runward 0.13.2 → 0.13.3

package/dist/commands/check.js

@@ -1,6 +1,7 @@
 import { join, resolve } from "node:path";
 import { analyze, findMissionRoot } from "../lib/mission.js";
 import { conformance, driftReport, unratifiedAdrs, decisionCoverage } from "../lib/conformance.js";
+import { behavioralProof } from "../lib/behavioral-proof.js";
 import { runHooks } from "../lib/hooks.js";
 import { c, createHeader, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
@@ -96,6 +97,27 @@ export async function checkCommand(opts) {
             strictGaps += unratified.length;
         }
         if (checked > 0 && strictGaps === 0) {
+            // The two proofs, made legible together: this gate is the DOCUMENTARY proof (decisions traced);
+            // the BEHAVIORAL proof is the operator's test suite. runward reads the pointer, never runs the code.
+            console.log(section("Behavioral proof (advisory, above the gate)"));
+            console.log("  " + c.darkGray("this gate is the documentary proof: the decisions are traced. runward did not run your code — it is not a runtime. The behavioral proof is your test suite."));
+            const bp = behavioralProof(mission, root);
+            if (!bp.declared) {
+                console.log("  " + c.darkGray("no behavioral proof declared — add `Behavioral proof: <command>` to runward/floor.md §2 (and optionally `Proof artifact: <path>`)."));
+            }
+            else {
+                if (bp.command)
+                    console.log(`  ${c.darkGray("prove behavior with:")} ${c.white(bp.command)}`);
+                if (bp.artifact) {
+                    if (!bp.present)
+                        console.log(`  ${c.warning("◑")} ${c.darkGray("proof artifact")} ${c.white(bp.artifact)} ${c.warning("missing — run the command to produce it")}`);
+                    else {
+                        const fresh = bp.fresh === undefined ? "" : bp.fresh ? c.success(" · fresh") : c.warning(" · stale (older than the code — re-run)");
+                        console.log(`  ${c.success("✓")} ${c.darkGray("proof artifact")} ${c.white(bp.artifact)} ${c.darkGray(`(${bp.date})`)}${fresh}`);
+                    }
+                }
+                console.log("  " + c.darkGray("advisory — runward reports presence and freshness, never runs or reads the result. You cross on both proofs."));
+            }
             console.log(section("Semantic check (advisory, above the gate)"));
             console.log("  " + c.darkGray("the gate proved every CRITICAL/HIGH rule was traced — not that the code applies it. Before you cross, run the verify workflow (runward/workflows/verify.md): an adversarial cite-vs-apply pass, ideally on a different model. Advisory, agent-executed, never blocks the gate (ADR-0007)."));
         }

package/dist/lib/behavioral-proof.js

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+export function behavioralProof(mission, root) {
+    const floor = join(mission, "floor.md");
+    if (!existsSync(floor))
+        return { declared: false };
+    const text = readFileSync(floor, "utf8");
+    const cmd = text.match(/^\s*[*_]*Behavioral proof[*_]*\s*:\s*`?([^`\n]+?)`?\s*$/mi);
+    const art = text.match(/^\s*[*_]*Proof artifact[*_]*\s*:\s*`?([^`\n]+?)`?\s*$/mi);
+    if (!cmd && !art)
+        return { declared: false };
+    const proof = { declared: true, command: cmd?.[1]?.trim(), artifact: art?.[1]?.trim() };
+    if (proof.artifact) {
+        const abs = join(root, proof.artifact);
+        proof.present = existsSync(abs);
+        if (proof.present) {
+            const st = statSync(abs);
+            proof.date = st.mtime.toISOString().slice(0, 10);
+            const codeDir = join(root, "code");
+            const newest = existsSync(codeDir) ? newestSourceMtime(codeDir) : 0;
+            proof.fresh = newest === 0 ? undefined : st.mtimeMs >= newest;
+        }
+    }
+    return proof;
+}
+/** Newest mtime of a tracked source file under a dir — read-only, node_modules and dotfiles skipped. */
+function newestSourceMtime(dir) {
+    let newest = 0;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return 0;
+    }
+    for (const e of entries) {
+        if (e.name === "node_modules" || e.name.startsWith("."))
+            continue;
+        const p = join(dir, e.name);
+        if (e.isDirectory())
+            newest = Math.max(newest, newestSourceMtime(p));
+        else if (/\.(ts|tsx|js|jsx|py|go|rs|java|rb)$/.test(e.name))
+            newest = Math.max(newest, statSync(p).mtimeMs);
+    }
+    return newest;
+}

package/examples/request-triage/runward/floor.md

@@ -37,6 +37,10 @@
 - **Verdict**: criterion met on the replayed sample and the first live week. The gate to `iterate` requires the full two-week live window per the criterion's wording — one more week of live measurement before the gate is crossed. Partial by duration, not by result.
 - **Observability check**: confirmed — a full trajectory (intake, model proposal, per-field guard outcome, routing decision, persistence) reconstructs from a single request ID; verified on 10 randomly drawn requests.
 
+**Behavioral proof**: `cd code && npm test`
+
+> 14 deterministic tests, no key, no network — including the guard refusing, fail-closed, a record whose action-bearing fields are still model-proposed (ADR-0002). The gate above proves the *decision* to guard was traced; this proves the guard *runs*. runward reports the pointer, never runs it.
+
 ## 3. Gaps and deviations
 
 | Gap / deviation | Impact | Agreed with sponsor |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",

package/templates/mission/floor.md

@@ -34,6 +34,11 @@
 - **Verdict**: [criterion met / partially met / not met — and what that means for the gate.]
 - **Observability check**: [confirmation that a full trajectory reconstructs from a single request ID.]
 
+**Behavioral proof**: `[the command that proves the floor's behavior, e.g. cd code && npm test]`
+**Proof artifact**: [optional — a result file the command writes, e.g. code/test-results.json; runward reports it present/fresh, never runs or reads it]
+
+> The gate above is the *documentary* proof (the decisions are traced). This line is the *behavioral* proof (your code actually runs). runward never executes it — it is not a runtime; on a green `--strict` it only reports the pointer, and the artifact's presence and freshness if you name one.
+
 ## 3. Gaps and deviations
 
 [Anything shipped differently from the architecture note, and anything the measurement revealed. Deviations were agreed with the sponsor, never silent.]