scheduler_state = this.cancelled ? 'cancelled' : 'completed';
+        ctx.auditTrail?.record('run_completed', ctx.policyActor ?? 'runtime', {
+            runId: ctx.runId,
+            detail: {
+                status: finalStatus,
+                completed: completed.length,
+                failed: failed.length,
+                blocked: blocked.length,
+                pending_gates: this.journal.pending_gates.slice(),
+            },
+        });
+        this.journal.scheduler_state = this.cancelled ? 'cancelled' : finalStatus === 'blocked' ? 'blocked' : 'completed';
         this.journal.completed_work_items = completed.slice();
         this.journal.failed_work_items = failed.slice();
         this.journal.blocked_work_items = blocked.slice();
         (0, run_journal_1.saveJournal)(ctx.projectRoot, ctx.runId, this.journal);
-        return { run_id: ctx.runId, status: finalStatus, completed, failed, blocked };
+        return {
+            run_id: ctx.runId,
+            status: finalStatus,
+            completed,
+            failed,
+            blocked,
+            pending_gates: this.journal.pending_gates.slice(),
+        };
     }
     /**
      * Recover a previously paused run by loading its journal and re-running
@@ -117,7 +146,11 @@ class Scheduler {
                 this.journal.blocked_work_items = blocked.slice();
                 this.journal.partial_result = { run_id: ctx.runId, completed, failed, blocked };
                 (0, run_journal_1.saveJournal)(ctx.projectRoot, ctx.runId, this.journal);
-                return { run_id: ctx.runId, status: 'paused', completed, failed, blocked };
+                ctx.auditTrail?.record('run_paused', ctx.policyActor ?? 'runtime', {
+                    runId: ctx.runId,
+                    detail: { recovered: true, completed, failed, blocked },
+                });
+                return { run_id: ctx.runId, status: 'paused', completed, failed, blocked, pending_gates: this.journal.pending_gates.slice() };
             }
             // Skip waves fully completed
             const allDone = wave.node_ids.every((id) => restoredCompleted.has(id) || restoredFailed.has(id) || restoredBlocked.has(id));
@@ -146,18 +179,37 @@ class Scheduler {
             ? 'cancelled'
             : failed.length > 0
                 ? 'failed'
-                : 'completed';
+                : blocked.length > 0
+                    ? 'blocked'
+                    : 'completed';
         this.emit(ctx, {
             type: 'RunCompleted',
             payload: { run_id: ctx.runId, status: finalStatus, recovered: true },
         });
-        this.journal.scheduler_state = this.cancelled ? 'cancelled' : 'completed';
+        ctx.auditTrail?.record('run_recovered', ctx.policyActor ?? 'runtime', {
+            runId: ctx.runId,
+            detail: {
+                status: finalStatus,
+                completed: completed.length,
+                failed: failed.length,
+                blocked: blocked.length,
+                pending_gates: this.journal.pending_gates.slice(),
+            },
+        });
+        this.journal.scheduler_state = this.cancelled ? 'cancelled' : finalStatus === 'blocked' ? 'blocked' : 'completed';
         this.journal.completed_work_items = completed.slice();
         this.journal.failed_work_items = failed.slice();
         this.journal.blocked_work_items = blocked.slice();
         (0, run_journal_1.saveJournal)(ctx.projectRoot, ctx.runId, this.journal);
         (0, run_journal_1.deleteJournal)(ctx.projectRoot, ctx.runId);
-        return { run_id: ctx.runId, status: finalStatus, completed, failed, blocked };
+        return {
+            run_id: ctx.runId,
+            status: finalStatus,
+            completed,
+            failed,
+            blocked,
+            pending_gates: this.journal.pending_gates.slice(),
+        };
     }
     async runWave(nodeIds, graph, ctx, status, completed, failed, blocked) {
         const eligible = [];
@@ -189,16 +241,16 @@ class Scheduler {
         });
         const mutations = eligible.filter((id) => !readOnly.includes(id));
         if (readOnly.length > 0) {
-            await Promise.all(readOnly.map((id) => this.runNode(id, graph, ctx, status, completed, failed)));
+            await Promise.all(readOnly.map((id) => this.runNode(id, graph, ctx, status, completed, failed, blocked)));
         }
         for (const id of mutations) {
             if (this.cancelled)
                 break;
-            await this.runNode(id, graph, ctx, status, completed, failed);
+            await this.runNode(id, graph, ctx, status, completed, failed, blocked);
         }
         return failed.length > 0;
     }
-    async runNode(nodeId, graph, ctx, status, completed, failed) {
+    async runNode(nodeId, graph, ctx, status, completed, failed, blocked) {
         const node = graph.nodes.get(nodeId);
         status.set(nodeId, 'running');
         this.emit(ctx, {
@@ -209,6 +261,11 @@ class Scheduler {
         let lease = null;
         let lastResult = null;
         const maxAttempts = node.policy.max_retries + 1;
+        const quotaBlocked = this.consumeQuotaForNode(ctx, node);
+        if (quotaBlocked) {
+            this.blockNode(nodeId, ctx, status, blocked, 'quota_exceeded', quotaBlocked);
+            return;
+        }
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
             const attemptId = `${nodeId}-a${attempt}`;
             this.emit(ctx, {
@@ -218,20 +275,50 @@ class Scheduler {
                 payload: { attempt_number: attempt },
             });
             try {
+                const policyDecision = this.evaluatePolicyForNode(node, ctx);
+                if (policyDecision && !policyDecision.allowed) {
+                    this.emit(ctx, {
+                        type: 'PolicyEvaluated',
+                        work_item_id: nodeId,
+                        attempt_id: attemptId,
+                        payload: { ...policyDecision },
+                    });
+                    ctx.auditTrail?.record('policy_denied', ctx.policyActor ?? 'runtime', {
+                        runId: ctx.runId,
+                        workItemId: nodeId,
+                        detail: { reason: policyDecision.reason, rule_id: policyDecision.rule_id },
+                    });
+                    this.blockNode(nodeId, ctx, status, blocked, 'policy_denied', policyDecision.reason);
+                    return;
+                }
+                if (policyDecision) {
+                    this.emit(ctx, {
+                        type: 'PolicyEvaluated',
+                        work_item_id: nodeId,
+                        attempt_id: attemptId,
+                        payload: { ...policyDecision },
+                    });
+                }
+                if (policyDecision?.gate_required || node.policy.requires_human_approval) {
+                    const gateId = await this.requestGateForNode(node, ctx, policyDecision);
+                    this.blockNode(nodeId, ctx, status, blocked, 'pending_gate', gateId);
+                    return;
+                }
                 const wsReq = {
                     work_item_id: nodeId,
                     attempt_number: attempt,
                     strategy: node.workspace_strategy,
                     mutation_scope: node.mutation_scope,
                 };
-                lease = await ctx.workspaceManager.allocate(wsReq);
+                const workspaceManager = ctx.pluginRegistry?.workspaceProviderFor(node.workspace_strategy) ?? ctx.workspaceManager;
+                lease = await workspaceManager.allocate(wsReq);
                 this.emit(ctx, {
                     type: 'WorkspaceAllocated',
                     work_item_id: nodeId,
                     attempt_id: attemptId,
                     payload: { workspace_id: lease.workspace_id, strategy: lease.strategy },
                 });
-                lastResult = await ctx.executor.execute(node, lease, ctx.runId, attempt);
+                lastResult = await this.executeNode(node, lease, ctx, attempt, attemptId);
                 if (lastResult.success) {
                     this.emit(ctx, {
                         type: 'WorkItemCompleted',
@@ -246,6 +333,11 @@ class Scheduler {
                 if (lastResult.failure_class === 'policy')
                     break;
                 if (attempt < maxAttempts) {
+                    const retryBlocked = this.consumeRetryQuota(ctx);
+                    if (retryBlocked) {
+                        this.blockNode(nodeId, ctx, status, blocked, 'quota_exceeded', retryBlocked);
+                        return;
+                    }
                     this.emit(ctx, {
                         type: 'RetryScheduled',
                         work_item_id: nodeId,
@@ -313,6 +405,136 @@ class Scheduler {
     static loadJournal(projectRoot, runId) {
         return (0, run_journal_1.loadJournal)(projectRoot, runId);
     }
+    async executeNode(node, lease, ctx, attempt, attemptId) {
+        const primaryAction = pickPrimaryAction(node, ctx.pluginRegistry);
+        const provider = primaryAction ? ctx.pluginRegistry?.toolProviderFor(primaryAction.type) : null;
+        if (!provider || !primaryAction) {
+            return ctx.executor.execute(node, lease, ctx.runId, attempt);
+        }
+        ctx.auditTrail?.record('plugin_invoked', ctx.policyActor ?? 'runtime', {
+            runId: ctx.runId,
+            workItemId: node.id,
+            resource: provider.name,
+            detail: { action_type: primaryAction.type, attempt_id: attemptId },
+        });
+        this.emit(ctx, {
+            type: 'ToolInvoked',
+            work_item_id: node.id,
+            attempt_id: attemptId,
+            payload: { provider: provider.name, action_type: primaryAction.type },
+        });
+        const result = await provider.invoke({
+            action_type: primaryAction.type,
+            work_item_id: node.id,
+            run_id: ctx.runId,
+            attempt_id: attemptId,
+            params: {
+                command: primaryAction.command ?? null,
+                targets: primaryAction.targets ?? [],
+            },
+            workspace_root: lease.root_path,
+        });
+        this.emit(ctx, {
+            type: result.success ? 'ToolCompleted' : 'ToolFailed',
+            work_item_id: node.id,
+            attempt_id: attemptId,
+            payload: {
+                provider: provider.name,
+                action_type: primaryAction.type,
+                evidence_paths: result.evidence_paths,
+                side_effects_applied: result.side_effects_applied,
+                error: result.error ?? null,
+            },
+        });
+        return {
+            success: result.success,
+            failure_class: result.success ? null : provider.kind === 'external_operation' ? 'policy' : 'env',
+            evidence: result.evidence_paths,
+            output: result.output,
+        };
+    }
+    evaluatePolicyForNode(node, ctx) {
+        if (!ctx.policyEngine)
+            return null;
+        const primaryAction = pickPrimaryAction(node, ctx.pluginRegistry);
+        const decisionContext = {
+            tool: primaryAction?.type ?? 'custom',
+            kind: node.workspace_strategy,
+            mutation_scope: node.mutation_scope,
+            affected_paths: node.mutation_scope,
+            side_effect_class: inferSideEffectClass(node),
+            mutation_count: node.mutation_scope.length,
+            node_policy: {
+                max_retries: node.policy.max_retries,
+            },
+        };
+        const evaluated = ctx.policyEngine.evaluate(decisionContext);
+        const persisted = {
+            ...evaluated,
+            run_id: ctx.runId,
+            work_item_id: node.id,
+            action: primaryAction?.type ?? 'custom',
+            actor: ctx.policyActor ?? 'runtime',
+            override: false,
+            rationale: null,
+            context: decisionContext,
+        };
+        (0, policy_engine_1.savePolicyDecision)(ctx.projectRoot, persisted);
+        return persisted;
+    }
+    async requestGateForNode(node, ctx, decision) {
+        if (!ctx.gateManager)
+            return 'gate-missing-manager';
+        const scope = inferGateScope(node);
+        const primaryAction = pickPrimaryAction(node, ctx.pluginRegistry);
+        const gate = await ctx.gateManager.request(scope, {
+            run_id: ctx.runId,
+            work_item_id: node.id,
+            action: primaryAction?.type ?? 'custom',
+            description: `Gate required before executing ${node.id}`,
+            evidence_refs: [],
+            risks: [decision?.reason ?? 'human approval required'],
+            rationale: decision?.reason ?? 'node policy requires approval',
+            policy_decision_id: decision?.decision_id ?? null,
+        });
+        if (this.journal && !this.journal.pending_gates.includes(gate.gate_id)) {
+            this.journal.pending_gates.push(gate.gate_id);
+        }
+        ctx.auditTrail?.record('gate_requested', ctx.policyActor ?? 'runtime', {
+            runId: ctx.runId,
+            workItemId: node.id,
+            detail: { gate_id: gate.gate_id, scope: gate.scope, action: gate.action },
+        });
+        return gate.gate_id;
+    }
+    blockNode(nodeId, ctx, status, blocked, reason, detail = null) {
+        this.emit(ctx, {
+            type: 'WorkItemBlocked',
+            work_item_id: nodeId,
+            payload: { reason, detail },
+        });
+        status.set(nodeId, 'blocked');
+        if (!blocked.includes(nodeId))
+            blocked.push(nodeId);
+    }
+    consumeQuotaForNode(ctx, node) {
+        if (!ctx.quota)
+            return null;
+        let quota = (0, audit_trail_1.consumeQuota)(ctx.quota, 'work_items', 1);
+        if (node.mutation_scope.length > 0) {
+            quota = (0, audit_trail_1.consumeQuota)(quota, 'mutations', 1);
+        }
+        const violation = (0, audit_trail_1.checkQuota)(quota);
+        ctx.quota = quota;
+        return violation ? `${violation.quota_type}:${violation.consumed}/${violation.limit}` : null;
+    }
+    consumeRetryQuota(ctx) {
+        if (!ctx.quota)
+            return null;
+        ctx.quota = (0, audit_trail_1.consumeQuota)(ctx.quota, 'retries', 1);
+        const violation = (0, audit_trail_1.checkQuota)(ctx.quota);
+        return violation ? `${violation.quota_type}:${violation.consumed}/${violation.limit}` : null;
+    }
     emit(ctx, input) {
         const event = (0, bus_1.appendEvent)(ctx.projectRoot, ctx.sessionId, {
             run_id: ctx.runId,
@@ -322,3 +544,26 @@ class Scheduler {
     }
 }
 exports.Scheduler = Scheduler;
+function inferSideEffectClass(node) {
+    if (node.mutation_scope.length > 0)
+        return 'write_fs';
+    if (node.actions.some((action) => action.type === 'run_tests' || action.type === 'run_lint'))
+        return 'spawn_process';
+    return 'read_fs';
+}
+function pickPrimaryAction(node, pluginRegistry) {
+    const candidateActions = node.actions.filter((action) => action.type !== 'collect_evidence');
+    const preferredMutation = candidateActions.find((action) => action.type === 'generate_patch')
+        || candidateActions.find((action) => action.type === 'run_tests')
+        || candidateActions[0];
+    if (!pluginRegistry)
+        return preferredMutation;
+    return candidateActions.find((action) => pluginRegistry.toolProviderFor(action.type)) || preferredMutation;
+}
+function inferGateScope(node) {
+    if (node.mutation_scope.length > 0)
+        return 'critical_mutation';
+    if (node.actions.some((action) => action.type === 'collect_evidence'))
+        return 'security';
+    return 'plan_approval';
+}

package/lib/runtime/verification/verification-compiler.d.ts

@@ -1,5 +1,9 @@
 import type { EvidenceType } from '../models/evidence';
 import type { VerificationStatus } from '../models/verification-result';
+import type { VerificationResult } from '../models/verification-result';
+import type { EvidenceStore } from '../evidence/evidence-store';
+import type { PluginRegistry } from '../plugins/plugin-registry';
+import { type EvidenceCoverageSummary, type ResidualRiskLedger, type VerificationManifest } from './verification-manifest';
 export type CheckType = 'unit' | 'integration' | 'contract' | 'smoke' | 'policy' | 'security' | 'ux_snapshot' | 'performance_baseline' | 'custom';
 export interface AcceptanceCheck {
     id: string;
@@ -24,6 +28,26 @@ export interface CheckResult {
     exit_code: number | null;
     duration_ms: number;
     error: string | null;
+    evidence_refs?: string[];
+}
+export interface ExecutedVerificationSuite {
+    results: CheckResult[];
+    verification_results: VerificationResult[];
+    evidence_refs: Map<string, string[]>;
+    manifest: VerificationManifest;
+    risk_ledger: ResidualRiskLedger;
+    evidence_coverage: EvidenceCoverageSummary;
+}
+export interface VerifyRunResult {
+    status: 'passed' | 'failed' | 'partial';
+    suite: AcceptanceCheckSuite;
+    executed: ExecutedVerificationSuite | null;
+    gaps: string[];
+    verification_results: VerificationResult[];
+    check_results: CheckResult[];
+    manifest: VerificationManifest | null;
+    risk_ledger: ResidualRiskLedger | null;
+    evidence_coverage: EvidenceCoverageSummary | null;
 }
 interface Criterion {
     id: string;
@@ -45,6 +69,14 @@ interface ParsedPlanLike {
 export declare function compile(spec: ParsedSpecLike, plan: ParsedPlanLike): AcceptanceCheckSuite;
 export declare function runCheck(check: AcceptanceCheck, cwd: string, timeoutMs?: number): Promise<CheckResult>;
 export declare function runSuite(suite: AcceptanceCheckSuite, cwd: string, timeoutMs?: number): Promise<CheckResult[]>;
+export declare function executeSuite(suite: AcceptanceCheckSuite, cwd: string, options: {
+    timeoutMs?: number;
+    runId: string;
+    workItemId: string;
+    attemptNumber?: number;
+    evidenceStore?: EvidenceStore;
+    pluginRegistry?: PluginRegistry;
+}): Promise<ExecutedVerificationSuite>;
 export declare function summarizeSuite(results: CheckResult[]): {
     total: number;
     pass: number;
@@ -53,4 +85,15 @@ export declare function summarizeSuite(results: CheckResult[]): {
     error: number;
     allPassed: boolean;
 };
+export declare function verifyRun(input: {
+    projectRoot: string;
+    runId: string;
+    workItemId: string;
+    cwd: string;
+    suite: AcceptanceCheckSuite;
+    pluginRegistry?: PluginRegistry;
+    evidenceStore?: EvidenceStore;
+    attemptNumber?: number;
+    timeoutMs?: number;
+}): Promise<VerifyRunResult>;
 export {};

package/lib/runtime/verification/verification-compiler.js

@@ -6,9 +6,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.compile = compile;
 exports.runCheck = runCheck;
 exports.runSuite = runSuite;
+exports.executeSuite = executeSuite;
 exports.summarizeSuite = summarizeSuite;
+exports.verifyRun = verifyRun;
 const crypto_1 = __importDefault(require("crypto"));
 const child_process_1 = require("child_process");
+const verification_manifest_1 = require("./verification-manifest");
 function inferCheckType(howToVerify) {
     const v = howToVerify.toLowerCase();
     if (v.includes('npm test') || v.includes('jest') || v.includes('vitest') || v.includes('node --test'))
@@ -132,12 +135,125 @@ async function runSuite(suite, cwd, timeoutMs = 60000) {
     }
     return results;
 }
+async function executeSuite(suite, cwd, options) {
+    const results = [];
+    const verificationResults = [];
+    const evidenceRefs = new Map();
+    const timeoutMs = options.timeoutMs ?? 60000;
+    const attemptNumber = options.attemptNumber ?? 1;
+    for (const check of suite.checks) {
+        const provider = options.pluginRegistry?.verifierProviderFor(check.type);
+        let result;
+        let verificationResult;
+        if (provider) {
+            const providerResult = await provider.execute({
+                check_id: check.id,
+                check_type: check.type,
+                command: check.command,
+                work_item_id: options.workItemId,
+                workspace_root: cwd,
+                evidence_dir: '',
+            });
+            result = {
+                check_id: check.id,
+                acceptance_ref: check.acceptance_ref,
+                status: providerResult.status,
+                stdout: providerResult.summary ?? '',
+                stderr: '',
+                exit_code: providerResult.status === 'pass' ? 0 : 1,
+                duration_ms: 0,
+                error: providerResult.status === 'error' ? providerResult.summary ?? 'provider error' : null,
+                evidence_refs: providerResult.evidence_refs,
+            };
+            verificationResult = providerResult;
+        }
+        else {
+            result = await runCheck(check, cwd, timeoutMs);
+            const collectedEvidence = options.evidenceStore
+                ? await collectCheckEvidence(options.evidenceStore, check, result, {
+                    run_id: options.runId,
+                    work_item_id: options.workItemId,
+                    attempt_number: attemptNumber,
+                })
+                : [];
+            result.evidence_refs = collectedEvidence;
+            verificationResult = {
+                verification_id: `vr-${crypto_1.default.randomBytes(4).toString('hex')}`,
+                work_item_id: options.workItemId,
+                check_id: check.id,
+                status: result.status,
+                evidence_refs: collectedEvidence,
+                summary: result.error || result.stderr || result.stdout || null,
+            };
+        }
+        if (result.evidence_refs && result.evidence_refs.length > 0) {
+            evidenceRefs.set(check.id, result.evidence_refs);
+        }
+        results.push(result);
+        verificationResults.push(verificationResult);
+    }
+    const manifest = (0, verification_manifest_1.buildManifest)(options.runId, results, {
+        workItemId: options.workItemId,
+        granularity: 'work_item',
+        evidenceRefs,
+    });
+    const riskLedger = (0, verification_manifest_1.buildRiskLedger)(options.runId, manifest);
+    const evidenceCoverage = (0, verification_manifest_1.summarizeEvidenceCoverage)(manifest);
+    return {
+        results,
+        verification_results: verificationResults,
+        evidence_refs: evidenceRefs,
+        manifest,
+        risk_ledger: riskLedger,
+        evidence_coverage: evidenceCoverage,
+    };
+}
 function summarizeSuite(results) {
     const counts = { total: results.length, pass: 0, fail: 0, skip: 0, error: 0 };
     for (const r of results)
         counts[r.status]++;
     return { ...counts, allPassed: counts.fail === 0 && counts.error === 0 };
 }
+async function verifyRun(input) {
+    const gaps = [];
+    if (!input.suite || !Array.isArray(input.suite.checks) || input.suite.checks.length === 0) {
+        gaps.push('Nenhum check executável foi compilado a partir de SPEC/PLAN.');
+        return {
+            status: 'partial',
+            suite: input.suite,
+            executed: null,
+            gaps,
+            verification_results: [],
+            check_results: [],
+            manifest: null,
+            risk_ledger: null,
+            evidence_coverage: null,
+        };
+    }
+    const executed = await executeSuite(input.suite, input.cwd, {
+        timeoutMs: input.timeoutMs,
+        runId: input.runId,
+        workItemId: input.workItemId,
+        attemptNumber: input.attemptNumber,
+        evidenceStore: input.evidenceStore,
+        pluginRegistry: input.pluginRegistry,
+    });
+    (0, verification_manifest_1.saveManifest)(input.projectRoot, input.runId, executed.manifest);
+    (0, verification_manifest_1.saveRiskLedger)(input.projectRoot, input.runId, executed.risk_ledger);
+    (0, verification_manifest_1.saveEvidenceCoverage)(input.projectRoot, input.runId, executed.evidence_coverage);
+    const summary = summarizeSuite(executed.results);
+    return {
+        status: summary.total === 0 ? 'partial' : summary.allPassed ? 'passed' : 'failed',
+        suite: input.suite,
+        executed,
+        gaps,
+        verification_results: executed.verification_results,
+        check_results: executed.results,
+        manifest: executed.manifest,
+        risk_ledger: executed.risk_ledger,
+        evidence_coverage: executed.evidence_coverage,
+    };
+}
 function hashObject(obj) {
     return crypto_1.default
         .createHash('sha256')
@@ -145,3 +261,24 @@ function hashObject(obj) {
         .digest('hex')
         .slice(0, 12);
 }
+async function collectCheckEvidence(store, check, result, options) {
+    const refs = [];
+    if (result.stdout) {
+        const evidence = await store.collect('stdout', result.stdout, options);
+        refs.push(evidence.evidence_id);
+    }
+    if (result.stderr) {
+        const evidence = await store.collect('stderr', result.stderr, options);
+        refs.push(evidence.evidence_id);
+    }
+    const summaryEvidence = await store.collect(check.evidence_type_expected, JSON.stringify({
+        check_id: check.id,
+        type: check.type,
+        command: check.command,
+        status: result.status,
+        exit_code: result.exit_code,
+        duration_ms: result.duration_ms,
+    }, null, 2), options);
+    refs.push(summaryEvidence.evidence_id);
+    return refs;
+}

package/lib/runtime/verification/verification-manifest.d.ts

@@ -43,6 +43,12 @@ export interface ResidualRiskLedger {
     generated_at: string;
     risks: ResidualRisk[];
 }
+export interface EvidenceCoverageSummary {
+    total_checks: number;
+    checks_with_evidence: number;
+    total_evidence_refs: number;
+    coverage_percent: number;
+}
 export declare function classifyFailure(result: CheckResult): FailureClass | null;
 export declare function buildManifest(runId: string, results: CheckResult[], options?: {
     workItemId?: string;
@@ -52,7 +58,10 @@ export declare function buildManifest(runId: string, results: CheckResult[], opt
     evidenceRefs?: Map<string, string[]>;
 }): VerificationManifest;
 export declare function buildRiskLedger(runId: string, manifest: VerificationManifest): ResidualRiskLedger;
+export declare function summarizeEvidenceCoverage(manifest: VerificationManifest): EvidenceCoverageSummary;
 export declare function saveManifest(projectRoot: string, runId: string, manifest: VerificationManifest): void;
 export declare function loadManifest(projectRoot: string, runId: string): VerificationManifest | null;
 export declare function saveRiskLedger(projectRoot: string, runId: string, ledger: ResidualRiskLedger): void;
 export declare function loadRiskLedger(projectRoot: string, runId: string): ResidualRiskLedger | null;
+export declare function saveEvidenceCoverage(projectRoot: string, runId: string, coverage: EvidenceCoverageSummary): void;
+export declare function loadEvidenceCoverage(projectRoot: string, runId: string): EvidenceCoverageSummary | null;