sdd-agent-platform 0.3.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/context/build-package.ts

@@ -0,0 +1,317 @@
+import { CONTEXT_PACKAGE_CONTRACT_VERSION } from '../contracts.js';
+import { recordRuntimeProjection } from '../storage/runtime-store.js';
+import { resolveSddContext } from '../sdd-docs/context.js';
+import { parseSddBranch } from '../sdd-docs/task-parser.js';
+import { inspectSddTask } from '../sdd-docs/task-inspection.js';
+import { contextBudgetForProfile, type ContextBudget, type ContextProfile } from './budget.js';
+import { contextSourceRefForAbsolutePath, contextSourceRefForProjectPath, uniqueContextSourceRefs } from './source-refs.js';
+import type { ContextSourceRef } from './source-refs.js';
+
+export type ContextBuildMode = 'do' | 'verify' | 'sync-back' | 'doctor';
+export type ContextBuildRole = 'default' | 'implementer' | 'reviewer' | 'validator' | 'context-curator';
+
+export interface ContextBuildPackage {
+  contract: typeof CONTEXT_PACKAGE_CONTRACT_VERSION;
+  profile: ContextProfile;
+  mode: ContextBuildMode;
+  agent: string | null;
+  role: ContextBuildRole;
+  authoritative: false;
+  usableForPass: false;
+  taskId: string;
+  branch: string;
+  budget: ContextBudgetAccounting;
+  mustRead: ContextSourceRef[];
+  optionalRead: ContextSourceRef[];
+  doNotReadUnlessNeeded: ContextSourceRef[];
+  nextCommands: string[];
+  warnings: string[];
+}
+
+export interface ContextBudgetRefSummary {
+  path: string;
+  kind: ContextSourceRef['kind'];
+  estimatedBytes: number;
+  reason: string;
+}
+
+export interface ContextBudgetAccounting {
+  profile: ContextProfile;
+  maxBytes: number;
+  estimatedBytes: number;
+  estimatedTokens: number;
+  includedRefs: ContextBudgetRefSummary[];
+  deferredRefs: ContextBudgetRefSummary[];
+  excludedRefs: ContextBudgetRefSummary[];
+  truncatedSummaries: string[];
+}
+
+export interface ContextBuildOptions {
+  taskId: string;
+  branch?: string;
+  mode: ContextBuildMode;
+  agent?: string;
+  profile?: ContextProfile;
+}
+
+export async function buildContextBuildPackage(projectRoot: string, options: ContextBuildOptions): Promise<ContextBuildPackage> {
+  const profile = options.profile ?? 'brief';
+  const branch = options.branch ?? (await resolveSddContext(projectRoot)).partition;
+  const model = await parseSddBranch(projectRoot, branch);
+  const inspected = inspectSddTask(model, options.taskId);
+  if (!inspected.task) {
+    throw new Error(`Task not found: ${options.taskId}`);
+  }
+  const role = contextBuildRole(options.agent);
+  const task = inspected.task;
+  const docRefs = await Promise.all([
+    contextSourceRefForAbsolutePath(projectRoot, model.tasksPath, 'document'),
+    contextSourceRefForAbsolutePath(projectRoot, model.planPath, 'document'),
+    contextSourceRefForAbsolutePath(projectRoot, model.specPath, 'document')
+  ]);
+  const affectedRefs = await Promise.all(task.affectedFiles.map((file) => contextSourceRefForProjectPath(projectRoot, file, 'document')));
+  const artifactRefs = await Promise.all(task.requiredArtifacts.map((artifact) => contextSourceRefForProjectPath(projectRoot, artifact, 'artifact')));
+  const routeRef = await contextSourceRefForProjectPath(projectRoot, `.sdd/cache/routes`, 'derived');
+  const runIndexRef = await contextSourceRefForProjectPath(projectRoot, `.sdd/run-index.json`, 'derived');
+  const candidateMustRead = uniqueContextSourceRefs(contextMustReadRefs(options.mode, role, docRefs, affectedRefs, artifactRefs, routeRef, runIndexRef));
+  const candidateOptionalRead = uniqueContextSourceRefs(contextOptionalRefs(options.mode, role, docRefs, affectedRefs, artifactRefs, routeRef, runIndexRef));
+  const candidateDeferredRead = uniqueContextSourceRefs(contextDeferredRefs(options.mode, role, docRefs, affectedRefs, artifactRefs, routeRef, runIndexRef));
+  const budgeted = applyContextBudget(contextBudgetForProfile(profile), candidateMustRead, candidateOptionalRead, candidateDeferredRead);
+  const contextPackage: ContextBuildPackage = {
+    contract: CONTEXT_PACKAGE_CONTRACT_VERSION,
+    profile,
+    mode: options.mode,
+    agent: options.agent ?? null,
+    role,
+    authoritative: false,
+    usableForPass: false,
+    taskId: task.id,
+    branch,
+    budget: budgeted.accounting,
+    mustRead: budgeted.mustRead,
+    optionalRead: budgeted.optionalRead,
+    doNotReadUnlessNeeded: budgeted.doNotReadUnlessNeeded,
+    nextCommands: contextNextCommands(task.id, branch, options.mode, options.agent),
+    warnings: [
+      'Context package is derived guidance only and cannot satisfy PASS evidence.',
+      ...inspected.gaps.map((gap) => `${gap.field}: ${gap.message}`)
+    ]
+  };
+  enforceContextPackageOutputBudget(contextPackage);
+  await recordRuntimeProjection(projectRoot, 'context_build', `${branch}:${task.id}:${options.mode}:${options.agent ?? 'none'}:${profile}`, contextPackage);
+  return contextPackage;
+}
+
+function applyContextBudget(
+  budget: ContextBudget,
+  mustRead: ContextSourceRef[],
+  optionalRead: ContextSourceRef[],
+  deferredRead: ContextSourceRef[]
+): {
+  mustRead: ContextSourceRef[];
+  optionalRead: ContextSourceRef[];
+  doNotReadUnlessNeeded: ContextSourceRef[];
+  accounting: ContextBudgetAccounting;
+} {
+  const includedRefs: ContextBudgetRefSummary[] = [];
+  const deferredRefs: ContextBudgetRefSummary[] = [];
+  const excludedRefs: ContextBudgetRefSummary[] = [];
+  const truncatedSummaries: string[] = [];
+  const nextMustRead: ContextSourceRef[] = [];
+  const nextOptionalRead: ContextSourceRef[] = [];
+  const nextDeferredRead: ContextSourceRef[] = [];
+  let estimatedBytes = 0;
+
+  for (const ref of mustRead) {
+    const summary = summarizeBudgetRef(ref, 'required');
+    if (estimatedBytes + summary.estimatedBytes <= budget.maxBytes || nextMustRead.length === 0) {
+      nextMustRead.push(ref);
+      includedRefs.push(summary);
+      estimatedBytes += summary.estimatedBytes;
+    } else {
+      nextDeferredRead.push(ref);
+      deferredRefs.push({ ...summary, reason: 'required_ref_deferred_by_context_budget' });
+    }
+  }
+
+  for (const ref of optionalRead) {
+    const summary = summarizeBudgetRef(ref, 'optional');
+    if (estimatedBytes + summary.estimatedBytes <= budget.maxBytes) {
+      nextOptionalRead.push(ref);
+      includedRefs.push(summary);
+      estimatedBytes += summary.estimatedBytes;
+    } else {
+      nextDeferredRead.push(ref);
+      deferredRefs.push({ ...summary, reason: 'optional_ref_deferred_by_context_budget' });
+    }
+  }
+
+  const seenDeferred = new Set(nextDeferredRead.map((ref) => `${ref.kind}:${ref.path}`));
+  for (const ref of deferredRead) {
+    const summary = summarizeBudgetRef(ref, 'deferred');
+    if (includedRefs.some((included) => included.path === ref.path && included.kind === ref.kind)) {
+      excludedRefs.push({ ...summary, reason: 'duplicate_ref_excluded' });
+    } else if (!seenDeferred.has(`${ref.kind}:${ref.path}`)) {
+      nextDeferredRead.push(ref);
+      deferredRefs.push(summary);
+    }
+  }
+
+  if (deferredRefs.length > 8) {
+    truncatedSummaries.push(`deferred_refs_truncated=${deferredRefs.length - 8}`);
+  }
+  if (excludedRefs.length > 8) {
+    truncatedSummaries.push(`excluded_refs_truncated=${excludedRefs.length - 8}`);
+  }
+
+  const accounting: ContextBudgetAccounting = {
+    profile: budget.profile,
+    maxBytes: budget.maxBytes,
+    estimatedBytes: Math.min(estimatedBytes, budget.maxBytes),
+    estimatedTokens: estimateTokens(Math.min(estimatedBytes, budget.maxBytes)),
+    includedRefs: includedRefs.slice(0, 12),
+    deferredRefs: deferredRefs.slice(0, 8),
+    excludedRefs: excludedRefs.slice(0, 8),
+    truncatedSummaries
+  };
+
+  return {
+    mustRead: nextMustRead,
+    optionalRead: nextOptionalRead,
+    doNotReadUnlessNeeded: uniqueContextSourceRefs(nextDeferredRead),
+    accounting
+  };
+}
+
+function enforceContextPackageOutputBudget(contextPackage: ContextBuildPackage): void {
+  let trimmedOptional = 0;
+  let trimmedDeferred = 0;
+  let trimmedAccounting = 0;
+
+  while (contextPackage.optionalRead.length > 0 && contextPackageOutputBytes(contextPackage) > contextPackage.budget.maxBytes) {
+    contextPackage.optionalRead.pop();
+    contextPackage.budget.includedRefs.pop();
+    trimmedOptional += 1;
+  }
+  while (contextPackage.doNotReadUnlessNeeded.length > 0 && contextPackageOutputBytes(contextPackage) > contextPackage.budget.maxBytes) {
+    contextPackage.doNotReadUnlessNeeded.pop();
+    trimmedDeferred += 1;
+  }
+  while (contextPackage.budget.excludedRefs.length > 0 && contextPackageOutputBytes(contextPackage) > contextPackage.budget.maxBytes) {
+    contextPackage.budget.excludedRefs.pop();
+    trimmedAccounting += 1;
+  }
+  while (contextPackage.budget.deferredRefs.length > 0 && contextPackageOutputBytes(contextPackage) > contextPackage.budget.maxBytes) {
+    contextPackage.budget.deferredRefs.pop();
+    trimmedAccounting += 1;
+  }
+
+  const trims = [
+    trimmedOptional > 0 ? `optional_refs_output_trimmed=${trimmedOptional}` : null,
+    trimmedDeferred > 0 ? `deferred_refs_output_trimmed=${trimmedDeferred}` : null,
+    trimmedAccounting > 0 ? `budget_accounting_output_trimmed=${trimmedAccounting}` : null
+  ].filter((item): item is string => item !== null);
+  if (trims.length > 0) {
+    contextPackage.budget.truncatedSummaries = trims;
+  }
+  contextPackage.budget.estimatedBytes = Math.min(contextPackageOutputBytes(contextPackage), contextPackage.budget.maxBytes);
+  contextPackage.budget.estimatedTokens = estimateTokens(contextPackage.budget.estimatedBytes);
+}
+
+function contextPackageOutputBytes(contextPackage: ContextBuildPackage): number {
+  return Buffer.byteLength(JSON.stringify(contextPackage), 'utf8');
+}
+
+function summarizeBudgetRef(ref: ContextSourceRef, reason: string): ContextBudgetRefSummary {
+  return {
+    path: ref.path,
+    kind: ref.kind,
+    estimatedBytes: Buffer.byteLength(JSON.stringify(ref), 'utf8'),
+    reason
+  };
+}
+
+function estimateTokens(bytes: number): number {
+  return Math.ceil(bytes / 4);
+}
+
+function contextMustReadRefs(mode: ContextBuildMode, role: ContextBuildRole, docs: ContextSourceRef[], affected: ContextSourceRef[], artifacts: ContextSourceRef[], routeRef: ContextSourceRef, runIndexRef: ContextSourceRef): ContextSourceRef[] {
+  if (role === 'implementer') {
+    return [docs[0], docs[1], ...affected];
+  }
+  if (role === 'reviewer') {
+    return [docs[0], docs[1], runIndexRef, ...affected];
+  }
+  if (role === 'validator') {
+    return [docs[0], ...artifacts, runIndexRef];
+  }
+  if (role === 'context-curator') {
+    return [docs[0], docs[2], routeRef];
+  }
+  if (mode === 'do') {
+    return [docs[0], docs[1], ...affected];
+  }
+  if (mode === 'verify') {
+    return [docs[0], ...artifacts];
+  }
+  if (mode === 'sync-back') {
+    return [docs[0], ...affected];
+  }
+  return [docs[0]];
+}
+
+function contextOptionalRefs(mode: ContextBuildMode, role: ContextBuildRole, docs: ContextSourceRef[], affected: ContextSourceRef[], artifacts: ContextSourceRef[], routeRef: ContextSourceRef, runIndexRef: ContextSourceRef): ContextSourceRef[] {
+  if (role === 'implementer') {
+    return [docs[2], ...artifacts, routeRef];
+  }
+  if (role === 'reviewer') {
+    return [docs[2], ...artifacts, routeRef];
+  }
+  if (role === 'validator') {
+    return [docs[1], docs[2], routeRef];
+  }
+  if (role === 'context-curator') {
+    return [docs[1], runIndexRef];
+  }
+  return mode === 'doctor' ? [docs[1], docs[2], runIndexRef, routeRef, ...artifacts] : [docs[2], ...artifacts];
+}
+
+function contextDeferredRefs(mode: ContextBuildMode, role: ContextBuildRole, docs: ContextSourceRef[], affected: ContextSourceRef[], artifacts: ContextSourceRef[], routeRef: ContextSourceRef, runIndexRef: ContextSourceRef): ContextSourceRef[] {
+  if (role === 'context-curator') {
+    return [...affected, ...artifacts];
+  }
+  if (mode === 'verify') {
+    return [...affected, routeRef];
+  }
+  return [runIndexRef, ...artifacts, docs[2]];
+}
+
+function contextBuildRole(agent: string | undefined): ContextBuildRole {
+  if (agent === 'implementer' || agent === 'reviewer' || agent === 'validator' || agent === 'context-curator') {
+    return agent;
+  }
+  if (agent === 'role.context-curator') {
+    return 'context-curator';
+  }
+  if (agent === 'role.implementation-reviewer') {
+    return 'reviewer';
+  }
+  if (agent === 'role.verification-designer' || agent === 'role.evidence-runner') {
+    return 'validator';
+  }
+  return 'default';
+}
+
+function contextNextCommands(taskId: string, branch: string, mode: ContextBuildMode, agent?: string): string[] {
+  if (mode === 'do') {
+    return [`sdd do task ${taskId} --branch ${branch}`];
+  }
+  if (mode === 'verify') {
+    return [`sdd test task ${taskId} --branch ${branch}`, `sdd evidence summary <run_id> --task ${taskId} --json`];
+  }
+  if (mode === 'sync-back') {
+    return [`sdd sync-back inspect --branch ${branch} --task ${taskId}`];
+  }
+  const agentSuffix = agent ? ` --agent ${agent}` : '';
+  return [`sdd doctor fast --branch ${branch}`, `sdd context build --task ${taskId} --branch ${branch} --mode verify${agentSuffix} --json`];
+}

package/node_modules/@sdd-agent-platform/core/src/context/command-summary.ts

@@ -0,0 +1,45 @@
+import { COMMAND_OUTPUT_SUMMARY_CONTRACT_VERSION } from '../contracts.js';
+import type { ContextProfile } from './budget.js';
+import type { ContextSourceRef } from './source-refs.js';
+
+export type ContextSummaryStatus = 'PASS' | 'FAIL' | 'BLOCKED' | 'UNKNOWN';
+
+export interface CommandOutputSummary {
+  contract: typeof COMMAND_OUTPUT_SUMMARY_CONTRACT_VERSION;
+  authoritative: false;
+  usableForPass: false;
+  source: ContextSourceRef;
+  status: ContextSummaryStatus;
+  highlights: string[];
+  omittedLines: number;
+}
+
+export function summarizeCommandOutput(rawOutput: string, source: ContextSourceRef, profile: ContextProfile = 'brief'): CommandOutputSummary {
+  const lines = rawOutput.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  const failureLines = lines.filter((line) => /\b(fail(?:ed|ure)?|error|blocked|exception|traceback|timed out|timeout)\b/i.test(line));
+  const successLines = lines.filter((line) => /\b(pass(?:ed)?|success|completed|ok)\b/i.test(line));
+  let maxHighlights = 5;
+  if (profile === 'normal') {
+    maxHighlights = 12;
+  } else if (profile === 'forensic') {
+    maxHighlights = lines.length;
+  }
+  const selected = [...failureLines, ...successLines, ...lines].filter((line, index, all) => all.indexOf(line) === index).slice(0, maxHighlights);
+  let status: ContextSummaryStatus = 'UNKNOWN';
+  if (failureLines.some((line) => /\bblocked\b/i.test(line))) {
+    status = 'BLOCKED';
+  } else if (failureLines.length > 0) {
+    status = 'FAIL';
+  } else if (successLines.length > 0) {
+    status = 'PASS';
+  }
+  return {
+    contract: COMMAND_OUTPUT_SUMMARY_CONTRACT_VERSION,
+    authoritative: false,
+    usableForPass: false,
+    source,
+    status,
+    highlights: selected,
+    omittedLines: Math.max(0, lines.length - selected.length)
+  };
+}

package/node_modules/@sdd-agent-platform/core/src/context/context-build.test.ts

@@ -0,0 +1,188 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { validateSddResultArtifact } from '../artifacts/sdd-result.js';
+import { initProject } from '../config/init-project.js';
+import { writeArtifact } from '../run-state/artifacts.js';
+import { createRun } from '../run-state/run-state.js';
+import { contextBuildTaskMarkdown, validResultArtifact, validTaskMarkdown, validTrustEvidence, writeBranchDocs } from '../test-support/fixtures.js';
+import { bindTestRunState } from '../test-support/run-state.js';
+import { getRuntimeStorePath } from '../runtime-paths.js';
+import { buildContextBuildPackage } from './build-package.js';
+import { contextBudgetForProfile, parseContextProfile } from './budget.js';
+import { summarizeCommandOutput } from './command-summary.js';
+import { buildEvidenceSummaryProjection } from './evidence-summary.js';
+import { validateLogWorkerSummary } from './log-worker.js';
+
+test('context budget contracts are JSON-renderable and non-authoritative', () => {
+  const budget = contextBudgetForProfile(parseContextProfile('brief'));
+  assert.equal(budget.contract, 'phase-6.10-context-budget-v1');
+  assert.equal(budget.profile, 'brief');
+  assert.ok(JSON.stringify(budget).includes('current_task'));
+
+  const summary = summarizeCommandOutput('line one\nERROR blocked by missing artifact\nPASS later line', {
+    path: '.sdd/runs/run-1/log.txt',
+    hash: 'abc123',
+    kind: 'command_output'
+  });
+  assert.equal(summary.contract, 'sdd-command-output-summary-v1');
+  assert.equal(summary.authoritative, false);
+  assert.equal(summary.usableForPass, false);
+  assert.equal(summary.status, 'BLOCKED');
+  assert.ok(summary.omittedLines >= 0);
+});
+
+test('evidence summary projection is hash-backed and not usable for PASS', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-evidence-summary-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    const state = await createRun(root, { runId: 'summary-run' });
+    await bindTestRunState(root, state.runId, 'master', 'T1');
+    await writeArtifact(root, state.runId, 'validation-T1.md', `${validResultArtifact('validator', 'T1', 'PASS', 'artifacts/validation-T1.md')}${validTrustEvidence('T1', 'AC-1', 'artifacts/validation-T1.md')}`);
+
+    const summary = await buildEvidenceSummaryProjection(root, { runId: state.runId, taskId: 'T1' });
+    const db = new DatabaseSync(getRuntimeStorePath(root), { readOnly: true });
+    try {
+      const projection = db.prepare('SELECT projection_type, scope_key, payload_json FROM projections WHERE projection_type = ?').get('evidence_summary') as { projection_type?: string; scope_key?: string; payload_json?: string } | undefined;
+      const payload = JSON.parse(projection?.payload_json ?? '{}') as { contract?: string; authoritative?: boolean; usableForPass?: boolean; taskId?: string };
+      assert.equal(summary.contract, 'sdd-evidence-summary-v1');
+      assert.equal(summary.authoritative, false);
+      assert.equal(summary.usableForPass, false);
+      assert.equal(summary.taskId, 'T1');
+      assert.ok(summary.sources.some((source) => source.path.endsWith('runtime.sqlite') && source.kind === 'run_state' && source.hash.length === 64));
+      assert.ok(summary.sources.some((source) => source.path.endsWith('.sdd/runs/master/evidence/artifacts/validation-T1.md') && source.kind === 'artifact'));
+      assert.ok(summary.policyRefs.some((ref) => ref.includes('reject-derived-source-evidence')));
+      assert.equal(projection?.scope_key, 'summary-run:T1');
+      assert.equal(payload.contract, 'sdd-evidence-summary-v1');
+      assert.equal(payload.authoritative, false);
+      assert.equal(payload.usableForPass, false);
+    } finally {
+      db.close();
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('context build packages differ by mode and agent while remaining derived guidance', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-context-build-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', contextBuildTaskMarkdown('T1'));
+    const implementerPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'do', agent: 'implementer' });
+    const validatorPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'verify', agent: 'validator' });
+    const db = new DatabaseSync(getRuntimeStorePath(root), { readOnly: true });
+    try {
+      const projections = db.prepare('SELECT projection_type, scope_key, payload_json FROM projections WHERE projection_type = ? ORDER BY scope_key').all('context_build') as Array<{ projection_type?: string; scope_key?: string; payload_json?: string }>;
+      const payloads = projections.map((projection) => JSON.parse(projection.payload_json ?? '{}') as { contract?: string; authoritative?: boolean; usableForPass?: boolean; budget?: { estimatedBytes?: number; maxBytes?: number; includedRefs?: unknown[]; deferredRefs?: unknown[]; excludedRefs?: unknown[] } });
+      assert.equal(implementerPackage.contract, 'sdd-context-package-v1');
+      assert.equal(implementerPackage.authoritative, false);
+      assert.equal(implementerPackage.usableForPass, false);
+      assert.ok(implementerPackage.mustRead.some((ref) => ref.path.endsWith('tasks.md')));
+      assert.ok(implementerPackage.mustRead.some((ref) => ref.path === 'packages/core/src/index.ts'));
+      assert.ok(validatorPackage.mustRead.some((ref) => ref.path === 'artifacts/validation-T1.md'));
+      assert.notDeepEqual(implementerPackage.mustRead.map((ref) => ref.path), validatorPackage.mustRead.map((ref) => ref.path));
+      assert.ok(validatorPackage.warnings.some((warning) => warning.includes('cannot satisfy PASS evidence')));
+      assert.ok(validatorPackage.nextCommands.includes('sdd test task T1 --branch master'));
+      assert.equal(validatorPackage.nextCommands.some((command) => command.startsWith('sdd verify task')), false);
+      assert.ok(implementerPackage.budget.estimatedBytes <= implementerPackage.budget.maxBytes);
+      assert.ok(implementerPackage.budget.estimatedTokens > 0);
+      assert.ok(implementerPackage.budget.includedRefs.some((ref) => ref.path.endsWith('tasks.md')));
+      assert.ok(implementerPackage.budget.deferredRefs.length > 0);
+      assert.ok(implementerPackage.budget.excludedRefs.length > 0);
+      assert.equal(projections.length, 2);
+      assert.ok(projections.some((projection) => projection.scope_key === 'master:T1:do:implementer:brief'));
+      assert.ok(projections.some((projection) => projection.scope_key === 'master:T1:verify:validator:brief'));
+      assert.equal(payloads.every((payload) => payload.contract === 'sdd-context-package-v1' && payload.authoritative === false && payload.usableForPass === false), true);
+      assert.equal(payloads.every((payload) => typeof payload.budget?.estimatedBytes === 'number' && Array.isArray(payload.budget.includedRefs) && Array.isArray(payload.budget.deferredRefs)), true);
+    } finally {
+      db.close();
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('context build packages scope materials by runtime role without PASS authority', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-context-build-roles-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', contextBuildTaskMarkdown('T1'));
+    const implementerPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'do', agent: 'implementer' });
+    const reviewerPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'do', agent: 'reviewer' });
+    const validatorPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'do', agent: 'validator' });
+    const curatorPackage = await buildContextBuildPackage(root, { taskId: 'T1', branch: 'master', mode: 'do', agent: 'context-curator' });
+
+    assert.equal(implementerPackage.role, 'implementer');
+    assert.equal(reviewerPackage.role, 'reviewer');
+    assert.equal(validatorPackage.role, 'validator');
+    assert.equal(curatorPackage.role, 'context-curator');
+    assert.equal([implementerPackage, reviewerPackage, validatorPackage, curatorPackage].every((contextPackage) => contextPackage.authoritative === false && contextPackage.usableForPass === false), true);
+    assert.ok(implementerPackage.mustRead.some((ref) => ref.path === 'packages/core/src/index.ts'));
+    assert.ok(reviewerPackage.mustRead.some((ref) => ref.path === '.sdd/run-index.json'));
+    assert.ok(validatorPackage.mustRead.some((ref) => ref.path === 'artifacts/validation-T1.md'));
+    assert.ok(curatorPackage.mustRead.some((ref) => ref.path.endsWith('spec.md')));
+    assert.ok(curatorPackage.mustRead.some((ref) => ref.path === '.sdd/cache/routes'));
+    assert.notDeepEqual(implementerPackage.mustRead.map((ref) => ref.path), reviewerPackage.mustRead.map((ref) => ref.path));
+    assert.notDeepEqual(validatorPackage.mustRead.map((ref) => ref.path), curatorPackage.mustRead.map((ref) => ref.path));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('derived context projections and log workers cannot claim authority', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-derived-context-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    const state = await createRun(root, { runId: 'derived-run' });
+    await bindTestRunState(root, state.runId, 'master', 'T1');
+    const derivedArtifact = `${validResultArtifact('validator', 'T1', 'PASS', 'artifacts/validation-T1.md')}
+
+
+
+
+\`\`\`sdd-evidence
+contract: sdd-evidence-v1
+version: 1.0.0
+task: T1
+acceptance: AC-1
+status: PASS
+claim: derived summary tries to pass
+source_artifact: artifacts/evidence-summary-T1.json
+evidence_refs:
+  - artifact:artifacts/context-package-T1.json
+provenance_refs:
+  - artifact:artifacts/log-worker-summary-T1.json
+policy_refs:
+  - acceptance-policy-v1:require-source-evidence
+\`\`\`
+`;
+    await writeArtifact(root, state.runId, 'validation-T1.md', derivedArtifact);
+    const validation = await validateSddResultArtifact(root, state.runId, 'artifacts/validation-T1.md', { expectedTask: 'T1', expectedAgent: 'validator' });
+
+    assert.equal(validation.valid, false);
+    assert.ok(validation.issues.some((issue) => issue.message.includes('DERIVED_SOURCE_EVIDENCE')));
+
+    const workerValidation = validateLogWorkerSummary({
+      contract: 'sdd-log-worker-summary-v1',
+      authoritative: false,
+      usableForPass: false,
+      runId: state.runId,
+      taskId: 'T1',
+      workerId: 'log-worker-1',
+      sources: [],
+      highlights: ['captured log'],
+      forbiddenAuthority: ['doctor verdict']
+    });
+    assert.equal(workerValidation.valid, false);
+    assert.ok(workerValidation.issues.some((issue) => issue.field === 'forbiddenAuthority'));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});